@tailor-platform/sdk-codemod 0.1.5 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @tailor-platform/sdk-codemod
 
+## 0.2.0
+
+### Minor Changes
+
+- [#1104](https://github.com/tailor-platform/sdk/pull/1104) [`3c1571c`](https://github.com/tailor-platform/sdk/commit/3c1571cd76d125854b8379dfb8edcb58c2f517a4) Thanks [@dqn](https://github.com/dqn)! - Add three v2 codemods that the upgrade runner can apply when migrating across the 1.x → 2.x boundary:
+
+  - `v2/test-run-arg-input` strips the deprecated `{ "input": ... }` wrapper from `tailor-sdk function test-run --arg` JSON inside `package.json` scripts, shell scripts, and Markdown code blocks.
+  - `v2/sdk-skills-shim` rewrites `tailor-sdk-skills` invocations to `tailor-sdk skills install` across `package.json`, shell, YAML, and Markdown files.
+  - `v2/principal-unify` renames `TailorUser` / `TailorActor` / `TailorInvoker` to the unified `TailorPrincipal`, drops `unauthenticatedTailorUser` (replacing standalone value references with `null`; member-access forms are left as-is so the resulting type error points authors at sites that need manual review), and renames `user` to `caller` inside `createResolver` body parameters and member accesses.
+  - `v2/apply-to-deploy` rewrites `tailor-sdk apply` invocations in `package.json` scripts, shell scripts, CI YAML, and Markdown to the v2-recommended `tailor-sdk deploy` alias. Optional `@version` pins (`tailor-sdk@latest`, `tailor-sdk@1.45.2`) are preserved.
+  - `v2/cli-rename` rewrites `tailor-sdk crash-report` invocations to the v2 single-word `tailor-sdk crashreport` form across `package.json` scripts, shell scripts, CI YAML, and Markdown. Optional `@version` pins are preserved.
+  - `v2/auth-invoker-unwrap` replaces `auth.invoker("name")` calls with the bare `"name"` string literal and drops the `auth` import when it has no other reference. Calls whose argument is not a literal string (`auth.invoker(variable)`, template literals) are left untouched so the author can decide.
+
+### Patch Changes
+
+- [#1181](https://github.com/tailor-platform/sdk/pull/1181) [`3da6be2`](https://github.com/tailor-platform/sdk/commit/3da6be28a9df97b7633ada4923564d3c18afbf49) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency @ast-grep/napi to v0.42.2
+
 ## 0.1.5
 
 ### Patch Changes

package/dist/codemods/v2/apply-to-deploy/scripts/transform.js

@@ -0,0 +1,49 @@
+import * as path from "pathe";
+//#region codemods/v2/apply-to-deploy/scripts/transform.ts
+const APPLY_PATTERN = /\btailor-sdk(@[^\s'"`]+)?(\s+)apply(?![-\w])/g;
+function replaceApply(value) {
+	return value.replace(APPLY_PATTERN, (_match, ver, sep) => `tailor-sdk${ver ?? ""}${sep}deploy`);
+}
+function transformText(source) {
+	if (!APPLY_PATTERN.test(source)) return null;
+	APPLY_PATTERN.lastIndex = 0;
+	const updated = replaceApply(source);
+	return updated === source ? null : updated;
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	let modified = false;
+	const scripts = parsed.scripts;
+	if (typeof scripts === "object" && scripts != null && !Array.isArray(scripts)) for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		if (!value.includes("tailor-sdk")) continue;
+		const updated = replaceApply(value);
+		if (updated !== value) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Replace `tailor-sdk apply` invocations with `tailor-sdk deploy`.
+*
+* `deploy` is a v1 alias of `apply` and the recommended name going forward.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch package.json vs text)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!source.includes("tailor-sdk")) return null;
+	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	return transformText(source);
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/auth-invoker-unwrap/scripts/transform.js

@@ -0,0 +1,152 @@
+import { Lang, parse } from "@ast-grep/napi";
+//#region codemods/v2/auth-invoker-unwrap/scripts/transform.ts
+const QUICK_FILTER_NEEDLE = "auth.invoker";
+function quickFilter(source) {
+	return source.includes(QUICK_FILTER_NEEDLE);
+}
+function isInsideImportStatement(node) {
+	let current = node.parent();
+	while (current) {
+		if (current.kind() === "import_statement") return true;
+		current = current.parent();
+	}
+	return false;
+}
+/**
+* Find every `auth.invoker(<stringLiteral>)` call in `root`. Calls whose
+* argument is not a literal string (e.g. `auth.invoker(name)`,
+* `auth.invoker(\`x\${y}\`)`) are intentionally ignored: only the literal form
+* is safely replaceable.
+*/
+function findInvokerCalls(root) {
+	const matches = root.findAll({ rule: { pattern: "auth.invoker($NAME)" } });
+	const out = [];
+	for (const match of matches) {
+		const arg = match.getMatch("NAME");
+		if (!arg) continue;
+		if (arg.kind() !== "string") continue;
+		const r = match.range();
+		out.push({
+			callNode: match,
+			argText: arg.text(),
+			range: [r.start.index, r.end.index]
+		});
+	}
+	return out;
+}
+/**
+* Count `auth` identifier references that are not part of an import statement
+* and not part of any of the `auth.invoker(...)` calls already scheduled for
+* replacement. A non-zero return means the `auth` import must be preserved.
+*/
+function countRemainingAuthRefs(root, scheduledCallRanges) {
+	const idents = root.findAll({ rule: {
+		kind: "identifier",
+		regex: "^auth$"
+	} });
+	let count = 0;
+	for (const node of idents) {
+		if (isInsideImportStatement(node)) continue;
+		const start = node.range().start.index;
+		if (scheduledCallRanges.some(([s, e]) => start >= s && start < e)) continue;
+		count++;
+	}
+	return count;
+}
+function* iterateImportSpecs(importStmt) {
+	const specs = importStmt.findAll({ rule: { kind: "import_specifier" } });
+	for (const spec of specs) {
+		const idents = spec.children().filter((c) => c.kind() === "identifier");
+		if (idents.length === 0) continue;
+		const importedName = idents[0].text();
+		yield {
+			spec,
+			importedName,
+			localName: idents[1]?.text() ?? importedName
+		};
+	}
+}
+/**
+* Build an Edit that removes the `auth` specifier from `importStmt`. Returns
+* null if the statement does not import `auth`. When `auth` is the only
+* specifier the entire import line is removed (including a trailing newline);
+* otherwise just the `auth,` / `, auth` fragment is dropped.
+*/
+function buildAuthImportRemovalEdit(source, importStmt) {
+	const specs = Array.from(iterateImportSpecs(importStmt));
+	const authSpec = specs.find((s) => s.localName === "auth" && s.importedName === "auth");
+	if (!authSpec) return null;
+	if (specs.length === 1) {
+		const r = importStmt.range();
+		let end = r.end.index;
+		while (end < source.length && (source[end] === "\n" || source[end] === "\r")) end++;
+		return {
+			startPos: r.start.index,
+			endPos: end,
+			insertedText: ""
+		};
+	}
+	const r = authSpec.spec.range();
+	let start = r.start.index;
+	let end = r.end.index;
+	while (end < source.length && (source[end] === " " || source[end] === "	")) end++;
+	if (source[end] === ",") {
+		end++;
+		while (end < source.length && (source[end] === " " || source[end] === "	")) end++;
+		return {
+			startPos: start,
+			endPos: end,
+			insertedText: ""
+		};
+	}
+	while (start > 0 && (source[start - 1] === " " || source[start - 1] === "	")) start--;
+	if (source[start - 1] === ",") {
+		start--;
+		while (start > 0 && (source[start - 1] === " " || source[start - 1] === "	")) start--;
+		return {
+			startPos: start,
+			endPos: end,
+			insertedText: ""
+		};
+	}
+	return {
+		startPos: r.start.index,
+		endPos: r.end.index,
+		insertedText: ""
+	};
+}
+function findAuthImports(root) {
+	return root.findAll({ rule: { kind: "import_statement" } }).filter((stmt) => {
+		for (const { localName, importedName } of iterateImportSpecs(stmt)) if (localName === "auth" && importedName === "auth") return true;
+		return false;
+	});
+}
+/**
+* Replace `auth.invoker("name")` calls with the bare `"name"` string literal.
+* If no other `auth` references remain after the rewrite, drop the `auth`
+* specifier (or the entire import line when `auth` was its sole specifier).
+*
+* `auth.invoker()` was deprecated in favor of passing the machine user name
+* directly; carrying the `auth` import only for `.invoker()` would otherwise
+* pull config-layer (Node-only) modules into runtime bundles.
+* @param source - File contents
+* @param filePath - Absolute path to the file (kept for the runner signature)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, _filePath) {
+	if (!quickFilter(source)) return null;
+	const root = parse(source.includes("</") || source.includes("/>") ? Lang.Tsx : Lang.TypeScript, source).root();
+	const calls = findInvokerCalls(root);
+	if (calls.length === 0) return null;
+	const edits = calls.map((c) => c.callNode.replace(c.argText));
+	if (countRemainingAuthRefs(root, calls.map((c) => c.range)) === 0) for (const importStmt of findAuthImports(root)) {
+		const edit = buildAuthImportRemovalEdit(source, importStmt);
+		if (edit) edits.push(edit);
+	}
+	if (edits.length === 0) return null;
+	let result = root.commitEdits(edits);
+	result = result.replace(/^[\t ]*\n+/, "").replace(/\n{3,}/g, "\n\n");
+	return result === source ? null : result;
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/cli-rename/scripts/transform.js

@@ -0,0 +1,54 @@
+import * as path from "pathe";
+//#region codemods/v2/cli-rename/scripts/transform.ts
+const COMMAND_RENAMES = [["crash-report", "crashreport"]];
+const COMMAND_PATTERN = new RegExp(`\\btailor-sdk(@[^\\s'"\`]+)?(\\s+)(${COMMAND_RENAMES.map(([from]) => from).join("|")})\\b`, "g");
+const COMMAND_MAP = new Map(COMMAND_RENAMES);
+function replaceAll(value) {
+	return value.replace(COMMAND_PATTERN, (_match, ver, sep, cmd) => `tailor-sdk${ver ?? ""}${sep}${COMMAND_MAP.get(cmd) ?? cmd}`);
+}
+function transformText(source) {
+	if (!COMMAND_PATTERN.test(source)) return null;
+	COMMAND_PATTERN.lastIndex = 0;
+	const updated = replaceAll(source);
+	return updated === source ? null : updated;
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	let modified = false;
+	const scripts = parsed.scripts;
+	if (typeof scripts === "object" && scripts != null && !Array.isArray(scripts)) for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		const updated = replaceAll(value);
+		if (updated !== value) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Apply v2 CLI naming conventions: multi-word commands collapse into a single
+* word (`crash-report` → `crashreport`). Optional `@version` pins on the binary
+* (`tailor-sdk@latest`) are preserved.
+*
+* Long options (`--executionId`, `--executorName`, `--jobId`) and the
+* positional argument keys with the same names are intentionally not rewritten:
+* those tokens are positional in the SDK CLI and never appear as long flags in
+* user scripts, so a transform here would have no real-world target.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch package.json vs text)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	return transformText(source);
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/principal-unify/scripts/transform.js

@@ -0,0 +1,470 @@
+import { Lang, parse } from "@ast-grep/napi";
+//#region codemods/v2/principal-unify/scripts/transform.ts
+const TYPE_RENAME_MAP = {
+	TailorUser: "TailorPrincipal",
+	TailorActor: "TailorPrincipal",
+	TailorInvoker: "TailorPrincipal"
+};
+const UNAUTHENTICATED = "unauthenticatedTailorUser";
+const QUICK_FILTER_NEEDLES = [
+	...Object.keys(TYPE_RENAME_MAP),
+	UNAUTHENTICATED,
+	"createResolver"
+];
+function quickFilter(source) {
+	if (!source.includes("@tailor-platform/sdk")) return false;
+	return QUICK_FILTER_NEEDLES.some((needle) => source.includes(needle));
+}
+function isInsideImportStatement(node) {
+	let current = node.parent();
+	while (current) {
+		if (current.kind() === "import_statement") return true;
+		current = current.parent();
+	}
+	return false;
+}
+function isMemberExpressionObject(node) {
+	const parent = node.parent();
+	if (!parent || parent.kind() !== "member_expression") return false;
+	const obj = parent.field("object");
+	if (!obj) return false;
+	const r = node.range();
+	const or = obj.range();
+	return r.start.index === or.start.index && r.end.index === or.end.index;
+}
+function extractModuleSource(importText) {
+	return importText.match(/from\s+(["'])([^"']+)\1/)?.[2] ?? "@tailor-platform/sdk";
+}
+function escapeRegex(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Yield each import specifier in `importStmt` along with its imported name and
+* optional alias. `import { Foo as Bar }` produces `{ importedName: "Foo",
+* aliasNode: <Bar>, localName: "Bar" }`; `import { Foo }` produces
+* `{ importedName: "Foo", aliasNode: undefined, localName: "Foo" }`.
+*/
+function* iterateImportSpecs(importStmt) {
+	const specs = importStmt.findAll({ rule: { kind: "import_specifier" } });
+	for (const spec of specs) {
+		const idents = spec.children().filter((c) => c.kind() === "identifier");
+		if (idents.length === 0) continue;
+		const importedName = idents[0].text();
+		const aliasNode = idents[1];
+		yield {
+			spec,
+			importedName,
+			aliasNode,
+			localName: aliasNode?.text() ?? importedName
+		};
+	}
+}
+function rebuildImportStatement(importStmt, globalEmittedRenamed, unauthenticatedLocalNames) {
+	const importText = importStmt.text();
+	const isImportType = /^\s*import\s+type\b/.test(importText);
+	const trailingSemi = importText.trimEnd().endsWith(";") ? ";" : "";
+	const sourceRaw = extractModuleSource(importText);
+	const newSpecTexts = [];
+	const seenLocal = /* @__PURE__ */ new Set();
+	let touched = false;
+	for (const { spec, importedName, aliasNode, localName } of iterateImportSpecs(importStmt)) {
+		const specText = spec.text();
+		const isTypeOnly = /^\s*type\s+/.test(specText);
+		const renamed = TYPE_RENAME_MAP[importedName];
+		if (renamed) {
+			touched = true;
+			const finalLocal = aliasNode?.text() ?? renamed;
+			if (seenLocal.has(finalLocal)) continue;
+			if (!aliasNode && globalEmittedRenamed.has(renamed)) continue;
+			seenLocal.add(finalLocal);
+			if (!aliasNode) globalEmittedRenamed.add(renamed);
+			const asPart = aliasNode ? ` as ${aliasNode.text()}` : "";
+			newSpecTexts.push(`${isTypeOnly ? "type " : ""}${renamed}${asPart}`);
+		} else if (importedName === UNAUTHENTICATED) {
+			touched = true;
+			unauthenticatedLocalNames.add(localName);
+		} else {
+			if (seenLocal.has(localName)) continue;
+			seenLocal.add(localName);
+			newSpecTexts.push(specText);
+		}
+	}
+	if (!touched) return {
+		newText: importText,
+		touched: false
+	};
+	if (newSpecTexts.length === 0) return {
+		newText: "",
+		touched: true
+	};
+	return {
+		newText: `${isImportType ? "import type " : "import "}{ ${newSpecTexts.join(", ")} } from "${sourceRaw}"${trailingSemi}`,
+		touched: true
+	};
+}
+const SCOPE_KINDS = new Set([
+	"statement_block",
+	"function_body",
+	"for_statement",
+	"for_in_statement",
+	"for_of_statement",
+	"arrow_function",
+	"function_expression",
+	"function_declaration",
+	"method_definition"
+]);
+const NESTED_FN_KINDS = [
+	"arrow_function",
+	"function_expression",
+	"function_declaration",
+	"method_definition"
+];
+function isInsideAnyRange(pos, ranges) {
+	return ranges.some(([s, e]) => pos >= s && pos < e);
+}
+/**
+* Walk up from `decl` and return the byte range of its enclosing scope, or
+* null if no recognized scope ancestor exists.
+*/
+function enclosingScopeRange(decl) {
+	let scope = decl.parent();
+	while (scope && !SCOPE_KINDS.has(scope.kind())) scope = scope.parent();
+	if (!scope) return null;
+	const range = scope.range();
+	return [range.start.index, range.end.index];
+}
+function patternBindsName(pat, name) {
+	const k = pat.kind();
+	if (k === "identifier") return pat.text() === name;
+	if (k === "object_pattern") for (const child of pat.children()) {
+		const ck = child.kind();
+		if (ck === "shorthand_property_identifier_pattern" && child.text() === name) return true;
+		if (ck === "pair_pattern") {
+			const value = child.field("value");
+			if (value && patternBindsName(value, name)) return true;
+		}
+		if (ck === "object_assignment_pattern") {
+			const inner = child.children().find((c) => c.kind() === "shorthand_property_identifier_pattern");
+			if (inner && inner.text() === name) return true;
+		}
+		if (ck === "rest_pattern") {
+			const inner = child.children().find((c) => c.kind() === "identifier");
+			if (inner && inner.text() === name) return true;
+		}
+	}
+	else if (k === "array_pattern") {
+		for (const child of pat.children()) if (patternBindsName(child, name)) return true;
+	} else if (k === "assignment_pattern") {
+		const left = pat.field("left");
+		if (left && patternBindsName(left, name)) return true;
+	}
+	return false;
+}
+function functionRebindsName(fn, name) {
+	const single = fn.field("parameter");
+	if (single && patternBindsName(single, name)) return true;
+	const params = fn.field("parameters") ?? fn.children().find((c) => c.kind() === "formal_parameters");
+	if (!params) return false;
+	for (const child of params.children()) {
+		const k = child.kind();
+		if (k === "identifier" && child.text() === name) return true;
+		if (k === "object_pattern" || k === "array_pattern") {
+			if (patternBindsName(child, name)) return true;
+		}
+		if (k === "required_parameter" || k === "optional_parameter") {
+			const pat = child.field("pattern");
+			if (pat && patternBindsName(pat, name)) return true;
+		}
+	}
+	return false;
+}
+/**
+* Collect byte ranges of inner functions that re-bind `ctxName` as a parameter.
+*
+* Member-accesses to `ctxName.user` whose start byte falls inside any of these
+* ranges refer to the inner function's parameter, not the resolver context, and
+* must not be renamed.
+* @param body - The resolver body node.
+* @param ctxName - The context parameter identifier name.
+* @param resolverArrow - The resolver's outer arrow/function expression to exclude.
+*/
+function collectCtxShadowRanges(body, ctxName, resolverArrow) {
+	const ranges = [];
+	const ar = resolverArrow.range();
+	for (const k of NESTED_FN_KINDS) {
+		const fns = body.findAll({ rule: { kind: k } });
+		for (const fn of fns) {
+			const r = fn.range();
+			if (r.start.index === ar.start.index && r.end.index === ar.end.index) continue;
+			if (functionRebindsName(fn, ctxName)) ranges.push([r.start.index, r.end.index]);
+		}
+	}
+	const declarators = body.findAll({ rule: { kind: "variable_declarator" } });
+	for (const decl of declarators) {
+		const nameNode = decl.field("name");
+		if (!nameNode || nameNode.kind() !== "identifier") continue;
+		if (nameNode.text() !== ctxName) continue;
+		const range = enclosingScopeRange(decl);
+		if (range) ranges.push(range);
+	}
+	return ranges;
+}
+/**
+* Collect every byte range across the file where `name` is locally re-bound,
+* so identifier references inside the range are treated as shadowed.
+*
+* Combines variable declarations (var/let/const, including object-pattern
+* shorthand declarations) with function-parameter bindings.
+*/
+function collectAllShadowRanges(root, name) {
+	const ranges = [];
+	const declarators = root.findAll({ rule: { kind: "variable_declarator" } });
+	for (const decl of declarators) {
+		const nameNode = decl.field("name");
+		if (!nameNode) continue;
+		if (!patternBindsName(nameNode, name)) continue;
+		const range = enclosingScopeRange(decl);
+		if (range) ranges.push(range);
+	}
+	for (const k of NESTED_FN_KINDS) {
+		const fns = root.findAll({ rule: { kind: k } });
+		for (const fn of fns) if (functionRebindsName(fn, name)) {
+			const range = fn.range();
+			ranges.push([range.start.index, range.end.index]);
+		}
+	}
+	return ranges;
+}
+function findResolverBodyArrow(call) {
+	const args = call.field("arguments");
+	if (!args) return null;
+	const objArg = args.children().find((c) => c.kind() === "object");
+	if (!objArg) return null;
+	const pairs = objArg.findAll({ rule: { kind: "pair" } });
+	for (const pair of pairs) {
+		if (pair.field("key")?.text() !== "body") continue;
+		const value = pair.field("value");
+		if (!value) continue;
+		if (value.kind() === "arrow_function" || value.kind() === "function_expression") return value;
+	}
+	return null;
+}
+/**
+* Look for any binding named `caller` in the resolver body or pattern. When
+* one exists, renaming `user` → `caller` would either shadow it, collide with
+* a duplicate `let`/`const`, or alias an unrelated value, so the codemod
+* leaves the body alone for manual migration instead.
+*/
+function hasCallerBindingConflict(pattern, body) {
+	for (const child of pattern.children()) {
+		const k = child.kind();
+		if (k === "shorthand_property_identifier_pattern" && child.text() === "caller") return true;
+		if (k === "pair_pattern") {
+			const key = child.field("key");
+			if (key && key.text() === "caller") return true;
+			const value = child.field("value");
+			if (value && value.kind() === "identifier" && value.text() === "caller") return true;
+		}
+		if (k === "object_assignment_pattern") {
+			const inner = child.children().find((c) => c.kind() === "shorthand_property_identifier_pattern");
+			if (inner && inner.text() === "caller") return true;
+		}
+	}
+	if (body.findAll({ rule: {
+		kind: "identifier",
+		regex: "^caller$",
+		inside: { kind: "variable_declarator" }
+	} }).length > 0) return true;
+	if (body.findAll({ rule: {
+		kind: "shorthand_property_identifier_pattern",
+		regex: "^caller$",
+		inside: { kind: "variable_declarator" }
+	} }).length > 0) return true;
+	for (const k of NESTED_FN_KINDS) {
+		const fns = body.findAll({ rule: { kind: k } });
+		for (const fn of fns) if (functionRebindsName(fn, "caller")) return true;
+	}
+	return false;
+}
+function transformResolverBody(arrowNode, edits) {
+	const params = arrowNode.field("parameters") ?? arrowNode.field("parameter") ?? arrowNode.children().find((c) => c.kind() === "formal_parameters");
+	const body = arrowNode.field("body");
+	if (!params || !body) return;
+	const firstParam = params.children().find((c) => c.kind() === "required_parameter" || c.kind() === "optional_parameter" || c.kind() === "identifier" || c.kind() === "object_pattern");
+	if (!firstParam) return;
+	let pattern;
+	if (firstParam.kind() === "object_pattern" || firstParam.kind() === "identifier") pattern = firstParam;
+	else {
+		const inner = firstParam.field("pattern");
+		if (inner) pattern = inner;
+	}
+	if (!pattern) return;
+	if (pattern.kind() === "object_pattern") {
+		if (hasCallerBindingConflict(pattern, body)) return;
+		let renamedShorthandUser = false;
+		for (const child of pattern.children()) {
+			const kind = child.kind();
+			if (kind === "shorthand_property_identifier_pattern" && child.text() === "user") {
+				edits.push(child.replace("caller"));
+				renamedShorthandUser = true;
+			} else if (kind === "pair_pattern") {
+				const key = child.field("key");
+				if (key && key.text() === "user") edits.push(key.replace("caller"));
+			} else if (kind === "object_assignment_pattern") {
+				const inner = child.children().find((c) => c.kind() === "shorthand_property_identifier_pattern");
+				if (inner && inner.text() === "user") {
+					edits.push(inner.replace("caller"));
+					renamedShorthandUser = true;
+				}
+			}
+		}
+		if (renamedShorthandUser) {
+			const shadowRanges = collectAllShadowRanges(body, "user");
+			const refs = body.findAll({ rule: {
+				kind: "identifier",
+				regex: "^user$"
+			} });
+			for (const ref of refs) {
+				const pos = ref.range().start.index;
+				if (isInsideAnyRange(pos, shadowRanges)) continue;
+				edits.push(ref.replace("caller"));
+			}
+			const shortRefs = body.findAll({ rule: {
+				kind: "shorthand_property_identifier",
+				regex: "^user$"
+			} });
+			for (const ref of shortRefs) {
+				const pos = ref.range().start.index;
+				if (isInsideAnyRange(pos, shadowRanges)) continue;
+				edits.push(ref.replace("user: caller"));
+			}
+		}
+		return;
+	}
+	const ctxName = pattern.text();
+	const ctxShadowRanges = collectCtxShadowRanges(body, ctxName, arrowNode);
+	const propertyAccesses = body.findAll({ rule: {
+		kind: "property_identifier",
+		regex: "^user$"
+	} });
+	for (const propId of propertyAccesses) {
+		const parent = propId.parent();
+		if (!parent || parent.kind() !== "member_expression") continue;
+		const obj = parent.field("object");
+		if (!(obj && obj.kind() === "identifier" && obj.text() === ctxName)) continue;
+		const pos = obj.range().start.index;
+		if (isInsideAnyRange(pos, ctxShadowRanges)) continue;
+		edits.push(propId.replace("caller"));
+	}
+	const ctxDestructures = body.findAll({ rule: {
+		kind: "variable_declarator",
+		has: {
+			field: "value",
+			kind: "identifier",
+			regex: `^${escapeRegex(ctxName)}$`
+		}
+	} });
+	for (const decl of ctxDestructures) {
+		const pos = decl.range().start.index;
+		if (isInsideAnyRange(pos, ctxShadowRanges)) continue;
+		const pat = decl.field("name");
+		if (!pat || pat.kind() !== "object_pattern") continue;
+		for (const child of pat.children()) {
+			const k = child.kind();
+			if (k === "shorthand_property_identifier_pattern" && child.text() === "user") edits.push(child.replace("caller: user"));
+			else if (k === "pair_pattern") {
+				const key = child.field("key");
+				if (key && key.text() === "user") edits.push(key.replace("caller"));
+			}
+		}
+	}
+}
+/**
+* Migrate user/actor/invoker types and identifiers to the unified TailorPrincipal.
+*
+* - Renames `TailorUser` / `TailorActor` / `TailorInvoker` type references to `TailorPrincipal`.
+* - Rewrites SDK imports (including the `/test` subpath) to use `TailorPrincipal` (deduped
+*   across statements) and drops `unauthenticatedTailorUser`.
+* - Replaces standalone references to `unauthenticatedTailorUser` with `null`. Member-access
+*   forms like `unauthenticatedTailorUser.id` are left alone on purpose so the resulting TS
+*   error after the import is removed points the author at the broken access.
+* - Renames `user` to `caller` for top-level destructured resolver bodies (`{ input, user }`),
+*   handles aliased pairs (`{ user: currentUser }`) by rewriting only the property name, and
+*   rewrites `<ctx>.user` for non-destructured single-param bodies — respecting variable
+*   shadowing in both directions.
+* @param source - TypeScript source text.
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source) {
+	if (!quickFilter(source)) return null;
+	const tree = parse(Lang.TypeScript, source).root();
+	const edits = [];
+	const sdkImports = tree.findAll({ rule: {
+		kind: "import_statement",
+		has: {
+			kind: "string",
+			regex: "^[\"']@tailor-platform/sdk(/test)?[\"']$"
+		}
+	} });
+	const sdkRenameSourceNames = /* @__PURE__ */ new Set();
+	for (const importStmt of sdkImports) for (const { importedName, aliasNode } of iterateImportSpecs(importStmt)) if (TYPE_RENAME_MAP[importedName] && !aliasNode) sdkRenameSourceNames.add(importedName);
+	const typeIdents = tree.findAll({ rule: {
+		kind: "type_identifier",
+		not: { inside: { kind: "import_statement" } }
+	} });
+	for (const id of typeIdents) {
+		if (!sdkRenameSourceNames.has(id.text())) continue;
+		const newName = TYPE_RENAME_MAP[id.text()];
+		edits.push(id.replace(newName));
+	}
+	let importRemoved = false;
+	const globalEmittedRenamed = /* @__PURE__ */ new Set();
+	const unauthenticatedLocalNames = /* @__PURE__ */ new Set();
+	for (const importStmt of sdkImports) {
+		const { newText, touched } = rebuildImportStatement(importStmt, globalEmittedRenamed, unauthenticatedLocalNames);
+		if (!touched) continue;
+		edits.push(importStmt.replace(newText));
+		if (newText === "") importRemoved = true;
+	}
+	for (const localName of unauthenticatedLocalNames) {
+		const shadowRanges = collectAllShadowRanges(tree, localName);
+		const ids = tree.findAll({ rule: {
+			kind: "identifier",
+			regex: `^${escapeRegex(localName)}$`
+		} });
+		for (const id of ids) {
+			if (isInsideImportStatement(id)) continue;
+			if (isMemberExpressionObject(id)) continue;
+			const pos = id.range().start.index;
+			if (isInsideAnyRange(pos, shadowRanges)) continue;
+			edits.push(id.replace("null"));
+		}
+	}
+	const createResolverLocalNames = /* @__PURE__ */ new Set();
+	for (const importStmt of sdkImports) for (const { importedName, localName } of iterateImportSpecs(importStmt)) if (importedName === "createResolver") createResolverLocalNames.add(localName);
+	for (const localName of createResolverLocalNames) {
+		const shadowRanges = collectAllShadowRanges(tree, localName);
+		const calls = tree.findAll({ rule: {
+			kind: "call_expression",
+			has: {
+				field: "function",
+				kind: "identifier",
+				regex: `^${escapeRegex(localName)}$`
+			}
+		} });
+		for (const call of calls) {
+			const callee = call.field("function");
+			if (!callee) continue;
+			const pos = callee.range().start.index;
+			if (isInsideAnyRange(pos, shadowRanges)) continue;
+			const arrow = findResolverBodyArrow(call);
+			if (arrow) transformResolverBody(arrow, edits);
+		}
+	}
+	if (edits.length === 0) return null;
+	let result = tree.commitEdits(edits);
+	if (importRemoved) result = result.replace(/^[\t ]*\n+/, "").replace(/\n{3,}/g, "\n\n");
+	return result;
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/sdk-skills-shim/scripts/transform.js

@@ -0,0 +1,51 @@
+import * as path from "pathe";
+//#region codemods/v2/sdk-skills-shim/scripts/transform.ts
+const SHIM_PATTERN = /\btailor-sdk-skills(?:@[^\s'"`]+)?(?:[ \t]+install)?\b(?!-)/g;
+const REPLACEMENT = "tailor-sdk skills install";
+function replaceShim(value) {
+	return value.replace(SHIM_PATTERN, REPLACEMENT);
+}
+function transformText(source) {
+	if (!SHIM_PATTERN.test(source)) return null;
+	SHIM_PATTERN.lastIndex = 0;
+	const updated = replaceShim(source);
+	return updated === source ? null : updated;
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	let modified = false;
+	const scripts = parsed.scripts;
+	if (typeof scripts === "object" && scripts != null && !Array.isArray(scripts)) for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		if (!value.includes("tailor-sdk-skills")) continue;
+		const updated = replaceShim(value);
+		if (updated !== value) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Replace `tailor-sdk-skills` invocations with `tailor-sdk skills install`.
+*
+* The standalone `tailor-sdk-skills` binary is removed in v2; users must call
+* the subcommand on the main `tailor-sdk` CLI instead.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch package.json vs text)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!source.includes("tailor-sdk-skills")) return null;
+	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	return transformText(source);
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/test-run-arg-input/scripts/transform.js

@@ -0,0 +1,144 @@
+import * as path from "pathe";
+//#region codemods/v2/test-run-arg-input/scripts/transform.ts
+const COMMAND_PATTERN = /\btailor-sdk\s+function\s+test-run\b/;
+const JOIN_MARKER = "SDK_CODEMOD_JOIN";
+const SHELL_ARG_PATTERN = new RegExp(`(--arg|-a)(\\s*=\\s*|(?:\\s|${JOIN_MARKER})+)(['"\`])((?:\\\\.|(?!\\3)[^\\\\])*)\\3`, "g");
+function isInputWrapper(parsed) {
+	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && Object.keys(parsed).length === 1 && "input" in parsed;
+}
+function unwrapJsonString(body, quote) {
+	const decoded = quote === "\"" ? body.replace(/\\(["\\])/g, "$1") : body;
+	let parsed;
+	try {
+		parsed = JSON.parse(decoded);
+	} catch {
+		return null;
+	}
+	if (!isInputWrapper(parsed)) return null;
+	const inner = JSON.stringify(parsed.input);
+	if (quote === "\"") return inner.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+	return inner;
+}
+/**
+* Apply the unwrap to one shell command segment. Quotes are tracked so command
+* boundary characters inside strings (e.g. `'a;b'`) are not split.
+*/
+function applyUnwrapToSegment(segment) {
+	return segment.replace(SHELL_ARG_PATTERN, (match, flag, sep, quote, body) => {
+		const unwrapped = unwrapJsonString(body, quote);
+		if (unwrapped == null) return match;
+		return `${flag}${sep}${quote}${unwrapped}${quote}`;
+	});
+}
+/**
+* Walk the line splitting on unquoted shell command boundaries (`;`, `&&`,
+* `||`, `|`, `&`) and only run the unwrap on segments that actually invoke
+* `tailor-sdk function test-run`. Without this, a chained line like
+* `tailor-sdk function test-run ... --arg '{"input":...}' && other-cli --arg '{"input":...}'`
+* would have the unrelated `other-cli` argument unwrapped too.
+*/
+function transformShellLine(line) {
+	if (!COMMAND_PATTERN.test(line)) return line;
+	let result = "";
+	let segBuf = "";
+	let i = 0;
+	let quoteChar = null;
+	const N = line.length;
+	const flushSegment = () => {
+		if (COMMAND_PATTERN.test(segBuf)) result += applyUnwrapToSegment(segBuf);
+		else result += segBuf;
+		segBuf = "";
+	};
+	while (i < N) {
+		const ch = line[i];
+		if (quoteChar) {
+			if (ch === "\\" && quoteChar !== "'" && i + 1 < N) {
+				segBuf += line.slice(i, i + 2);
+				i += 2;
+				continue;
+			}
+			if (ch === quoteChar) quoteChar = null;
+			segBuf += ch;
+			i++;
+			continue;
+		}
+		if (ch === "\"" || ch === "'" || ch === "`") {
+			quoteChar = ch;
+			segBuf += ch;
+			i++;
+			continue;
+		}
+		const two = line.slice(i, i + 2);
+		if (two === "&&" || two === "||") {
+			flushSegment();
+			result += two;
+			i += 2;
+			continue;
+		}
+		if (ch === ";" || ch === "|" || ch === "&") {
+			flushSegment();
+			result += ch;
+			i++;
+			continue;
+		}
+		segBuf += ch;
+		i++;
+	}
+	flushSegment();
+	return result;
+}
+function transformShellLikeText(source) {
+	if (!COMMAND_PATTERN.test(source)) return null;
+	const joined = source.replace(/\\\n/g, JOIN_MARKER);
+	let modified = false;
+	const lines = joined.split("\n");
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		const transformed = transformShellLine(line);
+		if (transformed !== line) {
+			lines[i] = transformed;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	return lines.join("\n").split(JOIN_MARKER).join("\\\n");
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	const scripts = parsed.scripts;
+	if (typeof scripts !== "object" || scripts == null || Array.isArray(scripts)) return null;
+	let modified = false;
+	for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		if (!COMMAND_PATTERN.test(value)) continue;
+		const updated = transformShellLikeText(value);
+		if (updated != null) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Strip `{ "input": ... }` wrappers from `tailor-sdk function test-run --arg` JSON.
+*
+* In v2 the resolver `--arg` JSON must be the input fields directly. Old format
+* wrapped them under `input` and is removed.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch by extension)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!source.includes("tailor-sdk")) return null;
+	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	return transformShellLikeText(source);
+}
+//#endregion
+export { transform as default };

package/dist/index.js

@@ -2,8 +2,8 @@
 import * as url from "node:url";
 import { fileURLToPath } from "node:url";
 import * as path from "pathe";
-import { arg, defineCommand, runMain } from "politty";
 import { readPackageJSON } from "pkg-types";
+import { arg, defineCommand, runMain } from "politty";
 import { z } from "zod";
 import { gte, lt, valid } from "semver";
 import * as fs from "node:fs";
@@ -13,15 +13,93 @@ import { structuredPatch } from "diff";
 import picomatch from "picomatch";
 //#region src/registry.ts
 const CODEMODS_ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), "codemods");
-const allCodemods = [{
-	id: "v2/define-generators-to-plugins",
-	name: "defineGenerators → definePlugins",
-	description: "Migrate defineGenerators() tuple syntax to definePlugins() with explicit plugin imports",
-	since: "1.0.0",
-	until: "2.0.0",
-	scriptPath: "v2/define-generators-to-plugins/scripts/transform.js",
-	legacyPatterns: ["defineGenerators"]
-}];
+const allCodemods = [
+	{
+		id: "v2/define-generators-to-plugins",
+		name: "defineGenerators → definePlugins",
+		description: "Migrate defineGenerators() tuple syntax to definePlugins() with explicit plugin imports",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/define-generators-to-plugins/scripts/transform.js",
+		legacyPatterns: ["defineGenerators"]
+	},
+	{
+		id: "v2/test-run-arg-input",
+		name: "function test-run --arg input unwrap",
+		description: "Strip the deprecated {input: ...} wrapper from `tailor-sdk function test-run --arg` JSON in scripts and docs",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/test-run-arg-input/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh}",
+			"**/*.md"
+		]
+	},
+	{
+		id: "v2/sdk-skills-shim",
+		name: "tailor-sdk-skills → tailor-sdk skills install",
+		description: "Replace deprecated `tailor-sdk-skills` invocations with `tailor-sdk skills install`",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/sdk-skills-shim/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh,yml,yaml}",
+			"**/*.md"
+		],
+		legacyPatterns: ["tailor-sdk-skills"]
+	},
+	{
+		id: "v2/principal-unify",
+		name: "Unify TailorUser/TailorActor/TailorInvoker → TailorPrincipal",
+		description: "Rename TailorUser/TailorActor/TailorInvoker to TailorPrincipal, drop unauthenticatedTailorUser, and rename resolver body `user` to `caller`",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/principal-unify/scripts/transform.js",
+		legacyPatterns: [
+			"TailorUser",
+			"TailorActor",
+			"TailorInvoker",
+			"unauthenticatedTailorUser"
+		]
+	},
+	{
+		id: "v2/apply-to-deploy",
+		name: "tailor-sdk apply → tailor-sdk deploy",
+		description: "Rewrite `tailor-sdk apply` invocations in package.json scripts, shell scripts, CI configs, and docs to the v2-recommended `tailor-sdk deploy` alias",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/apply-to-deploy/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh,yml,yaml}",
+			"**/*.md"
+		]
+	},
+	{
+		id: "v2/cli-rename",
+		name: "v2 CLI rename (single-word commands)",
+		description: "Rewrite `tailor-sdk crash-report` invocations to the v2 single-word `tailor-sdk crashreport` form across package.json scripts, shell scripts, CI configs, and docs",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/cli-rename/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh,yml,yaml}",
+			"**/*.md"
+		]
+	},
+	{
+		id: "v2/auth-invoker-unwrap",
+		name: "auth.invoker(\"name\") → \"name\"",
+		description: "Replace `auth.invoker(\"name\")` calls with the bare `\"name\"` string and drop the `auth` import when no other reference remains. The `auth.invoker()` helper is deprecated in v2 because importing `auth` from `tailor.config.ts` into runtime files pulls Node-only modules into the bundle.",
+		since: "1.0.0",
+		until: "2.0.0",
+		scriptPath: "v2/auth-invoker-unwrap/scripts/transform.js",
+		legacyPatterns: ["auth.invoker"]
+	}
+];
 /**
 * Resolve the absolute path to a codemod script.
 * @param scriptPath - Relative path from the codemods root

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk-codemod",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Codemod runner for Tailor Platform SDK upgrades",
   "license": "MIT",
   "repository": {
@@ -8,7 +8,6 @@
     "url": "git+https://github.com/tailor-platform/sdk.git",
     "directory": "packages/sdk-codemod"
   },
-  "bin": "dist/index.js",
   "files": [
     "CHANGELOG.md",
     "dist",
@@ -17,7 +16,7 @@
   ],
   "type": "module",
   "dependencies": {
-    "@ast-grep/napi": "0.42.1",
+    "@ast-grep/napi": "0.42.2",
     "chalk": "5.6.2",
     "diff": "9.0.0",
     "pathe": "2.0.3",
@@ -28,25 +27,24 @@
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@eslint/js": "10.0.1",
-    "@types/node": "24.12.2",
+    "@types/node": "24.12.3",
     "@types/picomatch": "4.0.3",
     "@types/semver": "7.7.1",
-    "eslint": "10.3.0",
-    "eslint-plugin-oxlint": "1.61.0",
     "oxlint": "1.61.0",
-    "tsdown": "0.21.10",
+    "tsdown": "0.22.0",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.59.1",
     "vitest": "4.1.5"
   },
   "scripts": {
     "build": "tsdown",
-    "lint": "oxlint . && eslint --cache .",
-    "lint:fix": "oxlint --fix . && eslint --cache --fix .",
+    "lint": "oxlint .",
+    "lint:fix": "oxlint . --fix",
     "typecheck": "tsc --noEmit",
     "test": "vitest",
     "prepublish": "pnpm run build",
     "publint": "publint --strict"
+  },
+  "bin": {
+    "sdk-codemod": "dist/index.js"
   }
 }