@tailor-platform/sdk-codemod 0.3.0-next.1 → 0.3.0-next.2

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # @tailor-platform/sdk-codemod
 
+## 0.3.0-next.2
+### Minor Changes
+
+
+
+- [#1473](https://github.com/tailor-platform/sdk/pull/1473) [`7ddf3c7`](https://github.com/tailor-platform/sdk/commit/7ddf3c716adf85a66a75d554da7730b5406f84b1) Thanks [@dqn](https://github.com/dqn)! - Add the `v2/principal-unify` codemod so `tailor-sdk upgrade` can migrate SDK principal APIs to `TailorPrincipal`.
+
+
+### Patch Changes
+
+
+
+- [#1515](https://github.com/tailor-platform/sdk/pull/1515) [`dcf66a1`](https://github.com/tailor-platform/sdk/commit/dcf66a1e648f5287eaea9ea330eb4ad726a4d363) Thanks [@dqn](https://github.com/dqn)! - Rewrite `tailor-sdk apply` to `tailor-sdk deploy` in source files that contain embedded CLI command strings.
+
+
+
+- [#1482](https://github.com/tailor-platform/sdk/pull/1482) [`8b5870e`](https://github.com/tailor-platform/sdk/commit/8b5870e85db1efec7647acb98226f8161e3d1583) Thanks [@toiroakr](https://github.com/toiroakr)! - Add LLM-assisted review support to the codemod runner. A codemod can declare `suspiciousPatterns` plus a `prompt`; after running, files whose post-transform content still matches a suspicious pattern are reported as `llmReviews` (in the JSON output and on stderr) together with the codemod's migration prompt. This surfaces the cases a deterministic transform cannot safely complete (e.g. a value reached through a variable) so they can be finished with an LLM. The `auth.invoker(...)` codemod adopts this for its non-literal-argument cases.
+
+
+
+- [#1495](https://github.com/tailor-platform/sdk/pull/1495) [`6234022`](https://github.com/tailor-platform/sdk/commit/6234022d7dc03813b8dade831b86f63a5f7a20e6) Thanks [@toiroakr](https://github.com/toiroakr)! - Generate the v2 migration guide (`packages/sdk/docs/migration/v2.md`) from the codemod registry, which is the single source of truth. Each entry renders its name, automation level (Automatic / Partially automatic / Manual), description, optional before/after `examples`, and — for changes the codemods cannot fully migrate on their own — the LLM/manual migration prompt. Run `pnpm codemod:docs:update` to regenerate and `pnpm codemod:docs:check` (wired into `pnpm check`) to verify it is in sync.
+  
+  `scriptPath` is now optional, so the registry can also describe codemod-less ("manual") migrations that ship only guidance (`examples` / `prompt` / `suspiciousPatterns`) with no automatic transform. A manual entry with a `prompt` but no scoping pattern is surfaced as a project-wide `llmReviews` entry at runtime.
+  
+  Add a `sdk-codemod list` command that prints every registered rule (id, name, kind, version range).
+
+
+- [#1517](https://github.com/tailor-platform/sdk/pull/1517) [`a649764`](https://github.com/tailor-platform/sdk/commit/a6497649be2786b3f6e410c8aa98c4247a599258) Thanks [@dqn](https://github.com/dqn)! - Reduce false-positive v2 codemod warnings and LLM-review prompts from source comments, string literals, and identifier substring matches.
+
+
+
+- [#1476](https://github.com/tailor-platform/sdk/pull/1476) [`fa83075`](https://github.com/tailor-platform/sdk/commit/fa83075f5e0e91085c0ef0cb44b7058a28a79ec3) Thanks [@toiroakr](https://github.com/toiroakr)! - `executeScript` now takes its `arg` as a JSON-serializable value instead of a pre-serialized JSON string. Pass the value directly (e.g. `arg: { a: 1 }`) instead of `arg: JSON.stringify({ a: 1 })`.
+  
+  Add the `v2/execute-script-arg` codemod, which unwraps `JSON.stringify(...)` passed as the `executeScript` `arg` option. Indirect forms (a stringified value held in a variable, etc.) cannot be rewritten automatically and are surfaced as an LLM-assisted review task with a migration prompt.
+
+
+- [#1518](https://github.com/tailor-platform/sdk/pull/1518) [`ab10b1f`](https://github.com/tailor-platform/sdk/commit/ab10b1fea309ec5496e09bdca394d46d58603f5f) Thanks [@dqn](https://github.com/dqn)! - Reduce noisy `executeScript` LLM-review prompts by flagging files only when unresolved `arg` stringification remains likely.
+
+
+
+- [#1509](https://github.com/tailor-platform/sdk/pull/1509) [`7cadaa7`](https://github.com/tailor-platform/sdk/commit/7cadaa7c4987b81130ca80ba80bc5d5b26276394) Thanks [@dqn](https://github.com/dqn)! - Rename resolver, executor, workflow trigger, and typed workflow start machine-user options from `authInvoker` to `invoker`.
+  
+  Update create-sdk templates and the v2 auth invoker codemod to generate the new `invoker` option.
+
+
+- [#1519](https://github.com/tailor-platform/sdk/pull/1519) [`4e3fa47`](https://github.com/tailor-platform/sdk/commit/4e3fa47d24e6bb1145eac13c355e976f2d594851) Thanks [@dqn](https://github.com/dqn)! - Limit the `openDownloadStream` migration review prompt to files that reference deprecated download stream APIs.
+
+
+
+- [#1521](https://github.com/tailor-platform/sdk/pull/1521) [`2d0689e`](https://github.com/tailor-platform/sdk/commit/2d0689e8ac0079473294fab367799a5431c130f4) Thanks [@dqn](https://github.com/dqn)! - Flag files that need project-specific review after the v2 principal migration, including resolver helper adapters and nullable `caller` follow-ups.
+
+
+
+- [#1525](https://github.com/tailor-platform/sdk/pull/1525) [`425a19d`](https://github.com/tailor-platform/sdk/commit/425a19dd58da6e373b739d3b3e838c2ff3d1736a) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency semver to v7.8.5
+
+
+
+- [#1520](https://github.com/tailor-platform/sdk/pull/1520) [`ed3d338`](https://github.com/tailor-platform/sdk/commit/ed3d338ce71d68904ef1fb83afbbd06a7e5f6973) Thanks [@dqn](https://github.com/dqn)! - Flag files that still reference ambient Tailor runtime globals so the v2 migration can opt them into `@tailor-platform/sdk/runtime/globals`.
+
+
+
+- [#1439](https://github.com/tailor-platform/sdk/pull/1439) [`c5b10d2`](https://github.com/tailor-platform/sdk/commit/c5b10d2841ded08927285bce538c05220cde5e4c) Thanks [@dqn](https://github.com/dqn)! - Unify function principal context around `TailorPrincipal`.
+  
+  Resolver contexts now use `caller` and `invoker` as `TailorPrincipal | null`, workflow and executor invokers also use `TailorPrincipal | null`, and event executor `actor` uses `TailorPrincipal | null` with `id`/`type` fields. The legacy `TailorUser`, `TailorInvoker`, `TailorActor`, `TailorActorType`, and `unauthenticatedTailorUser` exports are removed.
+
 ## 0.3.0-next.1
 ### Patch Changes
 

package/dist/codemods/v2/apply-to-deploy/scripts/transform.js

@@ -3,6 +3,16 @@ import * as path from "pathe";
 const ARG_VALUE = `(?:[^\\s'"\`;&|]+|'[^']*'|"(?:(?:\\\\.)|[^"\\\\])*")`;
 const GLOBAL_ARG_PATTERN = `(?:(?:\\s+(?:--verbose|--json|-j))|(?:\\s+(?:--env-file|--env-file-if-exists|-e)(?:=${ARG_VALUE}|\\s+${ARG_VALUE})))*`;
 const APPLY_PATTERN = new RegExp(`(?<![\\w-])tailor-sdk(?:@[^\\s'"\`]+)?(?![\\w-])(${GLOBAL_ARG_PATTERN}\\s+)apply(?![-\\w])`, "g");
+const SOURCE_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
 function replaceApply(value) {
 	return value.replace(APPLY_PATTERN, (match) => `${match.slice(0, -5)}deploy`);
 }
@@ -12,6 +22,10 @@ function transformText(source) {
 	const updated = replaceApply(source);
 	return updated === source ? null : updated;
 }
+function transformSourceText(source) {
+	const updated = source.split(/(\r\n|\n|\r)/).map((part, index) => index % 2 === 0 ? replaceApply(part) : part).join("");
+	return updated === source ? null : updated;
+}
 function transformPackageJson(source) {
 	let parsed;
 	try {
@@ -44,7 +58,9 @@ function transformPackageJson(source) {
 */
 function transform(source, filePath) {
 	if (!source.includes("tailor-sdk")) return null;
-	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	const ext = path.extname(filePath).toLowerCase();
+	if (ext === ".json") return transformPackageJson(source);
+	if (SOURCE_EXTENSIONS.has(ext)) return transformSourceText(source);
 	return transformText(source);
 }
 //#endregion

package/dist/codemods/v2/auth-invoker-unwrap/scripts/transform.js

@@ -1,8 +1,8 @@
 import { Lang, parse } from "@ast-grep/napi";
 //#region codemods/v2/auth-invoker-unwrap/scripts/transform.ts
-const QUICK_FILTER_NEEDLE = "auth.invoker";
+const QUICK_FILTER_NEEDLES = ["auth.invoker", "authInvoker"];
 function quickFilter(source) {
-	return source.includes(QUICK_FILTER_NEEDLE);
+	return QUICK_FILTER_NEEDLES.some((needle) => source.includes(needle));
 }
 function isInsideImportStatement(node) {
 	let current = node.parent();
@@ -121,14 +121,101 @@ function findAuthImports(root) {
 		return false;
 	});
 }
+function sameRange(a, b) {
+	const ar = a.range();
+	const br = b.range();
+	return ar.start.index === br.start.index && ar.end.index === br.end.index;
+}
+function keyText(node) {
+	if (!node) return null;
+	return node.text().replace(/^['"]|['"]$/g, "");
+}
+function expressionArguments(args) {
+	return args.children().filter((child) => ![
+		"(",
+		")",
+		","
+	].includes(child.kind()));
+}
+function argumentCallForObject(objectNode) {
+	const args = objectNode.parent();
+	const call = args?.parent();
+	if (args?.kind() !== "arguments" || call?.kind() !== "call_expression") return null;
+	const index = expressionArguments(args).findIndex((arg) => sameRange(arg, objectNode));
+	return index === -1 ? null : {
+		call,
+		index
+	};
+}
+function calleeText(call) {
+	return call.field("function")?.text() ?? "";
+}
+function isCreateCallOptionObject(objectNode, functionName) {
+	const callInfo = argumentCallForObject(objectNode);
+	return callInfo?.index === 0 && callInfo.call.field("function")?.kind() === "identifier" && calleeText(callInfo.call) === functionName;
+}
+function isExecutorOperationObject(objectNode) {
+	const operationPair = objectNode.parent();
+	if (operationPair?.kind() !== "pair" || keyText(operationPair.field("key")) !== "operation") return false;
+	const configObject = operationPair.parent();
+	return configObject?.kind() === "object" && isCreateCallOptionObject(configObject, "createExecutor");
+}
+function isSupportedInvokerOptionObject(objectNode) {
+	return isCreateCallOptionObject(objectNode, "createResolver") || isCreateCallOptionObject(objectNode, "startWorkflow") || isExecutorOperationObject(objectNode);
+}
+function optionObjectForPairKey(node) {
+	const parent = node.parent();
+	if (!parent || parent.kind() !== "pair") return null;
+	const key = parent.field("key");
+	if (!key || !sameRange(key, node)) return null;
+	const objectNode = parent.parent();
+	return objectNode?.kind() === "object" ? objectNode : null;
+}
+function isSupportedInvokerOptionKey(node) {
+	const objectNode = optionObjectForPairKey(node) ?? node.parent();
+	return objectNode?.kind() === "object" && isSupportedInvokerOptionObject(objectNode);
+}
+function isSupportedInvokerValueCall(node) {
+	const pair = node.parent();
+	if (pair?.kind() !== "pair") return false;
+	const value = pair.field("value");
+	if (!value || !sameRange(value, node)) return false;
+	const key = keyText(pair.field("key"));
+	if (key !== "authInvoker" && key !== "invoker") return false;
+	const objectNode = pair.parent();
+	return objectNode?.kind() === "object" && isSupportedInvokerOptionObject(objectNode);
+}
+function findAuthInvokerShorthands(root) {
+	return root.findAll({ rule: {
+		kind: "shorthand_property_identifier",
+		regex: "^authInvoker$"
+	} }).filter(isSupportedInvokerOptionKey);
+}
+function findAuthInvokerPropertyKeys(root) {
+	return root.findAll({ rule: {
+		kind: "property_identifier",
+		regex: "^authInvoker$"
+	} }).filter(isSupportedInvokerOptionKey);
+}
+function findQuotedAuthInvokerPropertyKeys(root) {
+	return root.findAll({ rule: {
+		kind: "string",
+		regex: "^['\"]authInvoker['\"]$"
+	} }).filter(isSupportedInvokerOptionKey);
+}
+function renameQuotedKey(node) {
+	const quote = node.text().startsWith("'") ? "'" : "\"";
+	return `${quote}invoker${quote}`;
+}
 /**
-* Replace `auth.invoker("name")` calls with the bare `"name"` string literal.
+* Replace `auth.invoker("name")` calls with the bare `"name"` string literal
+* and rename `authInvoker:` option keys to `invoker:`.
 * If no other `auth` references remain after the rewrite, drop the `auth`
 * specifier (or the entire import line when `auth` was its sole specifier).
 *
-* `auth.invoker()` was deprecated in favor of passing the machine user name
-* directly; carrying the `auth` import only for `.invoker()` would otherwise
-* pull config-layer (Node-only) modules into runtime bundles.
+* `auth.invoker()` was removed in favor of passing the machine user name
+* directly to `invoker`; carrying the `auth` import only for `.invoker()`
+* would otherwise pull config-layer modules into runtime bundles.
 * @param source - File contents
 * @param filePath - Absolute path to the file (kept for the runner signature)
 * @returns Transformed source or null when nothing matched.
@@ -136,15 +223,16 @@ function findAuthImports(root) {
 function transform(source, _filePath) {
 	if (!quickFilter(source)) return null;
 	const root = parse(source.includes("</") || source.includes("/>") ? Lang.Tsx : Lang.TypeScript, source).root();
-	const calls = findInvokerCalls(root);
-	if (calls.length === 0) return null;
+	const calls = findInvokerCalls(root).filter((c) => isSupportedInvokerValueCall(c.callNode));
 	const edits = calls.map((c) => c.callNode.replace(c.argText));
-	if (countRemainingAuthRefs(root, calls.map((c) => c.range)) === 0) for (const importStmt of findAuthImports(root)) {
+	edits.push(...findAuthInvokerPropertyKeys(root).map((node) => node.replace("invoker")));
+	edits.push(...findQuotedAuthInvokerPropertyKeys(root).map((node) => node.replace(renameQuotedKey(node))));
+	edits.push(...findAuthInvokerShorthands(root).map((node) => node.replace("invoker: authInvoker")));
+	if (calls.length > 0 && countRemainingAuthRefs(root, calls.map((c) => c.range)) === 0) for (const importStmt of findAuthImports(root)) {
 		const edit = buildAuthImportRemovalEdit(source, importStmt);
 		if (edit) edits.push(edit);
 	}
-	if (edits.length === 0) return null;
-	let result = root.commitEdits(edits);
+	let result = edits.length === 0 ? source : root.commitEdits(edits);
 	result = result.replace(/^[\t ]*\n+/, "").replace(/\n{3,}/g, "\n\n");
 	return result === source ? null : result;
 }

package/dist/codemods/v2/execute-script-arg/scripts/transform.js

@@ -0,0 +1,60 @@
+import { Lang, parse } from "@ast-grep/napi";
+//#region codemods/v2/execute-script-arg/scripts/transform.ts
+const NEEDLE = "executeScript";
+function quickFilter(source) {
+	return source.includes(NEEDLE) && source.includes("JSON.stringify");
+}
+function pairKeyText(pair) {
+	const key = pair.children()[0];
+	if (!key) return null;
+	return key.text().replace(/^['"]|['"]$/g, "");
+}
+/**
+* True when `stringifyCall` is the value of a top-level `arg:` property in the
+* object literal passed directly to `executeScript(...)`. The chain checked is
+* `JSON.stringify(...)` → pair (`arg:`) → object → arguments → `executeScript`
+* call, so a nested `arg:` (e.g. `executeScript({ opts: { arg: ... } })`) or an
+* unrelated `JSON.stringify` is left untouched.
+*/
+function isExecuteScriptArg(stringifyCall) {
+	const pair = stringifyCall.parent();
+	if (!pair || pair.kind() !== "pair") return false;
+	if (pairKeyText(pair) !== "arg") return false;
+	const obj = pair.parent();
+	if (!obj || obj.kind() !== "object") return false;
+	const args = obj.parent();
+	if (!args || args.kind() !== "arguments") return false;
+	const call = args.parent();
+	if (!call || call.kind() !== "call_expression") return false;
+	const callee = call.children()[0];
+	return !!callee && callee.text() === NEEDLE;
+}
+/**
+* Rewrite `executeScript({ ..., arg: JSON.stringify(X), ... })` to
+* `executeScript({ ..., arg: X, ... })`.
+*
+* In v2 the `executeScript` `arg` option takes a JSON-serializable value and
+* serializes it internally, so a pre-stringified argument double-encodes. Only
+* the literal `arg: JSON.stringify(<single expr>)` form is rewritten; indirect
+* forms (a stringified value held in a variable, `JSON.stringify(x, null, 2)`,
+* etc.) are left for manual migration.
+* @param source - File contents
+* @param _filePath - Absolute path to the file (kept for the runner signature)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, _filePath) {
+	if (!quickFilter(source)) return null;
+	const root = parse(source.includes("</") || source.includes("/>") ? Lang.Tsx : Lang.TypeScript, source).root();
+	const edits = [];
+	for (const match of root.findAll({ rule: { pattern: "JSON.stringify($X)" } })) {
+		if (!isExecuteScriptArg(match)) continue;
+		const inner = match.getMatch("X");
+		if (!inner) continue;
+		edits.push(match.replace(inner.text()));
+	}
+	if (edits.length === 0) return null;
+	const result = root.commitEdits(edits);
+	return result === source ? null : result;
+}
+//#endregion
+export { transform as default };