feat(tailordb): type-level hooks/validators with issues() API and default support

.agents/rules/schema-types.md

@@ -27,7 +27,7 @@ modules** — files named `types.ts` (or `*.types.ts` under `configure/`):
 | `parser/service/tailordb/types.ts`                                 | Parsed data structures (`TailorDBType`, `ParsedField`, permissions, ...) |
 | `parser/service/idp/types.ts`                                      | Normalized IdP permission types shared by parser and CLI                 |
 | `plugin/types.ts`                                                  | Plugin authoring types, generation hook contexts, generator config       |
-| `runtime/types.ts`                                                 | Runtime principal/env types (`TailorUser`, `TailorActor`, `TailorEnv`)   |
+| `runtime/types.ts`                                                 | Runtime principal/env types (`TailorPrincipal`, `TailorEnv`)             |
 
 Rules for pure type modules (enforced by oxlint):
 

.agents/rules/sdk-internals.md

@@ -1,5 +1,20 @@
 # SDK Internals
 
+## API Naming: `define*` vs `create*`
+
+Public functions in `src/configure/` follow a strict naming convention.
+
+| Prefix    | Meaning                                 | Output                                                                                             | Where used                                                               |
+| --------- | --------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `define*` | Declarative resource specification      | Pure data/config struct (no SDK-managed runtime methods)                                           | `tailor.config.ts` as resource entries                                   |
+| `create*` | Instantiation of a runtime-capable unit | Object with runtime-capable methods (`trigger`, `wait`, `resolve`) or user-written `body` function | Standalone files as default/named exports, or inside workflow job bodies |
+
+**`define*` examples:** `defineConfig`, `defineAuth`, `defineIdp`, `defineStaticWebSite`, `defineAIGateway`, `defineSecretManager`, `definePlugins`
+
+**`create*` examples:** `createResolver`, `createExecutor`, `createWorkflow`, `createWorkflowJob`, `createWaitPoint`, `createWaitPoints`, `createHttpAdapter`
+
+Decision rule: if the result has a method that calls the platform at runtime (`.trigger()`, `.wait()`, `.resolve()`, etc.) or carries a user-written `body` function, use `create*`. If the result is purely a typed config object that tooling/deployer reads, use `define*`.
+
 ## Module Architecture and Import Rules
 
 The SDK enforces strict module boundaries to maintain a clean architecture:

.agents/skills/e2e-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: e2e-setup
 description: >
   Set up the environment and run e2e tests in this repo (`example/e2e` and `packages/sdk/e2e`).
-  Covers tailor-sdk authentication, workspace selection, and re-deploying `example/` when
+  Covers tailor authentication, workspace selection, and re-deploying `example/` when
   the deployed app drifts from the current code. Use when running e2e tests locally, fixing
   e2e failures, or when a run errors with "Failed to refresh token", "Workspace ID not found",
   or mismatched counts/fields in resolver/workflow assertions.
@@ -50,7 +50,7 @@ set -a; source .agents/skills/e2e-setup/ids.local.env; set +a
 **Sanity check on `TAILOR_PLATFORM_WORKSPACE_ID`.** Before running `example/e2e`, confirm the workspace still has `my-app` deployed:
 
 ```
-pnpm exec tailor-sdk workspace app list --workspace-id "$TAILOR_PLATFORM_WORKSPACE_ID"
+pnpm exec tailor workspace app list --workspace-id "$TAILOR_PLATFORM_WORKSPACE_ID"
 ```
 
 If it is gone, re-deploy per [Pre-deploy](#one-time-setup) step 4.
@@ -63,18 +63,18 @@ The tests assert against the **deployed** state of `example/` (resolver count, w
 
 Only needed when `ids.local.env` has no `TAILOR_PLATFORM_WORKSPACE_ID` yet, or the saved workspace was deleted / no longer hosts `my-app`. Write the resolved workspace ID back to `ids.local.env` when finished.
 
-1. Make sure you are logged in. `tailor-sdk login` opens a browser — **only the user can run it**; the agent must ask. Verify with `pnpm exec tailor-sdk workspace list` (errors with `Tailor Platform token not found.` if unauthenticated).
+1. Make sure you are logged in. `tailor login` opens a browser — **only the user can run it**; the agent must ask. Verify with `pnpm exec tailor workspace list` (errors with `Tailor Platform token not found.` if unauthenticated).
 2. Look up the organization and folder you want the workspace to live under. The `workspace create` flags below need both IDs:
    ```
-   pnpm exec tailor-sdk organization list
-   pnpm exec tailor-sdk organization folder list --organization-id <org>
+   pnpm exec tailor organization list
+   pnpm exec tailor organization folder list --organization-id <org>
    # Optional: drill into a sub-folder
-   pnpm exec tailor-sdk organization folder list --organization-id <org> --parent-folder-id <folder>
+   pnpm exec tailor organization folder list --organization-id <org> --parent-folder-id <folder>
    ```
 3. Pick or create a personal workspace. Suggested name: `example-e2e` (descriptive of purpose; fall back to a personal prefix only if it collides under the same folder). The agent must not invent a name — use the suggestion or ask the user:
    ```
-   pnpm exec tailor-sdk workspace list
-   pnpm exec tailor-sdk workspace create --name example-e2e --region asia-northeast --organization-id <org> --folder-id <folder>
+   pnpm exec tailor workspace list
+   pnpm exec tailor workspace create --name example-e2e --region asia-northeast --organization-id <org> --folder-id <folder>
    ```
 4. Deploy `example/` into it once:
    ```
@@ -83,7 +83,7 @@ Only needed when `ids.local.env` has no `TAILOR_PLATFORM_WORKSPACE_ID` yet, or t
    Use `run deploy`, not bare `deploy` — pnpm has a builtin `deploy` command that shadows the package script when invoked via `--filter`.
 5. Confirm `my-app` is present:
    ```
-   pnpm exec tailor-sdk workspace app list --workspace-id <id>
+   pnpm exec tailor workspace app list --workspace-id <id>
    ```
 
 Optionally save the workspace as a profile (`~/.config/tailor-platform/config.yaml`) so `TAILOR_PLATFORM_PROFILE=<name>` alone is enough.
@@ -134,9 +134,9 @@ The script uses `loadAccessToken()` so it works with keyring/config credentials
 
 | Error                                                                                                      | Cause                                                                    | Fix                                                                                                                               |
 | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
-| `Failed to refresh token. Your session may have expired.`                                                  | The refresh token in `~/.config/tailor-platform/config.yaml` is expired. | `pnpm exec tailor-sdk login` (interactive; only the user can run this — the agent should ask).                                    |
+| `Failed to refresh token. Your session may have expired.`                                                  | The refresh token in `~/.config/tailor-platform/config.yaml` is expired. | `pnpm exec tailor login` (interactive; only the user can run this — the agent should ask).                                        |
 | `Workspace ID not found.`                                                                                  | No `--workspace-id`, no `TAILOR_PLATFORM_WORKSPACE_ID`, no profile set.  | Set `TAILOR_PLATFORM_WORKSPACE_ID` or `TAILOR_PLATFORM_PROFILE`.                                                                  |
-| `Application my-app does not have an auth configuration.` / `Machine user manager-machine-user not found.` | Wrong workspace selected, or `example/` was never deployed there.        | Confirm with `tailor-sdk workspace app list`; deploy if missing.                                                                  |
+| `Application my-app does not have an auth configuration.` / `Machine user manager-machine-user not found.` | Wrong workspace selected, or `example/` was never deployed there.        | Confirm with `tailor workspace app list`; deploy if missing.                                                                      |
 | `TAILOR_PLATFORM_ORGANIZATION_ID` / `..._FOLDER_ID` unset (in `packages/sdk/e2e`)                          | The suite needs these to create workspaces.                              | `source .agents/skills/e2e-setup/ids.local.env` (or follow the fallback in [Stored IDs](#stored-ids-idslocalenv) to populate it). |
 
 ## When the user reports an e2e failure

.agents/skills/llm-challenge/CREATING_PROBLEMS.md

@@ -18,7 +18,7 @@ Rules:
 - `verify.json`, when present, contains visible minimum-correctness checks only. Checks should encode conditions where missing evidence is definitely wrong, similar to type checking; do not put ideal implementations, hidden answers, scores, or broad quality judgments there.
 - Write `prompt.md` in English.
 - For `sdk-api`, do not include SDK API names, imports, code examples, or direct solution hints.
-- For `cli`, the prompt may name the `tailor-sdk` binary, but must not name the target subcommand or exact arguments.
+- For `cli`, the prompt may name the `tailor` binary, but must not name the target subcommand or exact arguments.
 - Keep `scaffold/` minimal and runnable enough for the task. Do not add `solution/`, evaluator tests, scoring metadata, or hidden hints.
 
 Validate discovery and focused behavior with narrow tests or a targeted dry run when practical.

.agents/skills/tailor

@@ -0,0 +1 @@
+../../packages/sdk/agent-skills/tailor

.changeset/apply-deploy-source-strings.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Rewrite `tailor-sdk apply` to `tailor-sdk deploy` in source files that contain embedded CLI command strings.

.changeset/auth-attributes-rename.md

@@ -0,0 +1,7 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/create-sdk": patch
+"@tailor-platform/sdk-codemod": patch
+---
+
+Rename auth attribute module augmentation from `AttributeMap` to `Attributes`.

.changeset/cli-plugins.md

@@ -0,0 +1,10 @@
+---
+"@tailor-platform/sdk": minor
+---
+
+Add CLI plugin support (beta). Running `tailor <name>` for an unknown subcommand now executes an external `tailor-<name>` executable found on your PATH or in `node_modules/.bin` (project-local takes precedence), forwarding all following arguments. This also works for unknown subcommands nested under a known command — e.g. `tailor tailordb erd` dispatches to `tailor-tailordb-erd`. Builtins always take precedence, matching stops at the first unknown segment, and a command that takes its own arguments is never replaced by a plugin. The plugin receives the current Tailor Platform context via environment variables (`TAILOR_PLATFORM_TOKEN`, `TAILOR_PLATFORM_URL`, `TAILOR_PLATFORM_OAUTH2_CLIENT_ID`, `TAILOR_PLATFORM_WORKSPACE_ID`, `TAILOR_PLATFORM_USER`, `TAILOR_CONFIG_PATH`, `TAILOR_VERSION`, `TAILOR_BIN`); token, workspace, and user are best-effort, so auth-free plugins still run when you are not logged in.
+
+Also adds:
+
+- `tailor auth token` — print a valid access token (refreshing it if expired) for use by plugins and scripts.
+- `tailor plugin list` — list discovered plugins and their executable paths.

.changeset/codemod-llm-review.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Add LLM-assisted review support to the codemod runner. A codemod can declare `suspiciousPatterns` plus a `prompt`; after running, files whose post-transform content still matches a suspicious pattern are reported as `llmReviews` (in the JSON output and on stderr) together with the codemod's migration prompt. This surfaces the cases a deterministic transform cannot safely complete (e.g. a value reached through a variable) so they can be finished with an LLM. The `auth.invoker(...)` codemod adopts this for its non-literal-argument cases.

.changeset/codemod-migration-docs.md

@@ -0,0 +1,10 @@
+---
+"@tailor-platform/sdk-codemod": patch
+"@tailor-platform/sdk": patch
+---
+
+Generate the v2 migration guide (`packages/sdk/docs/migration/v2.md`) from the codemod registry, which is the single source of truth. Each entry renders its name, automation level (Automatic / Partially automatic / Manual), description, optional before/after `examples`, and — for changes the codemods cannot fully migrate on their own — the LLM/manual migration prompt. Run `pnpm codemod:docs:update` to regenerate and `pnpm codemod:docs:check` (wired into `pnpm check`) to verify it is in sync.
+
+`scriptPath` is now optional, so the registry can also describe codemod-less ("manual") migrations that ship only guidance (`examples` / `prompt` / `suspiciousPatterns`) with no automatic transform. A manual entry with a `prompt` but no scoping pattern is surfaced as a project-wide `llmReviews` entry at runtime.
+
+Add a `sdk-codemod list` command that prints every registered rule (id, name, kind, version range).

.changeset/codemod-residual-matching.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Reduce false-positive v2 codemod warnings and LLM-review prompts from source comments, string literals, and identifier substring matches.

.changeset/codemod-runner-metadata.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Report the codemod runner identity in the JSON summary, including the source checkout commit and local build command when run from a branch build, so prerelease migration validation can distinguish exact npm packages from branch-head behavior.

.changeset/execute-script-json-arg.md

@@ -0,0 +1,8 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+`executeScript` now takes its `arg` as a JSON-serializable value instead of a pre-serialized JSON string. Pass the value directly (e.g. `arg: { a: 1 }`) instead of `arg: JSON.stringify({ a: 1 })`.
+
+Add the `v2/execute-script-arg` codemod, which unwraps `JSON.stringify(...)` passed as the `executeScript` `arg` option. Indirect forms (a stringified value held in a variable, etc.) cannot be rewritten automatically and are surfaced as an LLM-assisted review task with a migration prompt.

.changeset/execute-script-review-scope.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Reduce noisy `executeScript` LLM-review prompts by flagging files only when unresolved `arg` stringification remains likely.

.changeset/fix-rename-bin-source-files.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Apply the v2 `rename-bin` codemod to SDK CLI command strings in TypeScript and JavaScript source files.

.changeset/fix-v2-prerelease-codemods.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Run v2 codemods when the target version is a v2 prerelease.

.changeset/invoker-option-rename.md

@@ -0,0 +1,9 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+"@tailor-platform/create-sdk": patch
+---
+
+Rename resolver, executor, workflow trigger, and typed workflow start machine-user options from `authInvoker` to `invoker`.
+
+Update create-sdk templates and the v2 auth invoker codemod to generate the new `invoker` option.

.changeset/keyring-default-storage.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Store CLI login tokens in the OS keyring by default when available. If the keyring is unavailable, tokens are stored in the platform config file.

.changeset/open-download-review-scope.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Limit the `openDownloadStream` migration review prompt to files that reference deprecated download stream APIs.

.changeset/parser-schema-strict.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Reject unknown keys in SDK parser schemas instead of silently dropping them from application definitions.

.changeset/pre.json

@@ -0,0 +1,39 @@
+{
+  "mode": "pre",
+  "tag": "next",
+  "initialVersions": {
+    "@tailor-platform/create-sdk": "1.64.0",
+    "@tailor-platform/sdk": "1.64.0",
+    "@tailor-platform/sdk-codemod": "0.2.7"
+  },
+  "changesets": [
+    "apply-deploy-source-strings",
+    "codemod-llm-review",
+    "codemod-migration-docs",
+    "codemod-residual-matching",
+    "execute-script-json-arg",
+    "execute-script-review-scope",
+    "invoker-option-rename",
+    "keyring-default-storage",
+    "open-download-review-scope",
+    "principal-followup-review",
+    "principal-unify-codemod",
+    "remove-auth-invoker-helper",
+    "remove-define-generators",
+    "remove-function-test-run-input-wrapper",
+    "remove-open-download-stream",
+    "remove-runtime-globals-compatibility",
+    "remove-tailor-sdk-skills-shim",
+    "remove-v2-cli-aliases",
+    "remove-workflow-test-env-fallback",
+    "renovate-1516",
+    "renovate-1525",
+    "require-function-log-content-hash",
+    "runtime-globals-import",
+    "store-cli-users-by-subject",
+    "tailor-principal-type",
+    "timestamps-updated-at-create",
+    "v2-baseline",
+    "workflow-trigger-dispatch"
+  ]
+}

.changeset/principal-followup-review.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Flag files that need project-specific review after the v2 principal migration, including resolver helper adapters and nullable `caller` follow-ups.

.changeset/principal-unify-codemod.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": minor
+---
+
+Add the `v2/principal-unify` codemod so `tailor-sdk upgrade` can migrate SDK principal APIs to `TailorPrincipal`.

.changeset/principal-unify-review-findings.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Report precise file-local findings for `principal-unify` review follow-ups, including nullable caller call sites and `context.user` helper adapters.

.changeset/principal-unify-review-followup.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Fix `v2/principal-unify` review findings for nested SDK field parser invoker values and destructured context helper messages.

.changeset/remove-auth-connection-token.md

@@ -0,0 +1,6 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+Remove the deprecated `auth.getConnectionToken()` helper from values returned by `defineAuth()`. Use `authconnection.getConnectionToken(...)` from `@tailor-platform/sdk/runtime` in resolvers, executors, and workflows instead. The v2 codemod rewrites direct `auth.getConnectionToken(...)` calls when the `auth` binding is imported from `tailor.config`.

.changeset/remove-auth-invoker-helper.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Remove the deprecated `auth.invoker("<machine-user>")` helper. Pass machine user names directly as `authInvoker` strings in resolver, executor, and workflow APIs.

.changeset/remove-define-generators.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Remove `defineGenerators()` and legacy `generators` config support. Use `definePlugins()` with the built-in plugin packages for code generation.

.changeset/remove-function-test-run-input-wrapper.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Remove support for wrapping `tailor-sdk function test-run --arg` resolver input in an `input` object. Pass resolver input fields directly as the `--arg` JSON value.

.changeset/remove-open-download-stream.md

@@ -0,0 +1,8 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/create-sdk": patch
+---
+
+Remove the deprecated `openDownloadStream` file streaming API. Use `downloadStream` for streamed file downloads.
+
+The generated file utilities now emit `downloadFileStream`, which calls `downloadStream` and returns `FileDownloadStreamResponse`, instead of the removed `openFileDownloadStream` helper.

.changeset/remove-runtime-globals-compatibility.md

@@ -0,0 +1,8 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+Remove the v1 runtime globals compatibility layer. Importing from `@tailor-platform/sdk` no longer activates the ambient `tailor.*` / `tailordb.*` declarations; opt into globals with `@tailor-platform/sdk/runtime/globals` or use the typed wrappers from `@tailor-platform/sdk/runtime`.
+
+The capital-cased `Tailordb.*` namespace is removed. If your project still references `Tailordb.QueryResult`, `Tailordb.CommandType`, `Tailordb.Client`, or `typeof Tailordb.Client`, migrate before upgrading: run `pnpm dlx @tailor-platform/sdk-codemod v2/tailordb-namespace` to rewrite them to lowercase `tailordb.*`, then add `import "@tailor-platform/sdk/runtime/globals"` so the rewritten references resolve.

.changeset/remove-tailor-sdk-skills-shim.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Remove the deprecated `tailor-sdk-skills` binary shim. Use `tailor-sdk skills install` to install the bundled Tailor SDK agent skill.