@tailor-platform/sdk 2.0.0-next.4 → 2.0.0-next.6

package/dist/cli/index.mjs

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
+import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
+import { St as AuthInvokerSchema, T as CustomDomainStatus, U as FunctionExecution_Type, kt as PATScope } from "../workspace_resource_pb-Db3fv68L.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
-import { n as logger, r as styles } from "../logger-BEiZZ3qT.mjs";
-import { $ as fetchUserInfo, A as hasAnyUserTokenEntry, B as readPlatformConfig, D as loadConfig, Et as workspaceArgs, F as loadMachineUserName, G as writePlatformConfig, H as resolveConfigUser, I as loadPlatformClientConfig, J as fetchAll, K as closeConnectionPool, L as loadStoredUserTokens, M as loadAccessToken, N as loadConfigPath, O as deleteUserTokens, P as loadConsoleBaseUrl, Q as fetchPlatformMachineUserToken, R as loadWorkspaceId, T as hashContent$1, Tt as toPageDirection, U as resolveUserTokenKey, V as removeLegacyUserAlias, W as saveUserTokens, Y as fetchAllTolerant, Z as fetchPaged, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, at as initOperatorClient, b as resolveBundleLogLevel, bt as pagedLogArgs, c as WorkflowJobSchema, d as INVOKER_EXPR, dt as confirmationArgs, ft as deploymentArgs, gt as multiConfigArg, ht as isVerbose, it as initOAuth2Client, j as hasUserTokenEntry, k as fetchLatestToken, l as ResolverSchema, lt as commonArgs, nt as getOrNull, ot as isDefaultPlatform, q as defaultPlatformBaseUrl, rt as getPlatformBaseUrl, t as defineApplication, tt as getOAuth2ClientId, ut as configArg, v as composeFunctionTreeshakeOptions, w as getDistDir, wt as resolveMachineUserInputSource, xt as paginationArgs, y as createLogLevelTreeshakeOptions, z as platformConfigFromProfile } from "../application-BX13RArL.mjs";
-import { $t as compareSnapshotWithRemote, A as listCommand$13, An as apiCommand, C as listCommand$14, Cn as hasChanges, Dn as PluginManager, Dt as listCommand$7, E as waitCommand, En as sdkNameLabelKey, F as generateCommand$1, G as removeCommand$1, Gt as deploy, H as extractOwnedNamespaces, Ht as formatKeyValueTable, I as generateMigrationScript, It as getCommand$6, K as updateCommand$3, Kt as ensureConfigId, L as writeDbTypesFile, Mn as assertWritable, N as truncateCommand, Nn as defineAppCommand, O as resumeCommand, On as generateUserTypes, Pt as startCommand, Q as getCommand$5, Qt as parseMigrationLabelNumber, R as getConfiguredEditorCommand, Rt as executionsCommand, Sn as formatMigrationDiff, T as healthCommand, Tn as resourceTrn, Tt as triggerCommand, U as logBetaWarning, Ut as getCommand$1, V as showCommand, Vt as functionExecutionStatusToString, X as listCommand$12, Xt as MIGRATION_LABEL_KEY, Y as treeCommand, Zt as handleOptionalToRequiredError, _n as loadDiff, b as createCommand$4, bn as parseMigrationNumberArg, c as listCommand$15, cn as compareLocalTypesWithSnapshot, ct as createCommand$3, dn as getLatestMigrationNumber, en as generateAllTypeManifestsFromSnapshot, et as updateCommand$2, f as restoreCommand, ft as getCommand$3, g as getCommand$7, gn as isValidMigrationNumber, gt as listCommand$9, ht as tokenCommand$1, i as updateCommand$4, in as INITIAL_SCHEMA_NUMBER, it as getCommand$4, jt as jobsCommand, kn as prompt, m as listCommand$16, mn as getMigrationFiles, nt as listCommand$11, o as removeCommand, ot as deleteCommand$4, pn as getMigrationFilePath, qt as executeScript, r as queryCommand, sn as assertValidMigrationFiles, t as registerTsHook, tn as protoGqlPermission, u as inviteCommand, un as createSnapshotFromLocalTypes, ut as listCommand$10, v as deleteCommand$5, vn as reconstructSnapshotFromMigrations, vt as generate, wn as getNamespacesWithMigrations, wt as webhookCommand, xt as getCommand$2, yn as formatMigrationNumber, yt as listCommand$8, z as openInConfiguredEditor } from "../register-ts-hook-BM1caLT0.mjs";
-import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-ufH7sS8o.mjs";
+import { n as logger, r as styles } from "../logger-BwS4ppwO.mjs";
+import { $n as saveUserTokens, An as sdkNameLabelKey, B as extractOwnedNamespaces, Bn as hasUserTokenEntry, Bt as getCommand$1, Cn as formatMigrationNumber, Ct as triggerCommand, Dn as hasChanges, E as listCommand$14, En as formatMigrationDiff, F as openInConfiguredEditor, Fn as assertWritable, Gn as loadPlatformClientConfig, Hn as loadConfigPath, I as deployCommand$1, In as loadConfig, It as executionsCommand, J as listCommand$13, Jn as platformConfigFromProfile, Jt as formatKeyValueTable, Kn as loadStoredUserTokens, Kt as createCommand$4, Ln as deleteUserTokens, M as generateMigrationScript, Mt as startCommand, N as writeDbTypesFile, Nn as prompt, On as getNamespacesWithMigrations, P as getConfiguredEditorCommand, Pn as apiCall, Pt as getCommand$6, Q as updateCommand$2, Qn as resolveUserTokenKey, Rn as fetchLatestToken, S as waitCommand, Sn as reconstructSnapshotFromMigrations, St as webhookCommand, Tt as listCommand$8, U as removeCommand$1, Un as loadConsoleBaseUrl, Ut as deployFromCLI, V as logBetaWarning, Vn as loadAccessToken, W as updateCommand$3, Wn as loadMachineUserName, Wt as listCommand$17, X as getCommand$5, Xn as removeLegacyUserAlias, Xt as ensureConfigId, Yn as readPlatformConfig, Yt as workspaceNameSchema, Zn as resolveConfigUser, Zt as executeScript, _n as getMigrationFilePath, _t as listCommand$9, an as protoGqlPermission, ar as deploymentArgs, bn as isValidMigrationNumber, c as listCommand$16, cn as INITIAL_SCHEMA_NUMBER, cr as pagedLogArgs, ct as listCommand$11, dn as assertValidMigrationFiles, dr as toPageDirection, en as MIGRATION_LABEL_KEY, er as writePlatformConfig, et as listCommand$12, f as restoreCommand, fn as compareLocalTypesWithSnapshot, fr as workspaceArgs, g as deleteCommand$5, gt as generate, hn as getLatestMigrationNumber, i as updateCommand$4, in as generateAllTypeManifestsFromSnapshot, ir as confirmationArgs, it as deleteCommand$4, j as generateCommand$1, jn as PluginManager, k as truncateCommand, kn as resourceTrn, kt as jobsCommand, lr as paginationArgs, m as getCommand$7, mn as createSnapshotFromLocalTypes, mt as listCommand$10, nn as parseMigrationLabelNumber, nr as commonArgs, nt as getCommand$4, o as removeCommand, or as isVerbose, ot as createCommand$3, pt as tokenCommand$1, q as treeCommand, qn as loadWorkspaceId, r as queryCommand, rn as compareSnapshotWithRemote, rr as configArg, sr as multiConfigArg, t as registerTsHook, tn as handleOptionalToRequiredError, tr as defineAppCommand, u as inviteCommand, ur as resolveMachineUserInputSource, ut as getCommand$3, vn as getMigrationFiles, w as resumeCommand, wn as parseMigrationNumberArg, x as healthCommand, xn as loadDiff, y as listCommand$15, yt as getCommand$2, z as showCommand, zn as hasAnyUserTokenEntry, zt as functionExecutionStatusToString } from "../register-ts-hook-DL31O2W9.mjs";
+import { A as fetchAllTolerant, B as initOperatorClient, D as closeConnectionPool, I as getOAuth2ClientId, L as getOrNull, M as fetchPaged, N as fetchPlatformMachineUserToken, O as defaultPlatformBaseUrl, P as fetchUserInfo, R as getPlatformBaseUrl, V as isDefaultPlatform, _ as platformBundleDefinePlugin, a as resolveInlineSourcemap, b as resolveBundleLogLevel, c as WorkflowJobSchema, d as INVOKER_EXPR, k as fetchAll, l as ResolverSchema, v as composeFunctionTreeshakeOptions, w as getDistDir, y as createLogLevelTreeshakeOptions, z as initOAuth2Client } from "../application-BJXRpQj5.mjs";
+import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-CnHz9rwz.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
-import { i as userAgent } from "../secret-file-aoNXJmKa.mjs";
-import { n as isCLIError } from "../errors-118wUDRr.mjs";
-import { B as FunctionExecution_Type, Ct as PATScope, T as CustomDomainStatus, gt as AuthInvokerSchema } from "../service_pb-B5w9rjPY.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-Cg-pqRJV.mjs";
-import { t as isPluginGeneratedType } from "../type-source-DH_LH20p.mjs";
+import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
+import { n as errorToJson, r as isCLIError, t as createCLIError } from "../errors-DfnF4ibq.mjs";
+import { t as OperatorService } from "../service_pb-BoLM0X4K.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-CxHne11E.mjs";
 import * as path from "pathe";
 import { dirname, resolve } from "pathe";
 import { resolvePackageJSON, resolveTSConfig } from "pkg-types";
@@ -18,29 +19,578 @@ import { arg, defineCommand, runCommand, runMain } from "politty";
 import { withCompletionCommand } from "politty/completion";
 import { withSkillCommand } from "politty/skill";
 import { z } from "zod";
-import { create } from "@bufbuild/protobuf";
-import * as fs$1 from "node:fs";
+import { ScalarType, create } from "@bufbuild/protobuf";
+import * as fs from "node:fs";
 import { accessSync, constants, readdirSync } from "node:fs";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { pathToFileURL } from "node:url";
 import { generateCodeVerifier } from "@badgateway/oauth2-client";
 import { Code, ConnectError } from "@connectrpc/connect";
-import pLimit from "p-limit";
 import * as crypto from "node:crypto";
 import { createHash } from "node:crypto";
 import * as http from "node:http";
 import open from "open";
 import * as rolldown from "rolldown";
-import * as fsPromises from "node:fs/promises";
-import { glob } from "node:fs/promises";
 import * as os from "node:os";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import * as fsPromises from "node:fs/promises";
 import { TraceMap, generatedPositionFor, originalPositionFor } from "@jridgewell/trace-mapping";
 import { spawn, spawnSync } from "node:child_process";
-import { watch } from "chokidar";
-import * as fs from "fs";
-import { lookup } from "mime-types";
 
+//#region src/cli/commands/api/proto-reflect.ts
+const UNARY_METHODS = OperatorService.methods.filter((m) => m.methodKind === "unary");
+function listMethodNames() {
+	return UNARY_METHODS.map((m) => m.name).toSorted();
+}
+/**
+* Returns every accepted form of the `endpoint` positional — bare method name
+* and fully-qualified `service/Method`. politty's expand completion keys its
+* static table by the literal endpoint string, so both forms must appear in
+* `choices` or the user typing the fully-qualified name gets no `--field`
+* completion candidates back at TAB time.
+* @returns Sorted list of accepted endpoint values
+*/
+function listMethodChoices() {
+	return UNARY_METHODS.flatMap((m) => [m.name, `${OperatorService.typeName}/${m.name}`]).toSorted();
+}
+function getMethodDescriptor(methodName) {
+	return UNARY_METHODS.find((m) => m.name === methodName);
+}
+function extractMethodName(endpoint) {
+	if (!endpoint.includes("/")) return endpoint;
+	return endpoint.split("/").pop() ?? endpoint;
+}
+/**
+* Returns the nested message descriptor when the field is a message, a list of
+* messages, or a map with message values. Otherwise returns undefined.
+* @param field - The proto field descriptor to inspect
+* @returns The nested message descriptor, or undefined when the field isn't message-shaped
+*/
+function nestedMessage(field) {
+	if (field.fieldKind === "message") return field.message;
+	if (field.fieldKind === "list" && field.listKind === "message") return field.message;
+	if (field.fieldKind === "map" && field.mapKind === "message") return field.message;
+}
+/**
+* Most `google.protobuf.*` well-known types serialize as scalars in proto JSON
+* (Timestamp/Duration → RFC3339/duration string, FieldMask → comma-joined
+* string, *Value wrappers → underlying primitive, etc.), so we must not let
+* `--field` drill into their internal fields. Treating them as leaves keeps
+* the completion and the body shape consistent with what the server expects.
+* @param message - The proto message descriptor to inspect
+* @returns True when the message is a well-known type
+*/
+function isWellKnownType(message) {
+	return message.typeName.startsWith("google.protobuf.");
+}
+const UNREPRESENTABLE_WELL_KNOWN_TYPES = /* @__PURE__ */ new Set([
+	"google.protobuf.Struct",
+	"google.protobuf.Value",
+	"google.protobuf.ListValue",
+	"google.protobuf.NullValue",
+	"google.protobuf.Any",
+	"google.protobuf.Empty"
+]);
+/**
+* @param message - The proto message descriptor to inspect
+* @returns True when the message is a well-known type that `--field` cannot represent
+*/
+function isUnrepresentableWellKnownType(message) {
+	return UNREPRESENTABLE_WELL_KNOWN_TYPES.has(message.typeName);
+}
+/**
+* Pre-enumerates every `--field` completion candidate for `methodName`,
+* walking the input message tree to produce a flat list that the shell can
+* prefix-filter at TAB time. Used by the `expand` completion variant so no
+* Node process is spawned per keystroke.
+*
+* For each leaf field, emits `key=` (key completion). Enum leaves additionally
+* emit `key=ENUM_VALUE` per value, bool leaves emit `key=true` and
+* `key=false`. For nested messages, emits `key.` (drill-down) and recurses.
+*
+* Returns an empty array when `methodName` is unknown so the `expand`
+* generator stays exception-free at script-generation time.
+* @param methodName - Name of the unary RPC whose input message is being walked
+* @returns Flat list of `{ value, description }` candidates
+*/
+function enumerateAllFieldCompletions(methodName) {
+	const method = getMethodDescriptor(methodName);
+	if (!method) return [];
+	const candidates = [];
+	const visited = /* @__PURE__ */ new Set();
+	function walk(message, prefix) {
+		visited.add(message);
+		for (const field of message.fields) {
+			if (field.fieldKind === "list" || field.fieldKind === "map") continue;
+			const fullKey = prefix + field.localName;
+			if (field.fieldKind === "message") {
+				if (isUnrepresentableWellKnownType(field.message)) continue;
+				if (!isWellKnownType(field.message)) {
+					const nested = field.message;
+					candidates.push({
+						value: `${fullKey}.`,
+						description: `${fullKey} (message)`
+					});
+					if (!visited.has(nested)) walk(nested, `${fullKey}.`);
+					continue;
+				}
+			}
+			candidates.push({
+				value: `${fullKey}=`,
+				description: `Set ${fullKey}`
+			});
+			if (field.fieldKind === "enum") for (const v of field.enum.values) candidates.push({
+				value: `${fullKey}=${v.name}`,
+				description: v.name
+			});
+			else if (field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
+				candidates.push({
+					value: `${fullKey}=true`,
+					description: "true"
+				});
+				candidates.push({
+					value: `${fullKey}=false`,
+					description: "false"
+				});
+			}
+		}
+		visited.delete(message);
+	}
+	walk(method.input, "");
+	return candidates;
+}
+/**
+* Resolves the leaf `DescField` at a dotted `--field` path within an input
+* message tree. Returns undefined when any segment is missing or when a
+* non-leaf segment isn't a singular message — callers fall back to treating
+* the value as a string in that case.
+* @param input - The RPC input message descriptor
+* @param path - Dot-split path segments to follow (e.g. ["application", "name"])
+* @returns The leaf field descriptor, or undefined when the path doesn't resolve
+*/
+function resolveLeafField(input, path) {
+	let message = input;
+	for (let i = 0; i < path.length; i++) {
+		const field = message.fields.find((f) => f.localName === path[i]);
+		if (!field) return void 0;
+		if (i === path.length - 1) {
+			if (field.fieldKind === "message" && isUnrepresentableWellKnownType(field.message)) return;
+			return field;
+		}
+		if (field.fieldKind !== "message") return void 0;
+		if (isWellKnownType(field.message)) return void 0;
+		message = field.message;
+	}
+}
+
+//#endregion
+//#region src/cli/commands/api/render.ts
+const SCALAR_LABEL = {
+	[ScalarType.DOUBLE]: "double",
+	[ScalarType.FLOAT]: "float",
+	[ScalarType.INT64]: "int64",
+	[ScalarType.UINT64]: "uint64",
+	[ScalarType.INT32]: "int32",
+	[ScalarType.FIXED64]: "fixed64",
+	[ScalarType.FIXED32]: "fixed32",
+	[ScalarType.BOOL]: "bool",
+	[ScalarType.STRING]: "string",
+	[ScalarType.BYTES]: "bytes",
+	[ScalarType.UINT32]: "uint32",
+	[ScalarType.SFIXED32]: "sfixed32",
+	[ScalarType.SFIXED64]: "sfixed64",
+	[ScalarType.SINT32]: "sint32",
+	[ScalarType.SINT64]: "sint64"
+};
+function shortName(typeName) {
+	const dot = typeName.lastIndexOf(".");
+	return dot < 0 ? typeName : typeName.slice(dot + 1);
+}
+function scalarLabel(scalar) {
+	return SCALAR_LABEL[scalar] ?? `scalar(${scalar})`;
+}
+function enumLabel(enumDesc) {
+	return `enum ${shortName(enumDesc.typeName)}`;
+}
+function enumOf(field) {
+	if (field.fieldKind === "enum") return field.enum;
+	if (field.fieldKind === "list" && field.listKind === "enum") return field.enum;
+}
+function describeFieldType(field) {
+	switch (field.fieldKind) {
+		case "scalar": return scalarLabel(field.scalar);
+		case "enum": return enumLabel(field.enum);
+		case "message": return shortName(field.message.typeName);
+		case "list": {
+			let inner;
+			if (field.listKind === "scalar") inner = scalarLabel(field.scalar);
+			else if (field.listKind === "enum") inner = enumLabel(field.enum);
+			else inner = shortName(field.message.typeName);
+			return `repeated ${inner}`;
+		}
+		case "map": {
+			const keyType = scalarLabel(field.mapKey);
+			let valType;
+			if (field.mapKind === "scalar") valType = scalarLabel(field.scalar);
+			else if (field.mapKind === "enum") valType = enumLabel(field.enum);
+			else valType = shortName(field.message.typeName);
+			return `map<${keyType}, ${valType}>`;
+		}
+		default: return "<unknown>";
+	}
+}
+function fieldToJson(field, visited) {
+	const json = {
+		name: field.localName,
+		protoName: field.name,
+		type: describeFieldType(field),
+		fieldKind: field.fieldKind,
+		repeated: field.fieldKind === "list"
+	};
+	if (field.oneof) json.oneof = field.oneof.name;
+	const fieldEnum = enumOf(field);
+	if (fieldEnum) json.enumValues = fieldEnum.values.map((v) => v.name);
+	const nested = nestedMessage(field);
+	if (nested && !visited.has(nested)) {
+		visited.add(nested);
+		json.message = {
+			typeName: nested.typeName,
+			fields: nested.fields.map((f) => fieldToJson(f, visited))
+		};
+		visited.delete(nested);
+	} else if (nested) json.message = {
+		typeName: nested.typeName,
+		fields: [],
+		recursive: true
+	};
+	return json;
+}
+function renderInspectJson(method) {
+	const visited = /* @__PURE__ */ new Set([method.input]);
+	return {
+		method: method.name,
+		input: {
+			typeName: method.input.typeName,
+			fields: method.input.fields.map((f) => fieldToJson(f, visited))
+		},
+		output: { typeName: method.output.typeName }
+	};
+}
+function renderFieldText(field, indent, visited) {
+	const lines = [];
+	const oneofTag = field.oneof ? ` (oneof ${field.oneof.name})` : "";
+	lines.push(`${indent}${field.localName}: ${describeFieldType(field)}${oneofTag}`);
+	const fieldEnum = enumOf(field);
+	if (fieldEnum) {
+		const values = fieldEnum.values.map((v) => v.name).join(", ");
+		lines.push(`${indent}  values: ${values}`);
+	}
+	const nested = nestedMessage(field);
+	if (nested && !visited.has(nested)) {
+		visited.add(nested);
+		for (const sub of nested.fields) lines.push(...renderFieldText(sub, `${indent}  `, visited));
+		visited.delete(nested);
+	} else if (nested) lines.push(`${indent}  …(recursive ${nested.typeName})`);
+	return lines;
+}
+function renderInspectText(method) {
+	const lines = [];
+	lines.push(`${method.name}`);
+	lines.push(`  request: ${method.input.typeName}`);
+	const visited = /* @__PURE__ */ new Set([method.input]);
+	for (const f of method.input.fields) lines.push(...renderFieldText(f, "    ", visited));
+	lines.push(`  response: ${method.output.typeName}`);
+	return lines.join("\n");
+}
+
+//#endregion
+//#region src/cli/commands/api/inspect.ts
+const inspectCommand = defineAppCommand({
+	name: "inspect",
+	description: "Print the input message tree of an OperatorService endpoint.",
+	notes: "Combine with the global `--json` flag for a machine-readable descriptor. Recursive type references and `oneof` membership are annotated. Use `tailor api list` to discover endpoint names.",
+	examples: [{
+		cmd: "GetApplication",
+		desc: "Show fields of GetApplicationRequest."
+	}, {
+		cmd: "CreateExecutorExecutor",
+		desc: "Inspect a deeply nested input with `(oneof config)` annotations."
+	}],
+	args: z.strictObject({ endpoint: arg(z.string(), {
+		positional: true,
+		description: "API endpoint to inspect (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
+		completion: { custom: { choices: listMethodNames() } }
+	}) }),
+	run: (args) => {
+		const methodName = extractMethodName(args.endpoint);
+		const method = getMethodDescriptor(methodName);
+		if (!method) throw createCLIError({
+			message: `unknown method: ${methodName}`,
+			suggestion: "Run `tailor api list` to see available methods.",
+			command: "api inspect"
+		});
+		if (logger.jsonMode) logger.out(renderInspectJson(method));
+		else logger.out(renderInspectText(method));
+	}
+});
+
+//#endregion
+//#region src/cli/commands/api/list.ts
+const listCommand$7 = defineAppCommand({
+	name: "list",
+	description: "List all invocable OperatorService methods.",
+	notes: "Only single-request (non-streaming) methods are listed, because the CLI issues a single JSON request and reads one JSON response.",
+	args: z.strictObject({}),
+	run: () => {
+		const names = listMethodNames();
+		if (logger.jsonMode) logger.out(names);
+		else for (const name of names) logger.out(name);
+	}
+});
+
+//#endregion
+//#region src/cli/commands/api/index.ts
+function resolveNamespaceName(methodName, config) {
+	if (/Auth|Tenant|UserProfile/.test(methodName)) return config.auth?.name;
+	if (/IdP/.test(methodName)) {
+		if (config.idp?.length === 1) return assertDefined(config.idp[0], "idp config missing").name;
+		return;
+	}
+	if (/TailorDB/.test(methodName)) {
+		const keys = Object.keys(config.db ?? {});
+		if (keys.length === 1) return keys[0];
+		return;
+	}
+	if (/Pipeline/.test(methodName)) {
+		const keys = Object.keys(config.resolver ?? {});
+		if (keys.length === 1) return keys[0];
+		return;
+	}
+}
+/**
+* Parse a JSON body string as a plain object for field injection.
+* Returns undefined for invalid JSON or non-object values (null, arrays, primitives),
+* so callers can fall back to sending the raw string unchanged.
+* @param body - Raw body string
+* @returns Parsed object or undefined
+*/
+function parseBodyAsObject(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return;
+	return parsed;
+}
+/**
+* Set a dotted path on a body object, replacing non-object intermediates as
+* needed. `--field` takes precedence over `--body`, so collisions overwrite.
+* @param obj - The body object to mutate
+* @param path - Dot-split path segments (e.g. ["application", "name"])
+* @param value - Value to assign at the leaf
+*/
+function setNestedPath(obj, path, value) {
+	let cursor = obj;
+	for (let i = 0; i < path.length - 1; i++) {
+		const key = assertDefined(path[i], "path segment missing");
+		const next = cursor[key];
+		if (typeof next !== "object" || next === null || Array.isArray(next)) cursor[key] = {};
+		cursor = cursor[key];
+	}
+	cursor[assertDefined(path[path.length - 1], "path last segment missing")] = value;
+}
+/**
+* Coerces a raw `--field` string value to match the leaf proto type so the
+* JSON body sends a properly typed value. Today we only coerce bool — the
+* completion candidates explicitly suggest `=true`/`=false`, so sending the
+* literal string "true" would be a visible mismatch. Other scalars are left
+* as strings: proto JSON accepts string forms for ints/floats/int64/etc.,
+* and we'd rather pass through what the user typed than silently coerce.
+* @param field - The resolved leaf field descriptor, or undefined when the path didn't resolve
+* @param raw - The raw string value after `=`
+* @returns The value to write into the body object
+*/
+function coerceFieldValue(field, raw) {
+	if (field && field.fieldKind === "scalar" && field.scalar === ScalarType.BOOL) {
+		if (raw === "true") return true;
+		if (raw === "false") return false;
+		throw new Error(`Invalid value for bool field: '${raw}'. Expected 'true' or 'false'.`);
+	}
+	return raw;
+}
+/**
+* Collapse top-level body keys that address a known input field by its
+* protobuf name (snake_case) or JSON name to the field's `localName`. protojson
+* accepts every alias, so converging them here lets the presence checks below
+* reason in a single namespace — otherwise a `--body` written as
+* `{"workspace_id": ...}` slips past the camelCase check and we inject a second
+* `workspaceId`, which the server rejects as a duplicate field. When both forms
+* are present the canonical key wins and the alias is dropped.
+* @param body - The parsed body object to mutate
+* @param fields - The target endpoint's input fields
+* @returns Whether any key was rewritten
+*/
+function normalizeBodyFieldKeys(body, fields) {
+	const aliasToLocal = /* @__PURE__ */ new Map();
+	for (const f of fields) {
+		aliasToLocal.set(f.name, f.localName);
+		aliasToLocal.set(f.jsonName, f.localName);
+	}
+	let changed = false;
+	for (const key of Object.keys(body)) {
+		const local = aliasToLocal.get(key);
+		if (!local || local === key) continue;
+		if (!Object.hasOwn(body, local)) body[local] = body[key];
+		delete body[key];
+		changed = true;
+	}
+	return changed;
+}
+const FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const fieldArg = z.string().transform((val, ctx) => {
+	const eq = val.indexOf("=");
+	if (eq < 0) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: `Invalid field format: '${val}'. Expected format: 'key=value' or 'a.b.c=value'`
+		});
+		return z.NEVER;
+	}
+	const key = val.slice(0, eq);
+	if (key.length === 0) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Field key cannot be empty"
+		});
+		return z.NEVER;
+	}
+	const segments = key.split(".");
+	if (segments.some((seg) => seg.length === 0)) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: `Invalid field key: '${key}'. Dotted segments cannot be empty`
+		});
+		return z.NEVER;
+	}
+	const forbidden = segments.find((seg) => FORBIDDEN_SEGMENTS.has(seg));
+	if (forbidden) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: `Invalid field key: '${key}'. Segment '${forbidden}' is not allowed.`
+		});
+		return z.NEVER;
+	}
+	return {
+		path: segments,
+		value: val.slice(eq + 1)
+	};
+});
+const apiCommand = defineAppCommand({
+	name: "api",
+	description: "Call Tailor Platform API endpoints directly.",
+	notes: `Use \`tailor api list\` to enumerate invocable methods and \`tailor api inspect <endpoint>\` to print an endpoint's input message tree (combine with \`--json\` for machine-readable output).
+
+The request body is inferred from the target endpoint's request schema, and commonly required fields are auto-injected so they can be omitted from \`--body\`:
+
+- \`workspaceId\` — resolved from \`-w\` / \`TAILOR_PLATFORM_WORKSPACE_ID\` / the selected profile.
+- \`namespaceName\` — resolved from \`tailor.config.ts\` based on the endpoint's service:
+  - Auth / Tenant / UserProfile endpoints use \`auth.name\`.
+  - IdP / TailorDB / Pipeline endpoints use the sole configured namespace when exactly one is defined.
+
+Values already present in \`--body\` are never overridden. If a value cannot be resolved (e.g. no config found), injection is silently skipped and the server-side validation error takes precedence.
+
+Use \`--field key=value\` (repeatable) to set request body fields without writing JSON. Dotted keys (e.g. \`application.name=foo\`) build nested objects. \`--field\` overrides matching fields in \`--body\` and tab-completes from the endpoint's request schema.`,
+	examples: [
+		{
+			cmd: "GetApplication -b '{\"applicationName\":\"app-1\"}'",
+			desc: "Call an endpoint; workspaceId is auto-injected."
+		},
+		{
+			cmd: "GetApplication -f applicationName=app-1",
+			desc: "Same as above, using --field instead of --body."
+		},
+		{
+			cmd: "list",
+			desc: "List all invocable OperatorService methods."
+		},
+		{
+			cmd: "inspect GetApplication",
+			desc: "Show the input message tree for an endpoint."
+		}
+	],
+	subCommands: {
+		list: listCommand$7,
+		inspect: inspectCommand
+	},
+	args: z.strictObject({
+		...workspaceArgs,
+		...configArg,
+		body: arg(z.string().default("{}"), {
+			alias: "b",
+			description: "Request body as JSON."
+		}),
+		field: arg(fieldArg.array().optional(), {
+			alias: "f",
+			description: "Set a body field as `key=value` (repeatable; dotted keys nest). Overrides --body.",
+			completion: { custom: { expand: {
+				dependsOn: ["endpoint"],
+				enumerate: ({ endpoint }) => enumerateAllFieldCompletions(extractMethodName(endpoint ?? ""))
+			} } }
+		}),
+		endpoint: arg(z.string(), {
+			positional: true,
+			description: "API endpoint to call (e.g., 'GetApplication' or 'tailor.v1.OperatorService/GetApplication').",
+			completion: { custom: { choices: listMethodChoices() } }
+		})
+	}),
+	run: async (args) => {
+		await assertWritable({ profile: args.profile });
+		const methodName = extractMethodName(args.endpoint);
+		const method = getMethodDescriptor(methodName);
+		const parsedBody = parseBodyAsObject(args.body);
+		let mutated = false;
+		if (args.field && args.field.length > 0) {
+			if (!parsedBody) throw new Error("--field requires --body to be a JSON object (or omitted).");
+			for (const f of args.field) {
+				const leaf = method ? resolveLeafField(method.input, f.path) : void 0;
+				setNestedPath(parsedBody, f.path, coerceFieldValue(leaf, f.value));
+			}
+			mutated = true;
+		}
+		if (parsedBody && method) {
+			if (normalizeBodyFieldKeys(parsedBody, method.input.fields)) mutated = true;
+			const fieldNames = method.input.fields.map((f) => f.localName);
+			if (fieldNames.includes("workspaceId") && !Object.hasOwn(parsedBody, "workspaceId")) try {
+				parsedBody.workspaceId = await loadWorkspaceId({
+					workspaceId: args["workspace-id"],
+					profile: args.profile
+				});
+				mutated = true;
+			} catch {}
+			if (fieldNames.includes("namespaceName") && !Object.hasOwn(parsedBody, "namespaceName")) try {
+				const { config } = await loadConfig(args.config);
+				const ns = resolveNamespaceName(methodName, config);
+				if (ns) {
+					parsedBody.namespaceName = ns;
+					mutated = true;
+				}
+			} catch {}
+		}
+		const result = await apiCall({
+			profile: args.profile,
+			endpoint: args.endpoint,
+			body: mutated && parsedBody ? JSON.stringify(parsedBody) : args.body
+		});
+		logger.out(JSON.stringify(result.data, null, 2));
+	}
+});
+
+//#endregion
 //#region src/cli/commands/auth/token.ts
 const tokenCommand = defineAppCommand({
 	name: "token",
@@ -396,7 +946,7 @@ const listCommand$6 = defineAppCommand({
 		}
 		let entries;
 		try {
-			entries = fs$1.readdirSync(config.localDir);
+			entries = fs.readdirSync(config.localDir);
 		} catch {
 			logger.info("No crash reports found.");
 			if (jsonOutput) logger.out([]);
@@ -436,7 +986,7 @@ const sendCommand = defineAppCommand({
 	run: async (args) => {
 		let content;
 		try {
-			content = fs$1.readFileSync(args.file, "utf-8");
+			content = fs.readFileSync(args.file, "utf-8");
 		} catch {
 			logger.error(`Crash report file not found: ${args.file}`);
 			process.exit(1);
@@ -491,13 +1041,24 @@ const crashReportCommand = defineCommand({
 
 //#endregion
 //#region src/cli/commands/deploy/index.ts
-const deployCommand$1 = defineAppCommand({
+const deployCommand = defineAppCommand({
 	name: "deploy",
 	description: "Deploy your application by applying the Tailor configuration.",
 	args: z.strictObject({
 		...workspaceArgs,
 		...multiConfigArg,
 		...confirmationArgs,
+		"create-workspace": arg(z.boolean().optional(), { description: "Create a workspace when the account has none" }),
+		"workspace-name": arg(z.string().optional(), { description: "Name for a workspace created during deploy" }),
+		"workspace-region": arg(z.string().optional(), { description: "Region for a workspace created during deploy" }),
+		"organization-id": arg(z.string().optional(), {
+			description: "Organization ID for a workspace created during deploy",
+			env: "TAILOR_PLATFORM_ORGANIZATION_ID"
+		}),
+		"folder-id": arg(z.string().optional(), {
+			description: "Folder ID for a workspace created during deploy",
+			env: "TAILOR_PLATFORM_FOLDER_ID"
+		}),
 		"dry-run": arg(z.boolean().optional(), {
 			alias: "d",
 			description: "Run the command without making any changes"
@@ -511,16 +1072,26 @@ const deployCommand$1 = defineAppCommand({
 		await assertWritable({ profile: args.profile });
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		await deploy({
+		await deployFromCLI({
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
 			configPath: args.config,
 			dryRun: args["dry-run"],
 			yes: args.yes,
+			createWorkspace: args["create-workspace"],
+			workspaceName: args["workspace-name"],
+			workspaceRegion: args["workspace-region"],
+			organizationId: args["organization-id"],
+			folderId: args["folder-id"],
 			noSchemaCheck: args["no-schema-check"],
 			noValidate: args["no-validate"],
 			noCache: args["no-cache"],
 			cleanCache: args["clean-cache"]
+		}, {
+			envFile: args["env-file"],
+			envFileIfExists: args["env-file-if-exists"],
+			verbose: args.verbose,
+			json: args.json
 		});
 	}
 });
@@ -533,12 +1104,12 @@ const executorCommand = defineCommand({
 	subCommands: {
 		trigger: triggerCommand,
 		jobs: jobsCommand,
-		list: listCommand$7,
+		list: listCommand$8,
 		get: getCommand$1,
 		webhook: webhookCommand
 	},
 	async run() {
-		await runCommand(listCommand$7, []);
+		await runCommand(listCommand$8, []);
 	}
 });
 
@@ -1119,12 +1690,12 @@ async function bundleForTestRun(options) {
 	const inlineSourcemap = resolveInlineSourcemap(options.inlineSourcemap);
 	const bundleLogLevel = resolveBundleLogLevel(options.logLevel);
 	const outputDir = path.resolve(getDistDir(), "test-run");
-	fs$1.mkdirSync(outputDir, { recursive: true });
+	fs.mkdirSync(outputDir, { recursive: true });
 	const baseName = `test-run--${detected.name}`;
 	const scriptName = `${baseName}.js`;
 	const entryPath = path.join(outputDir, `${baseName}.entry.js`);
 	const entryContent = generateEntry(detected, sourceFile, env, machineUser, workspaceId);
-	fs$1.writeFileSync(entryPath, entryContent);
+	fs.writeFileSync(entryPath, entryContent);
 	let tsconfig;
 	try {
 		tsconfig = await resolveTSConfig();
@@ -1273,8 +1844,11 @@ async function detectFunctionType(options) {
 		const rawInput = module.default.input;
 		let inputSchema;
 		if (rawInput) {
-			const { t } = await import("../types-C-lQ4se3.mjs");
-			inputSchema = t.object(rawInput);
+			const fields = rawInput;
+			inputSchema = { parse: (args) => parseInputFields({
+				...args,
+				fields
+			}) };
 		}
 		return {
 			type: "resolver",
@@ -1420,7 +1994,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 	run: async (args) => {
 		const jsonOutput = logger.jsonMode;
 		const filePath = path.resolve(args.file);
-		if (!fs$1.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
+		if (!fs.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
 		const { config } = await loadConfig(args.config);
 		const authNamespace = resolveAuthNamespace(config.auth);
 		const machineUserName = await resolveMachineUserName({
@@ -1449,7 +2023,7 @@ When a \`.js\` file is provided, detection and bundling are skipped and the file
 		let functionName;
 		if (isPreBundled) {
 			scriptName = path.basename(filePath);
-			bundledCode = fs$1.readFileSync(filePath, "utf-8");
+			bundledCode = fs.readFileSync(filePath, "utf-8");
 			logger.info(`Using pre-bundled script ${styles.bold(scriptName)}`);
 		} else {
 			logger.info(`Detecting function type from ${styles.path(relativePath)}`);
@@ -1603,12 +2177,12 @@ const functionCommand = defineCommand({
 	description: "Manage functions",
 	subCommands: {
 		get: getCommand$2,
-		list: listCommand$8,
+		list: listCommand$9,
 		logs: logsCommand,
 		"test-run": testRunCommand
 	},
 	async run() {
-		await runCommand(listCommand$8, []);
+		await runCommand(listCommand$9, []);
 	}
 });
 
@@ -1617,23 +2191,14 @@ const functionCommand = defineCommand({
 const generateCommand = defineAppCommand({
 	name: "generate",
 	description: "Generate files using Tailor configuration.",
-	args: z.strictObject({
-		config: arg(z.string().default("tailor.config.ts"), {
-			alias: "c",
-			description: "Path to SDK config file"
-		}),
-		watch: arg(z.boolean().default(false), {
-			alias: "W",
-			description: "Watch for type/resolver changes and regenerate"
-		})
-	}),
+	args: z.strictObject({ config: arg(z.string().default("tailor.config.ts"), {
+		alias: "c",
+		description: "Path to SDK config file"
+	}) }),
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		await generate({
-			configPath: args.config,
-			watch: args.watch
-		});
+		await generate({ configPath: args.config });
 	}
 });
 
@@ -1692,8 +2257,47 @@ const redirectUri = `http://localhost:${redirectPort}/callback`;
 function randomState() {
 	return crypto.randomBytes(32).toString("base64url");
 }
-function assertProfileLoginUser(args, authenticatedUser, authenticatedSubject) {
-	if (args.profile && args.profileUser && authenticatedUser !== args.profileUser && authenticatedSubject !== args.profileUser) throw new Error(`Profile "${args.profile}" is configured for "${args.profileUser}", but login authenticated "${authenticatedUser}".`);
+function getProfileUserMismatch(args, authenticatedUser, authenticatedSubject) {
+	if (!args.profile || !args.profileUser || authenticatedUser === args.profileUser || authenticatedSubject === args.profileUser) return;
+	return {
+		profile: args.profile,
+		oldUser: args.profileUser,
+		authenticatedUser,
+		loginMode: args.loginMode ?? "user"
+	};
+}
+function quoteCommandArg(value, platform = process.platform) {
+	if (platform === "win32") {
+		if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value;
+		return;
+	}
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function profileUpdateCommand(mismatch) {
+	const profileArg = quoteCommandArg(mismatch.profile);
+	const userArg = quoteCommandArg(mismatch.authenticatedUser);
+	if (profileArg && userArg) return `tailor-sdk profile update --user ${userArg} -- ${profileArg}`;
+	return [
+		"tailor-sdk profile update --user <authenticated-user> -- <profile>",
+		`profile = ${JSON.stringify(mismatch.profile)}`,
+		`authenticated user = ${JSON.stringify(mismatch.authenticatedUser)}`
+	].join("\n");
+}
+function retryInstruction(mismatch) {
+	if (mismatch.loginMode === "machine-user") return "Then retry the original machine-user login command.";
+	const profileArg = quoteCommandArg(mismatch.profile);
+	if (!profileArg) return "Then retry the browser login with the same profile value.";
+	return `Then run:\n  tailor-sdk login --profile ${profileArg}`;
+}
+function profileUserMismatchError(mismatch) {
+	const updateCommand = profileUpdateCommand(mismatch);
+	const nextStep = retryInstruction(mismatch);
+	return new Error(multiline`
+    Profile "${mismatch.profile}" is configured for "${mismatch.oldUser}", but login authenticated "${mismatch.authenticatedUser}".
+    The authenticated user has been saved. To use it with this profile, run:
+      ${updateCommand}
+    ${nextStep}
+  `);
 }
 function shouldUpdateCurrentUser(profile, platformConfig) {
 	if (!profile) return true;
@@ -1713,7 +2317,6 @@ const startAuthServer = async (args = {}) => {
 					codeVerifier
 				});
 				const userInfo = await fetchUserInfo(tokens.accessToken, args.platformConfig);
-				assertProfileLoginUser(args, userInfo.email, userInfo.sub);
 				const pfConfig = await readPlatformConfig();
 				await saveUserTokens(pfConfig, userInfo.sub, {
 					accessToken: tokens.accessToken,
@@ -1722,6 +2325,11 @@ const startAuthServer = async (args = {}) => {
 					platformConfig: args.platformConfig,
 					email: userInfo.email
 				});
+				const mismatch = getProfileUserMismatch(args, userInfo.email, userInfo.sub);
+				if (mismatch) {
+					writePlatformConfig(pfConfig);
+					throw profileUserMismatchError(mismatch);
+				}
 				if (args.updateCurrentUser ?? true) pfConfig.current_user = userInfo.sub;
 				await removeLegacyUserAlias(pfConfig, userInfo.email, userInfo.sub, args.platformConfig);
 				writePlatformConfig(pfConfig);
@@ -1765,11 +2373,15 @@ const startAuthServer = async (args = {}) => {
 	});
 };
 async function loginAsMachineUser(args) {
-	assertProfileLoginUser(args, args.clientId);
 	const clientSecret = args.clientSecret ?? await prompt.password({ message: "Client secret" });
 	const tokens = await fetchPlatformMachineUserToken(args.clientId, clientSecret, args.platformConfig);
 	const pfConfig = await readPlatformConfig();
 	await saveUserTokens(pfConfig, args.clientId, { accessToken: tokens.accessToken }, new Date(assertDefined(tokens.expiresAt, "token response missing expiresAt")).toISOString(), { platformConfig: args.platformConfig });
+	const mismatch = getProfileUserMismatch(args, args.clientId);
+	if (mismatch) {
+		writePlatformConfig(pfConfig);
+		throw profileUserMismatchError(mismatch);
+	}
 	if (args.updateCurrentUser ?? true) pfConfig.current_user = args.clientId;
 	writePlatformConfig(pfConfig);
 }
@@ -1801,31 +2413,36 @@ const loginCommand = defineAppCommand({
 		})
 	}).describe("Machine User Login")]),
 	run: async (args) => {
-		let platformConfig;
-		let profileUser;
-		if ("profile" in args && args.profile) {
-			const profileEntry = (await readPlatformConfig()).profiles[args.profile];
-			if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
-			platformConfig = platformConfigFromProfile(profileEntry);
-			profileUser = profileEntry.user;
+		try {
+			let platformConfig;
+			let profileUser;
+			if ("profile" in args && args.profile) {
+				const profileEntry = (await readPlatformConfig()).profiles[args.profile];
+				if (!profileEntry) throw new Error(`Profile "${args.profile}" not found`);
+				platformConfig = platformConfigFromProfile(profileEntry);
+				profileUser = profileEntry.user;
+			}
+			const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
+			if ("machine-user" in args) await loginAsMachineUser({
+				clientId: args.clientId,
+				clientSecret: args.clientSecret,
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "machine-user"
+			});
+			else await startAuthServer({
+				profile: args.profile,
+				profileUser,
+				platformConfig,
+				updateCurrentUser,
+				loginMode: "user"
+			});
+			logger.success("Successfully logged in to Tailor Platform.");
+		} finally {
+			await closeConnectionPool();
 		}
-		const updateCurrentUser = shouldUpdateCurrentUser(args.profile, platformConfig);
-		if ("machine-user" in args) await loginAsMachineUser({
-			clientId: args.clientId,
-			clientSecret: args.clientSecret,
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		else await startAuthServer({
-			profile: args.profile,
-			profileUser,
-			platformConfig,
-			updateCurrentUser
-		});
-		logger.success("Successfully logged in to Tailor Platform.");
-		await closeConnectionPool();
 	}
 });
 
@@ -1892,11 +2509,11 @@ const machineuserCommand = defineCommand({
 	name: "machineuser",
 	description: "Manage machine users in your Tailor Platform application.",
 	subCommands: {
-		list: listCommand$9,
+		list: listCommand$10,
 		token: tokenCommand$1
 	},
 	async run() {
-		await runCommand(listCommand$9, []);
+		await runCommand(listCommand$10, []);
 	}
 });
 
@@ -1906,11 +2523,11 @@ const oauth2clientCommand = defineCommand({
 	name: "oauth2client",
 	description: "Manage OAuth2 clients in your Tailor Platform application.",
 	subCommands: {
-		list: listCommand$10,
+		list: listCommand$11,
 		get: getCommand$3
 	},
 	async run() {
-		await runCommand(listCommand$10, []);
+		await runCommand(listCommand$11, []);
 	}
 });
 
@@ -1967,7 +2584,7 @@ const folderCommand = defineCommand({
 		create: createCommand$3,
 		delete: deleteCommand$4,
 		get: getCommand$4,
-		list: listCommand$11,
+		list: listCommand$12,
 		update: updateCommand$2
 	}
 });
@@ -1980,12 +2597,12 @@ const organizationCommand = defineCommand({
 	subCommands: {
 		folder: folderCommand,
 		get: getCommand$5,
-		list: listCommand$12,
+		list: listCommand$13,
 		tree: treeCommand,
 		update: updateCommand$3
 	},
 	async run() {
-		await runCommand(listCommand$12, []);
+		await runCommand(listCommand$13, []);
 	}
 });
 
@@ -2033,6 +2650,12 @@ const BUILTIN_COMMAND_NAMES = [
 
 //#endregion
 //#region src/cli/shared/plugin.ts
+/**
+* npm packages known to provide a plugin slug, keyed by the slug the
+* dispatcher resolves (command path joined with `-`). Used to suggest an
+* install command when the plugin executable is not found.
+*/
+const KNOWN_PLUGIN_PACKAGES = { "tailordb-erd": "@tailor-platform/sdk-tailordb-erd-plugin" };
 /** PATH entry separator (`;` on Windows, `:` elsewhere). */
 const pathDelimiter = process.platform === "win32" ? ";" : ":";
 /**
@@ -2210,17 +2833,7 @@ async function resolveActiveUser(profile) {
 */
 async function buildPluginEnv(options = {}) {
 	const { profile } = options;
-	let platformConfig;
-	try {
-		platformConfig = await loadPlatformClientConfig({
-			profile,
-			allowMissingProfile: true
-		});
-	} catch {}
-	const env = {
-		TAILOR_PLATFORM_URL: getPlatformBaseUrl(platformConfig),
-		TAILOR_PLATFORM_OAUTH2_CLIENT_ID: getOAuth2ClientId(platformConfig)
-	};
+	const env = {};
 	const binPath = process.argv[1];
 	if (binPath) env.TAILOR_BIN = binPath;
 	try {
@@ -2229,6 +2842,16 @@ async function buildPluginEnv(options = {}) {
 	} catch {}
 	const configPath = loadConfigPath();
 	if (configPath) env.TAILOR_CONFIG_PATH = configPath;
+	if (options.skipPlatformContext) return env;
+	let platformConfig;
+	try {
+		platformConfig = await loadPlatformClientConfig({
+			profile,
+			allowMissingProfile: true
+		});
+	} catch {}
+	env.TAILOR_PLATFORM_URL = getPlatformBaseUrl(platformConfig);
+	env.TAILOR_PLATFORM_OAUTH2_CLIENT_ID = getOAuth2ClientId(platformConfig);
 	try {
 		env.TAILOR_PLATFORM_WORKSPACE_ID = await loadWorkspaceId({ profile });
 	} catch {}
@@ -2300,21 +2923,72 @@ function buildSpawnTarget(pluginPath, args) {
 	};
 }
 /**
+* Check whether args forwarded to a plugin carry an explicit env-file flag.
+* Scanning stops at a `--` terminator. The check is presence-only:
+* `--env-file-if-exists` counts even when the named file does not exist, so
+* no platform context is injected in that case either.
+* @param args - Args forwarded to the plugin
+* @returns Whether an `--env-file`/`-e`/`--env-file-if-exists` flag is present
+*/
+function hasEnvFileFlag(args) {
+	for (const token of args) {
+		if (token === "--") return false;
+		if (token === "--env-file" || token === "-e" || token === "--env-file-if-exists") return true;
+		if (token.startsWith("--env-file=") || token.startsWith("-e=") || token.startsWith("--env-file-if-exists=")) return true;
+	}
+	return false;
+}
+/**
+* Extract an explicit `--profile`/`-p` value from args forwarded to a plugin,
+* so the injected platform context matches the profile the plugin will use.
+* Scanning stops at a `--` terminator; the last occurrence wins.
+* @param args - Args forwarded to the plugin
+* @returns The explicit profile value, or undefined when not present
+*/
+function explicitProfileFromArgs(args) {
+	let profile;
+	for (let i = 0; i < args.length; i++) {
+		const token = args[i];
+		if (token === void 0 || token === "--") break;
+		if (token === "--profile" || token === "-p") {
+			const next = args[i + 1];
+			if (next !== void 0 && !next.startsWith("-")) {
+				profile = next;
+				i++;
+			}
+			continue;
+		}
+		if (token.startsWith("--profile=")) profile = token.slice(10);
+		else if (token.startsWith("-p=")) profile = token.slice(3);
+	}
+	return profile || void 0;
+}
+/**
+* Build the plugin slug from the known command path plus the unknown name,
+* so `tailor tailordb erd` resolves `tailor-tailordb-erd`.
+* @param commandPath - Parent command path preceding the unknown subcommand
+* @param name - Unknown subcommand name
+* @returns The plugin slug
+*/
+function pluginSlug(commandPath, name) {
+	return [...commandPath ?? [], name].join("-");
+}
+/**
 * Resolve and execute a plugin, forwarding stdio and propagating its exit code.
 * @param params - Dispatch parameters
-* @param params.name - Plugin name (without the `<cli>-` prefix)
-* @param params.args - Args to forward to the plugin
-* @param params.cliName - The host CLI name
-* @param params.profile - Active profile name, if any
 * @returns The plugin's exit code, or undefined when no matching plugin exists
 */
 async function dispatchPlugin(params) {
-	const slug = [...params.commandPath ?? [], params.name].join("-");
+	const slug = pluginSlug(params.commandPath, params.name);
 	const plugin = resolvePlugin(slug, params.cliName);
 	if (!plugin) return;
+	const profile = explicitProfileFromArgs(params.args) ?? params.profile;
 	const env = {
 		...process.env,
-		...await buildPluginEnv({ profile: params.profile })
+		...await buildPluginEnv({
+			profile,
+			skipPlatformContext: hasEnvFileFlag(params.args)
+		})
 	};
 	const { command, args, shell } = buildSpawnTarget(plugin.path, params.args);
 	return await new Promise((resolve) => {
@@ -2333,6 +3007,27 @@ async function dispatchPlugin(params) {
 		});
 	});
 }
+/**
+* Dispatch a plugin, printing an install hint when the subcommand maps to a
+* known plugin package that is not installed.
+* @param params - Dispatch parameters
+* @returns The plugin's exit code (1 after an install hint), or undefined when
+* the subcommand matches no plugin and no known package
+*/
+async function dispatchPluginWithInstallHint(params) {
+	const exitCode = await dispatchPlugin(params);
+	if (exitCode !== void 0) return exitCode;
+	const knownPackage = KNOWN_PLUGIN_PACKAGES[pluginSlug(params.commandPath, params.name)];
+	if (!knownPackage) return;
+	const fullCommand = [
+		params.cliName,
+		...params.commandPath ?? [],
+		params.name
+	].join(" ");
+	logger.error(`"${fullCommand}" is provided by the ${knownPackage} CLI plugin, which is not installed.`);
+	logger.info(`Install it with: npm install -D ${knownPackage}`);
+	return 1;
+}
 
 //#endregion
 //#region src/cli/commands/plugin/list.ts
@@ -3135,10 +3830,10 @@ function lockPath(outputDir) {
 */
 function readLock(outputDir) {
 	const file = lockPath(outputDir);
-	if (!fs$1.existsSync(file)) return null;
+	if (!fs.existsSync(file)) return null;
 	let parsed;
 	try {
-		parsed = JSON.parse(fs$1.readFileSync(file, "utf-8"));
+		parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
 	} catch (cause) {
 		throw new Error(`${LOCK_FILENAME} is not valid JSON. The lock file is machine-owned; restore it from git (git checkout -- .github/tailor.lock) and re-run setup.`, { cause });
 	}
@@ -3154,8 +3849,8 @@ function readLock(outputDir) {
 */
 function writeLock(outputDir, lock) {
 	const file = lockPath(outputDir);
-	fs$1.mkdirSync(path.dirname(file), { recursive: true });
-	fs$1.writeFileSync(file, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
 }
 /**
 * Find a lock target by identity. Targets are identified by (kind,
@@ -3171,23 +3866,23 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@7817f37adf2891fbb2ebbe0a3b222a5fa2ed0c1f # v1.3.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx tailor \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bunx tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx tailor \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bunx tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/coordinate.workflow.yml
-var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
 
 //#endregion
 //#region src/cli/commands/setup/preview.workflow.yml
-var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@e74173d4bdd931d036ad359cf5f7729fc6aa7067 # v1.5.1\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        uses: tailor-platform/actions/seed-validate@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
@@ -3206,10 +3901,10 @@ const HEADER = `# Generated by \`tailor setup\` — managed by the Tailor SDK.
 * @returns Detected package manager, defaults to npm
 */
 function detectPackageManager(dir) {
-	if (fs$1.existsSync(path.join(dir, "pnpm-lock.yaml"))) return "pnpm";
-	if (fs$1.existsSync(path.join(dir, "yarn.lock"))) return "yarn";
-	if (fs$1.existsSync(path.join(dir, "bun.lockb")) || fs$1.existsSync(path.join(dir, "bun.lock"))) return "bun";
-	if (fs$1.existsSync(path.join(dir, "package-lock.json"))) return "npm";
+	if (fs.existsSync(path.join(dir, "pnpm-lock.yaml"))) return "pnpm";
+	if (fs.existsSync(path.join(dir, "yarn.lock"))) return "yarn";
+	if (fs.existsSync(path.join(dir, "bun.lockb")) || fs.existsSync(path.join(dir, "bun.lock"))) return "bun";
+	if (fs.existsSync(path.join(dir, "package-lock.json"))) return "npm";
 	return "npm";
 }
 function block(content, name, keep) {
@@ -3357,7 +4052,8 @@ function renderActionWorkflow(params) {
 		generatedIds: ["tailor-apply", "tailor-notify"]
 	};
 }
-const ACTIONS_SHA = "e74173d4bdd931d036ad359cf5f7729fc6aa7067";
+const ACTIONS_SHA = "a3c3032e14277e81039eb26ae1a425adb22eb532";
+const ACTIONS_VERSION = "v1.7.0";
 /**
 * Render the coordinator workflow that orchestrates per-app composite actions.
 *
@@ -3399,7 +4095,7 @@ function renderCoordinateWorkflow(params) {
 	}
 	const driftCheckStep = [
 		`- id: tailor-drift-check`,
-		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # v1.5.1`,
+		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`  with:`,
 		`    package-manager: ${packageManager}`
 	].join("\n");
@@ -3416,7 +4112,7 @@ function renderCoordinateWorkflow(params) {
 		return [
 			`- id: tailor-plan-${group.id}`,
 			`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
-			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+			`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 			`  with:`,
 			`    workspace-id: \${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}`,
 			`    package-manager: ${packageManager}${wdLine}`,
@@ -3429,7 +4125,7 @@ function renderCoordinateWorkflow(params) {
 	const multiConfigPlanStep = (group) => [
 		`- id: tailor-plan-${group.id}`,
 		`  if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork`,
-		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # v1.5.1`,
+		`  uses: tailor-platform/actions/plan@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`  env:`,
 		`    TAILOR_PLATFORM_SDK_CONFIG_PATH: ${groupConfigPath(group)}`,
 		`  with:`,
@@ -3446,7 +4142,7 @@ function renderCoordinateWorkflow(params) {
 			const wdLine = wd ? `\n    working-directory: ${wd}` : "";
 			return [
 				`- id: tailor-generate-check-${app.name}`,
-				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # v1.5.1`,
+				`  uses: tailor-platform/actions/generate-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 				`  with:`,
 				`    package-manager: ${packageManager}${wdLine}`
 			];
@@ -3541,11 +4237,11 @@ function renderTailorSetupAction(params) {
 		`runs:`,
 		`  using: composite`,
 		`  steps:`,
-		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # v1.5.1`,
+		`    - uses: tailor-platform/actions/setup@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`      with:`,
 		`        package-manager: ${packageManager}`,
 		`    # Add custom steps here (e.g. private registry authentication)`,
-		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # v1.5.1`,
+		`    - uses: tailor-platform/actions/install@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`      with:`,
 		`        package-manager: ${packageManager}`,
 		`        # editable: install-command:`,
@@ -3594,9 +4290,8 @@ async function defaultLoadHasStaticWebsites$1(configPath) {
 	const { config } = await loadConfig(configPath);
 	return (config.staticWebsites?.length ?? 0) > 0;
 }
-const WORKSPACE_NAME_RE = /^[a-z0-9-]+$/;
 function validateWorkspaceName(name) {
-	if (name.length < 3 || name.length > 63 || !WORKSPACE_NAME_RE.test(name) || name.startsWith("-") || name.endsWith("-")) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --name.`);
+	if (!workspaceNameSchema.safeParse(name).success) throw new Error(`Invalid workspace name "${name}". Names must be 3-63 characters of lowercase letters, numbers, and hyphens, and cannot start or end with a hyphen. Pass a valid name with --name.`);
 }
 const BRANCH_RE = /^[A-Za-z0-9._/-]+$/;
 const TAG_PATTERN_RE = /^[A-Za-z0-9._/*?![\]-]+$/;
@@ -3639,13 +4334,13 @@ function resolveConfigPath(outputDir, dir) {
 	const appDir = path.resolve(outputDir, dir);
 	const rel = path.relative(outputDir, appDir);
 	if (path.isAbsolute(dir) || escapesRoot$1(rel)) throw new Error(`--dir must be a relative path inside the repository (got "${dir}").`);
-	if (fs$1.existsSync(appDir)) {
-		const realAppDir = path.normalize(fs$1.realpathSync(appDir));
-		const realOutputDir = path.normalize(fs$1.realpathSync(outputDir));
+	if (fs.existsSync(appDir)) {
+		const realAppDir = path.normalize(fs.realpathSync(appDir));
+		const realOutputDir = path.normalize(fs.realpathSync(outputDir));
 		if (escapesRoot$1(path.relative(realOutputDir, realAppDir))) throw new Error(`--dir must resolve to a directory inside the repository (got "${dir}", which links outside it).`);
 	}
 	const configPath = path.join(appDir, "tailor.config.ts");
-	if (!fs$1.existsSync(configPath)) throw new Error(`tailor.config.ts not found at ${configPath}. Run this from your SDK project root, or pass the app directory with --dir.`);
+	if (!fs.existsSync(configPath)) throw new Error(`tailor.config.ts not found at ${configPath}. Run this from your SDK project root, or pass the app directory with --dir.`);
 	return configPath;
 }
 /**
@@ -3881,8 +4576,8 @@ async function setupTarget(options) {
 		file: resolved.file
 	});
 	const existing = findTarget(lock, resolved.kind, resolved.workspaceName);
-	const fileExists = fs$1.existsSync(absFile);
-	const currentContent = fileExists ? fs$1.readFileSync(absFile, "utf-8") : null;
+	const fileExists = fs.existsSync(absFile);
+	const currentContent = fileExists ? fs.readFileSync(absFile, "utf-8") : null;
 	const normalize = resolved.kind === "action" ? normalizeActionContent : void 0;
 	const decision = decideAction({
 		existing,
@@ -3900,8 +4595,8 @@ async function setupTarget(options) {
 		const existingBody = extractBuildSiteRunBody(currentContent);
 		if (existingBody !== null) contentToWrite = injectBuildSiteRunBody(contentToWrite, existingBody);
 	}
-	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
-	fs$1.writeFileSync(absFile, contentToWrite, "utf-8");
+	fs.mkdirSync(path.dirname(absFile), { recursive: true });
+	fs.writeFileSync(absFile, contentToWrite, "utf-8");
 	const newTarget = {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
@@ -4005,21 +4700,21 @@ async function setupCoordinate(options) {
 		file
 	});
 	const existing = findTarget(lock, "coordinate", coordinatorName);
-	const fileExists = fs$1.existsSync(absFile);
+	const fileExists = fs.existsSync(absFile);
 	const decision = decideAction({
 		existing,
 		fileExists,
-		currentContent: fileExists ? fs$1.readFileSync(absFile, "utf-8") : null,
+		currentContent: fileExists ? fs.readFileSync(absFile, "utf-8") : null,
 		force
 	});
 	if (decision.action === "conflict") throw new Error(`${file}: ${decision.reason}`);
-	fs$1.mkdirSync(path.dirname(absFile), { recursive: true });
-	fs$1.writeFileSync(absFile, render.content, "utf-8");
+	fs.mkdirSync(path.dirname(absFile), { recursive: true });
+	fs.writeFileSync(absFile, render.content, "utf-8");
 	const tailorSetupFile = ".github/actions/tailor-setup/action.yml";
 	const absTailorSetupFile = path.join(outputDir, tailorSetupFile);
-	if (!fs$1.existsSync(absTailorSetupFile)) {
-		fs$1.mkdirSync(path.dirname(absTailorSetupFile), { recursive: true });
-		fs$1.writeFileSync(absTailorSetupFile, renderTailorSetupAction({ packageManager }), "utf-8");
+	if (!fs.existsSync(absTailorSetupFile)) {
+		fs.mkdirSync(path.dirname(absTailorSetupFile), { recursive: true });
+		fs.writeFileSync(absTailorSetupFile, renderTailorSetupAction({ packageManager }), "utf-8");
 		logger.success(`Generated ${styles.path(tailorSetupFile)}`);
 	}
 	const newTarget = {
@@ -4146,13 +4841,13 @@ function resolveWithinRoot(outputDir, relPath) {
 	const abs = path.join(outputDir, relPath);
 	if (escapesRoot(path.relative(outputDir, abs))) return null;
 	try {
-		if (escapesRoot(path.relative(fs$1.realpathSync(outputDir), fs$1.realpathSync(abs)))) return null;
+		if (escapesRoot(path.relative(fs.realpathSync(outputDir), fs.realpathSync(abs)))) return null;
 	} catch {}
 	return abs;
 }
 function readHash(absFile, normalize) {
 	try {
-		const content = fs$1.readFileSync(absFile, "utf-8");
+		const content = fs.readFileSync(absFile, "utf-8");
 		return hashContent(normalize ? normalize(content) : content);
 	} catch {
 		return null;
@@ -4193,7 +4888,7 @@ async function checkGitHub(options) {
 	}
 	const slackToken = Boolean(process.env["TAILOR_SLACK_BOT_TOKEN"]);
 	if (slackToken !== Boolean(process.env["TAILOR_SLACK_CHANNEL_ID"])) throw new Error(`Slack is partially configured: ${slackToken ? "TAILOR_SLACK_BOT_TOKEN is set" : "TAILOR_SLACK_CHANNEL_ID is set"} but not both. TAILOR_SLACK_BOT_TOKEN (secret) and TAILOR_SLACK_CHANNEL_ID (variable) must be set together, or neither should be set.`);
-	const exists = options.configExistsAt ?? ((p) => fs$1.existsSync(p));
+	const exists = options.configExistsAt ?? ((p) => fs.existsSync(p));
 	const defaultBranch = detectDefaultBranchSafe(outputDir, options.gitRunner);
 	const loadErdNamespaces = options.loadErdNamespaces ?? defaultLoadErdNamespaces;
 	const loadHasMigrations = options.loadHasMigrations ?? defaultLoadHasMigrations;
@@ -4282,10 +4977,10 @@ async function setupDelete(options) {
 	const remaining = [...lock.targets];
 	try {
 		for (const { relPath, absPath, target } of matches) {
-			fs$1.rmSync(absPath, { force: true });
+			fs.rmSync(absPath, { force: true });
 			if (target.kind === "action") {
 				const dir = path.dirname(absPath);
-				if (fs$1.existsSync(dir) && fs$1.readdirSync(dir).length === 0) fs$1.rmdirSync(dir);
+				if (fs.existsSync(dir) && fs.readdirSync(dir).length === 0) fs.rmdirSync(dir);
 			}
 			const index = remaining.findIndex((t) => targetKey(t) === targetKey(target));
 			if (index !== -1) remaining.splice(index, 1);
@@ -4489,203 +5184,6 @@ const setupCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/shared/progress.ts
-/**
-* Create a simple progress reporter that writes updates to stderr.
-* @param label - Label to prefix progress output
-* @param total - Total number of steps
-* @returns Progress helpers
-*/
-function createProgress(label, total) {
-	let current = 0;
-	const update = () => {
-		current += 1;
-		const percent = Math.round(current / total * 100);
-		process.stderr.write(`\r${label} ${current}/${total} (${percent}%)`);
-	};
-	const finish = () => {
-		process.stderr.write("\n");
-	};
-	return {
-		update,
-		finish
-	};
-}
-/**
-* Wrap a promise with a timeout, rejecting if the timeout elapses first.
-* @template T
-* @param p - Promise to await
-* @param ms - Timeout in milliseconds
-* @param message - Error message on timeout
-* @returns Result of the original promise if it completes in time
-*/
-async function withTimeout(p, ms, message) {
-	return await Promise.race([p, setTimeout$1(ms).then(() => {
-		throw new Error(message);
-	})]);
-}
-
-//#endregion
-//#region src/cli/commands/staticwebsite/deploy.ts
-const CHUNK_SIZE = 64 * 1024;
-const IGNORED_FILES = /* @__PURE__ */ new Set([
-	".DS_Store",
-	"thumbs.db",
-	"desktop.ini"
-]);
-function shouldIgnoreFile(filePath) {
-	const fileName = path.basename(filePath).toLowerCase();
-	return IGNORED_FILES.has(fileName);
-}
-/**
-* Deploy a static website by creating a deployment, uploading files, and publishing it.
-* @param client - Operator client instance
-* @param workspaceId - Workspace ID
-* @param name - Static website name
-* @param distDir - Directory containing static site files
-* @param showProgress - Whether to show upload progress
-* @returns Deployment result with URL and skipped files
-*/
-async function deployStaticWebsite(client, workspaceId, name, distDir, showProgress = true) {
-	const { deploymentId } = await client.createDeployment({
-		workspaceId,
-		name
-	});
-	if (!deploymentId) throw new Error("createDeployment returned empty deploymentId");
-	const skippedFiles = await uploadDirectory(client, workspaceId, deploymentId, distDir, showProgress);
-	const { url } = await client.publishDeployment({
-		workspaceId,
-		deploymentId
-	});
-	if (!url) throw new Error("publishDeployment returned empty url");
-	return {
-		url,
-		skippedFiles
-	};
-}
-async function uploadDirectory(client, workspaceId, deploymentId, rootDir, showProgress) {
-	const files = await collectFiles(rootDir);
-	if (files.length === 0) {
-		logger.warn(`No files found under ${rootDir}`);
-		return [];
-	}
-	const limit = pLimit(5);
-	const total = files.length;
-	const progress = showProgress ? createProgress("Uploading files", total) : void 0;
-	const skippedFiles = [];
-	await Promise.all(files.map((relativePath) => limit(async () => {
-		await uploadSingleFile(client, workspaceId, deploymentId, rootDir, relativePath, skippedFiles);
-		if (progress) progress.update();
-	})));
-	if (progress) progress.finish();
-	return skippedFiles;
-}
-/**
-* Recursively collect all deployable files under the given directory.
-* @param rootDir - Root directory to scan
-* @param currentDir - Current relative directory (for recursion)
-* @returns List of file paths relative to rootDir
-*/
-async function collectFiles(rootDir, currentDir = "") {
-	const dirPath = path.join(rootDir, currentDir);
-	const entries = await fs.promises.readdir(dirPath, { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		const rel = path.join(currentDir, entry.name);
-		if (entry.isDirectory()) {
-			const sub = await collectFiles(rootDir, rel);
-			files.push(...sub);
-		} else if (entry.isFile() && !entry.isSymbolicLink() && !shouldIgnoreFile(rel)) files.push(rel);
-	}
-	return files;
-}
-async function uploadSingleFile(client, workspaceId, deploymentId, rootDir, filePath, skippedFiles) {
-	const absPath = path.join(rootDir, filePath);
-	const mime = lookup(filePath);
-	if (!mime) {
-		skippedFiles.push(`${filePath} (unsupported content type; no MIME mapping found)`);
-		return;
-	}
-	const contentType = mime;
-	const readStream = fs.createReadStream(absPath, { highWaterMark: CHUNK_SIZE });
-	async function* requestStream() {
-		yield { payload: {
-			case: "initialMetadata",
-			value: {
-				workspaceId,
-				deploymentId,
-				filePath,
-				contentType
-			}
-		} };
-		for await (const chunk of readStream) yield { payload: {
-			case: "chunkData",
-			value: chunk
-		} };
-	}
-	async function uploadWithLogging() {
-		try {
-			await client.uploadFile(requestStream());
-		} catch (error) {
-			if (error instanceof ConnectError && error.code === Code.InvalidArgument) {
-				skippedFiles.push(`${filePath} (server rejected file as invalid: ${error.message})`);
-				return;
-			}
-			throw error;
-		}
-	}
-	await withTimeout(uploadWithLogging(), 2 * 6e4, `Upload timed out for "${filePath}"`);
-}
-/**
-* Log skipped files after a deployment, including reasons for skipping.
-* @param skippedFiles - List of skipped file descriptions
-*/
-function logSkippedFiles(skippedFiles) {
-	if (skippedFiles.length === 0) return;
-	logger.warn("Deployment completed, but some files failed to upload. These files may have unsupported content types or other validation issues. Please review the list below:");
-	for (const file of skippedFiles) logger.log(`  - ${file}`);
-}
-const deployCommand = defineAppCommand({
-	name: "deploy",
-	description: "Deploy a static website from a local build directory.",
-	args: z.strictObject({
-		...workspaceArgs,
-		name: arg(z.string(), {
-			alias: "n",
-			description: "Static website name"
-		}),
-		dir: arg(z.string(), {
-			alias: "d",
-			description: "Path to the static website files",
-			completion: { type: "directory" }
-		})
-	}),
-	run: async (args) => {
-		await assertWritable({ profile: args.profile });
-		logger.info(`Deploying static website "${args.name}" from directory: ${args.dir}`);
-		const client = await initOperatorClient(await loadAccessToken({ profile: args.profile }));
-		const name = args.name;
-		const dir = path.resolve(process.cwd(), args.dir);
-		const workspaceId = await loadWorkspaceId({
-			workspaceId: args["workspace-id"],
-			profile: args.profile
-		});
-		if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) throw new Error(`Directory not found or not a directory: ${dir}`);
-		const { url, skippedFiles } = await withTimeout(deployStaticWebsite(client, workspaceId, name, dir, !args.json), 10 * 6e4, "Deployment timed out after 10 minutes.");
-		if (args.json) logger.out({
-			name,
-			workspaceId,
-			url,
-			skippedFiles
-		});
-		else {
-			logger.success(`Static website "${name}" deployed successfully. URL: ${url}`);
-			logSkippedFiles(skippedFiles);
-		}
-	}
-});
-
 //#endregion
 //#region src/cli/commands/staticwebsite/domain/status.ts
 const statusLabels = {
@@ -4896,7 +5394,7 @@ const staticwebsiteCommand = defineCommand({
 	name: "staticwebsite",
 	description: "Manage static websites in your workspace.",
 	subCommands: {
-		deploy: deployCommand,
+		deploy: deployCommand$1,
 		domain: domainCommand,
 		list: listCommand$2,
 		get: getCommand
@@ -4906,1201 +5404,6 @@ const staticwebsiteCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/tailordb/erd/local-schema.ts
-/**
-* Resolve TailorDB namespaces that need local type loading for ERD generation.
-* @param config - Loaded Tailor config.
-* @param options - Namespace selection options.
-* @returns Namespace names to load, or undefined to load all owned namespaces.
-*/
-function resolveLocalErdSchemaNamespaces(config, options) {
-	if (options.namespaces) return options.namespaces;
-	if (!options.requireErdSite) return;
-	return Object.entries(config.db ?? {}).flatMap(([namespace, dbConfig]) => "external" in dbConfig || !dbConfig.erdSite ? [] : [namespace]);
-}
-/**
-* Load local TailorDB namespaces exactly as SDK generation/deploy sees them.
-* @param options - Local schema loading options.
-* @returns Loaded TailorDB namespace data.
-*/
-async function loadLocalErdSchema(options) {
-	const { config, plugins } = await loadConfig(options.configPath);
-	await generateUserTypes({
-		config,
-		configPath: config.path
-	});
-	const application = defineApplication({
-		config,
-		pluginManager: plugins.length > 0 ? new PluginManager(plugins) : void 0
-	});
-	const namespaceNames = resolveLocalErdSchemaNamespaces(config, {
-		namespaces: options.namespaces,
-		requireErdSite: options.requireErdSite
-	});
-	const namespaceFilter = namespaceNames ? new Set(namespaceNames) : void 0;
-	const services = namespaceFilter ? application.tailorDBServices.filter((db) => namespaceFilter.has(db.namespace)) : application.tailorDBServices;
-	if (namespaceFilter && services.length !== namespaceFilter.size) {
-		const available = application.tailorDBServices.map((db) => db.namespace).join(", ");
-		const requested = [...namespaceFilter].join(", ");
-		throw new Error(`TailorDB namespace "${requested}" not found in local config.db.` + (available ? ` Available owned namespaces: ${available}` : ""));
-	}
-	const namespaces = [];
-	for (const db of services) {
-		await db.loadTypes();
-		await db.processNamespacePlugins();
-		namespaces.push({
-			namespace: db.namespace,
-			types: { ...db.types },
-			sourceInfo: new Map(Object.entries(db.typeSourceInfo)),
-			pluginAttachments: db.pluginAttachments
-		});
-	}
-	return {
-		config,
-		namespaces
-	};
-}
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/schema.ts
-const CLEAN_ROOM_NOTES = [
-	"Generated by a TailorDB-specific viewer implementation.",
-	"The implementation is based on TailorDB schema contracts, public Liam documentation, Liam CLI help, and black-box generated-output observation.",
-	"It does not copy Liam source code, generated JavaScript/CSS, parser internals, or layout internals."
-];
-function buildRevision(schema) {
-	return hashContent$1(JSON.stringify(schema)).slice(0, 16);
-}
-function toTypeSource(source) {
-	if (!source) return void 0;
-	if (isPluginGeneratedType(source)) return {
-		kind: "plugin",
-		exportName: source.exportName,
-		pluginId: source.pluginId,
-		pluginImportPath: source.pluginImportPath,
-		originalExportName: source.originalExportName,
-		generatedTypeKind: source.generatedTypeKind,
-		namespace: source.namespace
-	};
-	return {
-		kind: "user",
-		exportName: source.exportName
-	};
-}
-function toRelationships(relationships) {
-	return Object.entries(relationships).toSorted(([a], [b]) => a.localeCompare(b)).map(([name, relationship]) => ({
-		name,
-		targetType: relationship.targetType,
-		targetField: relationship.targetField,
-		sourceField: relationship.sourceField,
-		isArray: relationship.isArray,
-		...relationship.description && { description: relationship.description }
-	}));
-}
-function toIndexes(type) {
-	return Object.entries(type.indexes ?? {}).toSorted(([a], [b]) => a.localeCompare(b)).map(([name, index]) => ({
-		name,
-		fields: [...index.fields],
-		unique: index.unique === true
-	}));
-}
-function toColumnRelation(options) {
-	const { fieldConfig, parsedField } = options;
-	if (!fieldConfig.foreignKey || !fieldConfig.foreignKeyType) return;
-	const required = fieldConfig.required !== false;
-	const kind = parsedField?.relation || fieldConfig.rawRelation ? "relation" : "foreignKey";
-	return {
-		targetTable: fieldConfig.foreignKeyType,
-		targetColumn: fieldConfig.foreignKeyField || "id",
-		kind,
-		required,
-		...fieldConfig.rawRelation?.type && { relationType: fieldConfig.rawRelation.type },
-		...parsedField?.relation?.forwardName && { forwardName: parsedField.relation.forwardName },
-		...parsedField?.relation?.backwardName && { backwardName: parsedField.relation.backwardName }
-	};
-}
-function toColumn(options) {
-	const { fieldName, fieldConfig } = options;
-	const indexNames = options.indexEntries.filter(([, index]) => index.fields.includes(fieldName)).map(([name]) => name);
-	const uniqueIndexNames = options.indexEntries.filter(([, index]) => index.unique && index.fields.includes(fieldName)).map(([name]) => name);
-	const enumValues = fieldConfig.allowedValues?.map((value) => value.value) ?? [];
-	const enumValueDescriptions = Object.fromEntries((fieldConfig.allowedValues ?? []).flatMap((value) => value.description ? [[value.value, value.description]] : []));
-	const nestedFields = Object.entries(fieldConfig.fields ?? {}).map(([nestedName, nestedConfig]) => toColumn({
-		fieldName: nestedName,
-		fieldConfig: nestedConfig,
-		indexEntries: []
-	}));
-	const relation = toColumnRelation(options);
-	return {
-		name: fieldName,
-		type: fieldConfig.type || "string",
-		required: fieldConfig.required !== false,
-		array: fieldConfig.array === true,
-		...fieldConfig.description && { description: fieldConfig.description },
-		...fieldConfig.unique && { unique: true },
-		...(fieldConfig.index || indexNames.length > 0) && { index: true },
-		...indexNames.length > 0 && { indexNames },
-		...uniqueIndexNames.length > 0 && { uniqueIndexNames },
-		...enumValues.length > 0 && { enumValues },
-		...Object.keys(enumValueDescriptions).length > 0 && { enumValueDescriptions },
-		...fieldConfig.vector && { vector: true },
-		...fieldConfig.serial && { serial: { ...fieldConfig.serial } },
-		...fieldConfig.scale !== void 0 && { scale: fieldConfig.scale },
-		...fieldConfig.validate?.length && { validations: fieldConfig.validate.length },
-		...fieldConfig.hooks && { hooks: {
-			...fieldConfig.hooks.create && { create: true },
-			...fieldConfig.hooks.update && { update: true }
-		} },
-		...nestedFields.length > 0 && { fields: nestedFields },
-		...relation && { relation }
-	};
-}
-function toTable(type, source) {
-	const indexes = toIndexes(type);
-	const indexEntries = indexes.map((index) => [index.name, index]);
-	const fieldColumns = Object.entries(type.fields).filter(([fieldName]) => fieldName !== "id").map(([fieldName, field]) => toColumn({
-		fieldName,
-		fieldConfig: field.config,
-		parsedField: field,
-		indexEntries
-	}));
-	const typeSource = toTypeSource(source);
-	return {
-		name: type.name,
-		pluralForm: type.pluralForm,
-		...type.description && { description: type.description },
-		...typeSource && { source: typeSource },
-		columns: [{
-			name: "id",
-			type: "uuid",
-			required: true,
-			array: false,
-			primaryKey: true,
-			unique: true
-		}, ...fieldColumns],
-		indexes,
-		forwardRelationships: toRelationships(type.forwardRelationships),
-		backwardRelationships: toRelationships(type.backwardRelationships)
-	};
-}
-function toRelation(sourceTable, field) {
-	const relation = toColumnRelation({
-		fieldName: field.name,
-		fieldConfig: field.config,
-		parsedField: field,
-		indexEntries: []
-	});
-	if (!relation) return void 0;
-	return {
-		name: `${sourceTable}.${field.name}->${relation.targetTable}.${relation.targetColumn}`,
-		sourceTable,
-		sourceColumns: [field.name],
-		targetTable: relation.targetTable,
-		targetColumns: [relation.targetColumn],
-		required: relation.required,
-		unique: field.config.unique === true || field.relation?.unique === true,
-		kind: relation.kind,
-		...relation.relationType && { relationType: relation.relationType },
-		...relation.forwardName && { forwardName: relation.forwardName },
-		...relation.backwardName && { backwardName: relation.backwardName }
-	};
-}
-function buildRelations(types) {
-	const relations = [];
-	for (const type of Object.values(types)) for (const field of Object.values(type.fields)) {
-		const relation = toRelation(type.name, field);
-		if (relation) relations.push(relation);
-	}
-	return relations.toSorted((a, b) => a.name.localeCompare(b.name));
-}
-/**
-* Build the TailorDB ERD viewer schema for one namespace.
-* @param options - Schema build options.
-* @returns TailorDB ERD viewer schema.
-*/
-function buildTailorDbErdSchema(options) {
-	const { namespaceData } = options;
-	const tables = Object.values(namespaceData.types).toSorted((a, b) => a.name.localeCompare(b.name)).map((type) => toTable(type, namespaceData.sourceInfo.get(type.name)));
-	const schemaWithoutRevision = {
-		version: 1,
-		namespace: namespaceData.namespace,
-		source: options.source ?? "local",
-		cleanRoom: {
-			implementation: "tailor",
-			notes: CLEAN_ROOM_NOTES
-		},
-		tables,
-		relations: buildRelations(namespaceData.types)
-	};
-	return {
-		...schemaWithoutRevision,
-		generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		revision: buildRevision(schemaWithoutRevision)
-	};
-}
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/utils.ts
-/**
-* Initialize shared ERD command behavior.
-*/
-function initErdCommand() {
-	logBetaWarning("tailordb erd");
-}
-/**
-* Initialize platform context for ERD deployment.
-* @param args - CLI arguments.
-* @returns Initialized deploy context.
-*/
-async function initErdDeployContext(args) {
-	initErdCommand();
-	return {
-		client: await initOperatorClient(await loadAccessToken({ profile: args.profile })),
-		workspaceId: await loadWorkspaceId({
-			workspaceId: args.workspaceId,
-			profile: args.profile
-		})
-	};
-}
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/viewer.ts
-const VIEWER_ASSETS_DIR = "erd-viewer-assets";
-const STYLES_LINK = "<link rel=\"stylesheet\" href=\"./styles.css\" />";
-const APP_SCRIPT = "<script src=\"./app.js\" type=\"module\"><\/script>";
-function escapeHtml(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
-}
-function assetDirCandidates() {
-	const currentDir = path.dirname(fileURLToPath(import.meta.url));
-	return [
-		path.join(currentDir, "viewer-assets"),
-		path.join(currentDir, VIEWER_ASSETS_DIR),
-		path.join(currentDir, "commands", "tailordb", "erd", VIEWER_ASSETS_DIR),
-		path.resolve(process.cwd(), "packages/sdk/src/cli/commands/tailordb/erd/viewer-assets")
-	];
-}
-/**
-* Resolve the packaged ERD viewer asset directory.
-* @returns Absolute path to the viewer asset directory.
-*/
-function resolveViewerAssetsDir() {
-	for (const candidate of assetDirCandidates()) if (fs$1.existsSync(path.join(candidate, "index.html"))) return candidate;
-	throw new Error(`ERD viewer assets not found. Checked: ${assetDirCandidates().join(", ")}`);
-}
-/**
-* Build the self-contained ERD viewer HTML document. CSS, JS, and the schema
-* are inlined as separately extractable blocks: a `<style>` element, a
-* `<script type="module">`, and a `<script type="application/json"
-* id="erd-schema">` data block. This renders without any sibling asset files
-* and lets external tooling (including the ERD diff command) pull out the
-* schema via `JSON.parse`.
-* @param options - Viewer build options.
-* @returns The self-contained HTML document.
-*/
-function buildViewerHtml(options) {
-	const assetsDir = resolveViewerAssetsDir();
-	const html = fs$1.readFileSync(path.join(assetsDir, "index.html"), "utf8");
-	const css = fs$1.readFileSync(path.join(assetsDir, "styles.css"), "utf8");
-	const appJs = fs$1.readFileSync(path.join(assetsDir, "app.js"), "utf8");
-	if (!html.includes(STYLES_LINK) || !html.includes(APP_SCRIPT)) throw new Error("ERD viewer index.html is missing expected asset references for inlining.");
-	const embedScript = `<script type="application/json" id="erd-schema">${JSON.stringify(options.schema).replaceAll("<", "\\u003c")}<\/script>`;
-	const currentSchemaScript = options.currentSchema === void 0 ? "" : `\n    <script type="application/json" id="erd-current-schema">${JSON.stringify(options.currentSchema).replaceAll("<", "\\u003c")}<\/script>`;
-	const diffScript = options.diff === void 0 ? "" : `\n    <script type="application/json" id="erd-diff">${JSON.stringify(options.diff).replaceAll("<", "\\u003c")}<\/script>`;
-	const inlineScript = `<script type="module">\n${appJs.replace(/<\/script/gi, "<\\/script")}\n<\/script>`;
-	return html.replace("<title>TailorDB ERD</title>", () => `<title>${escapeHtml(options.title ?? "TailorDB ERD")}</title>`).replace(STYLES_LINK, () => `<style>\n${css}\n</style>`).replace(APP_SCRIPT, () => `${embedScript}${currentSchemaScript}${diffScript}\n    ${inlineScript}`);
-}
-/**
-* Write the self-contained TailorDB ERD viewer to `<distDir>/index.html`.
-* @param options - Viewer dist write options.
-*/
-function writeViewerDist(options) {
-	fs$1.rmSync(options.distDir, {
-		recursive: true,
-		force: true
-	});
-	fs$1.mkdirSync(options.distDir, { recursive: true });
-	fs$1.writeFileSync(path.join(options.distDir, "index.html"), buildViewerHtml({ schema: options.schema }), "utf8");
-}
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/export.ts
-const DEFAULT_ERD_BASE_DIR$1 = ".tailor/erd";
-function getErdSite(context, namespace) {
-	const dbConfig = context.config.db?.[namespace];
-	if (!dbConfig || "external" in dbConfig) return;
-	return dbConfig.erdSite;
-}
-function resolveExplicitTarget(options) {
-	const namespaceData = options.context.namespaces.find((candidate) => candidate.namespace === options.namespace);
-	if (!namespaceData) {
-		const available = options.context.namespaces.map((candidate) => candidate.namespace).join(", ");
-		throw new Error(`TailorDB namespace "${options.namespace}" not found in local config.db.` + (available ? ` Available owned namespaces: ${available}` : ""));
-	}
-	const erdSite = getErdSite(options.context, namespaceData.namespace);
-	if (options.requireErdSite && !erdSite) throw new Error(`No erdSite configured for namespace "${namespaceData.namespace}". Add erdSite: "<static-website-name>" to db.${namespaceData.namespace} in tailor.config.ts.`);
-	return toTarget(options.outputDir, namespaceData, erdSite);
-}
-function resolveAllTargets(options) {
-	const namespaces = options.context.namespaces.filter((namespaceData) => !options.requireErdSite || getErdSite(options.context, namespaceData.namespace));
-	if (namespaces.length === 0) throw new Error(options.requireErdSite ? "No namespaces with erdSite configured found. Add erdSite: \"<static-website-name>\" to db.<namespace> in tailor.config.ts." : "No TailorDB namespaces found in config. Please define db services in tailor.config.ts.");
-	logger.info(`Found ${namespaces.length} namespace(s)${options.requireErdSite ? " with erdSite configured" : ""}.`);
-	return namespaces.map((namespaceData) => toTarget(options.outputDir, namespaceData, getErdSite(options.context, namespaceData.namespace)));
-}
-function toTarget(outputDir, namespaceData, erdSite) {
-	return {
-		namespaceData,
-		erdSite,
-		distDir: path.join(outputDir, namespaceData.namespace, "dist")
-	};
-}
-function resolveTargets(options) {
-	if (options.namespace) return [resolveExplicitTarget(options)];
-	return resolveAllTargets(options);
-}
-function prepareErdBuild(target) {
-	writeViewerDist({
-		schema: buildTailorDbErdSchema({ namespaceData: target.namespaceData }),
-		distDir: target.distDir
-	});
-	const relativePath = path.relative(process.cwd(), target.distDir);
-	logger.success(`Built ERD to ${relativePath}`);
-	return {
-		namespace: target.namespaceData.namespace,
-		erdSite: target.erdSite,
-		distDir: target.distDir
-	};
-}
-/**
-* Prepare TailorDB ERD static viewer builds for one or more namespaces.
-* @param options - Build options.
-* @returns Build results by namespace.
-*/
-async function prepareErdBuilds(options) {
-	return prepareErdBuildsFromContext({
-		context: await loadLocalErdSchema({
-			configPath: options.configPath,
-			namespaces: options.namespace ? [options.namespace] : void 0,
-			requireErdSite: options.requireErdSite
-		}),
-		namespace: options.namespace,
-		outputDir: options.outputDir,
-		requireErdSite: options.requireErdSite
-	});
-}
-/**
-* Prepare TailorDB ERD static viewer builds from an already loaded schema context.
-* @param options - Build options.
-* @returns Build results by namespace.
-*/
-function prepareErdBuildsFromContext(options) {
-	const outputDir = path.resolve(process.cwd(), options.outputDir ?? DEFAULT_ERD_BASE_DIR$1);
-	return resolveTargets({
-		context: options.context,
-		namespace: options.namespace,
-		outputDir,
-		requireErdSite: options.requireErdSite
-	}).map((target) => prepareErdBuild(target));
-}
-const erdExportCommand = defineAppCommand({
-	name: "export",
-	description: "Export TailorDB ERD static viewer from local TailorDB schema.",
-	args: z.strictObject({
-		...configArg,
-		namespace: arg(z.string().optional(), {
-			alias: "n",
-			description: "TailorDB namespace name (optional if only one namespace is defined in config)"
-		}),
-		output: arg(z.string().default(DEFAULT_ERD_BASE_DIR$1), {
-			alias: "o",
-			description: "Output directory path for TailorDB ERD viewer files (writes to `<outputDir>/<namespace>/dist`)",
-			completion: { type: "directory" }
-		})
-	}),
-	run: async (args) => {
-		initErdCommand();
-		const results = await prepareErdBuilds({
-			configPath: args.config,
-			namespace: args.namespace,
-			outputDir: args.output
-		});
-		logger.newline();
-		if (args.json) logger.out(results.map((result) => ({
-			namespace: result.namespace,
-			distDir: result.distDir
-		})));
-		else for (const result of results) {
-			logger.out(`Exported ERD for namespace "${result.namespace}"`);
-			logger.out(`  - ERD viewer: ${path.join(result.distDir, "index.html")}`);
-		}
-	}
-});
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/deploy.ts
-const erdDeployCommand = defineAppCommand({
-	name: "deploy",
-	description: "Deploy ERD static website for TailorDB namespace(s).",
-	args: z.strictObject({
-		...deploymentArgs,
-		namespace: arg(z.string().optional(), {
-			alias: "n",
-			description: "TailorDB namespace name (optional - deploys all namespaces with erdSite if omitted)"
-		})
-	}),
-	run: async (args) => {
-		await assertWritable({ profile: args.profile });
-		const { client, workspaceId } = await initErdDeployContext(args);
-		const buildResults = await prepareErdBuilds({
-			configPath: args.config,
-			namespace: args.namespace,
-			requireErdSite: true
-		});
-		const deployResults = await Promise.all(buildResults.map(async (result) => {
-			if (!result.erdSite) throw new Error(`No erdSite configured for namespace "${result.namespace}". Add erdSite: "<static-website-name>" to db.${result.namespace} in tailor.config.ts.`);
-			if (!args.json) logger.info(`Deploying ERD for namespace "${result.namespace}" to site "${result.erdSite}"...`);
-			const { url, skippedFiles } = await deployStaticWebsite(client, workspaceId, result.erdSite, result.distDir, !args.json);
-			return {
-				namespace: result.namespace,
-				erdSite: result.erdSite,
-				url,
-				skippedFiles
-			};
-		}));
-		logger.newline();
-		if (args.json) logger.out(deployResults);
-		else for (const result of deployResults) {
-			logSkippedFiles(result.skippedFiles);
-			logger.newline();
-			logger.success(`ERD site "${result.erdSite}" deployed successfully.`);
-			logger.out(result.url);
-		}
-	}
-});
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/diff.ts
-const SCHEMA_BLOCK_PATTERN = /<script type="application\/json" id="erd-schema">([\s\S]*?)<\/script>/;
-function stableValue(value) {
-	if (Array.isArray(value)) return value.map((item) => stableValue(item));
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, stableValue(item)]));
-	return value;
-}
-function stableJson(value) {
-	return JSON.stringify(stableValue(value));
-}
-function changedFields(base, head) {
-	return [.../* @__PURE__ */ new Set([...Object.keys(base), ...Object.keys(head)])].toSorted((a, b) => a.localeCompare(b)).filter((key) => stableJson(base[key]) !== stableJson(head[key]));
-}
-function detailForChangedFields(fields) {
-	return `Changed fields: ${fields.join(", ")}`;
-}
-function mapByName(items) {
-	return new Map(items.map((item) => [item.name, item]));
-}
-function compareCommonNamed(baseItems, headItems, addChange) {
-	const baseByName = mapByName(baseItems);
-	const headByName = mapByName(headItems);
-	const commonNames = [...baseByName.keys()].filter((name) => headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
-	for (const name of commonNames) {
-		const base = baseByName.get(name);
-		const head = headByName.get(name);
-		if (!base || !head) continue;
-		const fields = changedFields(base, head);
-		if (fields.length > 0) addChange(name, fields);
-	}
-}
-function removedNames(baseItems, headItems) {
-	const headByName = mapByName(headItems);
-	return baseItems.map((item) => item.name).filter((name) => !headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
-}
-function addedNames(baseItems, headItems) {
-	const baseByName = mapByName(baseItems);
-	return headItems.map((item) => item.name).filter((name) => !baseByName.has(name)).toSorted((a, b) => a.localeCompare(b));
-}
-function tableMetadata(table) {
-	return {
-		backwardRelationships: table.backwardRelationships,
-		description: table.description,
-		forwardRelationships: table.forwardRelationships,
-		pluralForm: table.pluralForm,
-		source: table.source
-	};
-}
-function pushChange(changes, change) {
-	changes.push(change);
-}
-function diffColumns(changes, tableName, baseColumns, headColumns) {
-	compareCommonNamed(baseColumns, headColumns, (name, fields) => {
-		pushChange(changes, {
-			action: "changed",
-			entity: "column",
-			path: `${tableName}.${name}`,
-			detail: detailForChangedFields(fields)
-		});
-	});
-	for (const name of removedNames(baseColumns, headColumns)) pushChange(changes, {
-		action: "removed",
-		entity: "column",
-		path: `${tableName}.${name}`,
-		detail: "Column removed"
-	});
-	for (const name of addedNames(baseColumns, headColumns)) pushChange(changes, {
-		action: "added",
-		entity: "column",
-		path: `${tableName}.${name}`,
-		detail: "Column added"
-	});
-}
-function diffIndexes(changes, tableName, baseIndexes, headIndexes) {
-	compareCommonNamed(baseIndexes, headIndexes, (name, fields) => {
-		pushChange(changes, {
-			action: "changed",
-			entity: "index",
-			path: `${tableName}.${name}`,
-			detail: detailForChangedFields(fields)
-		});
-	});
-	for (const name of removedNames(baseIndexes, headIndexes)) pushChange(changes, {
-		action: "removed",
-		entity: "index",
-		path: `${tableName}.${name}`,
-		detail: "Index removed"
-	});
-	for (const name of addedNames(baseIndexes, headIndexes)) pushChange(changes, {
-		action: "added",
-		entity: "index",
-		path: `${tableName}.${name}`,
-		detail: "Index added"
-	});
-}
-function diffTables(changes, baseTables, headTables) {
-	const baseByName = mapByName(baseTables);
-	const headByName = mapByName(headTables);
-	for (const name of removedNames(baseTables, headTables)) pushChange(changes, {
-		action: "removed",
-		entity: "table",
-		path: name,
-		detail: "Table removed"
-	});
-	for (const name of addedNames(baseTables, headTables)) pushChange(changes, {
-		action: "added",
-		entity: "table",
-		path: name,
-		detail: "Table added"
-	});
-	const commonNames = [...baseByName.keys()].filter((name) => headByName.has(name)).toSorted((a, b) => a.localeCompare(b));
-	for (const name of commonNames) {
-		const base = baseByName.get(name);
-		const head = headByName.get(name);
-		if (!base || !head) continue;
-		const tableFields = changedFields(tableMetadata(base), tableMetadata(head));
-		if (tableFields.length > 0) pushChange(changes, {
-			action: "changed",
-			entity: "table",
-			path: name,
-			detail: detailForChangedFields(tableFields)
-		});
-		diffColumns(changes, name, base.columns, head.columns);
-		diffIndexes(changes, name, base.indexes, head.indexes);
-	}
-}
-function diffRelations(changes, baseRelations, headRelations) {
-	compareCommonNamed(baseRelations, headRelations, (name, fields) => {
-		pushChange(changes, {
-			action: "changed",
-			entity: "relation",
-			path: name,
-			detail: detailForChangedFields(fields)
-		});
-	});
-	for (const name of removedNames(baseRelations, headRelations)) pushChange(changes, {
-		action: "removed",
-		entity: "relation",
-		path: name,
-		detail: "Relation removed"
-	});
-	for (const name of addedNames(baseRelations, headRelations)) pushChange(changes, {
-		action: "added",
-		entity: "relation",
-		path: name,
-		detail: "Relation added"
-	});
-}
-function summarize(changes) {
-	return {
-		added: changes.filter((change) => change.action === "added").length,
-		changed: changes.filter((change) => change.action === "changed").length,
-		removed: changes.filter((change) => change.action === "removed").length
-	};
-}
-function extractEmbeddedErdSchema(html) {
-	const match = SCHEMA_BLOCK_PATTERN.exec(html);
-	if (!match?.[1]) throw new Error("ERD schema block not found.");
-	try {
-		return JSON.parse(match[1]);
-	} catch (error) {
-		throw new Error(`Failed to parse ERD schema block: ${String(error)}`, { cause: error });
-	}
-}
-function createEmptyErdSchema(options) {
-	return {
-		version: 1,
-		namespace: options.namespace,
-		generatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-		revision: options.revision,
-		source: "local",
-		cleanRoom: {
-			implementation: "tailor",
-			notes: ["Synthetic empty schema used for ERD diff generation."]
-		},
-		tables: [],
-		relations: []
-	};
-}
-function buildErdSchemaDiff(options) {
-	const { base, head } = options;
-	if (base.namespace !== head.namespace) throw new Error(`Cannot diff ERD schemas from different namespaces: ${base.namespace}, ${head.namespace}`);
-	const changes = [];
-	diffTables(changes, base.tables, head.tables);
-	diffRelations(changes, base.relations, head.relations);
-	const summary = summarize(changes);
-	return {
-		namespace: head.namespace,
-		baseRevision: base.revision,
-		headRevision: head.revision,
-		changed: changes.length > 0,
-		summary,
-		changes
-	};
-}
-function mergeNamedByHead(baseItems, headItems) {
-	const headByName = mapByName(headItems);
-	const removedItems = baseItems.filter((item) => !headByName.has(item.name)).toSorted((a, b) => a.name.localeCompare(b.name));
-	return [...headItems, ...removedItems];
-}
-function mergeDiffViewerTable(baseTable, headTable) {
-	return {
-		...headTable,
-		columns: mergeNamedByHead(baseTable.columns, headTable.columns),
-		indexes: mergeNamedByHead(baseTable.indexes, headTable.indexes)
-	};
-}
-function mergeDiffViewerTables(baseTables, headTables) {
-	const baseByName = mapByName(baseTables);
-	const headByName = mapByName(headTables);
-	const merged = headTables.map((headTable) => {
-		const baseTable = baseByName.get(headTable.name);
-		return baseTable ? mergeDiffViewerTable(baseTable, headTable) : headTable;
-	});
-	const removedTables = baseTables.filter((table) => !headByName.has(table.name)).toSorted((a, b) => a.name.localeCompare(b.name));
-	return [...merged, ...removedTables];
-}
-/**
-* Build the schema rendered by the diff viewer. The ordinary ERD viewer only
-* knows how to draw objects present in its schema, so the diff schema keeps
-* base-only tables, columns, indexes, and relations visible for removal
-* highlighting while preferring head-side metadata for unchanged objects.
-* @param options - Base and head schemas to merge for diff rendering.
-* @returns A TailorDB ERD schema suitable for the visual diff viewer.
-*/
-function buildErdDiffViewerSchema(options) {
-	const { base, head } = options;
-	if (base.namespace !== head.namespace) throw new Error(`Cannot diff ERD schemas from different namespaces: ${base.namespace}, ${head.namespace}`);
-	return {
-		...head,
-		tables: mergeDiffViewerTables(base.tables, head.tables),
-		relations: mergeNamedByHead(base.relations, head.relations)
-	};
-}
-function renderErdDiffHtml(options) {
-	return buildViewerHtml({
-		schema: options.schema,
-		currentSchema: options.currentSchema,
-		diff: options.diff,
-		title: `TailorDB ERD diff - ${options.diff.namespace}`
-	});
-}
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/diff-command.ts
-function readSchema(filePath) {
-	if (!filePath) return void 0;
-	return extractEmbeddedErdSchema(fs$1.readFileSync(filePath, "utf8"));
-}
-function resolveNamespace(options) {
-	const namespace = options.namespace ?? options.head?.namespace ?? options.base?.namespace;
-	if (!namespace) throw new Error("Missing --namespace when one side of the ERD diff is omitted.");
-	if (options.base && options.base.namespace !== namespace) throw new Error(`Base ERD namespace "${options.base.namespace}" does not match "${namespace}".`);
-	if (options.head && options.head.namespace !== namespace) throw new Error(`Head ERD namespace "${options.head.namespace}" does not match "${namespace}".`);
-	return namespace;
-}
-function writeFile(filePath, content) {
-	fs$1.mkdirSync(path.dirname(filePath), { recursive: true });
-	fs$1.writeFileSync(filePath, content, "utf8");
-}
-function writeErdDiff(options) {
-	const base = readSchema(options.baseHtml);
-	const head = readSchema(options.headHtml);
-	if (!base && !head) throw new Error("At least one of --base-html or --head-html is required.");
-	const namespace = resolveNamespace({
-		namespace: options.namespace,
-		base,
-		head
-	});
-	const baseSchema = base ?? createEmptyErdSchema({
-		namespace,
-		revision: "missing-base"
-	});
-	const headSchema = head ?? createEmptyErdSchema({
-		namespace,
-		revision: "missing-head"
-	});
-	const diff = buildErdSchemaDiff({
-		base: baseSchema,
-		head: headSchema
-	});
-	const viewerSchema = buildErdDiffViewerSchema({
-		base: baseSchema,
-		head: headSchema
-	});
-	writeFile(options.outputHtml, renderErdDiffHtml({
-		schema: viewerSchema,
-		currentSchema: headSchema,
-		diff
-	}));
-	if (options.outputJson) writeFile(options.outputJson, `${JSON.stringify(diff, null, 2)}\n`);
-	return {
-		namespace,
-		outputHtml: options.outputHtml,
-		outputJson: options.outputJson,
-		diff
-	};
-}
-const erdDiffCommand = defineAppCommand({
-	name: "diff",
-	description: "Render TailorDB ERD schema diff HTML from exported ERD viewers.",
-	args: z.strictObject({
-		"base-html": arg(z.string().optional(), {
-			description: "Base ERD viewer HTML file",
-			completion: {
-				type: "file",
-				matcher: [".html"]
-			}
-		}),
-		"head-html": arg(z.string().optional(), {
-			description: "Head ERD viewer HTML file",
-			completion: {
-				type: "file",
-				matcher: [".html"]
-			}
-		}),
-		namespace: arg(z.string().optional(), {
-			alias: "n",
-			description: "TailorDB namespace name (defaults to the provided ERD schema namespace)"
-		}),
-		output: arg(z.string().min(1), {
-			alias: "o",
-			description: "Output ERD diff HTML file",
-			completion: {
-				type: "file",
-				matcher: [".html"]
-			}
-		}),
-		"output-json": arg(z.string().optional(), {
-			description: "Optional output JSON file for the computed diff",
-			completion: {
-				type: "file",
-				matcher: [".json"]
-			}
-		})
-	}),
-	run: (args) => {
-		initErdCommand();
-		const result = writeErdDiff({
-			baseHtml: args["base-html"],
-			headHtml: args["head-html"],
-			namespace: args.namespace,
-			outputHtml: args.output,
-			outputJson: args["output-json"]
-		});
-		if (args.json) logger.out({
-			namespace: result.namespace,
-			outputHtml: result.outputHtml,
-			outputJson: result.outputJson,
-			summary: result.diff.summary
-		});
-		else logger.success(`Wrote ERD diff to ${path.relative(process.cwd(), result.outputHtml)}`);
-	}
-});
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/serve.ts
-const DEFAULT_ERD_BASE_DIR = ".tailor/erd";
-const LOCAL_HOST = "127.0.0.1";
-const GLOB_CHARS = /[*?[\]{}()!+@]/;
-function formatServeCommand(namespace) {
-	return `tailor tailordb erd serve --namespace ${namespace}`;
-}
-function getCacheControl(filePath) {
-	return filePath.endsWith(".html") || filePath.endsWith(".json") ? "no-cache" : "public, max-age=3600";
-}
-function resolveRequestPath(distDir, requestUrl) {
-	const url = new URL(requestUrl ?? "/", "http://localhost");
-	let pathname;
-	try {
-		pathname = decodeURIComponent(url.pathname);
-	} catch {
-		return;
-	}
-	if (pathname === "/" || pathname.endsWith("/")) pathname = path.join(pathname, "index.html");
-	const root = path.resolve(distDir);
-	const filePath = path.resolve(root, `.${pathname}`);
-	if (filePath !== root && !filePath.startsWith(`${root}${path.sep}`)) return;
-	return filePath;
-}
-function openStaticFile(filePath) {
-	let fd;
-	try {
-		fd = fs$1.openSync(filePath, "r");
-		if (!fs$1.fstatSync(fd).isFile()) {
-			fs$1.closeSync(fd);
-			return;
-		}
-		return {
-			filePath,
-			fd
-		};
-	} catch {
-		if (fd !== void 0) fs$1.closeSync(fd);
-		return;
-	}
-}
-function serveFile(distDir, req, res) {
-	const filePath = resolveRequestPath(distDir, req.url);
-	if (!filePath) {
-		res.writeHead(403);
-		res.end("Forbidden");
-		return;
-	}
-	const fallbackPath = path.join(distDir, "index.html");
-	const target = openStaticFile(filePath) ?? openStaticFile(fallbackPath);
-	if (!target) {
-		res.writeHead(503, {
-			"Content-Type": "text/plain; charset=utf-8",
-			"Cache-Control": "no-cache",
-			"Retry-After": "1"
-		});
-		res.end("ERD build is refreshing. Please retry.");
-		return;
-	}
-	const mimeType = lookup(target.filePath) || "application/octet-stream";
-	const stream = fs$1.createReadStream(target.filePath, {
-		fd: target.fd,
-		autoClose: true
-	});
-	stream.on("error", () => {
-		if (!res.headersSent) {
-			res.writeHead(503, {
-				"Content-Type": "text/plain; charset=utf-8",
-				"Cache-Control": "no-cache",
-				"Retry-After": "1"
-			});
-			res.end("ERD build is refreshing. Please retry.");
-			return;
-		}
-		res.destroy();
-	});
-	res.writeHead(200, {
-		"Content-Type": mimeType,
-		"Cache-Control": getCacheControl(target.filePath)
-	});
-	stream.pipe(res);
-}
-async function startStaticServer(options) {
-	const server = http.createServer((req, res) => {
-		serveFile(options.distDir, req, res);
-	});
-	return await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(options.port, LOCAL_HOST, () => {
-			server.off("error", reject);
-			const address = server.address();
-			if (!address || typeof address === "string") {
-				reject(/* @__PURE__ */ new Error("Failed to determine ERD server address."));
-				return;
-			}
-			resolve({
-				server,
-				url: `http://${LOCAL_HOST}:${address.port}`
-			});
-		});
-	});
-}
-function getWatchPatterns(config, results) {
-	const namespaces = new Set(results.map((result) => result.namespace));
-	const patterns = [config.path];
-	for (const namespace of namespaces) {
-		const dbConfig = config.db?.[namespace];
-		if (dbConfig && !("external" in dbConfig)) patterns.push(...dbConfig.files);
-	}
-	return [...new Set(patterns)];
-}
-function hasGlobPattern(pattern) {
-	return GLOB_CHARS.test(pattern);
-}
-function globBaseDir(pattern) {
-	const absolutePattern = path.resolve(pattern);
-	const parsed = path.parse(absolutePattern);
-	const relativePattern = absolutePattern.slice(parsed.root.length);
-	const literalParts = [];
-	for (const part of relativePattern.split(path.sep)) {
-		if (!part || GLOB_CHARS.test(part)) break;
-		literalParts.push(part);
-	}
-	const literalPath = literalParts.length > 0 ? path.join(parsed.root, ...literalParts) : parsed.root;
-	if (!literalPath || literalPath === parsed.root) return parsed.root || process.cwd();
-	if (!fs$1.existsSync(literalPath)) return path.dirname(literalPath);
-	return fs$1.statSync(literalPath).isDirectory() ? literalPath : path.dirname(literalPath);
-}
-async function expandWatchPattern(pattern) {
-	if (!hasGlobPattern(pattern)) return [path.resolve(pattern)];
-	const paths = /* @__PURE__ */ new Set();
-	for await (const file of glob(pattern)) paths.add(path.resolve(file));
-	const baseDir = globBaseDir(pattern);
-	if (fs$1.existsSync(baseDir) && fs$1.statSync(baseDir).isDirectory()) paths.add(baseDir);
-	return [...paths];
-}
-async function resolveWatchPathsFromConfig(config, results) {
-	const paths = /* @__PURE__ */ new Set();
-	for (const pattern of getWatchPatterns(config, results)) for (const watchPath of await expandWatchPattern(pattern)) paths.add(watchPath);
-	return [...paths];
-}
-async function resolveWatchPaths(context, results) {
-	return await resolveWatchPathsFromConfig(context.config, results);
-}
-function parseFreshErdExportResults(stdout) {
-	const lines = stdout.trim().split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-	for (const line of lines.toReversed()) try {
-		const parsed = JSON.parse(line);
-		if (!Array.isArray(parsed)) continue;
-		return parsed.map((entry) => {
-			const result = entry;
-			if (typeof result.namespace !== "string" || typeof result.distDir !== "string") throw new Error("Invalid ERD export JSON output.");
-			return {
-				namespace: result.namespace,
-				distDir: result.distDir
-			};
-		});
-	} catch {
-		continue;
-	}
-	throw new Error("Failed to parse ERD export JSON output.");
-}
-function freshErdExportArgs(options) {
-	const cliEntry = process.argv[1];
-	if (!cliEntry) throw new Error("Cannot rebuild ERD schema in a fresh process: CLI entrypoint is unavailable.");
-	const args = [
-		cliEntry,
-		"tailordb",
-		"erd",
-		"export",
-		"--output",
-		options.outputDir,
-		"--json"
-	];
-	if (options.configPath) args.push("--config", options.configPath);
-	if (options.namespace) args.push("--namespace", options.namespace);
-	return args;
-}
-async function runFreshErdExport(options) {
-	return await new Promise((resolve, reject) => {
-		const child = spawn(process.execPath, freshErdExportArgs(options), {
-			cwd: process.cwd(),
-			env: process.env,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.setEncoding("utf8");
-		child.stderr.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			stdout += chunk;
-		});
-		child.stderr.on("data", (chunk) => {
-			stderr += chunk;
-		});
-		child.on("error", reject);
-		child.on("close", (code, signal) => {
-			if (code !== 0) {
-				const detail = stderr.trim() || signal || `exit code ${code}`;
-				reject(/* @__PURE__ */ new Error(`Fresh ERD export failed: ${detail}`));
-				return;
-			}
-			try {
-				resolve(parseFreshErdExportResults(stdout));
-			} catch (error) {
-				reject(error);
-			}
-		});
-	});
-}
-function selectPrimaryResult(results) {
-	const [primary, ...rest] = results;
-	if (!primary) throw new Error("No ERD build results found.");
-	logger.info(`Serving ERD for namespace "${primary.namespace}".`);
-	if (rest.length > 0) {
-		const commands = rest.map((result) => `  - ${formatServeCommand(result.namespace)}`).join("\n");
-		logger.warn(`Multiple namespaces found. To serve another namespace, run:\n${commands}`);
-	}
-	return primary;
-}
-async function createErdWatcher(options) {
-	let rebuilding = false;
-	let pending = false;
-	let watchPaths = await resolveWatchPaths(options.initialContext, options.initialResults);
-	let importNonce = 0;
-	const watcher = watch(watchPaths, {
-		ignored: /node_modules/,
-		ignoreInitial: true,
-		awaitWriteFinish: {
-			stabilityThreshold: 100,
-			pollInterval: 100
-		}
-	});
-	async function rebuild() {
-		if (rebuilding) {
-			pending = true;
-			return;
-		}
-		rebuilding = true;
-		try {
-			const results = await runFreshErdExport({
-				configPath: options.configPath,
-				namespace: options.namespace,
-				outputDir: options.outputDir
-			});
-			const { config } = await loadConfig(options.configPath, { importNonce: String(importNonce += 1) });
-			const nextWatchPaths = await resolveWatchPathsFromConfig(config, results);
-			watcher.unwatch(watchPaths);
-			watcher.add(nextWatchPaths);
-			watchPaths = nextWatchPaths;
-			logger.success(`Rebuilt ERD schema (${results.map((result) => result.namespace).join(", ")})`, { mode: "stream" });
-		} catch (error) {
-			logger.error("Failed to rebuild ERD schema. Serving the last successful build.", { mode: "stream" });
-			logger.error(String(error));
-		} finally {
-			rebuilding = false;
-			if (pending) {
-				pending = false;
-				await rebuild();
-			}
-		}
-	}
-	let debounceTimer;
-	const scheduleRebuild = (changedPath) => {
-		logger.info(`Schema source changed: ${path.relative(process.cwd(), changedPath)}`, { mode: "stream" });
-		if (debounceTimer) clearTimeout(debounceTimer);
-		debounceTimer = setTimeout(() => {
-			rebuild();
-		}, 150);
-	};
-	watcher.on("add", scheduleRebuild);
-	watcher.on("change", scheduleRebuild);
-	watcher.on("unlink", scheduleRebuild);
-	watcher.on("error", (error) => {
-		logger.error(`ERD watcher error: ${String(error)}`, { mode: "stream" });
-	});
-	return watcher;
-}
-async function waitForShutdown(server, watcher) {
-	return await new Promise((resolve) => {
-		const shutdown = () => {
-			watcher.close().finally(() => {
-				server.close(() => {
-					logger.info("ERD server stopped.");
-					resolve();
-				});
-			});
-		};
-		process.once("SIGINT", shutdown);
-		process.once("SIGTERM", shutdown);
-	});
-}
-const erdServeCommand = defineAppCommand({
-	name: "serve",
-	description: "Generate and serve TailorDB ERD locally with watch reload. (beta)",
-	args: z.strictObject({
-		...configArg,
-		namespace: arg(z.string().optional(), {
-			alias: "n",
-			description: "TailorDB namespace name (uses first namespace in config if not specified)"
-		}),
-		port: arg(z.coerce.number().int().min(0).max(65535).default(0), { description: "Local server port (0 selects a free port)" }),
-		open: arg(z.boolean().default(false), { description: "Open the ERD viewer in the default browser" })
-	}),
-	run: async (args) => {
-		initErdCommand();
-		const outputDir = path.resolve(process.cwd(), DEFAULT_ERD_BASE_DIR);
-		const context = await loadLocalErdSchema({
-			configPath: args.config,
-			namespaces: args.namespace ? [args.namespace] : void 0
-		});
-		const results = prepareErdBuildsFromContext({
-			context,
-			namespace: args.namespace,
-			outputDir
-		});
-		const primary = selectPrimaryResult(results);
-		const { server, url } = await startStaticServer({
-			distDir: primary.distDir,
-			port: args.port
-		});
-		const watchUrl = `${url}/?watch=1`;
-		const watcher = await createErdWatcher({
-			configPath: args.config,
-			namespace: args.namespace,
-			outputDir,
-			initialContext: context,
-			initialResults: results
-		});
-		logger.newline();
-		if (args.json) logger.out({
-			namespace: primary.namespace,
-			url: watchUrl,
-			distDir: primary.distDir
-		});
-		else {
-			logger.success("ERD server started.");
-			logger.out(watchUrl);
-		}
-		if (args.open) try {
-			await open(watchUrl);
-		} catch {
-			logger.warn("Failed to open browser automatically. Please open the URL above manually.");
-		}
-		await waitForShutdown(server, watcher);
-	}
-});
-
-//#endregion
-//#region src/cli/commands/tailordb/erd/index.ts
-const erdCommand = defineCommand({
-	name: "erd",
-	description: "Generate TailorDB ERD viewer artifacts from local TailorDB schema. (beta)",
-	subCommands: {
-		export: erdExportCommand,
-		diff: erdDiffCommand,
-		serve: erdServeCommand,
-		deploy: erdDeployCommand
-	}
-});
-
 //#endregion
 //#region src/cli/commands/tailordb/migrate/script.ts
 /**
@@ -6125,9 +5428,9 @@ async function script(options) {
 	const targetNamespace = resolveTargetNamespace(namespacesWithMigrations, options.namespace);
 	const { migrationsDir } = assertDefined(namespacesWithMigrations.find((ns) => ns.namespace === targetNamespace), "namespace with migrations not found");
 	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
-	if (!fs$1.existsSync(diffPath)) throw new Error(`Migration ${options.number} not found in ${migrationsDir}. Expected ${diffPath}.`);
+	if (!fs.existsSync(diffPath)) throw new Error(`Migration ${options.number} not found in ${migrationsDir}. Expected ${diffPath}.`);
 	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
-	if (fs$1.existsSync(migratePath)) throw new Error(`Migration script already exists at ${migratePath}.`);
+	if (fs.existsSync(migratePath)) throw new Error(`Migration script already exists at ${migratePath}.`);
 	const diff = loadDiff(diffPath);
 	const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir, migrationNumber - 1);
 	if (!previousSnapshot) throw new Error(`Could not reconstruct previous schema for migration ${options.number}. Make sure migration ${0} exists.`);
@@ -6312,7 +5615,7 @@ async function collectMigrationStatuses(options) {
 		const pendingMigrations = getMigrationFiles(migrationsDir).map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => {
 			const diffPath = getMigrationFilePath(migrationsDir, num, "diff");
 			let description;
-			if (fs$1.existsSync(diffPath)) try {
+			if (fs.existsSync(diffPath)) try {
 				description = loadDiff(diffPath).description;
 			} catch {}
 			return {
@@ -6427,7 +5730,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BO4ZF8wP.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BV-AXawv.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6439,7 +5742,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-CkIwEctX.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-nU6ITOHL.mjs")).createExecutorService({ config: { files: [] } }) : void 0);
 	await executorService?.loadExecutors();
 	if (pluginExecutorFiles.length > 0) await executorService?.loadPluginExecutorFiles([...pluginExecutorFiles]);
 	const executorUsedTypes = /* @__PURE__ */ new Set();
@@ -6684,10 +5987,10 @@ const migrationCommand = defineCommand({
 const tailordbCommand = defineCommand({
 	name: "tailordb",
 	description: "Manage TailorDB tables and data.",
+	notes: "The `tailordb erd` commands are provided by the @tailor-platform/sdk-tailordb-erd-plugin CLI plugin.",
 	subCommands: {
 		truncate: truncateCommand,
-		migration: migrationCommand,
-		erd: erdCommand
+		migration: migrationCommand
 	}
 });
 
@@ -6710,7 +6013,7 @@ const upgradeCommand = defineAppCommand({
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-DeZeYa06.mjs");
+		const { upgrade } = await import("../service-DaeJlBoH.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -7055,7 +6358,7 @@ const workflowCommand = defineCommand({
 	name: "workflow",
 	description: "Manage workflows and workflow executions.",
 	subCommands: {
-		list: listCommand$13,
+		list: listCommand$14,
 		get: getCommand$6,
 		start: startCommand,
 		wait: waitCommand,
@@ -7063,7 +6366,7 @@ const workflowCommand = defineCommand({
 		resume: resumeCommand
 	},
 	async run() {
-		await runCommand(listCommand$13, []);
+		await runCommand(listCommand$14, []);
 	}
 });
 
@@ -7074,10 +6377,10 @@ const appCommand = defineCommand({
 	description: "Manage workspace applications",
 	subCommands: {
 		health: healthCommand,
-		list: listCommand$14
+		list: listCommand$15
 	},
 	async run() {
-		await runCommand(listCommand$14, []);
+		await runCommand(listCommand$15, []);
 	}
 });
 
@@ -7088,12 +6391,12 @@ const userCommand = defineCommand({
 	description: "Manage workspace users",
 	subCommands: {
 		invite: inviteCommand,
-		list: listCommand$15,
+		list: listCommand$16,
 		remove: removeCommand,
 		update: updateCommand$4
 	},
 	async run() {
-		await runCommand(listCommand$15, []);
+		await runCommand(listCommand$16, []);
 	}
 });
 
@@ -7107,12 +6410,12 @@ const workspaceCommand = defineCommand({
 		create: createCommand$4,
 		delete: deleteCommand$5,
 		get: getCommand$7,
-		list: listCommand$16,
+		list: listCommand$17,
 		restore: restoreCommand,
 		user: userCommand
 	},
 	async run() {
-		await runCommand(listCommand$16, []);
+		await runCommand(listCommand$17, []);
 	}
 });
 
@@ -7124,37 +6427,22 @@ const packageJson = await readPackageJson();
 const cliName = Object.keys(packageJson.bin ?? {})[0] || "tailor";
 const packageName = packageJson.name ?? "@tailor-platform/sdk";
 const bundledSkillsDir = resolve(dirname(await resolvePackageJSON(import.meta.url)), "agent-skills");
-function replaceCommandArgs(command, removals = []) {
-	const args = command.args;
-	if (!args?.shape) return command;
-	const shape = { ...args.shape };
-	for (const name of removals) delete shape[name];
-	return {
-		...command,
-		args: z.strictObject({ ...shape })
-	};
-}
-function removeCommandAliases(command) {
-	const next = { ...command };
-	delete next.aliases;
-	return next;
-}
 function alignSkillCommand(command) {
 	const subCommands = command.subCommands ?? {};
 	const add = {
-		...removeCommandAliases(replaceCommandArgs(subCommands.add, ["verbose"])),
+		...subCommands.add,
 		description: "Install Tailor SDK agent skills."
 	};
 	const list = {
-		...replaceCommandArgs(subCommands.list, ["json"]),
+		...subCommands.list,
 		description: "List Tailor SDK agent skills."
 	};
 	const remove = {
-		...removeCommandAliases(replaceCommandArgs(subCommands.remove)),
+		...subCommands.remove,
 		description: "Remove installed Tailor SDK agent skills."
 	};
 	const sync = {
-		...replaceCommandArgs(subCommands.sync, ["verbose"]),
+		...subCommands.sync,
 		description: "Remove and reinstall Tailor SDK agent skills."
 	};
 	return {
@@ -7183,7 +6471,7 @@ Run \`${cliName} plugin list\` to see which plugins are installed and where they
 		auth: authCommand,
 		authconnection: authconnectionCommand,
 		crashreport: crashReportCommand,
-		deploy: deployCommand$1,
+		deploy: deployCommand,
 		executor: executorCommand,
 		function: functionCommand,
 		generate: generateCommand,
@@ -7212,21 +6500,26 @@ Run \`${cliName} plugin list\` to see which plugins are installed and where they
 	sourceDir: bundledSkillsDir,
 	package: packageName,
 	mode: "copy",
-	descriptionAppend: false
+	descriptionAppend: false,
+	globalArgs: z.object(commonArgs),
+	commandMap: {
+		add: ["add"],
+		remove: ["remove"]
+	},
+	unknownKeys: "strict"
 });
-const commandWithSkillsSubCommands = commandWithSkills.subCommands ?? {};
 const mainCommand = withCompletionCommand({
 	...commandWithSkills,
 	subCommands: {
-		...commandWithSkillsSubCommands,
-		skills: alignSkillCommand(commandWithSkillsSubCommands.skills)
+		...commandWithSkills.subCommands,
+		skills: alignSkillCommand(commandWithSkills.subCommands.skills)
 	}
 });
 runMain(mainCommand, {
 	version: packageJson.version,
 	globalArgs: z.object(commonArgs),
 	displayErrors: false,
-	onUnknownSubcommand: ({ commandPath, name, args }) => dispatchPlugin({
+	onUnknownSubcommand: ({ commandPath, name, args }) => dispatchPluginWithInstallHint({
 		commandPath,
 		name,
 		args,
@@ -7235,7 +6528,8 @@ runMain(mainCommand, {
 	}),
 	cleanup: async ({ error }) => {
 		if (error) {
-			if (isCLIError(error)) {
+			if (logger.jsonMode) logger.log(JSON.stringify(errorToJson(error, { includeStack: isVerbose() })));
+			else if (isCLIError(error)) {
 				logger.log(error.format());
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else if (error instanceof Error) {
@@ -7243,7 +6537,7 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-D3RjuSYb.mjs");
+				const { reportCrash } = await import("../crashreport-0ioNRZ4K.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}