@tailor-platform/sdk 2.2.0 → 2.3.0

package/dist/cli/main.mjs

@@ -3,13 +3,13 @@ import { r as parseInputFields } from "../schema--xYWRGfe.mjs";
 import { At as PATScope, Ct as AuthInvokerSchema, E as CustomDomainStatus, Ft as CloneOperationStatus, W as FunctionExecution_Type } from "../workspace_resource_pb-HNIL_Vfj.mjs";
 import { t as assertDefined } from "../assert-DBxo8jPo.mjs";
 import { n as logger, r as styles } from "../logger-DSdExfor.mjs";
-import { $ as treeCommand, $n as formatDiffSummary, An as MIGRATION_NUMBER_PATTERN, Ar as removeLegacyUserAlias, B as MIGRATION_REVIEW_REQUIRED_MARKER, Br as isVerbose, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConsoleBaseUrl, Ct as listCommand$9, Dr as loadWorkspaceId, E as resumeCommand, En as DIFF_FILE_NAME, Er as loadStoredUserTokens, F as chunkSeedData, Fn as compareLocalTypesWithSnapshot, Fr as defineAppCommand, Ft as jobsCommand, G as showCommand, Gn as loadSnapshot, Gr as toPageDirection, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFiles, Hr as pagedLogArgs, Ht as executionsCommand, I as bundleSeedScript, In as compareSnapshots, Ir as commonArgs, Jn as MIGRATION_HISTORY_LABEL_KEY, K as extractOwnedNamespaces, Kn as normalizeSchemaSnapshot, Kr as workspaceArgs, Kt as getCommand$1, Ln as createSnapshotFromLocalTypes, Lr as configArg, M as loadSeedContext, Mn as UnsupportedMigrationFileVersionError, Mr as resolveUserTokenKey, N as loadApplicationNamespaces, Nn as assertMigrationNumberExists, Nr as saveUserTokens, O as listCommand$14, On as MIGRATE_FILE_NAME, Or as platformConfigFromProfile, Ot as webhookCommand, Pn as assertValidMigrationFiles, Pr as writePlatformConfig, Qn as sanitizeMigrationLabel, Qt as listCommand$17, R as generateCommand$1, Rn as formatSchemaDrifts, Rr as confirmationArgs, Rt as startCommand, Sn as protoGqlPermission, Sr as loadConfigPath, St as generate, Tn as DB_TYPES_FILE_NAME, Tr as loadPlatformClientConfig, Tt as getCommand$2, Ur as paginationArgs, V as generateSchemaFile, Vn as getMigrationFilePath, Vr as multiConfigArg, Wn as loadDiff, Wr as resolveMachineUserInputSource, X as updateCommand$3, Xn as createMigrationHistoryId, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_LABEL_KEY, Yt as deployFromCLI, Zn as handleOptionalToRequiredError, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as deleteUserTokens, a as queryCommand, an as ensureConfigId, ar as sdkAppIdLabelKey, bn as compareSnapshotWithRemote, br as hasUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as writeMetadataLabels, ct as getCommand$4, dn as bundleMigrationScript, dr as formatMigrationNumber, en as createCommand$4, er as formatMigrationDiff, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as parseMigrationNumberArg, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as loadConfig, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as assertWritable, in as workspaceNameSchema, ir as resourceTrn, it as updateCommand$2, j as truncateCommand, jn as SCHEMA_FILE_NAME, jr as resolveConfigUser, jt as listCommand$8, kr as readPlatformConfig, kt as triggerCommand, lr as PluginManager, m as restoreCommand, mn as formatRemoteVerificationResults, mr as apiCall, mt as listCommand$11, nr as getNamespacesWithMigrations, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkNameLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as prompt, q as logBetaWarning, qn as reconstructSnapshotFromMigrations, r as serializeError, rn as formatKeyValueTable, rr as selectTargetNamespace, sn as updateMigrationLabel, sr as sdkVersionLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as hasChanges, u as listCommand$16, un as formatMigrationScriptCommand, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as fetchLatestToken, w as waitCommand, wn as captureMigrationFileState, wr as loadMachineUserName, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as loadAccessToken, yn as fetchRemoteMigrationState, yr as hasAnyUserTokenEntry, yt as tokenCommand$1, z as scriptCommand, zn as getLatestMigrationNumber, zr as deploymentArgs } from "../register-ts-hook-CTth1eqj.mjs";
-import { A as getDistDir, B as fetchUserInfo, C as composeFunctionTreeshakeOptions, E as createBundleLog, F as fetchAll, G as initOAuth2Client, H as getOAuth2ClientId, I as fetchAllTolerant, K as initOperatorClient, N as closeConnectionPool, P as defaultPlatformBaseUrl, R as fetchPaged, S as platformBundleDefinePlugin, T as resolveBundleLogLevel, U as getOrNull, W as getPlatformBaseUrl, a as resolveInlineSourcemap, b as createTsconfigPathsPlugin, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as isDefaultPlatform, u as ResolverSchema, w as createLogLevelTreeshakeOptions, x as resolveTSConfigWithFallback, y as createGeneratedEntryResolverPlugin, z as fetchPlatformMachineUserToken } from "../application-BpLeawBg.mjs";
-import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-goqlJJgA.mjs";
+import { $ as treeCommand, $n as sanitizeMigrationLabel, An as MIGRATION_FILE_NAMES, Ar as readPlatformConfig, B as MIGRATION_REVIEW_REQUIRED_MARKER, Bn as getLatestMigrationNumber, Br as deploymentArgs, Bt as getCommand$6, C as healthCommand, Cn as captureFileState, Cr as loadConfigPath, Ct as listCommand$9, Dr as loadStoredUserTokens, E as resumeCommand, Er as loadPlatformClientConfig, F as chunkSeedData, Fn as assertValidMigrationFiles, Fr as writePlatformConfig, Ft as jobsCommand, G as showCommand, Gn as loadDiff, Gr as resolveMachineUserInputSource, Gt as functionExecutionStatusToString, H as deployCommand$1, Hn as getMigrationFilePath, Hr as multiConfigArg, Ht as executionsCommand, I as bundleSeedScript, In as compareLocalTypesWithSnapshot, Ir as defineAppCommand, Jn as reconstructSnapshotFromMigrations, K as extractOwnedNamespaces, Kn as loadSnapshot, Kr as toPageDirection, Kt as getCommand$1, Ln as compareSnapshots, Lr as commonArgs, M as loadSeedContext, Mr as resolveConfigUser, N as loadApplicationNamespaces, Nn as UnsupportedMigrationFileVersionError, Nr as resolveUserTokenKey, O as listCommand$14, Or as loadWorkspaceId, Ot as webhookCommand, Pn as assertMigrationNumberExists, Pr as saveUserTokens, Qn as handleOptionalToRequiredError, Qt as listCommand$17, R as generateCommand$1, Rn as createSnapshotFromLocalTypes, Rr as configArg, Rt as startCommand, Sn as protoGqlPermission, Sr as loadAccessToken, St as generate, Tr as loadMachineUserName, Tt as getCommand$2, Un as getMigrationFiles, Ur as pagedLogArgs, V as generateSchemaFile, Vr as isVerbose, Wr as paginationArgs, X as updateCommand$3, Xn as MIGRATION_LABEL_KEY, Xt as deployMigrationTestBaseline, Y as removeCommand$1, Yn as MIGRATION_HISTORY_LABEL_KEY, Yt as deployFromCLI, Zn as createMigrationHistoryId, Zt as deployMigrationTestTarget, _n as verifyRemoteSchema, _r as loadConfig, a as queryCommand, an as ensureConfigId, ar as resourceTrn, bn as compareSnapshotWithRemote, br as hasAnyUserTokenEntry, bt as listCommand$10, c as removeCommand, cn as executeScript, cr as sdkVersionLabelKey, ct as getCommand$4, dn as bundleMigrationScript, en as createCommand$4, er as formatDiffSummary, et as listCommand$13, f as inviteCommand, fn as checkMigrationDiffs, fr as formatMigrationNumber, ft as createCommand$3, g as getCommand$7, gn as toTailorDBDeployInput, gr as assertWritable, gt as getCommand$3, hn as logRemoteDriftGuidance, hr as apiCall, in as workspaceNameSchema, ir as selectTargetNamespace, it as updateCommand$2, j as truncateCommand, jn as MIGRATION_NUMBER_PATTERN, jr as removeLegacyUserAlias, jt as listCommand$8, kr as platformConfigFromProfile, kt as triggerCommand, lr as writeMetadataLabels, m as restoreCommand, mn as formatRemoteVerificationResults, mr as prompt, mt as listCommand$11, nr as hasChanges, nt as getCommand$5, o as updateCommand$4, on as getMigrationMachineUser, or as sdkAppIdLabelKey, ot as listCommand$12, pn as fetchRemoteSchemaSnapshot, pr as parseMigrationNumberArg, q as logBetaWarning, qn as normalizeSchemaSnapshot, qr as workspaceArgs, r as serializeError, rn as formatKeyValueTable, rr as getNamespacesWithMigrations, sn as updateMigrationLabel, sr as sdkNameLabelKey, t as registerTsHook, tn as createValidatedWorkspaceWithClient, tr as formatMigrationDiff, u as listCommand$16, un as formatMigrationScriptCommand, ur as PluginManager, ut as deleteCommand$4, v as deleteCommand$5, vn as fetchRemoteMigrationNumber, vr as deleteUserTokens, w as waitCommand, wn as captureMigrationFileState, wr as loadConsoleBaseUrl, x as listCommand$15, xn as generateAllTypeManifestsFromSnapshot, xr as hasUserTokenEntry, yn as fetchRemoteMigrationState, yr as fetchLatestToken, yt as tokenCommand$1, z as scriptCommand, zn as formatSchemaDrifts, zr as confirmationArgs } from "../register-ts-hook-ClI226n2.mjs";
+import { B as fetchPaged, C as resolveTSConfigWithFallback, D as resolveBundleLogLevel, E as createLogLevelTreeshakeOptions, F as closeConnectionPool, G as getOrNull, H as fetchUserInfo, I as defaultPlatformBaseUrl, J as initOperatorClient, K as getPlatformBaseUrl, L as fetchAll, M as getDistDir, O as createBundleLog, R as fetchAllTolerant, S as createTsconfigPathsPlugin, T as composeFunctionTreeshakeOptions, V as fetchPlatformMachineUserToken, W as getOAuth2ClientId, Y as isDefaultPlatform, a as resolveInlineSourcemap, c as WorkflowJobSchema, f as INVOKER_EXPR, g as assertUniqueLocalTailorDBTypeNames, h as buildResolverPermissionAndInputCheckExpr, l as resolveResolverDefaultPermissionForFile, q as initOAuth2Client, u as ResolverSchema, w as platformBundleDefinePlugin, x as createGeneratedEntryResolverPlugin } from "../application-F-nl107y.mjs";
+import { h as loadFilesWithIgnores, i as ExecutorSchema, r as stripExecutorTriggerArgs } from "../service-C_WpbKHu.mjs";
 import { t as multiline } from "../multiline-sfHpTZZK.mjs";
 import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";
 import { t as userAgent } from "../user-agent-Bgsszb5I.mjs";
-import { i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-CWj21238.mjs";
+import { a as typeOnlyImportHint, i as isCLIError, r as formatNextAction, t as createCLIError } from "../errors-BVb6vYGy.mjs";
 import { t as OperatorService } from "../service_pb-BEWj1pOV.mjs";
 import { a as JSON_FOOTER_MARKER, i as CRASH_LOG_EXTENSION, o as parseCrashReportConfig, r as sendCrashReport, t as initCrashReporting } from "../crashreport-CIIfLnoO.mjs";
 import * as path from "pathe";
@@ -3818,6 +3818,14 @@ function detectDefaultBranch(cwd, run = defaultGitRunner) {
 const LOCK_VERSION = 1;
 /** Lock file path, relative to the repository root. */
 const LOCK_FILENAME = ".github/tailor.lock";
+function assertSafeLockPath(outputDir) {
+	for (const relativePath of [".github", LOCK_FILENAME]) try {
+		if (fs.lstatSync(path.join(outputDir, relativePath)).isSymbolicLink()) throw new Error(`Refusing to use ${LOCK_FILENAME}: "${relativePath}" is a symbolic link.`);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") continue;
+		throw error;
+	}
+}
 /**
 * Compute the lock content hash for a rendered workflow file.
 * @param content - File content to hash
@@ -3843,6 +3851,7 @@ function lockPath(outputDir) {
 * @returns Parsed lock file, or null when absent
 */
 function readLock(outputDir) {
+	assertSafeLockPath(outputDir);
 	const file = lockPath(outputDir);
 	if (!fs.existsSync(file)) return null;
 	let parsed;
@@ -3862,6 +3871,7 @@ function readLock(outputDir) {
 * @param lock - Lock file contents to serialize
 */
 function writeLock(outputDir, lock) {
+	assertSafeLockPath(outputDir);
 	const file = lockPath(outputDir);
 	fs.mkdirSync(path.dirname(file), { recursive: true });
 	fs.writeFileSync(file, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
@@ -3880,23 +3890,23 @@ function findTarget(lock, kind, workspaceName) {
 
 //#endregion
 //#region src/cli/commands/setup/action.yml
-var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
+var action_default = "# __HEADER__\nname: __WORKSPACE_NAME__\ndescription: >-\n  Deploy __WORKSPACE_NAME__ to Tailor Platform.\n  Checkout and dependency installation are expected to be handled by the caller.\n\ninputs:\n  workspace-id:\n    description: Tailor Platform workspace id\n    required: true\n  name:\n    description: Workspace name (used in Slack notifications)\n    required: true\n  working-directory:\n    description: App directory relative to the repository root\n    required: false\n    default: \".\"\n  config:\n    description: SDK config path, or comma-separated config paths for multi-config deploys\n    required: false\n    default: \"tailor.config.ts\"\n  deploy:\n    description: Whether to run the Tailor deploy step after build steps\n    required: false\n    default: \"true\"\n  build-site:\n    description: Whether to run the static website build slot when present\n    required: false\n    default: \"true\"\n  platform-client-id:\n    description: Machine-user client id\n    required: true\n  platform-client-secret:\n    description: Machine-user client secret\n    required: true\n  slack-token:\n    description: Slack bot token\n    required: false\n  slack-channel-id:\n    description: Slack channel id\n    required: false\n  user-mapping:\n    description: JSON string mapping GitHub usernames to Slack user IDs\n    required: false\n  package-manager:\n    description: Package manager used for dependency installation (pnpm, npm, yarn, bun)\n    required: false\n    default: pnpm\n\noutputs:\n  app-url:\n    description: Deployed application URL\n    value: ${{ steps.tailor-apply.outputs.app-url }}\n\nruns:\n  using: composite\n  steps:\n    # __STATIC_WEBSITE_BUILD_START__\n    - id: build-site\n      if: inputs.build-site == 'true'\n      shell: bash\n      run: |\n        # Replace with your static website build command.\n        # Example: pnpm --filter <package-name> run build:static\n        # Note: this run: command is user-editable. Custom build commands are preserved across\n        # reruns and are not treated as drift by setup check. Other edits to this file are flagged\n        # as drift and will be overwritten if you re-run setup action with --force.\n        true\n    # __STATIC_WEBSITE_BUILD_END__\n    - id: tailor-apply\n      if: inputs.deploy == 'true'\n      uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n      env:\n        TAILOR_PLATFORM_SDK_CONFIG_PATH: ${{ inputs.config }}\n      with:\n        workspace-id: ${{ inputs.workspace-id }}\n        working-directory: ${{ inputs.working-directory }}\n        package-manager: ${{ inputs.package-manager }}\n        platform-client-id: ${{ inputs.platform-client-id }}\n        platform-client-secret: ${{ inputs.platform-client-secret }}\n    - id: tailor-notify\n      if: failure() && inputs.slack-token != '' && inputs.slack-channel-id != ''\n      uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n      with:\n        provider: slack\n        status: failure\n        workspace-name: ${{ inputs.name }}\n        slack-token: ${{ inputs.slack-token }}\n        slack-channel-id: ${{ inputs.slack-channel-id }}\n        user-mapping: ${{ inputs.user-mapping }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/branch.workflow.yml
-var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx @tailor-platform/sdk \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bun run tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var branch_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  # __PULL_REQUEST_END__\n  push:\n    branches: [\"__BRANCH__\"]\n    # __PATHS__\n  workflow_dispatch:\n    # __DISPATCH_INPUTS_START__\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n    # __DISPATCH_INPUTS_END__\n\npermissions:\n  contents: read\n\njobs:\n  # __PLAN_JOB_START__\n  tailor-plan:\n    if: >-\n      github.event_name == 'pull_request' ||\n      (github.event_name == 'workflow_dispatch' && inputs['dry-run'])\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        # Fork PRs cannot read secrets; the checks above still run for them.\n        if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork\n        uses: tailor-platform/actions/plan@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n  # __PLAN_JOB_END__\n  # __ERD_PREVIEW_JOB_START__\n  tailor-erd-preview-matrix:\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      namespaces: ${{ steps.tailor-erd-preview-matrix.outputs.namespaces }}\n      base-app-dir: ${{ steps.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-erd-preview-matrix\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          WORKSPACE_NAME: \"__WORKSPACE_NAME__\"\n        run: |\n          set -euo pipefail\n          node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const appDir = process.env.APP_DIR || \".\";\n          const workspaceName = process.env.WORKSPACE_NAME;\n          const output = process.env.GITHUB_OUTPUT;\n          const dirPattern = /^[A-Za-z0-9._/-]+$/;\n          const namespacePattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n          function lockTarget(file) {\n            try {\n              const lock = JSON.parse(fs.readFileSync(file, \"utf8\"));\n              return lock.targets?.find(\n                (candidate) =>\n                  candidate.kind === \"branch\" &&\n                  candidate.workspaceName === workspaceName,\n              );\n            } catch (error) {\n              if (error && error.code === \"ENOENT\") return undefined;\n              throw error;\n            }\n          }\n\n          function namespacesFromTarget(target, label) {\n            const namespaces =\n              target?.inputs?.erdPreview === true && Array.isArray(target.inputs?.erdNamespaces)\n                ? target.inputs.erdNamespaces\n                : [];\n            for (const namespace of namespaces) {\n              if (typeof namespace !== \"string\" || !namespacePattern.test(namespace)) {\n                throw new Error(`Invalid ERD namespace in ${label}: ${String(namespace)}`);\n              }\n            }\n            return namespaces;\n          }\n\n          function normalizeDir(value, label) {\n            const raw = typeof value === \"string\" && value.length > 0 ? value : appDir;\n            const normalized =\n              raw.replaceAll(\"\\\\\", \"/\").replace(/\\/{2,}/g, \"/\").replace(/^\\.\\//, \"\").replace(/\\/$/, \"\") ||\n              \".\";\n            if (\n              !dirPattern.test(normalized) ||\n              normalized.startsWith(\"/\") ||\n              normalized.split(\"/\").includes(\"..\")\n            ) {\n              throw new Error(`Invalid ERD app dir in ${label}: ${raw}`);\n            }\n            return normalized;\n          }\n\n          const headTarget = lockTarget(\".github/tailor.lock\");\n          const baseTarget = lockTarget(\".tailor-erd-base/.github/tailor.lock\");\n          const baseAppDir = normalizeDir(baseTarget?.inputs?.dir, \"base setup lock\");\n          const namespaces = [\n            ...new Set([\n              ...namespacesFromTarget(headTarget, \"head setup lock\"),\n              ...namespacesFromTarget(baseTarget, \"base setup lock\"),\n            ]),\n          ].sort((a, b) => a.localeCompare(b));\n\n          if (namespaces.length === 0) {\n            console.error(\"No ERD preview namespaces found in the head or base setup lock.\");\n            process.exit(1);\n          }\n\n          fs.appendFileSync(output, `namespaces=${JSON.stringify(namespaces)}\\n`);\n          fs.appendFileSync(output, `base-app-dir=${baseAppDir}\\n`);\n          NODE\n\n  tailor-erd-preview:\n    needs: tailor-erd-preview-matrix\n    if: github.event_name == 'pull_request'\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    strategy:\n      fail-fast: false\n      matrix:\n        namespace: ${{ fromJSON(needs.tailor-erd-preview-matrix.outputs.namespaces) }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          persist-credentials: false\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-checkout-base\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          repository: ${{ github.event.pull_request.base.repo.full_name }}\n          ref: ${{ github.event.pull_request.base.sha }}\n          path: .tailor-erd-base\n          persist-credentials: false\n      - id: tailor-detect-base-package-manager\n        shell: bash\n        run: |\n          set -euo pipefail\n          cd .tailor-erd-base\n          base_package_manager=\"$(\n            if [ -f pnpm-lock.yaml ]; then\n              echo pnpm\n            elif [ -f yarn.lock ]; then\n              echo yarn\n            elif [ -f bun.lockb ] || [ -f bun.lock ]; then\n              echo bun\n            elif [ -f package-lock.json ]; then\n              echo npm\n            else\n              echo \"__PACKAGE_MANAGER__\"\n            fi\n          )\"\n          echo \"package-manager=$base_package_manager\" >> \"$GITHUB_OUTPUT\"\n          if [ \"$base_package_manager\" = \"pnpm\" ]; then\n            base_pnpm_version=\"$(node <<'NODE'\n          const fs = require(\"node:fs\");\n\n          const fallback = \"10\";\n\n          function readManifest(file) {\n            try {\n              return JSON.parse(fs.readFileSync(file, \"utf8\"));\n            } catch {\n              return {};\n            }\n          }\n\n          function pnpmVersion(manifest) {\n            const packageManager = manifest.packageManager;\n            if (typeof packageManager === \"string\" && packageManager.startsWith(\"pnpm@\")) {\n              return packageManager.slice(\"pnpm@\".length).split(\"+\")[0];\n            }\n\n            const devPackageManager = manifest.devEngines?.packageManager;\n            if (devPackageManager?.name === \"pnpm\" && devPackageManager.version) {\n              return devPackageManager.version;\n            }\n\n            return undefined;\n          }\n\n          process.stdout.write(\n            pnpmVersion(readManifest(\"package.json\")) ?? fallback,\n          );\n          NODE\n          )\"\n            echo \"pnpm-version=$base_pnpm_version\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-setup-base-pnpm\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'pnpm'\n        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${{ steps.tailor-detect-base-package-manager.outputs['pnpm-version'] }}\n          package_json_file: .tailor-erd-base/package.json\n          run_install: false\n      - id: tailor-setup-base-node\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] != 'bun'\n        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7\n        with:\n          node-version-file: .tailor-erd-base/package.json\n      - id: tailor-setup-base-yarn\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'yarn'\n        shell: bash\n        working-directory: .tailor-erd-base\n        run: |\n          set -euo pipefail\n          corepack enable\n      - id: tailor-setup-base-bun\n        if: steps.tailor-detect-base-package-manager.outputs['package-manager'] == 'bun'\n        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0\n      - id: tailor-install-base\n        shell: bash\n        working-directory: .tailor-erd-base\n        env:\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n        run: |\n          set -euo pipefail\n          case \"$BASE_PACKAGE_MANAGER\" in\n            pnpm) pnpm install --frozen-lockfile ;;\n            npm) npm ci ;;\n            yarn)\n              if grep -q '^__metadata:' yarn.lock; then\n                yarn install --immutable\n              else\n                yarn install --frozen-lockfile\n              fi\n              ;;\n            bun) bun install --frozen-lockfile ;;\n            *)\n              echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n              exit 1\n              ;;\n          esac\n      - id: tailor-restore-head-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-build-erd-preview\n        shell: bash\n        env:\n          APP_DIR: \"__APP_DIR__\"\n          BASE_APP_DIR: ${{ needs.tailor-erd-preview-matrix.outputs['base-app-dir'] }}\n          BASE_PACKAGE_MANAGER: ${{ steps.tailor-detect-base-package-manager.outputs['package-manager'] }}\n          NAMESPACE: ${{ matrix.namespace }}\n        run: |\n          set -euo pipefail\n\n          run_tailor_cli() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec tailor \"$@\" ;;\n              npm) npx @tailor-platform/sdk \"$@\" ;;\n              yarn) yarn tailor \"$@\" ;;\n              bun) bun run tailor \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          run_head_node() {\n            case \"__PACKAGE_MANAGER__\" in\n              pnpm) pnpm exec node \"$@\" ;;\n              npm) node \"$@\" ;;\n              yarn) yarn node \"$@\" ;;\n              bun) node \"$@\" ;;\n              *)\n                echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                exit 1\n                ;;\n            esac\n          }\n\n          tailor_cli_bin=\"$(\n            run_head_node - <<'NODE'\n          const path = require(\"node:path\");\n          const { createRequire } = require(\"node:module\");\n          const appDir = process.env.APP_DIR || \".\";\n          const githubWorkspace = process.env.GITHUB_WORKSPACE;\n          if (!githubWorkspace) {\n            throw new Error(\"GITHUB_WORKSPACE is required.\");\n          }\n\n          let lastError;\n          for (const manifestPath of [\n            path.join(githubWorkspace, appDir, \"package.json\"),\n            path.join(githubWorkspace, \"package.json\"),\n          ]) {\n            try {\n              const requireFromManifest = createRequire(manifestPath);\n              process.stdout.write(\n                path.join(\n                  path.dirname(requireFromManifest.resolve(\"@tailor-platform/sdk/cli\")),\n                  \"index.mjs\",\n                ),\n              );\n              process.exit(0);\n            } catch (error) {\n              lastError = error;\n            }\n          }\n          throw lastError || new Error(\"Failed to resolve @tailor-platform/sdk/cli.\");\n          NODE\n          )\"\n\n          run_head_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$GITHUB_WORKSPACE\" || exit 1\n              case \"__PACKAGE_MANAGER__\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported package-manager '__PACKAGE_MANAGER__' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          run_base_tailor_cli_bin() {\n            local command_cwd=\"$1\"\n            shift\n\n            run_head_cli_env() {\n              env TAILOR_CLI_BIN=\"$tailor_cli_bin\" TAILOR_CLI_CWD=\"$command_cwd\" \"$@\"\n            }\n\n            (\n              cd \"$command_cwd\" || exit 1\n              case \"$BASE_PACKAGE_MANAGER\" in\n                pnpm) run_head_cli_env pnpm exec node \"$head_cli_runner\" \"$@\" ;;\n                npm) run_head_cli_env node \"$head_cli_runner\" \"$@\" ;;\n                yarn) run_head_cli_env yarn node \"$head_cli_runner\" \"$@\" ;;\n                bun) run_head_cli_env bun \"$head_cli_runner\" \"$@\" ;;\n                *)\n                  echo \"::error::Unsupported base package-manager '$BASE_PACKAGE_MANAGER' (expected pnpm, npm, yarn, or bun)\"\n                  exit 1\n                  ;;\n              esac\n            )\n          }\n\n          head_output=\"$RUNNER_TEMP/tailor-erd/head\"\n          base_output=\"$RUNNER_TEMP/tailor-erd/base\"\n          preview_output=\"$RUNNER_TEMP/tailor-erd/preview\"\n          dts_output=\"$RUNNER_TEMP/tailor-erd/dts\"\n          head_cli_runner=\"$RUNNER_TEMP/tailor-erd/run-head-cli.mjs\"\n          head_log=\"$RUNNER_TEMP/tailor-erd/head-$NAMESPACE.log\"\n          base_log=\"$RUNNER_TEMP/tailor-erd/base-$NAMESPACE.log\"\n          rm -rf \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          mkdir -p \"$head_output\" \"$base_output\" \"$preview_output\" \"$dts_output\"\n          cat > \"$head_cli_runner\" <<'NODE'\n          import { pathToFileURL } from \"node:url\";\n\n          const cliBin = process.env.TAILOR_CLI_BIN;\n          const commandCwd = process.env.TAILOR_CLI_CWD;\n          if (!cliBin || !commandCwd) {\n            throw new Error(\"TAILOR_CLI_BIN and TAILOR_CLI_CWD are required.\");\n          }\n\n          process.chdir(commandCwd);\n          process.argv = [process.argv[0], cliBin, ...process.argv.slice(2)];\n          await import(pathToFileURL(cliBin).href);\n          NODE\n\n          head_config=\"$GITHUB_WORKSPACE/$APP_DIR/tailor.config.ts\"\n          base_config=\"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR/tailor.config.ts\"\n          head_html=\"$head_output/$NAMESPACE/dist/index.html\"\n          base_html=\"$base_output/$NAMESPACE/dist/index.html\"\n          preview_html=\"$preview_output/$NAMESPACE-viewer.html\"\n\n          head_missing=\"false\"\n          if [ ! -f \"$head_config\" ]; then\n            echo \"Head ERD config not found; rendering base objects as removed.\"\n            head_missing=\"true\"\n          elif ! (\n            cd \"$GITHUB_WORKSPACE/$APP_DIR\" || exit 1\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/head-$NAMESPACE.d.ts\" \\\n              run_tailor_cli tailordb erd export --config \"$head_config\" --namespace \"$NAMESPACE\" --output \"$head_output\"\n          ) >\"$head_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$head_log\"; then\n              cat \"$head_log\"\n              echo \"Head ERD namespace '$NAMESPACE' not found; rendering base objects as removed.\"\n              head_missing=\"true\"\n            else\n              cat \"$head_log\"\n              exit 1\n            fi\n          elif [ -s \"$head_log\" ]; then\n            cat \"$head_log\"\n          fi\n\n          base_missing=\"false\"\n          if [ ! -f \"$base_config\" ]; then\n            echo \"Base ERD config not found; rendering current objects as added.\"\n            base_missing=\"true\"\n          elif ! (\n            TAILOR_PLATFORM_SDK_DTS_PATH=\"$dts_output/base-$NAMESPACE.d.ts\" \\\n              run_base_tailor_cli_bin \"$GITHUB_WORKSPACE/.tailor-erd-base/$BASE_APP_DIR\" tailordb erd export --config \"$base_config\" --namespace \"$NAMESPACE\" --output \"$base_output\"\n          ) >\"$base_log\" 2>&1; then\n            if grep -q 'not found in local config.db' \"$base_log\"; then\n              cat \"$base_log\"\n              echo \"Base ERD namespace '$NAMESPACE' not found; rendering current objects as added.\"\n              base_missing=\"true\"\n            else\n              cat \"$base_log\"\n              exit 1\n            fi\n          elif [ -s \"$base_log\" ]; then\n            cat \"$base_log\"\n          fi\n\n          if [ \"$head_missing\" = \"true\" ] && [ \"$base_missing\" = \"true\" ]; then\n            echo \"::error::ERD namespace '$NAMESPACE' was not found in head or base.\"\n            exit 1\n          fi\n          if [ \"$head_missing\" = \"false\" ] && [ ! -f \"$head_html\" ]; then\n            echo \"::error::Head ERD viewer was not generated at $head_html\"\n            exit 1\n          fi\n          if [ \"$base_missing\" = \"false\" ] && [ ! -f \"$base_html\" ]; then\n            echo \"::error::Base ERD viewer was not generated at $base_html\"\n            exit 1\n          fi\n\n          diff_args=(--namespace \"$NAMESPACE\" --output \"$preview_html\")\n          if [ \"$head_missing\" = \"false\" ]; then\n            diff_args+=(--head-html \"$head_html\")\n          fi\n          if [ \"$base_missing\" = \"false\" ]; then\n            diff_args+=(--base-html \"$base_html\")\n          fi\n          run_head_tailor_cli_bin \"$GITHUB_WORKSPACE\" tailordb erd diff \"${diff_args[@]}\"\n      - id: tailor-upload-erd-viewer\n        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1\n        with:\n          name: ${{ matrix.namespace }}-viewer.html\n          path: ${{ runner.temp }}/tailor-erd/preview/${{ matrix.namespace }}-viewer.html\n          if-no-files-found: error\n          archive: false\n          retention-days: 7\n\n  # __ERD_PREVIEW_JOB_END__\n  # __ERD_PREVIEW_COMMENT_JOB_START__\n  tailor-erd-preview-comment:\n    needs: tailor-erd-preview\n    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      actions: read\n      pull-requests: write\n    steps:\n      - id: tailor-comment-erd-preview\n        env:\n          GH_TOKEN: ${{ github.token }}\n          REPO: ${{ github.repository }}\n          RUN_ID: ${{ github.run_id }}\n          SERVER: ${{ github.server_url }}\n          PR_NUMBER: ${{ github.event.pull_request.number }}\n          BASE_REF: ${{ github.event.pull_request.base.ref }}\n          HEAD_SHA: ${{ github.event.pull_request.head.sha }}\n          MARKER: \"<!-- tailor-erd-preview: __WORKSPACE_NAME__ -->\"\n        run: |\n          set -euo pipefail\n\n          current_head=$(gh api \"repos/$REPO/pulls/$PR_NUMBER\" --jq '.head.sha')\n          if [ \"$current_head\" != \"$HEAD_SHA\" ]; then\n            echo \"Skipping stale ERD preview comment for $HEAD_SHA; current head is $current_head.\"\n            exit 0\n          fi\n\n          body=\"$MARKER\"$'\\n'\"### TailorDB ERD preview (__WORKSPACE_NAME__)\"$'\\n\\n'\n          body+=\"Self-contained ERD viewer HTML artifacts for this pull request. Each viewer can switch between the current schema and a diff against base branch \\`$BASE_REF\\`.\"$'\\n'\n\n          while IFS=$'\\t' read -r name id; do\n            [ -z \"$name\" ] && continue\n            if [[ \"$name\" != *-viewer.html ]]; then\n              continue\n            fi\n            ns=${name%-viewer.html}\n            label=\"$ns viewer\"\n            body+=$'\\n'\"- **$label**: [$name]($SERVER/$REPO/actions/runs/$RUN_ID/artifacts/$id)\"\n          done < <(gh api \"repos/$REPO/actions/runs/$RUN_ID/artifacts\" --paginate \\\n            --jq '.artifacts[] | select(.name | endswith(\"-viewer.html\")) | [.name, (.id|tostring)] | @tsv' | sort)\n\n          existing=$(gh api \"repos/$REPO/issues/$PR_NUMBER/comments\" --paginate \\\n            --jq 'map(select(.body | contains(env.MARKER))) | .[0].id // empty')\n          if [ -n \"$existing\" ]; then\n            gh api --method PATCH \"repos/$REPO/issues/comments/$existing\" -f body=\"$body\" >/dev/null\n          else\n            gh api --method POST \"repos/$REPO/issues/$PR_NUMBER/comments\" -f body=\"$body\" >/dev/null\n          fi\n\n  # __ERD_PREVIEW_COMMENT_JOB_END__\n  tailor-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    environment: __ENVIRONMENT__\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/coordinate.workflow.yml
-var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
+var coordinate_workflow_default = "# __HEADER__\nname: Tailor Coordinator (__WORKSPACE_NAME__)\n\non:\n  # __PULL_REQUEST_START__\n  pull_request:\n    branches: [\"__BRANCH__\"]\n  # __PULL_REQUEST_END__\n  push:\n    # __PUSH_BRANCHES_START__\n    branches: [\"__BRANCH__\"]\n    # __PUSH_BRANCHES_END__\n    # __PUSH_TAGS_START__\n    tags: [__TAG_PATTERN__]\n    # __PUSH_TAGS_END__\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          target-branch: __BRANCH__\n  # __TAG_GUARD_JOB_END__\n\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-plan-__WORKSPACE_NAME__-${{ github.event.pull_request.number || github.run_id }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_PLAN_STEPS__\n\n  tailor-deploy:\n    # __DEPLOY_NEEDS__\n    # __DEPLOY_IF__\n    # __DEPLOY_ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: ./.github/actions/tailor-setup\n      # __PER_APP_DEPLOY_STEPS__\n";
 
 //#endregion
 //#region src/cli/commands/setup/preview.workflow.yml
-var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
+var preview_workflow_default = "# __HEADER__\nname: Tailor Preview (__WORKSPACE_NAME__)\n\non:\n  pull_request:\n    branches: [\"__BRANCH__\"]\n    # __PR_TYPES__\n    # To deploy only for PRs that carry the `tailor:preview` label instead of all PRs,\n    # re-run: tailor setup preview --require-preview-label\n    # __PATHS__\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  tailor-preview-deploy:\n    # __DEPLOY_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    concurrency:\n      group: tailor-preview-__WORKSPACE_NAME__-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      - id: tailor-preview-deploy\n        uses: tailor-platform/actions/preview-deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          region: \"__REGION__\"\n          organization-id: ${{ vars.TAILOR_PLATFORM_ORGANIZATION_ID }}\n          folder-id: ${{ vars.TAILOR_PLATFORM_FOLDER_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n      - id: tailor-preview-comment\n        if: always()\n        uses: tailor-platform/actions/preview-comment@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ steps.tailor-preview-deploy.outputs.workspace-id }}\n          workspace-name: ${{ steps.tailor-preview-deploy.outputs.workspace-name }}\n          status: ${{ job.status == 'success' && 'success' || 'failure' }}\n          app-url: ${{ steps.tailor-preview-deploy.outputs.app-url }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n\n  tailor-preview-cleanup:\n    # __CLEANUP_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n      pull-requests: write\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-preview-cleanup\n        uses: tailor-platform/actions/preview-cleanup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-name-prefix: __WORKSPACE_NAME__\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/tag.workflow.yml
-var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@1f2d0cc26b84b9fdae8a3a0427526df31e6c966b # v2.0.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
+var tag_workflow_default = "# __HEADER__\nname: Tailor (__WORKSPACE_NAME__)\n\non:\n  push:\n    tags: [\"__TAG_PATTERN__\"]\n  workflow_dispatch:\n    inputs:\n      dry-run:\n        description: Preview changes without deploying\n        type: boolean\n        default: false\n\npermissions:\n  contents: read\n\njobs:\n  # __TAG_GUARD_JOB_START__\n  tailor-tag-guard:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    outputs:\n      on-branch: ${{ steps.tailor-tag-guard.outputs.on-branch }}\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n        with:\n          fetch-depth: 0\n      - id: tailor-tag-guard\n        uses: tailor-platform/actions/tag-guard@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          target-branch: \"__BRANCH__\"\n  # __TAG_GUARD_JOB_END__\n  tailor-plan:\n    # __PLAN_NEEDS__\n    # __PLAN_IF__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    environment: __ENVIRONMENT__\n    permissions:\n      contents: read\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-generate-check\n        uses: tailor-platform/actions/generate-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_START__\n      - id: tailor-seed-validate\n        run: __TAILOR_CLI__ seed validate\n        # __WORKING_DIRECTORY__\n      # __SEED_VALIDATE_END__\n      - id: tailor-drift-check\n        uses: tailor-platform/actions/drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          fail-on-drift: ${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}\n      # __MIGRATION_DRIFT_CHECK_START__\n      - id: tailor-migration-drift-check\n        uses: tailor-platform/actions/migration-drift-check@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n      # __MIGRATION_DRIFT_CHECK_END__\n      - id: tailor-plan\n        uses: tailor-platform/actions/plan@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          label: __WORKSPACE_NAME__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n\n  tailor-deploy:\n    needs: tailor-plan\n    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs['dry-run']) }}\n    environment: __ENVIRONMENT__\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    permissions:\n      contents: read\n    concurrency:\n      group: tailor-deploy-__WORKSPACE_NAME__\n      cancel-in-progress: false\n    steps:\n      - id: tailor-checkout\n        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n      - id: tailor-setup\n        uses: tailor-platform/actions/setup@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-install\n        uses: tailor-platform/actions/install@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          package-manager: __PACKAGE_MANAGER__\n      - id: tailor-apply\n        uses: tailor-platform/actions/deploy@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          workspace-id: ${{ vars.TAILOR_PLATFORM_WORKSPACE_ID }}\n          package-manager: __PACKAGE_MANAGER__\n          # __WORKING_DIRECTORY__\n          platform-client-id: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_ID }}\n          platform-client-secret: ${{ secrets.TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET }}\n      # __SEED_DATA_START__\n      - id: seed-data\n        if: false\n        shell: bash\n        # __WORKING_DIRECTORY__\n        run: |\n          # Uncomment and implement to seed data on deploy.\n          # Run after apply so the schema is ready.\n          # Example: node scripts/seed.mjs\n          true\n      # __SEED_DATA_END__\n      - id: slack-prereq\n        if: always()\n        shell: bash\n        env:\n          SLACK_TOKEN: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          SLACK_CHANNEL_ID: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n        run: |\n          if [[ -n \"$SLACK_TOKEN\" && -n \"$SLACK_CHANNEL_ID\" ]]; then\n            echo \"ready=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n      - id: tailor-notify\n        if: always() && steps.slack-prereq.outputs.ready == 'true'\n        uses: tailor-platform/actions/notify@85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c # v2.2.0\n        with:\n          provider: slack\n          status: ${{ job.status }}\n          workspace-name: __WORKSPACE_NAME__\n          slack-token: ${{ secrets.TAILOR_SLACK_BOT_TOKEN }}\n          slack-channel-id: ${{ vars.TAILOR_SLACK_CHANNEL_ID }}\n          # user-mapping: ${{ vars.TAILOR_SLACK_USER_MAPPING }}\n";
 
 //#endregion
 //#region src/cli/commands/setup/templates.ts
@@ -4044,6 +4054,7 @@ function renderPreviewWorkflow(params) {
 			"tailor-preview-deploy/tailor-setup",
 			"tailor-preview-deploy/tailor-install",
 			"tailor-preview-deploy/tailor-generate-check",
+			"tailor-preview-deploy/tailor-drift-check",
 			"tailor-preview-deploy/tailor-preview-deploy",
 			"tailor-preview-deploy/tailor-preview-comment",
 			"tailor-preview-cleanup",
@@ -4072,8 +4083,8 @@ function renderActionWorkflow(params) {
 		generatedIds: ["tailor-apply", "tailor-notify"]
 	};
 }
-const ACTIONS_SHA = "1f2d0cc26b84b9fdae8a3a0427526df31e6c966b";
-const ACTIONS_VERSION = "v2.0.0";
+const ACTIONS_SHA = "85f0ec85d3bcbdec915daa315b6ddf46ce9b6d2c";
+const ACTIONS_VERSION = "v2.2.0";
 /**
 * Render the coordinator workflow that orchestrates per-app composite actions.
 *
@@ -4117,7 +4128,8 @@ function renderCoordinateWorkflow(params) {
 		`- id: tailor-drift-check`,
 		`  uses: tailor-platform/actions/drift-check@${ACTIONS_SHA} # ${ACTIONS_VERSION}`,
 		`  with:`,
-		`    package-manager: ${packageManager}`
+		`    package-manager: ${packageManager}`,
+		`    fail-on-drift: \${{ vars.TAILOR_PLATFORM_FAIL_ON_DRIFT == 'true' }}`
 	].join("\n");
 	const configPath = (app) => app.dir === "." ? "tailor.config.ts" : `${app.dir}/tailor.config.ts`;
 	const groupConfigPath = (group) => group.apps.map(configPath).join(",");
@@ -4621,7 +4633,7 @@ async function setupTarget(options) {
 		kind: resolved.kind,
 		workspaceName: resolved.workspaceName,
 		file: resolved.file,
-		templateVersion: 9,
+		templateVersion: 11,
 		inputs: resolved.inputs,
 		generatedIds: resolved.render.generatedIds,
 		ejectedIds: existing?.ejectedIds ?? [],
@@ -4689,7 +4701,7 @@ async function setupCoordinate(options) {
 			seenNames.add(name);
 			const entry = actionTargets.get(name);
 			if (!entry) throw new Error(`Action target "${name}" not found in .github/tailor.lock. Run \`tailor setup action --name ${name}\` first.`);
-			if (names.length > 1 && entry.templateVersion < 9) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
+			if (names.length > 1 && entry.templateVersion < 11) throw new Error(`Action target "${name}" was generated with an older setup template. Run \`tailor setup action --name ${name} --force\` before grouping it in setup coordinate.`);
 			validateDir(entry.inputs.dir);
 			return {
 				name,
@@ -4741,7 +4753,7 @@ async function setupCoordinate(options) {
 		kind: "coordinate",
 		workspaceName: coordinatorName,
 		file,
-		templateVersion: 9,
+		templateVersion: 11,
 		inputs: {
 			branch,
 			branchAutoDetected: coordinateKind === "branch" ? branchAutoDetected : branch !== null ? false : void 0,
@@ -4785,6 +4797,7 @@ async function setupCoordinate(options) {
 
 //#endregion
 //#region src/cli/commands/setup/check.ts
+const DRIFT_COUNT_MARKER = "TAILOR_SETUP_CHECK_DRIFT_COUNT";
 /**
 * Compute drift findings for one target by comparing its recorded lock state
 * against the current repository/config state.
@@ -4929,7 +4942,7 @@ async function checkGitHub(options) {
 			currentHash,
 			configExists,
 			defaultBranch,
-			templateVersion: 9,
+			templateVersion: 11,
 			erdNamespaces,
 			hasMigrations,
 			hasSeeds,
@@ -4942,6 +4955,7 @@ async function checkGitHub(options) {
 		return;
 	}
 	for (const finding of findings) logger.warn(`[${finding.target}] ${finding.message} (ignore key: ${finding.rule})`);
+	if (options.ci) logger.log(`${DRIFT_COUNT_MARKER}=${String(findings.length)}`);
 	throw new Error(`Detected ${String(findings.length)} drift finding(s) across ${String(count)} target(s). Re-run \`tailor setup\` to regenerate, or address each finding above.`);
 }
 
@@ -5014,6 +5028,134 @@ async function setupDelete(options) {
 	}
 }
 
+//#endregion
+//#region src/cli/commands/setup/renovate.ts
+const RENOVATE_CONFIG_FILE = "renovate.json";
+const RENOVATE_PRESET = "github>tailor-inc/renovate-config";
+const RENOVATE_CONFIG_FILES = [
+	RENOVATE_CONFIG_FILE,
+	"renovate.jsonc",
+	"renovate.json5",
+	".github/renovate.json",
+	".github/renovate.jsonc",
+	".github/renovate.json5",
+	".gitlab/renovate.json",
+	".gitlab/renovate.jsonc",
+	".gitlab/renovate.json5",
+	".renovaterc",
+	".renovaterc.json",
+	".renovaterc.jsonc",
+	".renovaterc.json5"
+];
+function getPathEntry(filePath) {
+	try {
+		return fs.lstatSync(filePath);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+function pathEntryExists(filePath) {
+	return getPathEntry(filePath) !== null;
+}
+function extendsPreset(config) {
+	if (!("extends" in config)) return false;
+	const value = config.extends;
+	return Array.isArray(value) && value.includes("github>tailor-inc/renovate-config");
+}
+function readJsonConfig(filePath) {
+	const entry = getPathEntry(filePath);
+	if (entry === null || !entry.isFile()) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+	} catch {
+		return null;
+	}
+	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+}
+function classifyConfig(location, filePath, config) {
+	if (config === null) return {
+		kind: "unreadable",
+		location
+	};
+	if (extendsPreset(config)) return {
+		kind: "extends-preset",
+		location
+	};
+	return {
+		kind: "appendable",
+		location,
+		filePath,
+		config
+	};
+}
+function findExistingConfig(outputDir) {
+	for (const file of RENOVATE_CONFIG_FILES) {
+		const filePath = path.join(outputDir, file);
+		if (!pathEntryExists(filePath)) continue;
+		return classifyConfig(file, filePath, readJsonConfig(filePath));
+	}
+	const packageJsonPath = path.join(outputDir, "package.json");
+	if (!fs.existsSync(packageJsonPath)) return null;
+	let packageJson;
+	try {
+		packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+	} catch (cause) {
+		throw new Error("package.json is not valid JSON; could not inspect its Renovate config.", { cause });
+	}
+	if (typeof packageJson === "object" && packageJson !== null && "renovate" in packageJson) {
+		const renovate = packageJson.renovate;
+		return classifyConfig("package.json#renovate", packageJsonPath, typeof renovate === "object" && renovate !== null && !Array.isArray(renovate) ? renovate : null);
+	}
+	return null;
+}
+function detectIndent(source) {
+	return /^(?<indent>[ ]+)"/m.exec(source)?.groups?.indent?.length ?? 2;
+}
+function appendPreset(existing) {
+	const source = fs.readFileSync(existing.filePath, "utf-8");
+	const current = "extends" in existing.config ? existing.config.extends : void 0;
+	if (current !== void 0 && !Array.isArray(current)) throw new Error(`Renovate config at "${existing.location}" has a non-array "extends". No files were changed. Add "${RENOVATE_PRESET}" to it manually.`);
+	const config = {
+		...existing.config,
+		extends: [...current ?? [], RENOVATE_PRESET]
+	};
+	const root = existing.location === "package.json#renovate" ? {
+		...JSON.parse(source),
+		renovate: config
+	} : config;
+	const trailingNewline = source.endsWith("\n") ? "\n" : "";
+	fs.writeFileSync(existing.filePath, `${JSON.stringify(root, null, detectIndent(source))}${trailingNewline}`, "utf-8");
+}
+function renderRenovateConfig() {
+	return `${JSON.stringify({
+		$schema: "https://docs.renovatebot.com/renovate-schema.json",
+		extends: [RENOVATE_PRESET]
+	}, null, 2)}\n`;
+}
+/**
+* Generate a repository-level Renovate config that extends Tailor's shared preset.
+* @param options - Renovate setup options
+*/
+async function setupRenovate(options) {
+	logBetaWarning("setup");
+	const existingConfig = findExistingConfig(options.outputDir);
+	if (existingConfig !== null) {
+		if (existingConfig.kind === "extends-preset") {
+			logger.info(`Renovate is already set up at ${styles.path(existingConfig.location)}.`);
+			return;
+		}
+		if (existingConfig.kind === "unreadable") throw new Error(`Found a Renovate config at "${existingConfig.location}" but could not parse it as JSON. Comment-containing JSON5/JSONC configs are not supported yet. No files were changed. Check its extends array for "${RENOVATE_PRESET}" manually.`);
+		appendPreset(existingConfig);
+		logger.success(`Added the Tailor preset to ${styles.path(existingConfig.location)}`);
+		return;
+	}
+	const outputPath = path.join(options.outputDir, RENOVATE_CONFIG_FILE);
+	fs.writeFileSync(outputPath, renderRenovateConfig(), "utf-8");
+	logger.success(`Generated ${styles.path(RENOVATE_CONFIG_FILE)}`);
+}
+
 //#endregion
 //#region src/cli/commands/setup/index.ts
 const checkCommand = defineAppCommand({
@@ -5172,6 +5314,14 @@ const previewCommand = defineAppCommand({
 		});
 	}
 });
+const renovateCommand = defineAppCommand({
+	name: "renovate",
+	description: "Generate a Renovate config for Tailor dependency and workflow updates.",
+	args: z.strictObject({}),
+	run: async () => {
+		await setupRenovate({ outputDir: process.cwd() });
+	}
+});
 const deleteCommand$1 = defineAppCommand({
 	name: "delete",
 	description: "Delete managed workflow/action file(s) and their .github/tailor.lock entries.",
@@ -5192,13 +5342,14 @@ const deleteCommand$1 = defineAppCommand({
 });
 const setupCommand = defineCommand({
 	name: "setup",
-	description: "Generate CI deploy workflows for your project. (beta)",
+	description: "Set up repository automation for your project. (beta)",
 	subCommands: {
 		branch: branchCommand,
 		tag: tagCommand,
 		preview: previewCommand,
 		action: actionCommand,
 		coordinate: coordinateCommand,
+		renovate: renovateCommand,
 		check: checkCommand,
 		delete: deleteCommand$1
 	}
@@ -5426,12 +5577,7 @@ const staticwebsiteCommand = defineCommand({
 
 //#endregion
 //#region src/cli/commands/tailordb/migrate/rebaseline.ts
-const MIGRATION_ARTIFACT_NAMES = /* @__PURE__ */ new Set([
-	SCHEMA_FILE_NAME,
-	DIFF_FILE_NAME,
-	MIGRATE_FILE_NAME,
-	DB_TYPES_FILE_NAME
-]);
+const MIGRATION_ARTIFACT_NAMES = new Set(Object.values(MIGRATION_FILE_NAMES));
 async function activateBaseline(migrationsDir, snapshot, namespace, rebaseline) {
 	const resolvedMigrationsDir = await fsPromises.realpath(migrationsDir);
 	const parentDir = path.dirname(resolvedMigrationsDir);
@@ -5454,7 +5600,7 @@ async function activateBaseline(migrationsDir, snapshot, namespace, rebaseline)
 		loadSnapshot((await generateSchemaFile({
 			...snapshot,
 			namespace,
-			version: 2,
+			version: 5,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			rebaseline
 		}, stagingDir, 0)).filePath);
@@ -5507,7 +5653,7 @@ async function rebaseline(options) {
 	const currentHistoryId = reconstructSnapshotFromMigrations(target.migrationsDir, 0)?.rebaseline?.historyId ?? null;
 	const initialFileState = captureMigrationFileState([target])[target.namespace];
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-BxLLiLsr.mjs");
+	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5520,7 +5666,7 @@ async function rebaseline(options) {
 	if (!targetService) throw new Error(`No TailorDB service found for namespace "${target.namespace}"`);
 	const assertLocalTypesReady = () => {
 		const currentSnapshot = createSnapshotFromLocalTypes(targetService.types, target.namespace);
-		const localDiff = compareLocalTypesWithSnapshot(latestSnapshot, currentSnapshot.types, target.namespace);
+		const localDiff = compareLocalTypesWithSnapshot(latestSnapshot, currentSnapshot.tables, target.namespace);
 		if (hasChanges(localDiff)) {
 			logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
 			logger.log(formatMigrationDiff(localDiff));
@@ -5945,7 +6091,7 @@ async function fetchRemoteTypes(client, workspaceId, namespace) {
 async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	const { config, plugins } = loaded;
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BxLLiLsr.mjs");
+	const { defineApplication, generatePluginFilesIfNeeded } = await import("../application-BZfk4HKm.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -5957,7 +6103,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 		await service.processNamespacePlugins();
 	}
 	const pluginExecutorFiles = generatePluginFilesIfNeeded(pluginManager, application.tailorDBServices, config.path);
-	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-_XmjSEGr.mjs")).createExecutorService({
+	const executorService = application.executorService ?? (pluginExecutorFiles.length > 0 ? (await import("../service-D1RCdzIL.mjs")).createExecutorService({
 		config: { files: [] },
 		baseDir: path.dirname(config.path)
 	}) : void 0);
@@ -5971,7 +6117,7 @@ async function assertMigrationsReproduceLocalTypes(loaded, target) {
 	};
 	const latestSnapshot = reconstructSnapshotFromMigrations(target.migrationsDir);
 	if (!latestSnapshot) return manifestOptions;
-	const diff = compareLocalTypesWithSnapshot(latestSnapshot, createSnapshotFromLocalTypes(tailordbService.types, target.namespace).types, target.namespace);
+	const diff = compareLocalTypesWithSnapshot(latestSnapshot, createSnapshotFromLocalTypes(tailordbService.types, target.namespace).tables, target.namespace);
 	if (!hasChanges(diff)) return manifestOptions;
 	logger.error(`Migration history does not reproduce the current local schema for namespace ${styles.bold(target.namespace)}:`);
 	logger.log(formatMigrationDiff(diff));
@@ -6019,7 +6165,7 @@ async function sync(options) {
 	const { creates, updates, deletes } = compareSnapshotWithRemote(snapshot, new Set(remoteTypes.map((t) => t.name)));
 	const remoteGqlPermissions = await fetchRemoteGqlPermissions(client, workspaceId, target.namespace);
 	const remoteGqlPermissionTypes = new Set(remoteGqlPermissions.map((p) => p.typeName));
-	const desiredGqlPermissions = Object.entries(snapshot.types).flatMap(([typeName, snapshotType]) => snapshotType.permissions?.gql ? [{
+	const desiredGqlPermissions = Object.entries(snapshot.tables).flatMap(([typeName, snapshotType]) => snapshotType.permissions?.gql ? [{
 		typeName,
 		permission: protoGqlPermission(snapshotType.permissions.gql)
 	}] : []);
@@ -6245,7 +6391,7 @@ async function waitForCloneApplicationData(client, options) {
 function loadSnapshotSeedData(dataDir, typeNames, snapshot) {
 	const data = {};
 	for (const typeName of typeNames) {
-		const snapshotType = snapshot?.types[typeName];
+		const snapshotType = snapshot?.tables[typeName];
 		const jsonlPath = path.join(dataDir, `${typeName}.jsonl`);
 		let content;
 		try {
@@ -6296,11 +6442,11 @@ function isJsonObject(value) {
 * @returns Dependency-ordered type names and self-referencing types
 */
 function sortSeedTypesForSnapshot(snapshot) {
-	const typeNames = Object.keys(snapshot.types);
+	const typeNames = Object.keys(snapshot.tables);
 	const available = new Set(typeNames);
 	const dependencies = /* @__PURE__ */ new Map();
 	const selfRefTypes = [];
-	for (const [typeName, type] of Object.entries(snapshot.types)) {
+	for (const [typeName, type] of Object.entries(snapshot.tables)) {
 		const referenced = /* @__PURE__ */ new Set();
 		for (const field of Object.values(type.fields)) {
 			const target = field.foreignKeyType;
@@ -6528,7 +6674,7 @@ function createMigrationTestDependencies() {
 					version: 1,
 					namespace: service.namespace,
 					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-					types: input.types
+					tables: input.types
 				})];
 			}));
 			for (const [namespace, snapshot] of seedSnapshots) {
@@ -6744,15 +6890,18 @@ const testCommand = defineAppCommand({
 //#region src/cli/commands/tailordb/migrate/validate.ts
 /**
 * Walk the local migration history once to assert that every required
-* migration script exists and generated normalization logic has been
-* reviewed, and to collect migrations with data-loss warnings that have
-* neither a migrate.ts nor a recorded --no-script acknowledgment
+* migration script exists, no migration carries both a --no-script
+* acknowledgment and a migrate.ts, and generated normalization logic has
+* been reviewed, and to collect migrations with data-loss warnings that
+* have neither a migrate.ts nor a recorded --no-script acknowledgment
 * @param {string} migrationsDir - Migrations directory path
 * @param {string} namespace - TailorDB namespace (for error messages)
+* @param {string} [configPath] - Config path the current run used (for remediation hints)
 * @returns {UnacknowledgedWarningMigration[]} Unacknowledged warning migrations in the local history
 */
-function assertMigrationScriptsReady(migrationsDir, namespace) {
+function assertMigrationScriptsReady(migrationsDir, namespace, configPath) {
 	const missing = [];
+	const conflicting = [];
 	const unreviewed = [];
 	const unacknowledgedWarnings = [];
 	for (const file of getMigrationFiles(migrationsDir)) {
@@ -6761,6 +6910,7 @@ function assertMigrationScriptsReady(migrationsDir, namespace) {
 		const migrateFilePath = getMigrationFilePath(migrationsDir, file.number, "migrate");
 		const hasScript = fs.existsSync(migrateFilePath);
 		if (diff.requiresMigrationScript && !diff.scriptSkipped && !hasScript) missing.push(file.number);
+		if (diff.scriptSkipped && hasScript) conflicting.push(file.number);
 		if (hasScript && fs.readFileSync(migrateFilePath, "utf8").includes("TODO(tailor-migration-review)")) unreviewed.push(file.number);
 		if (diff.hasWarnings && !diff.scriptSkipped && !hasScript) unacknowledgedWarnings.push({
 			migrationNumber: file.number,
@@ -6768,6 +6918,15 @@ function assertMigrationScriptsReady(migrationsDir, namespace) {
 		});
 	}
 	if (missing.length > 0) throw new Error(`Migration(s) ${missing.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" require a migration script but have no migrate.ts. Add one with 'tailor tailordb migration script <number>', or record that no script is needed with 'tailor tailordb migration script <number> --no-script --reason "..."'.`);
+	if (conflicting.length > 0) {
+		const clearCommands = conflicting.map((migrationNumber) => `  ${formatMigrationScriptCommand({
+			migrationNumber,
+			namespace,
+			configPath
+		})}`).join("\n");
+		throw new Error(`Migration(s) ${conflicting.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" have both a --no-script skip acknowledgment and migrate.ts. Clear the stale acknowledgment(s):
+${clearCommands}\nOr delete migrate.ts to keep the skip.`);
+	}
 	if (unreviewed.length > 0) throw new Error(`Migration(s) ${unreviewed.map(formatMigrationNumber).join(", ")} in namespace "${namespace}" contain generated normalization logic that still requires review in migrate.ts. Review each ${MIGRATION_REVIEW_REQUIRED_MARKER} marker, then remove the marker and its associated \`never\` annotation.`);
 	return unacknowledgedWarnings;
 }
@@ -6841,7 +7000,7 @@ async function collectValidationReports(options) {
 	const targetNamespaces = options.namespace ? namespacesWithMigrations.filter((ns) => ns.namespace === options.namespace) : namespacesWithMigrations;
 	if (targetNamespaces.length === 0) throw new Error(`Namespace "${options.namespace}" not found or does not have migrations configured`);
 	const pluginManager = plugins.length > 0 ? new PluginManager(plugins) : void 0;
-	const { defineApplication } = await import("../application-BxLLiLsr.mjs");
+	const { defineApplication } = await import("../application-BZfk4HKm.mjs");
 	const application = defineApplication({
 		config,
 		pluginManager
@@ -6860,7 +7019,7 @@ async function collectValidationReports(options) {
 	for (const target of targetNamespaces) try {
 		assertValidMigrationFiles(target.migrationsDir, target.namespace);
 		reconstructSnapshotFromMigrations(target.migrationsDir);
-		const namespaceWarnings = assertMigrationScriptsReady(target.migrationsDir, target.namespace);
+		const namespaceWarnings = assertMigrationScriptsReady(target.migrationsDir, target.namespace, options.configPath);
 		unacknowledgedWarnings?.set(target.namespace, namespaceWarnings);
 		checkableNamespaces.push(target);
 	} catch (error) {
@@ -6926,7 +7085,7 @@ function printValidationReports(reports) {
 				const label = formatMigrationNumber(migration.migrationNumber);
 				for (const warning of migration.warnings) {
 					const field = warning.fieldName ? `.${warning.fieldName}` : "";
-					logger.log(`    ${label}: ${warning.typeName}${field}: ${warning.reason}`);
+					logger.log(`    ${label}: ${warning.tableName}${field}: ${warning.reason}`);
 				}
 			}
 		}
@@ -7051,7 +7210,7 @@ const upgradeCommand = defineAppCommand({
 	run: async (args) => {
 		const { initTelemetry } = await import("../telemetry-CkbkeJxl.mjs");
 		await initTelemetry();
-		const { upgrade } = await import("../service-CCwl3Avt.mjs");
+		const { upgrade } = await import("../service-hZskxZmg.mjs");
 		await upgrade({
 			from: args.from,
 			dryRun: args["dry-run"],
@@ -7555,6 +7714,8 @@ runMain(mainCommand, {
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else if (error instanceof Error) {
 				logger.error(error.message);
+				const hint = typeOnlyImportHint(error);
+				if (hint) logger.log(`  ${styles.info("Suggestion:")} ${hint}`);
 				if (isVerbose() && error.stack) logger.debug(`\nStack trace:\n${error.stack}`);
 			} else logger.error(`Unknown error: ${error}`);
 			if (!isCLIError(error) && (!(error instanceof Error) || error instanceof TypeError || error instanceof RangeError)) {