@tailor-platform/sdk 2.1.0 → 2.3.0

package/dist/cli/main.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
-import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-DXnO2AT-.mjs";
+import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, Ft as CloneOperationStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-HNIL_Vfj.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
-import { n as logger, r as styles } from "../logger-CXQq9YIp.mjs";
-import { $n as hasUserTokenEntry, $t as ensureConfigId, An as loadDiff, Bn as sdkAppIdLabelKey, C as healthCommand, Cn as createSnapshotFromLocalTypes, Cr as resolveMachineUserInputSource, Dn as getMigrationFilePath, E as resumeCommand, Et as triggerCommand, F as writeDbTypesFile, Fn as formatMigrationDiff, Ft as startCommand, G as removeCommand$1, H as extractOwnedNamespaces, Hn as sdkVersionLabelKey, Ht as functionExecutionStatusToString, I as getConfiguredEditorCommand, In as hasChanges, Jn as assertWritable, K as updateCommand$3, Kn as prompt, Kt as deployFromCLI, L as openInConfiguredEditor, Ln as getNamespacesWithMigrations, Lt as getCommand$6, Mn as formatMigrationNumber, Mt as jobsCommand, N as generateCommand$1, Nn as parseMigrationNumberArg, O as listCommand$14, On as getMigrationFiles, Ot as listCommand$8, P as generateMigrationScript, Pn as formatDiffSummary, Q as getCommand$5, Qn as hasAnyUserTokenEntry, Qt as workspaceNameSchema, R as deployCommand$1, Rn as selectTargetNamespace, Sr as paginationArgs, St as getCommand$2, Tr as workspaceArgs, Tt as webhookCommand, U as logBetaWarning, Un as writeMetadataLabels, Ut as getCommand$1, V as showCommand, Vn as sdkNameLabelKey, Wn as PluginManager, X as listCommand$13, Xn as deleteUserTokens, Y as treeCommand, Yn as loadConfig, Yt as createCommand$4, Zn as fetchLatestToken, Zt as formatKeyValueTable, _r as confirmationArgs, a as queryCommand, an as toTailorDBDeployInput, ar as loadStoredUserTokens, bn as assertValidMigrationFiles, br as multiConfigArg, bt as listCommand$9, c as removeCommand, cn as handleOptionalToRequiredError, cr as readPlatformConfig, ct as createCommand$3, dn as compareSnapshotWithRemote, dr as resolveUserTokenKey, en as executeScript, er as loadAccessToken, et as updateCommand$2, f as inviteCommand, fn as generateAllTypeManifestsFromSnapshot, fr as saveUserTokens, ft as getCommand$3, g as getCommand$7, gn as INITIAL_SCHEMA_NUMBER, gr as configArg, gt as listCommand$10, hr as commonArgs, ht as tokenCommand$1, in as logRemoteDriftGuidance, ir as loadPlatformClientConfig, it as getCommand$4, j as truncateCommand, jn as reconstructSnapshotFromMigrations, ln as parseMigrationLabelNumber, lr as removeLegacyUserAlias, m as restoreCommand, mr as defineAppCommand, nr as loadConsoleBaseUrl, nt as listCommand$12, o as updateCommand$4, on as verifyRemoteSchema, or as loadWorkspaceId, ot as deleteCommand$4, pn as protoGqlPermission, pr as writePlatformConfig, qn as apiCall, qt as listCommand$17, r as serializeError, rn as checkMigrationDiffs, rr as loadMachineUserName, sn as MIGRATION_LABEL_KEY, sr as platformConfigFromProfile, t as registerTsHook, tr as loadConfigPath, u as listCommand$16, un as sanitizeMigrationLabel, ur as resolveConfigUser, ut as listCommand$11, v as deleteCommand$5, vr as deploymentArgs, vt as generate, w as waitCommand, wn as formatSchemaDrifts, wr as toPageDirection, x as listCommand$15, xn as compareLocalTypesWithSnapshot, xr as pagedLogArgs, yn as assertMigrationNumberExists, yr as isVerbose, zn as resourceTrn, zt as executionsCommand } from "../register-ts-hook-BU18uU44.mjs";
-import { A as getDistDir, B as fetchUserInfo, C as composeFunctionTreeshakeOptions, E as createBundleLog, F as fetchAll, G as initOAuth2Client, H as getOAuth2ClientId, I as fetchAllTolerant, K as initOperatorClient, N as closeConnectionPool, P as defaultPlatformBaseUrl, R as fetchPaged, S as platformBundleDefinePlugin, T as resolveBundleLogLevel, U as getOrNull, W as getPlatformBaseUrl, a as resolveInlineSourcemap, b as createTsconfigPathsPlugin, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as isDefaultPlatform, u as ResolverSchema, w as createLogLevelTreeshakeOptions, x as resolveTSConfigWithFallback, y as createGeneratedEntryResolverPlugin, z as fetchPlatformMachineUserToken } from "../application-D77KJFKD.mjs";
-import { i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-k1xy_A5G.mjs";
+import { n as logger, r as styles } from "../logger-DSdExfor.mjs";
+import { $ as treeCommand, $n as sanitizeMigrationLabel, An as MIGRATION_FILE_NAMES, Ar as readPlatformConfig, B as MIGRATION_REVIEW_REQUIRED_MARKER, Bn as getLatestMigrationNumber, Br as deploymentArgs, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConfigPath, Ct as listCommand$9, Dr as loadStoredUserTokens, E as resumeCommand, Er as loadPlatformClientConfig, F as chunkSeedData, Fn as assertValidMigrationFiles, Fr as writePlatformConfig, Ft as jobsCommand, G as showCommand, Gn as loadDiff, Gr as resolveMachineUserInputSource, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFilePath, Hr as multiConfigArg, Ht as executionsCommand, I as bundleSeedScript, In as compareLocalTypesWithSnapshot, Ir as defineAppCommand, Jn as reconstructSnapshotFromMigrations, K as extractOwnedNamespaces, Kn as loadSnapshot, Kr as toPageDirection, Kt as getCommand$1, Ln as compareSnapshots, Lr as commonArgs, M as loadSeedContext, Mr as resolveConfigUser, N as loadApplicationNamespaces, Nn as UnsupportedMigrationFileVersionError, Nr as resolveUserTokenKey, O as listCommand$14, Or as loadWorkspaceId, Ot as webhookCommand, Pn as assertMigrationNumberExists, Pr as saveUserTokens, Qn as handleOptionalToRequiredError, Qt as listCommand$17, R as generateCommand$1, Rn as createSnapshotFromLocalTypes, Rr as configArg, Rt as startCommand, Sn as protoGqlPermission, Sr as loadAccessToken, St as generate, Tr as loadMachineUserName, Tt as getCommand$2, Un as getMigrationFiles, Ur as pagedLogArgs, V as generateSchemaFile, Vr as isVerbose, Wr as paginationArgs, X as updateCommand$3, Xn as MIGRATION_LABEL_KEY, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_HISTORY_LABEL_KEY, Yt as deployFromCLI, Zn as createMigrationHistoryId, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as loadConfig, a as queryCommand, an as ensureConfigId, ar as resourceTrn, bn as compareSnapshotWithRemote, br as hasAnyUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as sdkVersionLabelKey, ct as getCommand$4, dn as bundleMigrationScript, en as createCommand$4, er as formatDiffSummary, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as formatMigrationNumber, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as assertWritable, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as apiCall, in as workspaceNameSchema, ir as selectTargetNamespace, it as updateCommand$2, j as truncateCommand, jn as MIGRATION_NUMBER_PATTERN, jr as removeLegacyUserAlias, jt as listCommand$8, kr as platformConfigFromProfile, kt as triggerCommand, lr as writeMetadataLabels, m as restoreCommand, mn as formatRemoteVerificationResults, mr as prompt, mt as listCommand$11, nr as hasChanges, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkAppIdLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as parseMigrationNumberArg, q as logBetaWarning, qn as normalizeSchemaSnapshot, qr as workspaceArgs, r as serializeError, rn as formatKeyValueTable, rr as getNamespacesWithMigrations, sn as updateMigrationLabel, sr as sdkNameLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as formatMigrationDiff, u as listCommand$16, un as formatMigrationScriptCommand, ur as PluginManager, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as deleteUserTokens, w as waitCommand, wn as captureMigrationFileState, wr as loadConsoleBaseUrl, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as hasUserTokenEntry, yn as fetchRemoteMigrationState, yr as fetchLatestToken, yt as tokenCommand$1, z as scriptCommand, zn as formatSchemaDrifts, zr as confirmationArgs } from "../register-ts-hook-ClI226n2.mjs";
+import { B as fetchPaged, C as resolveTSConfigWithFallback, D as resolveBundleLogLevel, E as createLogLevelTreeshakeOptions, F as closeConnectionPool, G as getOrNull, H as fetchUserInfo, I as defaultPlatformBaseUrl, J as initOperatorClient, K as getPlatformBaseUrl, L as fetchAll, M as getDistDir, O as createBundleLog, R as fetchAllTolerant, S as createTsconfigPathsPlugin, T as composeFunctionTreeshakeOptions, V as fetchPlatformMachineUserToken, W as getOAuth2ClientId, Y as isDefaultPlatform, a as resolveInlineSourcemap, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as initOAuth2Client, u as ResolverSchema, w as platformBundleDefinePlugin, x as createGeneratedEntryResolverPlugin } from "../application-F-nl107y.mjs";
+import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-C_WpbKHu.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
-import { n as isCLIError, t as createCLIError } from "../errors-D7583Zz7.mjs";
-import { t as OperatorService } from "../service_pb-D5--My_M.mjs";
-import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-B5LqCTfF.mjs";
+import { a as typeOnlyImportHint, i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-BVb6vYGy.mjs";
+import { t as OperatorService } from "../service_pb-BEWj1pOV.mjs";
+import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-CIIfLnoO.mjs";
 import * as path from "pathe";
 import { dirname, resolve } from "pathe";
 import { resolvePackageJSON } from "pkg-types";
@@ -27,7 +27,7 @@ import { pathToFileURL } from "node:url";
 import { generateCodeVerifier } from "@badgateway/oauth2-client";
 import { Code, ConnectError } from "@connectrpc/connect";
 import * as crypto from "node:crypto";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import * as http from "node:http";
 import open from "open";
 import * as rolldown from "rolldown";
@@ -1498,7 +1498,7 @@ function composeExecutionErrorString(error) {
 * @returns Formatted fallback string for display
 */
 function formatExecutionErrorFallback(error) {
-	const [headerLine, ...frameLines] = composeExecutionErrorString(error).split("\n");
+	const [headerLine = "", ...frameLines] = composeExecutionErrorString(error).split("\n");
 	return [`  ${styles.error(headerLine)}`, ...frameLines.map((line) => `  ${styles.dim(line)}`)].join("\n");
 }
 /**
@@ -3818,6 +3818,14 @@ function detectDefaultBranch(cwd, run = defaultGitRunner) {
 const LOCK_VERSION = 1;
 /** Lock file path, relative to the repository root. */
 const LOCK_FILENAME = ".github/tailor.lock";
+function assertSafeLockPath(outputDir) {
+	for (const relativePath of [".github", LOCK_FILENAME]) try {
+		if (fs.lstatSync(path.join(outputDir, relativePath)).isSymbolicLink()) throw new Error(`Refusing to use ${LOCK_FILENAME}: "${relativePath}" is a symbolic link.`);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") continue;
+		throw error;
+	}
+}
 /**
 * Compute the lock content hash for a rendered workflow file.
 * @param content - File content to hash
@@ -3843,6 +3851,7 @@ function lockPath(outputDir) {
 * @returns Parsed lock file, or null when absent
 */
 function readLock(outputDir) {
+	assertSafeLockPath(outputDir);
 	const file = lockPath(outputDir);
 	if (!fs.existsSync(file)) return null;
 	let parsed;
@@ -3862,6 +3871,7 @@ function readLock(outputDir) {
 * @param lock - Lock file contents to serialize
 */
 function writeLock(outputDir, lock) {
+	assertSafeLockPath(outputDir);
 	const file = lockPath(outputDir);
 	fs.mkdirSync(path.dirname(file), { recursive: true });
 	fs.writeFileSync(file, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
@@ -3880,23 +3890,23 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx @tailor-platform/sdk \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bun run tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx @tailor-platform/sdk \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bun run tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/coordinate.workflow.yml
-var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
 
 //#endregion
 //#region src/cli/commands/setup/preview.workflow.yml
-var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
@@ -4044,6 +4054,7 @@ function renderPreviewWorkflow(params) {
 			"tailor-preview-deploy/tailor-setup",
 			"tailor-preview-deploy/tailor-install",
 			"tailor-preview-deploy/tailor-generate-check",
+			"tailor-preview-deploy/tailor-drift-check",
 			"tailor-preview-deploy/tailor-preview-deploy",
 			"tailor-preview-deploy/tailor-preview-comment",
 			"tailor-preview-cleanup",
@@ -4072,8 +4083,8 @@ function renderActionWorkflow(params) {
 		generatedIds: ["tailor-apply", "tailor-notify"]
 	};
 }
-const ACTIONS_SHA = "1f2d0cc26b84b9fdae8a3a0427526df31e6c966b";
-const ACTIONS_VERSION = "v2.0.0";
+const ACTIONS_SHA = "85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c";
+const ACTIONS_VERSION = "v2.2.0";
 /**
 * Render the coordinator workflow that orchestrates per-app composite actions.
 *
@@ -4117,7 +4128,8 @@ function renderCoordinateWorkflow(params) {
 		`- id: tailor-drift-check`,
 		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`  with:`,
-		`    package-manager: ${packageManager}`
+		`    package-manager: ${packageManager}`,
+		`    fail-on-drift: \${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}`
 	].join("\n");
 	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
 	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
@@ -4621,7 +4633,7 @@ async function setupTarget(options) {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 9,
+		templateVersion: 11,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -4689,7 +4701,7 @@ async function setupCoordinate(options) {
 			seenNames.add(name);
 			const entry = actionTargets.get(name);
 			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
-			if (names.length > 1 && entry.templateVersion < 9) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			if (names.length > 1 && entry.templateVersion < 11) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
 			validateDir(entry.inputs.dir);
 			return {
 				name,
@@ -4741,7 +4753,7 @@ async function setupCoordinate(options) {
 		kind: "coordinate",
 		workspaceName: coordinatorName,
 		file,
-		templateVersion: 9,
+		templateVersion: 11,
 		inputs: {
 			branch,
 			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
@@ -4785,6 +4797,7 @@ async function setupCoordinate(options) {
 
 //#endregion
 //#region src/cli/commands/setup/check.ts
+const DRIFT_COUNT_MARKER = "TAILOR_SETUP_CHECK_DRIFT_COUNT";
 /**
 * Compute drift findings for one target by comparing its recorded lock state
 * against the current repository/config state.
@@ -4929,7 +4942,7 @@ async function checkGitHub(options) {
 			currentHash,
 			configExists,
 			defaultBranch,
-			templateVersion: 9,
+			templateVersion: 11,
 			erdNamespaces,
 			hasMigrations,
 			hasSeeds,
@@ -4942,6 +4955,7 @@ async function checkGitHub(options) {
 		return;
 	}
 	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
+	if (options.ci) logger.log(`${DRIFT_COUNT_MARKER}=${String(findings.length)}`);
 	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor setup\` to regenerate, or address each finding above.`);
 }
 
@@ -5014,6 +5028,134 @@ async function setupDelete(options) {
 	}
 }
 
+//#endregion
+//#region src/cli/commands/setup/renovate.ts
+const RENOVATE_CONFIG_FILE = "renovate.json";
+const RENOVATE_PRESET = "github>tailor-inc/renovate-config";
+const RENOVATE_CONFIG_FILES = [
+	RENOVATE_CONFIG_FILE,
+	"renovate.jsonc",
+	"renovate.json5",
+	".github/renovate.json",
+	".github/renovate.jsonc",
+	".github/renovate.json5",
+	".gitlab/renovate.json",
+	".gitlab/renovate.jsonc",
+	".gitlab/renovate.json5",
+	".renovaterc",
+	".renovaterc.json",
+	".renovaterc.jsonc",
+	".renovaterc.json5"
+];
+function getPathEntry(filePath) {
+	try {
+		return fs.lstatSync(filePath);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+function pathEntryExists(filePath) {
+	return getPathEntry(filePath) !== null;
+}
+function extendsPreset(config) {
+	if (!("extends" in config)) return false;
+	const value = config.extends;
+	return Array.isArray(value) && value.includes("github>tailor-inc/renovate-config");
+}
+function readJsonConfig(filePath) {
+	const entry = getPathEntry(filePath);
+	if (entry === null || !entry.isFile()) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+	} catch {
+		return null;
+	}
+	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+}
+function classifyConfig(location, filePath, config) {
+	if (config === null) return {
+		kind: "unreadable",
+		location
+	};
+	if (extendsPreset(config)) return {
+		kind: "extends-preset",
+		location
+	};
+	return {
+		kind: "appendable",
+		location,
+		filePath,
+		config
+	};
+}
+function findExistingConfig(outputDir) {
+	for (const file of RENOVATE_CONFIG_FILES) {
+		const filePath = path.join(outputDir, file);
+		if (!pathEntryExists(filePath)) continue;
+		return classifyConfig(file, filePath, readJsonConfig(filePath));
+	}
+	const packageJsonPath = path.join(outputDir, "package.json");
+	if (!fs.existsSync(packageJsonPath)) return null;
+	let packageJson;
+	try {
+		packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+	} catch (cause) {
+		throw new Error("package.json is not valid JSON; could not inspect its Renovate config.", { cause });
+	}
+	if (typeof packageJson === "object" && packageJson !== null && "renovate" in packageJson) {
+		const renovate = packageJson.renovate;
+		return classifyConfig("package.json#renovate", packageJsonPath, typeof renovate === "object" && renovate !== null && !Array.isArray(renovate) ? renovate : null);
+	}
+	return null;
+}
+function detectIndent(source) {
+	return /^(?<indent>[ ]+)"/m.exec(source)?.groups?.indent?.length ?? 2;
+}
+function appendPreset(existing) {
+	const source = fs.readFileSync(existing.filePath, "utf-8");
+	const current = "extends" in existing.config ? existing.config.extends : void 0;
+	if (current !== void 0 && !Array.isArray(current)) throw new Error(`Renovate config at "${existing.location}" has a non-array "extends". No files were changed. Add "${RENOVATE_PRESET}" to it manually.`);
+	const config = {
+		...existing.config,
+		extends: [...current ?? [], RENOVATE_PRESET]
+	};
+	const root = existing.location === "package.json#renovate" ? {
+		...JSON.parse(source),
+		renovate: config
+	} : config;
+	const trailingNewline = source.endsWith("\n") ? "\n" : "";
+	fs.writeFileSync(existing.filePath, `${JSON.stringify(root, null, detectIndent(source))}${trailingNewline}`, "utf-8");
+}
+function renderRenovateConfig() {
+	return `${JSON.stringify({
+		$schema: "https://docs.renovatebot.com/renovate-schema.json",
+		extends: [RENOVATE_PRESET]
+	}, null, 2)}\n`;
+}
+/**
+* Generate a repository-level Renovate config that extends Tailor's shared preset.
+* @param options - Renovate setup options
+*/
+async function setupRenovate(options) {
+	logBetaWarning("setup");
+	const existingConfig = findExistingConfig(options.outputDir);
+	if (existingConfig !== null) {
+		if (existingConfig.kind === "extends-preset") {
+			logger.info(`Renovate is already set up at ${styles.path(existingConfig.location)}.`);
+			return;
+		}
+		if (existingConfig.kind === "unreadable") throw new Error(`Found a Renovate config at "${existingConfig.location}" but could not parse it as JSON. Comment-containing JSON5/JSONC configs are not supported yet. No files were changed. Check its extends array for "${RENOVATE_PRESET}" manually.`);
+		appendPreset(existingConfig);
+		logger.success(`Added the Tailor preset to ${styles.path(existingConfig.location)}`);
+		return;
+	}
+	const outputPath = path.join(options.outputDir, RENOVATE_CONFIG_FILE);
+	fs.writeFileSync(outputPath, renderRenovateConfig(), "utf-8");
+	logger.success(`Generated ${styles.path(RENOVATE_CONFIG_FILE)}`);
+}
+
 //#endregion
 //#region src/cli/commands/setup/index.ts
 const checkCommand = defineAppCommand({
@@ -5172,6 +5314,14 @@ const previewCommand = defineAppCommand({
 		});
 	}
 });
+const renovateCommand = defineAppCommand({
+	name: "renovate",
+	description: "Generate a Renovate config for Tailor dependency and workflow updates.",
+	args: z.strictObject({}),
+	run: async () => {
+		await setupRenovate({ outputDir: process.cwd() });
+	}
+});
 const deleteCommand$1 = defineAppCommand({
 	name: "delete",
 	description: "Delete managed workflow/action file(s) and their .github/tailor.lock entries.",
@@ -5192,13 +5342,14 @@ const deleteCommand$1 = defineAppCommand({
 });
 const setupCommand = defineCommand({
 	name: "setup",
-	description: "Generate CI deploy workflows for your project. (beta)",
+	description: "Set up repository automation for your project. (beta)",
 	subCommands: {
 		branch: branchCommand,
 		tag: tagCommand,
 		preview: previewCommand,
 		action: actionCommand,
 		coordinate: coordinateCommand,
+		renovate: renovateCommand,
 		check: checkCommand,
 		delete: deleteCommand$1
 	}
@@ -5425,164 +5576,214 @@ const staticwebsiteCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/commands/tailordb/migrate/script.ts
-/**
-* Script command for TailorDB migrations
-*
-* Adds a `migrate.ts` (and supporting `db.ts`) template to an existing
-* migration directory. Useful for warning-tier changes where users may
-* want to write a custom data migration even though the change does not
-* automatically require one.
-*/
-/**
-* Record in diff.json that a migration requiring a script intentionally has none.
-* @param {MarkScriptSkippedOptions} options - Target migration and skip reason
-* @returns {ScriptSkippedInfo} The recorded acknowledgment
-*/
-function markMigrationScriptSkipped(options) {
-	const { migrationsDir, migrationNumber, reason } = options;
-	const label = formatMigrationNumber(migrationNumber);
-	const normalizedReason = reason.trim();
-	if (!normalizedReason) throw new Error("Migration script skip reason must not be empty.");
-	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
-	if (!fs.existsSync(diffPath)) throw new Error(`Migration ${label} not found in ${migrationsDir}. Expected ${diffPath}.`);
-	const diff = loadDiff(diffPath);
-	if (!diff.requiresMigrationScript) throw new Error(`Migration ${label} does not require a migration script; nothing to skip.`);
-	if (diff.scriptSkipped) throw new Error(`Migration ${label} already has a script skip recorded (${diff.scriptSkipped.acknowledgedAt}: ${diff.scriptSkipped.reason}).`);
-	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
-	if (fs.existsSync(migratePath)) throw new Error(`Migration script exists at ${migratePath}. Delete migrate.ts first if this migration should run without a script.`);
-	const scriptSkipped = {
-		reason: normalizedReason,
-		acknowledgedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	const raw = JSON.parse(fs.readFileSync(diffPath, "utf-8"));
-	raw.scriptSkipped = scriptSkipped;
-	fs.writeFileSync(diffPath, JSON.stringify(raw, null, 2));
-	return scriptSkipped;
-}
-/**
-* Remove a script skip acknowledgment after a real migration script is created.
-* @param diffPath - Migration diff file to update
-*/
-function clearMigrationScriptSkipped(diffPath) {
-	const raw = JSON.parse(fs.readFileSync(diffPath, "utf-8"));
-	if (!Object.hasOwn(raw, "scriptSkipped")) return;
-	delete raw.scriptSkipped;
-	fs.writeFileSync(diffPath, JSON.stringify(raw, null, 2));
+//#region src/cli/commands/tailordb/migrate/rebaseline.ts
+const MIGRATION_ARTIFACT_NAMES = new Set(Object.values(MIGRATION_FILE_NAMES));
+async function activateBaseline(migrationsDir, snapshot, namespace, rebaseline) {
+	const resolvedMigrationsDir = await fsPromises.realpath(migrationsDir);
+	const parentDir = path.dirname(resolvedMigrationsDir);
+	const baseName = path.basename(resolvedMigrationsDir);
+	const stagingDir = await fsPromises.mkdtemp(path.join(parentDir, `.${baseName}-rebaseline-`));
+	const backupDir = `${stagingDir}-previous`;
+	let movedLiveDirectory = false;
+	let activatedStagingDirectory = false;
+	try {
+		await fsPromises.cp(resolvedMigrationsDir, stagingDir, { recursive: true });
+		for (const entry of await fsPromises.readdir(stagingDir, { withFileTypes: true })) {
+			if (!entry.isDirectory() || !MIGRATION_NUMBER_PATTERN.test(entry.name)) continue;
+			const entryPath = path.join(stagingDir, entry.name);
+			if (!(await fsPromises.readdir(entryPath)).some((childName) => MIGRATION_ARTIFACT_NAMES.has(childName))) continue;
+			await fsPromises.rm(entryPath, {
+				recursive: true,
+				force: true
+			});
+		}
+		loadSnapshot((await generateSchemaFile({
+			...snapshot,
+			namespace,
+			version: 5,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			rebaseline
+		}, stagingDir, 0)).filePath);
+		await fsPromises.rename(resolvedMigrationsDir, backupDir);
+		movedLiveDirectory = true;
+		try {
+			await fsPromises.rename(stagingDir, resolvedMigrationsDir);
+			activatedStagingDirectory = true;
+		} catch (error) {
+			await fsPromises.rename(backupDir, resolvedMigrationsDir);
+			movedLiveDirectory = false;
+			throw error;
+		}
+		try {
+			await fsPromises.rm(backupDir, {
+				recursive: true,
+				force: true
+			});
+		} catch (error) {
+			logger.warn(`The previous migration directory remains at ${backupDir}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		movedLiveDirectory = false;
+	} finally {
+		if (fs.existsSync(stagingDir)) await fsPromises.rm(stagingDir, {
+			recursive: true,
+			force: true
+		});
+		if (!activatedStagingDirectory && movedLiveDirectory && fs.existsSync(backupDir)) await fsPromises.rename(backupDir, resolvedMigrationsDir);
+	}
 }
-/**
-* Add a migrate.ts template to an existing migration directory.
-* @param {ScriptOptions} options - Command options
-*/
-async function script(options) {
+async function rebaseline(options) {
 	logBetaWarning("tailordb migration");
-	const migrationNumber = parseMigrationNumberArg(options.number);
-	if (migrationNumber === 0) throw new Error(`Migration ${options.number} is the initial schema snapshot and cannot have a migration script.`);
-	const { config } = await loadConfig(options.configPath);
-	const namespacesWithMigrations = getNamespacesWithMigrations(config, path.dirname(config.path));
-	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
-	const targetNamespace = resolveTargetNamespace(namespacesWithMigrations, options.namespace);
-	const { migrationsDir } = assertDefined(namespacesWithMigrations.find((ns) => ns.namespace === targetNamespace), "namespace with migrations not found");
-	if (options.noScript) {
-		const reason = options.reason?.trim();
-		if (!reason) throw new Error("--reason is required with --no-script.");
-		const scriptSkipped = markMigrationScriptSkipped({
-			migrationsDir,
-			migrationNumber,
-			reason
-		});
-		logger.success(`Recorded that migration ${styles.bold(options.number)} in namespace ${styles.bold(targetNamespace)} intentionally has no migration script`);
-		logger.info(`  Reason: ${scriptSkipped.reason}`);
-		logger.info(`  Diff file: ${getMigrationFilePath(migrationsDir, migrationNumber, "diff")}`);
-		return;
+	const { config, plugins } = await loadConfig(options.configPath);
+	const configDir = path.dirname(config.path);
+	const target = selectTargetNamespace(getNamespacesWithMigrations(config, configDir), options.namespace);
+	const generateCommand = formatNextAction({
+		command: "tailor",
+		args: [
+			"tailordb",
+			"migration",
+			"generate",
+			"--config",
+			config.path
+		]
+	});
+	assertValidMigrationFiles(target.migrationsDir, target.namespace);
+	const latestSnapshot = reconstructSnapshotFromMigrations(target.migrationsDir);
+	if (!latestSnapshot) throw new Error(`No migration history found for namespace "${target.namespace}". Run ${generateCommand} first.`);
+	const latestMigration = getLatestMigrationNumber(target.migrationsDir);
+	const currentHistoryId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId ?? null;
+	const initialFileState = captureMigrationFileState([target])[target.namespace];
+	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
+	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
+	const application = defineApplication({
+		config,
+		pluginManager
+	});
+	for (const service of application.tailorDBServices) {
+		await service.loadTypes();
+		await service.processNamespacePlugins();
 	}
-	if (options.reason !== void 0) throw new Error("--reason can only be used together with --no-script.");
-	const diffPath = getMigrationFilePath(migrationsDir, migrationNumber, "diff");
-	if (!fs.existsSync(diffPath)) throw new Error(`Migration ${options.number} not found in ${migrationsDir}. Expected ${diffPath}.`);
-	const migratePath = getMigrationFilePath(migrationsDir, migrationNumber, "migrate");
-	if (fs.existsSync(migratePath)) throw new Error(`Migration script already exists at ${migratePath}.`);
-	const diff = loadDiff(diffPath);
-	const previousSnapshot = reconstructSnapshotFromMigrations(migrationsDir, migrationNumber - 1);
-	if (!previousSnapshot) throw new Error(`Could not reconstruct previous schema for migration ${options.number}. Make sure migration ${0} exists.`);
-	const scriptContent = generateMigrationScript(diff);
-	await fsPromises.writeFile(migratePath, scriptContent);
-	await writeDbTypesFile(previousSnapshot, migrationsDir, migrationNumber, diff);
-	clearMigrationScriptSkipped(diffPath);
-	logger.success(`Added migration script for migration ${styles.bold(options.number)} in namespace ${styles.bold(targetNamespace)}`);
-	logger.info(`  Migration script: ${migratePath}`);
-	logger.info(`  DB types: ${getMigrationFilePath(migrationsDir, migrationNumber, "db")}`);
+	const targetService = application.tailorDBServices.find((service) => service.namespace === target.namespace);
+	if (!targetService) throw new Error(`No TailorDB service found for namespace "${target.namespace}"`);
+	const assertLocalTypesReady = () => {
+		const currentSnapshot = createSnapshotFromLocalTypes(targetService.types, target.namespace);
+		const localDiff = compareLocalTypesWithSnapshot(latestSnapshot, currentSnapshot.tables, target.namespace);
+		if (hasChanges(localDiff)) {
+			logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
+			logger.log(formatMigrationDiff(localDiff));
+			throw new Error(`Refusing to re-baseline: the migration history must reproduce the current local schema. Run ${generateCommand} first.`);
+		}
+	};
+	const localSourceFiles = () => [config.path, ...loadFilesWithIgnores(targetService.config, configDir)];
+	assertLocalTypesReady();
+	const initialLocalFileState = captureFileState(localSourceFiles());
+	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
+	const workspaceId = await loadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	const remoteContextArgs = [
+		"--config",
+		config.path,
+		"--workspace-id",
+		workspaceId,
+		...options.profile ? ["--profile", options.profile] : []
+	];
+	const setBaselineCommand = formatNextAction({
+		command: "tailor",
+		args: [
+			"tailordb",
+			"migration",
+			"set",
+			"0",
+			"--namespace",
+			target.namespace,
+			...remoteContextArgs
+		]
+	});
+	const deployCommand = formatNextAction({
+		command: "tailor",
+		args: ["deploy", ...remoteContextArgs]
+	});
+	const assertConnectedWorkspaceReady = async (expectedHistoryId, phase) => {
+		const remoteState = await fetchRemoteMigrationState(client, resourceTrn(workspaceId, "tailordb", target.namespace));
+		const remoteMigration = remoteState.number;
+		if (remoteMigration !== latestMigration) {
+			const actual = remoteMigration === null ? "<unset>" : formatMigrationNumber(remoteMigration);
+			throw new Error(`The connected workspace must be at the latest migration ${formatMigrationNumber(latestMigration)} before re-baselining; current checkpoint is ${actual}.`);
+		}
+		if (remoteState.historyIdInvalid) throw new Error("Refusing to re-baseline: the connected workspace has an invalid migration history marker.");
+		if (remoteState.historyId !== expectedHistoryId) throw new Error(phase === "confirmation" ? "The connected workspace migration history changed while waiting for confirmation. Run the command again." : "Refusing to re-baseline: the connected workspace does not match the local migration history.");
+		const remoteResults = await verifyRemoteSchema(client, workspaceId, [target], config, [toTailorDBDeployInput(targetService)]);
+		const remoteResult = remoteResults[0];
+		if (!remoteResult || remoteResult.remoteMigrationNumber !== latestMigration || remoteResult.hasDrift || remoteResult.checkpointMissingLocal) {
+			if (remoteResult?.hasDrift) {
+				logger.error("Remote schema drift detected:");
+				logger.log(formatRemoteVerificationResults(remoteResults));
+			}
+			throw new Error("Refusing to re-baseline: the connected workspace remote schema must match the latest migration.");
+		}
+	};
+	await assertConnectedWorkspaceReady(currentHistoryId, "initial");
 	logger.newline();
-	logger.log("Edit the script to implement your data migration logic.");
-	logger.log("It will be executed by 'tailor deploy' between Pre and Post phases.");
-	const editor = getConfiguredEditorCommand();
-	if (!editor) return;
+	logger.warn(`This will replace the migration history for ${styles.bold(target.namespace)}.`);
+	logger.log(`  Latest migration: ${formatMigrationNumber(latestMigration)}`);
+	logger.log("  New history: 0000/schema.json only");
+	logger.log("  migrate.ts and db.ts files will disappear from the working tree.");
+	logger.log("  Committed migration files will remain in Git history. Preserve any uncommitted files before continuing.");
+	logger.log("  Every other environment must already be at the latest migration.");
+	logger.log("  The connected workspace checkpoint will be reset to 0000.");
 	logger.newline();
-	logger.info(`Opening ${path.basename(migratePath)} in ${editor}...`);
-	try {
-		await openInConfiguredEditor(migratePath);
-	} catch {
-		return;
-	}
-}
-function resolveTargetNamespace(namespacesWithMigrations, requested) {
-	if (requested) {
-		if (!namespacesWithMigrations.some((ns) => ns.namespace === requested)) throw new Error(`Namespace "${requested}" not found or does not have migrations configured`);
-		return requested;
+	if (!options.yes) {
+		if (!await prompt.confirm({
+			message: "Re-baseline this migration history and reset the connected workspace checkpoint?",
+			default: false
+		})) {
+			logger.info("Operation cancelled.");
+			return;
+		}
 	}
-	if (namespacesWithMigrations.length === 1) {
-		const [ns] = namespacesWithMigrations;
-		return assertDefined(ns, "namespace with migrations missing").namespace;
+	assertValidMigrationFiles(target.migrationsDir, target.namespace);
+	if (captureMigrationFileState([target])[target.namespace] !== initialFileState) throw new Error("Migration files changed while waiting for confirmation. Run the command again.");
+	if (captureFileState(localSourceFiles()) !== initialLocalFileState) throw new Error("Local TailorDB type or config files changed. Run the command again.");
+	assertLocalTypesReady();
+	await assertConnectedWorkspaceReady(currentHistoryId, "confirmation");
+	const rebaselineMarker = {
+		historyId: createMigrationHistoryId(),
+		replacedHistoryId: currentHistoryId,
+		replacedLatestMigration: latestMigration
+	};
+	await activateBaseline(target.migrationsDir, latestSnapshot, target.namespace, rebaselineMarker);
+	try {
+		await updateMigrationLabel(client, workspaceId, target.namespace, 0, rebaselineMarker.historyId);
+	} catch (error) {
+		throw new Error(`The local migration history was re-baselined, but the connected workspace checkpoint could not be updated. Run ${setBaselineCommand}, or run ${deployCommand} with schema checks enabled after resolving the connection error.`, { cause: error });
 	}
-	throw new Error(`Multiple TailorDB services found. Please specify namespace with --namespace flag: ${namespacesWithMigrations.map((ns) => ns.namespace).join(", ")}`);
+	logger.success(`Re-baselined ${styles.bold(target.namespace)} and reset the connected workspace checkpoint to 0000.`);
 }
-const scriptCommand = defineAppCommand({
-	name: "script",
-	description: "Add a migration script (migrate.ts) template to an existing migration directory, or record with --no-script that a migration intentionally has none.",
+const rebaselineCommand = defineAppCommand({
+	name: "rebaseline",
+	description: "Collapse the full migration history into a new 0000 baseline.",
+	notes: `Re-baselining removes migrations after 0000 from the working tree, records a new migration history ID, and resets the connected workspace checkpoint without changing its schema or data. Every environment must already have applied the latest migration before you run this command.`,
 	args: z.strictObject({
-		...configArg,
-		number: arg(z.string(), {
-			positional: true,
-			description: "Migration number to add a script to (e.g., 0001 or 1)"
-		}),
+		...deploymentArgs,
+		...confirmationArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "Target TailorDB namespace (required if multiple namespaces exist)"
-		}),
-		"no-script": arg(z.boolean().optional(), { description: "Record that this migration intentionally runs without a migration script (requires --reason)" }),
-		reason: arg(z.string().optional(), { description: "Reason why no migration script is needed (used with --no-script)" })
+		})
 	}),
 	run: async (args) => {
-		await script({
+		await assertWritable({ profile: args.profile });
+		await rebaseline({
 			configPath: args.config,
-			number: args.number,
 			namespace: args.namespace,
-			noScript: args["no-script"],
-			reason: args.reason
+			yes: args.yes,
+			workspaceId: args["workspace-id"],
+			profile: args.profile
 		});
 	}
 });
 
-//#endregion
-//#region src/cli/commands/tailordb/migrate/remote-state.ts
-/**
-* Fetch the namespace's current migration number from its metadata labels.
-*
-* Only a namespace that has not been deployed yet reads as "no current
-* migration". Every other lookup failure must propagate: treating it as
-* unset would misreport a transient error as "no checkpoint", showing
-* every migration as pending to callers.
-* @param client - Operator client
-* @param trn - Namespace TRN
-* @returns Parsed current migration number, or null when unset or unparseable
-*/
-async function fetchRemoteMigrationNumber(client, trn) {
-	const label = (await getOrNull(async () => {
-		const { metadata } = await client.getMetadata({ trn });
-		return metadata;
-	}))?.labels[MIGRATION_LABEL_KEY];
-	return label ? parseMigrationLabelNumber(label) : null;
-}
-
 //#endregion
 //#region src/cli/commands/tailordb/migrate/set.ts
 /**
@@ -5597,18 +5798,24 @@ async function set(options) {
 	const targetNamespace = target.namespace;
 	assertValidMigrationFiles(target.migrationsDir, targetNamespace);
 	assertMigrationNumberExists(target.migrationsDir, migrationNumber);
+	const historyId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId;
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const trn = resourceTrn(await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	}), "tailordb", targetNamespace);
-	const current = await fetchRemoteMigrationNumber(client, trn);
+	const currentState = await fetchRemoteMigrationState(client, trn);
+	const current = currentState.number;
 	const currentMigration = current ?? 0;
+	const currentHistoryId = currentState.historyIdInvalid ? "<invalid>" : currentState.historyId ?? "<unset>";
+	const newHistoryId = historyId ?? "<unset>";
 	logger.newline();
-	logger.warn("This operation will change the migration checkpoint.");
+	logger.warn("This operation will change TailorDB migration state metadata.");
 	logger.log(`Namespace: ${styles.bold(targetNamespace)}`);
 	logger.log(`Current migration: ${current === null ? "<unset>" : styles.bold(formatMigrationNumber(current))}`);
 	logger.log(`New migration: ${styles.bold(formatMigrationNumber(migrationNumber))}`);
+	logger.log(`Current migration history ID: ${styles.bold(currentHistoryId)}`);
+	logger.log(`New migration history ID: ${styles.bold(newHistoryId)}`);
 	logger.newline();
 	if (migrationNumber < currentMigration) {
 		logger.warn(`Setting migration number backwards (${formatMigrationNumber(currentMigration)} → ${formatMigrationNumber(migrationNumber)}) will cause previous migrations to be re-executed on next apply.`);
@@ -5619,7 +5826,7 @@ async function set(options) {
 	}
 	if (!options.yes) {
 		if (!await prompt.confirm({
-			message: "Continue with migration checkpoint update?",
+			message: "Continue with migration checkpoint and history ID update?",
 			default: false
 		})) {
 			logger.info("Operation cancelled.");
@@ -5629,7 +5836,11 @@ async function set(options) {
 	}
 	await writeMetadataLabels(client, {
 		trn,
-		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber) }
+		labels: {
+			[MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(migrationNumber),
+			...historyId ? { [MIGRATION_HISTORY_LABEL_KEY]: historyId } : {}
+		},
+		remove: historyId ? void 0 : [MIGRATION_HISTORY_LABEL_KEY]
 	});
 	logger.success(`Migration checkpoint set to ${styles.bold(formatMigrationNumber(migrationNumber))} for namespace ${styles.bold(targetNamespace)}`);
 }
@@ -5675,17 +5886,67 @@ async function collectMigrationStatuses(options) {
 	if (namespacesWithMigrations.length === 0) throw new Error("No TailorDB services with migrations configuration found");
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
+	const localStates = /* @__PURE__ */ new Map();
+	const localFailures = /* @__PURE__ */ new Map();
+	for (const { namespace, migrationsDir } of targetNamespaces) try {
+		const migrationFiles = getMigrationFiles(migrationsDir);
+		const descriptions = /* @__PURE__ */ new Map();
+		let historyId = null;
+		for (const file of migrationFiles) {
+			if (file.type === "schema") {
+				const snapshot = loadSnapshot(file.path);
+				if (file.number === 0) historyId = snapshot.rebaseline?.historyId ?? null;
+				continue;
+			}
+			try {
+				const diff = loadDiff(file.path);
+				if (diff.description) descriptions.set(file.number, diff.description);
+			} catch (error) {
+				if (error instanceof UnsupportedMigrationFileVersionError) throw error;
+			}
+		}
+		localStates.set(namespace, {
+			migrationFiles,
+			descriptions,
+			historyId
+		});
+	} catch (error) {
+		localFailures.set(namespace, error instanceof Error ? error.message : String(error));
+	}
+	if (localStates.size === 0) return targetNamespaces.map(({ namespace }) => ({
+		status: "error",
+		namespace,
+		error: localFailures.get(namespace) ?? "Failed to read local migration history."
+	}));
 	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }));
 	const workspaceId = await loadWorkspaceId({
 		workspaceId: options.workspaceId,
 		profile: options.profile
 	});
 	const rows = [];
-	for (const { namespace, migrationsDir } of targetNamespaces) {
+	for (const { namespace } of targetNamespaces) {
+		if (localFailures.has(namespace)) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: localFailures.get(namespace) ?? "Failed to read local migration history."
+			});
+			continue;
+		}
+		const localState = localStates.get(namespace);
+		if (!localState) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: "Failed to read local migration history."
+			});
+			continue;
+		}
+		const { migrationFiles, descriptions, historyId: localHistoryId } = localState;
 		const trn = resourceTrn(workspaceId, "tailordb", namespace);
-		let current;
+		let remoteState;
 		try {
-			current = await fetchRemoteMigrationNumber(client, trn);
+			remoteState = await fetchRemoteMigrationState(client, trn);
 		} catch (error) {
 			rows.push({
 				status: "error",
@@ -5694,19 +5955,28 @@ async function collectMigrationStatuses(options) {
 			});
 			continue;
 		}
-		const currentMigration = current ?? 0;
-		const pendingMigrations = getMigrationFiles(migrationsDir).map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => {
-			const diffPath = getMigrationFilePath(migrationsDir, num, "diff");
-			let description;
-			if (fs.existsSync(diffPath)) try {
-				description = loadDiff(diffPath).description;
-			} catch {}
-			return {
-				number: num,
-				label: formatMigrationNumber(num),
-				...description ? { description } : {}
-			};
-		});
+		const currentMigration = remoteState.number ?? 0;
+		if (remoteState.historyIdInvalid) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: "Remote migration history ID is invalid."
+			});
+			continue;
+		}
+		if ((remoteState.number !== null || remoteState.historyId !== null) && remoteState.historyId !== localHistoryId) {
+			rows.push({
+				status: "error",
+				namespace,
+				error: `Remote migration history ID ${remoteState.historyId ?? "<unset>"} does not match local migration history ID ${localHistoryId ?? "<unset>"}.`
+			});
+			continue;
+		}
+		const pendingMigrations = migrationFiles.map((f) => f.number).filter((n, i, arr) => arr.indexOf(n) === i).toSorted((a, b) => a - b).filter((n) => n > currentMigration).map((num) => ({
+			number: num,
+			label: formatMigrationNumber(num),
+			...descriptions.has(num) ? { description: descriptions.get(num) } : {}
+		}));
 		rows.push({
 			status: "ok",
 			namespace,
@@ -5722,7 +5992,7 @@ function printMigrationStatuses(rows) {
 		logger.newline();
 		logger.info(`Namespace: ${styles.bold(row.namespace)}`);
 		if (isStatusFailure(row)) {
-			logger.error(`  Failed to read migration state: ${row.error}`);
+			logger.error(`  Migration status error: ${row.error}`);
 			continue;
 		}
 		logger.log(`  Current migration: ${styles.bold(row.currentMigrationLabel)}`);
@@ -5746,13 +6016,13 @@ async function status(options) {
 	const failures = rows.filter(isStatusFailure);
 	if (failures.length > 0) {
 		const namespaces = failures.map((f) => f.namespace).join(", ");
-		throw new Error(`Failed to read migration state for ${failures.length} namespace${failures.length === 1 ? "" : "s"}: ${namespaces}`);
+		throw new Error(`Migration status check failed for ${failures.length} namespace${failures.length === 1 ? "" : "s"}: ${namespaces}`);
 	}
 }
 const statusCommand = defineAppCommand({
 	name: "status",
 	description: "Show the current migration status for TailorDB namespaces, including applied and pending migrations.",
-	notes: "Metadata lookup failures (authentication, permission, or network errors) are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.",
+	notes: "Every local migration file is checked for a compatible format version, and deployed migration history IDs must match the local baseline. Compatibility errors, history mismatches, and metadata lookup failures are reported per namespace and make the command exit non-zero; only a not-yet-deployed namespace is treated as having no applied migrations.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
@@ -5821,7 +6091,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-Af1zIqSI.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BZfk4HKm.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5833,7 +6103,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-M7OYziQP.mjs")).createExecutorService({
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-D1RCdzIL.mjs")).createExecutorService({
 		config: { files: [] },
 		baseDir: path.dirname(config.path)
 	}) : void 0);
@@ -5847,7 +6117,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	};
 	const latestSnapshot = reconstructSnapshotFromMigrations(target.migrationsDir);
 	if (!latestSnapshot) return manifestOptions;
-	const diff = compareLocalTypesWithSnapshot(latestSnapshot, createSnapshotFromLocalTypes(tailordbService.types, target.namespace).types, target.namespace);
+	const diff = compareLocalTypesWithSnapshot(latestSnapshot, createSnapshotFromLocalTypes(tailordbService.types, target.namespace).tables, target.namespace);
 	if (!hasChanges(diff)) return manifestOptions;
 	logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
 	logger.log(formatMigrationDiff(diff));
@@ -5895,7 +6165,7 @@ async function sync(options) {
 	const { creates, updates, deletes } = compareSnapshotWithRemote(snapshot, new Set(remoteTypes.map((t) => t.name)));
 	const remoteGqlPermissions = await fetchRemoteGqlPermissions(client, workspaceId, target.namespace);
 	const remoteGqlPermissionTypes = new Set(remoteGqlPermissions.map((p) => p.typeName));
-	const desiredGqlPermissions = Object.entries(snapshot.types).flatMap(([typeName, snapshotType]) => snapshotType.permissions?.gql ? [{
+	const desiredGqlPermissions = Object.entries(snapshot.tables).flatMap(([typeName, snapshotType]) => snapshotType.permissions?.gql ? [{
 		typeName,
 		permission: protoGqlPermission(snapshotType.permissions.gql)
 	}] : []);
@@ -5978,7 +6248,11 @@ async function sync(options) {
 	})));
 	await writeMetadataLabels(client, {
 		trn,
-		labels: { [MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(targetVersion) }
+		labels: {
+			[MIGRATION_LABEL_KEY]: sanitizeMigrationLabel(targetVersion),
+			...snapshot.rebaseline?.historyId ? { [MIGRATION_HISTORY_LABEL_KEY]: snapshot.rebaseline.historyId } : {}
+		},
+		remove: snapshot.rebaseline?.historyId ? void 0 : [MIGRATION_HISTORY_LABEL_KEY]
 	});
 	logger.success(`Synced namespace ${styles.bold(target.namespace)} to migration ${styles.bold(formatMigrationNumber(targetVersion))}.`);
 	if (targetVersion < latest) {
@@ -6014,23 +6288,647 @@ const syncCommand = defineAppCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tailordb/migrate/test-runtime.ts
+const CLONE_POLL_INTERVAL = 1e3;
+const CLONE_TIMEOUT = 300 * 1e3;
+function delay(milliseconds) {
+	return milliseconds > 0 ? new Promise((resolve) => setTimeout(resolve, milliseconds)) : Promise.resolve();
+}
+function assertSeedDataDirectory(dataDir) {
+	let stats;
+	try {
+		stats = fs.statSync(dataDir);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new Error(`Seed data directory not found: ${dataDir}. Run 'tailor generate' before testing migrations.`, { cause: error });
+		throw error;
+	}
+	if (!stats.isDirectory()) throw new Error(`Seed data path is not a directory: ${dataDir}`);
+}
+function assertAssertionScript(assertionPath) {
+	const resolvedPath = path.resolve(assertionPath);
+	let stats;
+	try {
+		stats = fs.statSync(resolvedPath);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new Error(`Migration assertion script not found: ${resolvedPath}`, { cause: error });
+		throw error;
+	}
+	if (!stats.isFile()) throw new Error(`Migration assertion path is not a file: ${resolvedPath}`);
+}
+/**
+* Require a designated clone target to share the source workspace's region.
+* @param sourceRegion - Source workspace region
+* @param targetRegion - Target workspace region
+*/
+function assertCloneTargetRegion(sourceRegion, targetRegion) {
+	if (sourceRegion !== targetRegion) throw new Error(`Clone mode requires source and target workspaces in the same region (source: ${sourceRegion}, target: ${targetRegion}).`);
+}
+/**
+* Require the migration test target workspace to differ from the source workspace.
+* @param sourceWorkspaceId - Source workspace ID
+* @param targetWorkspaceId - Designated target workspace ID, if any
+*/
+function assertTargetWorkspaceDiffers(sourceWorkspaceId, targetWorkspaceId) {
+	if (targetWorkspaceId?.toLowerCase() === sourceWorkspaceId.toLowerCase()) throw new Error("The migration test target workspace must differ from the source workspace.");
+}
+/**
+* Resolve the namespace an assertion script runs against.
+* @param pendingNamespaces - Namespaces with pending migrations
+* @param assertionNamespace - Explicit namespace from `--assert-namespace`, if any
+* @returns Resolved assertion namespace
+*/
+function resolveAssertionNamespace(pendingNamespaces, assertionNamespace) {
+	const namespace = assertionNamespace ?? (pendingNamespaces.length === 1 ? pendingNamespaces[0] : void 0);
+	if (!namespace) throw new Error("--assert-namespace is required when pending migrations span multiple namespaces.");
+	if (!pendingNamespaces.includes(namespace)) throw new Error(`Assertion namespace "${namespace}" has no pending migrations.`);
+	return namespace;
+}
+/**
+* Build the schema overrides used before migration-test data is loaded.
+* @param options - Source workspace, local inputs, and migration baselines
+* @returns Schema snapshots keyed by namespace
+*/
+async function createMigrationTestBaselineSnapshots(options) {
+	const snapshots = new Map([...options.baselines].map(([namespace, baseline]) => [namespace, baseline.snapshot]));
+	if (options.dataMode !== "clone") return snapshots;
+	const unmigratedInputs = options.inputs.filter((input) => !snapshots.has(input.namespace));
+	const remoteSnapshots = await Promise.all(unmigratedInputs.map((input) => fetchRemoteSchemaSnapshot(options.client, options.workspaceId, input.namespace)));
+	unmigratedInputs.forEach((input, index) => {
+		snapshots.set(input.namespace, assertDefined(remoteSnapshots[index], `remote snapshot missing for "${input.namespace}"`));
+	});
+	return snapshots;
+}
+/**
+* Wait for an application-data clone operation to reach a terminal state.
+* @param client - Operator client
+* @param options - Clone operation identifiers and polling limits
+*/
+async function waitForCloneApplicationData(client, options) {
+	const pollInterval = options.pollInterval ?? CLONE_POLL_INTERVAL;
+	const timeout = options.timeout ?? CLONE_TIMEOUT;
+	const deadline = Date.now() + timeout;
+	while (Date.now() <= deadline) {
+		const operation = await client.getCloneApplicationDataOperation({
+			sourceWorkspaceId: options.sourceWorkspaceId,
+			targetWorkspaceId: options.targetWorkspaceId,
+			operationId: options.operationId
+		});
+		if (operation.status === CloneOperationStatus.COMPLETED) return;
+		if (operation.status === CloneOperationStatus.FAILED) throw new Error(`Application data clone failed: ${operation.errorMessage || "unknown platform error"}`);
+		if (operation.status !== CloneOperationStatus.PENDING && operation.status !== CloneOperationStatus.PROCESSING) throw new Error(`Application data clone returned unexpected status ${operation.status}.`);
+		await delay(pollInterval);
+	}
+	throw new Error(`Application data clone timed out after ${Math.round(timeout / 1e3)} seconds.`);
+}
+/**
+* Load generated JSONL seed rows for the types in a baseline snapshot.
+* @param dataDir - Directory containing `<Type>.jsonl` files
+* @param typeNames - Baseline type names to load
+* @param snapshot - Baseline schema used to remove fields introduced by pending migrations
+* @returns Seed rows keyed by type name
+*/
+function loadSnapshotSeedData(dataDir, typeNames, snapshot) {
+	const data = {};
+	for (const typeName of typeNames) {
+		const snapshotType = snapshot?.tables[typeName];
+		const jsonlPath = path.join(dataDir, `${typeName}.jsonl`);
+		let content;
+		try {
+			content = fs.readFileSync(jsonlPath, "utf8").trim();
+		} catch (error) {
+			if (error.code === "ENOENT") {
+				data[typeName] = [];
+				continue;
+			}
+			throw error;
+		}
+		data[typeName] = content ? content.split("\n").map((line, index) => {
+			let value;
+			try {
+				value = JSON.parse(line);
+			} catch (error) {
+				throw new Error(`Invalid JSON in ${jsonlPath} at line ${index + 1}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+			}
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`Invalid seed row in ${jsonlPath} at line ${index + 1}: expected a JSON object`);
+			const row = value;
+			return snapshotType ? projectSeedObject(row, snapshotType.fields, /* @__PURE__ */ new Set(["id"])) : row;
+		}) : [];
+	}
+	return data;
+}
+function projectSeedObject(value, fields, implicitFields = /* @__PURE__ */ new Set()) {
+	return Object.fromEntries(Object.entries(value).flatMap(([fieldName, fieldValue]) => {
+		const field = fields[fieldName];
+		if (!field) return implicitFields.has(fieldName) ? [[fieldName, fieldValue]] : [];
+		return [[fieldName, projectSeedValue(fieldValue, field)]];
+	}));
+}
+function projectSeedValue(value, field) {
+	const fields = field.fields;
+	if (!fields) return value;
+	if (field.array) {
+		if (!Array.isArray(value)) return value;
+		return value.map((entry) => isJsonObject(entry) ? projectSeedObject(entry, fields) : entry);
+	}
+	return isJsonObject(value) ? projectSeedObject(value, fields) : value;
+}
+function isJsonObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Derive insertion order and self-referencing types from a baseline snapshot.
+* @param snapshot - Baseline schema snapshot
+* @returns Dependency-ordered type names and self-referencing types
+*/
+function sortSeedTypesForSnapshot(snapshot) {
+	const typeNames = Object.keys(snapshot.tables);
+	const available = new Set(typeNames);
+	const dependencies = /* @__PURE__ */ new Map();
+	const selfRefTypes = [];
+	for (const [typeName, type] of Object.entries(snapshot.tables)) {
+		const referenced = /* @__PURE__ */ new Set();
+		for (const field of Object.values(type.fields)) {
+			const target = field.foreignKeyType;
+			if (!target) continue;
+			if (target === typeName) selfRefTypes.push(typeName);
+			else if (available.has(target)) referenced.add(target);
+		}
+		dependencies.set(typeName, [...referenced]);
+	}
+	const visited = /* @__PURE__ */ new Set();
+	const order = [];
+	const visit = (typeName) => {
+		if (visited.has(typeName)) return;
+		visited.add(typeName);
+		for (const dependency of dependencies.get(typeName) ?? []) visit(dependency);
+		order.push(typeName);
+	};
+	for (const typeName of typeNames) visit(typeName);
+	return {
+		order,
+		selfRefTypes
+	};
+}
+function temporaryWorkspaceName() {
+	return `migration-test-${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T.Z]/g, "").slice(0, 14)}-${randomBytes(3).toString("hex")}`;
+}
+function stateOrThrow(state) {
+	return assertDefined(state, "migration test runtime was used before preparation");
+}
+/**
+* Require the source workspace to still match the prepared baselines.
+*
+* The source is verified during preparation, but the baseline deploy runs in
+* between; a source deploy in that window would make the clone diverge from
+* the already-deployed baseline schemas.
+* @param state - Prepared migration test runtime state
+* @param prepared - Baselines captured during preparation
+* @param sourceWorkspaceId - Source workspace ID
+*/
+async function assertSourceBaselineFresh(state, prepared, sourceWorkspaceId) {
+	const loaded = state.loaded;
+	const namespaces = getNamespacesWithMigrations(loaded.config, path.dirname(loaded.config.path));
+	const inputs = loaded.application.tailorDBServices.map(toTailorDBDeployInput);
+	const invalidRemote = (await verifyRemoteSchema(state.client, sourceWorkspaceId, namespaces, loaded.config, inputs)).find((check) => check.hasDrift || check.checkpointMissingLocal || check.checkpointRepair);
+	if (invalidRemote) throw new Error(`Source namespace "${invalidRemote.namespace}" changed after migration test preparation. Run the migration test again.`);
+	for (const namespace of namespaces) {
+		const baseline = prepared.baselines.get(namespace.namespace);
+		if (!baseline) continue;
+		const migrationNumber = await fetchRemoteMigrationNumber(state.client, resourceTrn(sourceWorkspaceId, "tailordb", namespace.namespace));
+		if (migrationNumber !== baseline.migrationNumber) throw new Error(`Source namespace "${namespace.namespace}" moved from migration ${baseline.migrationNumber} to ${migrationNumber ?? "none"} after migration test preparation. Run the migration test again.`);
+	}
+	const unmigratedInputs = inputs.filter((input) => !prepared.baselines.has(input.namespace));
+	for (const input of unmigratedInputs) {
+		const snapshot = prepared.baselineSnapshots.get(input.namespace);
+		if (!snapshot) continue;
+		if (compareSnapshots(snapshot, await fetchRemoteSchemaSnapshot(state.client, sourceWorkspaceId, input.namespace)).changes.length > 0) throw new Error(`Source namespace "${input.namespace}" schema changed after migration test preparation. Run the migration test again.`);
+	}
+}
+/**
+* Delete the target workspace's user profile config when one exists.
+*
+* A retained target may carry a user profile config referencing types the
+* baseline deploy replaces; deleting it up front lets the baseline's planAuth
+* see no existing config instead of reordering delete phases.
+* @param state - Prepared migration test runtime state
+* @param targetWorkspaceId - Target workspace ID
+*/
+async function deleteExistingUserProfileConfig(state, targetWorkspaceId) {
+	const auth = state.loaded.application.authService;
+	if (!auth) return;
+	const namespaceName = auth.config.name;
+	if (!await getOrNull(() => state.client.getUserProfileConfig({
+		workspaceId: targetWorkspaceId,
+		namespaceName
+	}))) return;
+	await state.client.deleteUserProfileConfig({
+		workspaceId: targetWorkspaceId,
+		namespaceName
+	});
+}
+function migrationConfig(loaded, namespace) {
+	return (loaded.config.db?.[namespace])?.migration;
+}
+function authExecutionContext(state, namespace, explicitMachineUser) {
+	const auth = state.loaded.application.authService;
+	if (!auth) throw new Error("Auth configuration is required to execute migration test scripts.");
+	const machineUserName = explicitMachineUser ?? getMigrationMachineUser(migrationConfig(state.loaded, namespace), auth.config.machineUsers ? Object.keys(auth.config.machineUsers) : void 0);
+	if (!machineUserName) throw new Error(`No machine user is available for namespace "${namespace}". Pass --machine-user or configure one in auth or db.${namespace}.migration.`);
+	return {
+		authNamespace: auth.config.name,
+		machineUserName
+	};
+}
+async function prepareMigrationTest(options) {
+	const loaded = await loadApplicationNamespaces({ configPath: options.configPath });
+	const configDir = path.dirname(loaded.config.path);
+	const namespaces = getNamespacesWithMigrations(loaded.config, configDir);
+	if (namespaces.length === 0) throw new Error("No TailorDB services with migrations configuration found.");
+	for (const namespace of namespaces) assertValidMigrationFiles(namespace.migrationsDir, namespace.namespace);
+	let seedContext;
+	if (options.data === "seed") {
+		seedContext = await loadSeedContext({ configPath: loaded.config.path });
+		assertSeedDataDirectory(path.join(seedContext.distPath, "data"));
+	}
+	if (options.assertionPath) assertAssertionScript(options.assertionPath);
+	const inputs = loaded.application.tailorDBServices.map(toTailorDBDeployInput);
+	const client = await initOperatorClient(await loadAccessToken({ profile: options.profile }), await loadPlatformClientConfig({ profile: options.profile }));
+	const sourceWorkspaceId = await loadWorkspaceId({
+		workspaceId: options.workspaceId,
+		profile: options.profile
+	});
+	assertTargetWorkspaceDiffers(sourceWorkspaceId, options.targetWorkspaceId);
+	const [workspaceResponse, applicationResponse, targetWorkspaceResponse] = await Promise.all([
+		client.getWorkspace({ workspaceId: sourceWorkspaceId }),
+		client.getApplication({
+			workspaceId: sourceWorkspaceId,
+			applicationName: loaded.config.name
+		}),
+		options.data === "clone" && options.targetWorkspaceId ? client.getWorkspace({ workspaceId: options.targetWorkspaceId }) : Promise.resolve(void 0)
+	]);
+	const sourceWorkspace = assertDefined(workspaceResponse.workspace, `source workspace "${sourceWorkspaceId}" not found`);
+	assertDefined(applicationResponse.application, `application "${loaded.config.name}" not found in source workspace`);
+	const designatedTarget = targetWorkspaceResponse ? assertDefined(targetWorkspaceResponse.workspace, `target workspace "${options.targetWorkspaceId}" not found`) : void 0;
+	const remoteChecks = await verifyRemoteSchema(client, sourceWorkspaceId, namespaces, loaded.config, inputs);
+	const invalidRemote = remoteChecks.find((check) => check.hasDrift || check.checkpointMissingLocal);
+	if (invalidRemote) throw new Error(`Source namespace "${invalidRemote.namespace}" does not match its migration checkpoint. Run 'tailor tailordb migration validate' first.`);
+	const pendingRepair = remoteChecks.find((check) => check.checkpointRepair);
+	if (pendingRepair) throw new Error(`Source namespace "${pendingRepair.namespace}" has a pending migration checkpoint repair. Run 'tailor deploy' against the source workspace first.`);
+	const baselines = /* @__PURE__ */ new Map();
+	const targetSnapshots = /* @__PURE__ */ new Map();
+	const pendingNamespaces = [];
+	for (const namespace of namespaces) {
+		const migrationNumber = await fetchRemoteMigrationNumber(client, resourceTrn(sourceWorkspaceId, "tailordb", namespace.namespace));
+		if (migrationNumber === null) throw new Error(`Source namespace "${namespace.namespace}" has no sdk-migration checkpoint. Deploy or set its migration checkpoint before testing.`);
+		const latest = getLatestMigrationNumber(namespace.migrationsDir);
+		if (migrationNumber > latest) throw new Error(`Source namespace "${namespace.namespace}" is at migration ${migrationNumber}, but the local history ends at ${latest}.`);
+		const snapshot = reconstructSnapshotFromMigrations(namespace.migrationsDir, migrationNumber);
+		if (!snapshot) throw new Error(`No migration baseline snapshot found for namespace "${namespace.namespace}".`);
+		baselines.set(namespace.namespace, {
+			migrationNumber,
+			snapshot,
+			historyId: snapshot.rebaseline?.historyId ?? null
+		});
+		const targetSnapshot = reconstructSnapshotFromMigrations(namespace.migrationsDir, latest);
+		if (!targetSnapshot) throw new Error(`No target migration snapshot found for namespace "${namespace.namespace}".`);
+		targetSnapshots.set(namespace.namespace, targetSnapshot);
+		if (migrationNumber < latest) pendingNamespaces.push(namespace.namespace);
+	}
+	if (pendingNamespaces.length === 0) throw new Error("No pending TailorDB migrations found in the source workspace.");
+	const baselineSnapshots = await createMigrationTestBaselineSnapshots({
+		client,
+		workspaceId: sourceWorkspaceId,
+		dataMode: options.data,
+		inputs,
+		baselines
+	});
+	const prepared = {
+		sourceWorkspaceId,
+		sourceApplicationName: loaded.config.name,
+		temporaryWorkspace: {
+			name: temporaryWorkspaceName(),
+			region: sourceWorkspace.region,
+			...sourceWorkspace.organizationId ? { organizationId: sourceWorkspace.organizationId } : {},
+			...sourceWorkspace.folderId ? { folderId: sourceWorkspace.folderId } : {}
+		},
+		baselines,
+		baselineSnapshots,
+		targetSnapshots,
+		pendingNamespaces,
+		...designatedTarget ? { designatedTarget: {
+			id: designatedTarget.id,
+			region: designatedTarget.region
+		} } : {}
+	};
+	return {
+		state: {
+			client,
+			loaded,
+			options,
+			...seedContext ? { seedContext } : {}
+		},
+		prepared
+	};
+}
+/**
+* Create the platform operations used by `tailordb migration test`.
+* @returns Migration test dependencies backed by the Operator API
+*/
+function createMigrationTestDependencies() {
+	let runtimeState;
+	return {
+		prepare: async (options) => {
+			const { state, prepared } = await prepareMigrationTest(options);
+			runtimeState = state;
+			return prepared;
+		},
+		createWorkspace: async (prepared) => {
+			const workspace = await createValidatedWorkspaceWithClient(stateOrThrow(runtimeState).client, prepared.temporaryWorkspace);
+			logger.info(`Created temporary workspace ${workspace.name} (${workspace.id}).`);
+			return {
+				id: workspace.id,
+				name: workspace.name
+			};
+		},
+		deployBaseline: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			await deleteExistingUserProfileConfig(state, targetWorkspaceId);
+			await deployMigrationTestBaseline({
+				configPath: state.loaded.config.path,
+				profile: state.options.profile,
+				workspaceId: targetWorkspaceId,
+				yes: true
+			}, prepared.baselines, prepared.baselineSnapshots);
+			for (const [namespace, baseline] of prepared.baselines) await updateMigrationLabel(state.client, targetWorkspaceId, namespace, baseline.migrationNumber, baseline.historyId ?? void 0);
+		},
+		seedData: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			const seedContext = assertDefined(state.seedContext, "seed context missing after migration test preparation");
+			const dataDir = path.join(seedContext.distPath, "data");
+			assertSeedDataDirectory(dataDir);
+			const seedSnapshots = new Map(state.loaded.application.tailorDBServices.map((service) => {
+				const baseline = prepared.baselines.get(service.namespace);
+				const input = toTailorDBDeployInput(service);
+				return [service.namespace, baseline?.snapshot ?? normalizeSchemaSnapshot({
+					version: 1,
+					namespace: service.namespace,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					tables: input.types
+				})];
+			}));
+			for (const [namespace, snapshot] of seedSnapshots) {
+				const { order, selfRefTypes } = sortSeedTypesForSnapshot(snapshot);
+				const data = loadSnapshotSeedData(dataDir, order, snapshot);
+				const typesWithData = order.filter((typeName) => (data[typeName]?.length ?? 0) > 0);
+				if (typesWithData.length === 0) continue;
+				const bundled = await bundleSeedScript(namespace, typesWithData, path.dirname(state.loaded.config.path));
+				const chunks = chunkSeedData({
+					data,
+					order,
+					codeByteSize: new TextEncoder().encode(bundled.bundledCode).length
+				});
+				const auth = authExecutionContext(state, namespace, state.options.machineUser ?? seedContext.machineUserName);
+				for (const chunk of chunks) {
+					const execution = await executeScript({
+						client: state.client,
+						workspaceId: targetWorkspaceId,
+						name: `migration-test-seed-${namespace}.ts`,
+						code: bundled.bundledCode,
+						arg: {
+							data: chunk.data,
+							order: chunk.order,
+							selfRefTypes,
+							upsert: false
+						},
+						invoker: {
+							namespace: auth.authNamespace,
+							machineUserName: auth.machineUserName
+						}
+					});
+					if (!execution.success) throw new Error(execution.error ?? `Seed execution failed for namespace "${namespace}".`);
+					if (JSON.parse(execution.result || "{}").success !== true) throw new Error(`Seed execution reported failure for namespace "${namespace}".`);
+				}
+			}
+		},
+		cloneData: async ({ prepared, sourceWorkspaceId, targetWorkspaceId, applicationName }) => {
+			const state = stateOrThrow(runtimeState);
+			await assertSourceBaselineFresh(state, prepared, sourceWorkspaceId);
+			logger.warn("Clone mode copies TailorDB records only; IdP users and file blobs are not copied.");
+			let operationId;
+			try {
+				operationId = (await state.client.cloneApplicationData({
+					sourceWorkspaceId,
+					sourceApplicationName: applicationName,
+					targetWorkspaceId,
+					targetApplicationName: applicationName
+				})).operationId;
+			} catch (error) {
+				if (error instanceof ConnectError && error.code === Code.Unimplemented) throw new Error("Application data clone is not enabled for this platform. Retry with '--data seed'.", { cause: error });
+				throw error;
+			}
+			if (!operationId) throw new Error("Application data clone returned no operation ID.");
+			await waitForCloneApplicationData(state.client, {
+				sourceWorkspaceId,
+				targetWorkspaceId,
+				operationId
+			});
+		},
+		deployMigrations: async ({ prepared, targetWorkspaceId }) => {
+			const state = stateOrThrow(runtimeState);
+			await deployMigrationTestTarget({
+				configPath: state.loaded.config.path,
+				profile: state.options.profile,
+				workspaceId: targetWorkspaceId,
+				yes: true
+			}, prepared.targetSnapshots);
+		},
+		runAssertion: async ({ prepared, targetWorkspaceId, assertionPath, assertionNamespace, machineUser }) => {
+			const state = stateOrThrow(runtimeState);
+			const namespace = resolveAssertionNamespace(prepared.pendingNamespaces, assertionNamespace);
+			const auth = authExecutionContext(state, namespace, machineUser);
+			const bundled = await bundleMigrationScript(assertionPath, namespace, 0, state.loaded.config.env ?? {}, path.dirname(state.loaded.config.path));
+			const execution = await executeScript({
+				client: state.client,
+				workspaceId: targetWorkspaceId,
+				name: `migration-test-assert-${namespace}.ts`,
+				code: bundled.bundledCode,
+				invoker: {
+					namespace: auth.authNamespace,
+					machineUserName: auth.machineUserName
+				}
+			});
+			if (!execution.success) throw new Error(execution.error ?? `Migration assertion failed for namespace "${namespace}".`);
+		},
+		deleteWorkspace: async (workspaceId) => {
+			await stateOrThrow(runtimeState).client.deleteWorkspace({ workspaceId });
+		}
+	};
+}
+
+//#endregion
+//#region src/cli/commands/tailordb/migrate/test.ts
+/**
+* Run pending migrations against an isolated target workspace.
+* @param options - Migration test options
+* @param dependencies - Runtime operations used by the migration test
+* @returns Migration test result
+*/
+async function runMigrationTest(options, dependencies = createMigrationTestDependencies()) {
+	if (options.targetWorkspaceId && !options.yes) throw new Error("--target-workspace-id requires --yes because the target may be overwritten.");
+	if (options.keep && options.targetWorkspaceId) throw new Error("--keep applies only to automatically created workspaces; a designated target is always retained.");
+	if (options.assertionNamespace && !options.assertionPath) throw new Error("--assert is required when --assert-namespace is provided.");
+	const prepared = await dependencies.prepare(options);
+	assertTargetWorkspaceDiffers(prepared.sourceWorkspaceId, options.targetWorkspaceId);
+	if (options.assertionPath) resolveAssertionNamespace(prepared.pendingNamespaces, options.assertionNamespace);
+	if (options.data === "clone" && options.targetWorkspaceId) {
+		const target = assertDefined(prepared.designatedTarget, "designated clone target was not loaded during preparation");
+		assertCloneTargetRegion(prepared.temporaryWorkspace.region, target.region);
+	}
+	const temporary = options.targetWorkspaceId === void 0;
+	const workspace = temporary ? await dependencies.createWorkspace(prepared) : {
+		id: assertDefined(options.targetWorkspaceId, "designated target workspace missing"),
+		name: void 0
+	};
+	let primaryError;
+	let failed = false;
+	let deleted = false;
+	try {
+		const target = {
+			prepared,
+			targetWorkspaceId: workspace.id
+		};
+		await dependencies.deployBaseline(target);
+		const dataTarget = {
+			...target,
+			sourceWorkspaceId: prepared.sourceWorkspaceId,
+			applicationName: prepared.sourceApplicationName
+		};
+		if (options.data === "clone") await dependencies.cloneData(dataTarget);
+		else await dependencies.seedData(dataTarget);
+		await dependencies.deployMigrations(target);
+		if (options.assertionPath) await dependencies.runAssertion({
+			...target,
+			assertionPath: options.assertionPath,
+			assertionNamespace: options.assertionNamespace,
+			machineUser: options.machineUser
+		});
+	} catch (error) {
+		primaryError = error;
+		failed = true;
+	}
+	if (temporary && options.keep) logger.info(`Keeping temporary workspace ${workspace.name ?? workspace.id}.`);
+	else if (temporary) try {
+		await dependencies.deleteWorkspace(workspace.id);
+		deleted = true;
+	} catch (cleanupError) {
+		if (!failed) throw new Error(`Failed to delete temporary workspace ${workspace.id}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+		logger.warn(`Failed to delete temporary workspace ${workspace.id}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+	}
+	if (failed) throw primaryError;
+	return {
+		success: true,
+		workspaceId: workspace.id,
+		...workspace.name ? { workspaceName: workspace.name } : {},
+		temporary,
+		deleted,
+		data: options.data,
+		pendingNamespaces: prepared.pendingNamespaces
+	};
+}
+async function migrationTest(options) {
+	logBetaWarning("tailordb migration");
+	const result = await runMigrationTest(options);
+	if (options.json) {
+		logger.out(result);
+		return;
+	}
+	logger.success(`Pending migrations completed in workspace ${result.workspaceName ?? result.workspaceId}.`);
+}
+const testCommand = defineAppCommand({
+	name: "test",
+	description: "Test pending migrations with seed fixtures or cloned data in a temporary workspace.",
+	notes: "The source workspace is read-only. Without --target-workspace-id, the command creates a workspace in the source workspace's region and deletes it after success or failure; pass --keep to retain it for inspection. A designated target is retained and requires --yes. Clone mode copies TailorDB records only; it does not copy IdP users or file blobs.",
+	args: z.strictObject({
+		...deploymentArgs,
+		yes: arg(z.boolean().default(false), {
+			alias: "y",
+			description: "Acknowledge that a designated target workspace may be overwritten"
+		}),
+		data: arg(z.enum(["seed", "clone"]).default("seed"), { description: "Data source for the migration test (seed or clone)" }),
+		"target-workspace-id": arg(z.uuid().optional(), { description: "Existing throwaway workspace to retain after the test (requires --yes)" }),
+		keep: arg(z.boolean().default(false), { description: "Keep the automatically created workspace after the test" }),
+		assert: arg(z.string().optional(), {
+			description: "Path to a TypeScript assertion script to run after migrations",
+			completion: {
+				type: "file",
+				extensions: ["ts"]
+			}
+		}),
+		"assert-namespace": arg(z.string().optional(), { description: "TailorDB namespace exposed to the assertion script" }),
+		"machine-user": arg(z.string().optional(), { description: "Machine user for seed and assertion script execution" })
+	}),
+	run: async (args) => {
+		await assertWritable({ profile: args.profile });
+		await migrationTest({
+			configPath: args.config,
+			workspaceId: args["workspace-id"],
+			profile: args.profile,
+			data: args.data,
+			targetWorkspaceId: args["target-workspace-id"],
+			keep: args.keep,
+			assertionPath: args.assert,
+			assertionNamespace: args["assert-namespace"],
+			machineUser: args["machine-user"],
+			yes: args.yes,
+			json: logger.jsonMode
+		});
+	}
+});
+
 //#endregion
 //#region src/cli/commands/tailordb/migrate/validate.ts
 /**
-* Assert that every migration in the local history whose diff requires a data
-* migration script has a migrate.ts on disk or an explicit skip acknowledgment
+* Walk the local migration history once to assert that every required
+* migration script exists, no migration carries both a --no-script
+* acknowledgment and a migrate.ts, and generated normalization logic has
+* been reviewed, and to collect migrations with data-loss warnings that
+* have neither a migrate.ts nor a recorded --no-script acknowledgment
 * @param {string} migrationsDir - Migrations directory path
 * @param {string} namespace - TailorDB namespace (for error messages)
+* @param {string} [configPath] - Config path the current run used (for remediation hints)
+* @returns {UnacknowledgedWarningMigration[]} Unacknowledged warning migrations in the local history
 */
-function assertRequiredMigrationScripts(migrationsDir, namespace) {
+function assertMigrationScriptsReady(migrationsDir, namespace, configPath) {
 	const missing = [];
+	const conflicting = [];
+	const unreviewed = [];
+	const unacknowledgedWarnings = [];
 	for (const file of getMigrationFiles(migrationsDir)) {
 		if (file.type !== "diff") continue;
 		const diff = loadDiff(file.path);
-		if (!diff.requiresMigrationScript || diff.scriptSkipped) continue;
-		if (!fs.existsSync(getMigrationFilePath(migrationsDir, file.number, "migrate"))) missing.push(file.number);
+		const migrateFilePath = getMigrationFilePath(migrationsDir, file.number, "migrate");
+		const hasScript = fs.existsSync(migrateFilePath);
+		if (diff.requiresMigrationScript && !diff.scriptSkipped && !hasScript) missing.push(file.number);
+		if (diff.scriptSkipped && hasScript) conflicting.push(file.number);
+		if (hasScript && fs.readFileSync(migrateFilePath, "utf8").includes("TODO(tailor-migration-review)")) unreviewed.push(file.number);
+		if (diff.hasWarnings && !diff.scriptSkipped && !hasScript) unacknowledgedWarnings.push({
+			migrationNumber: file.number,
+			warnings: diff.warnings
+		});
 	}
 	if (missing.length > 0) throw new Error(`Migration(s) ${missing.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" require a migration script but have no migrate.ts. Add one with 'tailor tailordb migration script <number>', or record that no script is needed with 'tailor tailordb migration script <number> --no-script --reason "..."'.`);
+	if (conflicting.length > 0) {
+		const clearCommands = conflicting.map((migrationNumber) => `  ${formatMigrationScriptCommand({
+			migrationNumber,
+			namespace,
+			configPath
+		})}`).join("\n");
+		throw new Error(`Migration(s) ${conflicting.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" have both a --no-script skip acknowledgment and migrate.ts. Clear the stale acknowledgment(s):
+${clearCommands}\nOr delete migrate.ts to keep the skip.`);
+	}
+	if (unreviewed.length > 0) throw new Error(`Migration(s) ${unreviewed.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" contain generated normalization logic that still requires review in migrate.ts. Review each ${MIGRATION_REVIEW_REQUIRED_MARKER} marker, then remove the marker and its associated \`never\` annotation.`);
+	return unacknowledgedWarnings;
 }
 /**
 * Build per-namespace reports from the checks that completed
@@ -6038,7 +6936,7 @@ function assertRequiredMigrationScripts(migrationsDir, namespace) {
 * @returns {NamespaceValidationReport[]} Validation reports per namespace
 */
 function buildValidationReports(options) {
-	const { targetNamespaces, migrationFileErrors, localResults, remoteResults } = options;
+	const { targetNamespaces, migrationFileErrors, localResults, remoteResults, unacknowledgedWarnings } = options;
 	return targetNamespaces.map((target) => {
 		const fileError = migrationFileErrors.get(target.namespace);
 		if (fileError !== void 0) return {
@@ -6068,14 +6966,25 @@ function buildValidationReports(options) {
 			hasDrift: remote.hasDrift,
 			drifts: remote.drifts,
 			...remote.skipped ? { skipped: remote.skipped } : {},
-			...checkpointMissingLocal ? { checkpointMissingLocal: true } : {}
+			...checkpointMissingLocal ? { checkpointMissingLocal: true } : {},
+			...remote.checkpointRepair ? { checkpointRepair: remote.checkpointRepair } : {}
 		};
+		const candidates = unacknowledgedWarnings?.get(target.namespace);
+		let warningAcknowledgments;
+		if (candidates !== void 0) {
+			const missing = candidates.filter((candidate) => candidate.migrationNumber > remote.remoteMigrationNumber);
+			warningAcknowledgments = {
+				valid: missing.length === 0,
+				missing
+			};
+		}
 		return {
 			namespace: target.namespace,
-			valid: !localSchema.hasDiff && !remoteSchema.hasDrift && !checkpointMissingLocal,
+			valid: !localSchema.hasDiff && !remoteSchema.hasDrift && !checkpointMissingLocal && warningAcknowledgments?.valid !== false,
 			migrationFiles: { valid: true },
 			localSchema,
-			remoteSchema
+			remoteSchema,
+			...warningAcknowledgments ? { warningAcknowledgments } : {}
 		};
 	});
 }
@@ -6091,7 +7000,7 @@ async function collectValidationReports(options) {
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-Af1zIqSI.mjs");
+	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6106,10 +7015,12 @@ async function collectValidationReports(options) {
 	const typesByNamespace = new Map(tailorDBInputs.map((input) => [input.namespace, input.types]));
 	const migrationFileErrors = /* @__PURE__ */ new Map();
 	const checkableNamespaces = [];
+	const unacknowledgedWarnings = options.strict ? /* @__PURE__ */ new Map() : void 0;
 	for (const target of targetNamespaces) try {
 		assertValidMigrationFiles(target.migrationsDir, target.namespace);
 		reconstructSnapshotFromMigrations(target.migrationsDir);
-		assertRequiredMigrationScripts(target.migrationsDir, target.namespace);
+		const namespaceWarnings = assertMigrationScriptsReady(target.migrationsDir, target.namespace, options.configPath);
+		unacknowledgedWarnings?.set(target.namespace, namespaceWarnings);
 		checkableNamespaces.push(target);
 	} catch (error) {
 		migrationFileErrors.set(target.namespace, error instanceof Error ? error.message : String(error));
@@ -6117,7 +7028,8 @@ async function collectValidationReports(options) {
 	const localReportOptions = {
 		targetNamespaces,
 		migrationFileErrors,
-		localResults: await checkMigrationDiffs(typesByNamespace, checkableNamespaces)
+		localResults: await checkMigrationDiffs(typesByNamespace, checkableNamespaces),
+		...unacknowledgedWarnings ? { unacknowledgedWarnings } : {}
 	};
 	if (checkableNamespaces.length === 0) return { reports: buildValidationReports(localReportOptions) };
 	let remoteResults;
@@ -6156,6 +7068,7 @@ function printValidationReports(reports) {
 		else logger.log(`  Local schema: ${styles.success("OK")}`);
 		const remote = report.remoteSchema;
 		if (remote?.skipped === "check_failed") logger.log(`  Remote schema: ${styles.error("not checked")}`);
+		else if (remote?.checkpointRepair) logger.log(`  Remote schema: ${styles.success("OK")} (next deploy will reset the checkpoint to 0000 from ${formatMigrationNumber(remote.checkpointRepair.from)})`);
 		else if (remote?.checkpointMissingLocal) logger.log(`  Remote schema: ${styles.error(`remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)} is not in the local migration history`)}`);
 		else if (remote?.hasDrift) {
 			logger.log(`  Remote schema: ${styles.error("drift detected")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
@@ -6164,14 +7077,36 @@ function printValidationReports(reports) {
 		else if (remote?.skipped === "no_migration_label") logger.log(`  Remote schema: ${styles.dim("skipped (deployed namespace has no migration state)")}`);
 		else if (remote?.skipped === "no_snapshot") logger.log(`  Remote schema: ${styles.dim(`skipped (no local snapshot for remote migration ${formatMigrationNumber(remote.remoteMigrationNumber)})`)}`);
 		else if (remote) logger.log(`  Remote schema: ${styles.success("OK")} (remote migration: ${formatMigrationNumber(remote.remoteMigrationNumber)})`);
+		const acknowledgments = report.warningAcknowledgments;
+		if (acknowledgments) if (acknowledgments.valid) logger.log(`  Warning acknowledgments: ${styles.success("OK")}`);
+		else {
+			logger.log(`  Warning acknowledgments: ${styles.error("missing for pending migration(s) with possible data loss")}`);
+			for (const migration of acknowledgments.missing) {
+				const label = formatMigrationNumber(migration.migrationNumber);
+				for (const warning of migration.warnings) {
+					const field = warning.fieldName ? `.${warning.fieldName}` : "";
+					logger.log(`    ${label}: ${warning.tableName}${field}: ${warning.reason}`);
+				}
+			}
+		}
 	}
 	logger.newline();
 }
-function printResolutionHints(reports) {
+function printResolutionHints(reports, configPath) {
 	if (reports.some((r) => r.localSchema?.hasDiff && !r.localSchema.diff)) logger.info("Run 'tailor tailordb migration generate' to create the initial snapshot.");
 	if (reports.some((r) => r.localSchema?.diff)) logger.info("Run 'tailor tailordb migration generate' to create migration files.");
 	if (reports.some((r) => r.remoteSchema?.checkpointMissingLocal)) logger.info("The remote migration checkpoint is ahead of the local history. Pull the latest migration files, or run 'tailor tailordb migration status' to compare.");
 	if (reports.some((r) => r.remoteSchema?.hasDrift)) logRemoteDriftGuidance();
+	const missingAcknowledgments = reports.filter((r) => r.warningAcknowledgments && !r.warningAcknowledgments.valid);
+	if (missingAcknowledgments.length > 0) {
+		logger.info("For each migration listed, either add a data migration script with 'tailor tailordb migration script <number>' or record why none is needed:");
+		for (const report of missingAcknowledgments) for (const migration of report.warningAcknowledgments?.missing ?? []) logger.info(`  ${formatMigrationScriptCommand({
+			migrationNumber: migration.migrationNumber,
+			namespace: report.namespace,
+			configPath,
+			noScript: true
+		})}`, { mode: "plain" });
+	}
 }
 /**
 * Validate migration files and schema state without deploying
@@ -6186,20 +7121,21 @@ async function validate(options) {
 	else {
 		printValidationReports(reports);
 		if (invalidCount === 0 && !("remoteError" in collected)) logger.success("All migration validation checks passed.");
-		else printResolutionHints(reports);
+		else printResolutionHints(reports, options.configPath);
 	}
 	if ("remoteError" in collected) throw collected.remoteError;
 	if (invalidCount > 0) throw new Error(`Migration validation failed for ${invalidCount} namespace(s)`);
 }
 const validateCommand = defineAppCommand({
 	name: "validate",
-	description: "Validate the full migration history and detect schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
+	description: "Validate the full migration history, unreviewed generated migration scripts, and schema drift (local types vs. migration snapshot, remote schema vs. migration checkpoint) without deploying. This includes the migration and schema-drift checks used by 'deploy' and exits with a non-zero code when issues are found.",
 	args: z.strictObject({
 		...deploymentArgs,
 		namespace: arg(z.string().optional(), {
 			alias: "n",
 			description: "Target TailorDB namespace (validates all namespaces if not specified)"
-		})
+		}),
+		strict: arg(z.boolean().default(false), { description: "Also fail when a pending migration can drop data without an acknowledgment" })
 	}),
 	run: async (args) => {
 		await validate({
@@ -6207,7 +7143,8 @@ const validateCommand = defineAppCommand({
 			namespace: args.namespace,
 			workspaceId: args["workspace-id"],
 			profile: args.profile,
-			json: logger.jsonMode
+			json: logger.jsonMode,
+			strict: args.strict
 		});
 	}
 });
@@ -6219,10 +7156,12 @@ const validateCommand = defineAppCommand({
 *
 * Subcommands:
 * - generate: Generate migration files from schema differences
+* - rebaseline: Collapse the full migration history into a new baseline
 * - script:   Add a migrate.ts template to an existing migration
 * - set:      Set migration checkpoint to a specific number
 * - status:   Show migration status for TailorDB namespaces
 * - sync:     Sync remote TailorDB schema to a specific migration snapshot
+* - test:     Test pending migrations in an isolated workspace
 * - validate: Validate migration files and detect schema drift without deploying
 */
 const migrationCommand = defineCommand({
@@ -6230,10 +7169,12 @@ const migrationCommand = defineCommand({
 	description: "Manage TailorDB schema migrations.",
 	subCommands: {
 		generate: generateCommand$1,
+		rebaseline: rebaselineCommand,
 		script: scriptCommand,
 		set: setCommand,
 		status: statusCommand,
 		sync: syncCommand,
+		test: testCommand,
 		validate: validateCommand
 	}
 });
@@ -6269,7 +7210,7 @@ const upgradeCommand = defineAppCommand({
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-B5WynBHQ.mjs");
+		const { upgrade } = await import("../service-hZskxZmg.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -6773,10 +7714,12 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else if (error instanceof Error) {
 				logger.error(error.message);
+				const hint = typeOnlyImportHint(error);
+				if (hint) logger.log(`  ${styles.info("Suggestion:")} ${hint}`);
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {
-				const { reportCrash } = await import("../crashreport-eI7ty7ok.mjs");
+				const { reportCrash } = await import("../crashreport-CINZ5dVN.mjs");
 				await reportCrash(error, "handledError");
 			}
 		}