@tailor-platform/sdk-codemod 0.4.0-next.9 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,277 @@
 # @tailor-platform/sdk-codemod
 
+## 0.4.1
+
+### Patch Changes
+
+- [#1957](https://github.com/tailor-platform/sdk/pull/1957) [`a465547`](https://github.com/tailor-platform/sdk/commit/a465547df712ca8c607c1e42cf12c15fe3e830d1) Thanks [@toiroakr](https://github.com/toiroakr)! - Invoke the CLI as `npx @tailor-platform/sdk <command>` wherever an invocation is written for you. `npx` resolves a command it cannot find locally as a package name, so `npx tailor` fell through to an unrelated `tailor` package on npm whenever the SDK was not installed in the project — including in CI, where npm installs without prompting. Omitting the version specifier keeps using the project's installed SDK when there is one.
+  
+  - Setup examples in the README, the quickstart, and the scaffolded project READMEs now use the package-runner form. Bun examples use `bun tailor <command>`, which resolves the local binary without fetching from the registry.
+  - Workflows generated by `tailor setup` use `npx @tailor-platform/sdk` for npm projects and `bun run tailor` for Bun projects. `tailor setup check` reports the template as outdated so existing projects regenerate; re-run `tailor setup` to pick it up.
+  - The `v2/seed-exec-to-cli-plugin` and `v2/sdk-skills-shim` codemods write the package-runner form when the invocation they produce goes through a runner that installs from the registry (`npx`, `bunx`, `pnpm`/`yarn dlx`, `npm exec`). A runner that resolves project binaries, such as `pnpm exec`, still gets the bare `tailor` binary.
+
+## 0.4.0
+
+### Minor Changes
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`23904bc`](https://github.com/tailor-platform/sdk/commit/23904bcb1807f96ecd3026e72d9b4de44eb8705f) Thanks [@toiroakr](https://github.com/toiroakr)! - Add the `v2/principal-unify` codemod so `tailor-sdk upgrade` can migrate SDK principal APIs to `TailorPrincipal`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`20aa5a9`](https://github.com/tailor-platform/sdk/commit/20aa5a95167d370b4b3cc7352cb60a22a695d673) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove the APIs that were marked `@deprecated` on the way to v2, so 2.0.0 ships without deprecated aliases. Each removal has migration coverage in `tailor upgrade`:
+  
+  - `@tailor-platform/sdk/cli` no longer re-exports `kyselyTypePlugin`, `enumConstantsPlugin`, `fileUtilsPlugin`, and `seedPlugin`. Import them from `@tailor-platform/sdk/plugin/kysely-type`, `/plugin/enum-constants`, `/plugin/file-utils`, and `/plugin/seed` (codemod `v2/plugin-cli-import`).
+  - `tailor.workflow.startJobFunction` and the `StartJobFunctionOptions` type are removed; use the canonical `execJobFunction` / `ExecJobFunctionOptions` (new codemod `v2/exec-job-function-rename`). `mockWorkflow()` no longer exposes the `startJobFunction` alias — assert on its `execJobFunction` mock instead — and `v2/workflow-trigger-rename` now rewrites `triggerJobFunction` straight to `execJobFunction`.
+  - `@tailor-platform/sdk/test` no longer exports the platform-global mocks `setupTailordbMock`, `setupWorkflowMock`, `setupWaitPointMock`, `setupInvokerMock`, and `setupTailorErrorsMock`, nor the bundled-output helper `createImportMain`. Use the `tailor-runtime` environment from `@tailor-platform/sdk/vitest` with `mockTailordb` / `mockWorkflow` (migration guidance: `v2/sdk-test-mocks-to-vitest`). `createTailorDBHook`, `createStandardSchema`, and `unauthenticatedTailorUser` are unchanged.
+  - The programmatic CLI functions no longer accept name-keyed options: `GetWorkflowOptions`, `StartWorkflowOptions`, `ListWorkflowExecutionsOptions`, `GetExecutorOptions`, `TriggerExecutorOptions`, `ListExecutorJobsOptions`, `GetExecutorJobOptions`, and `WatchExecutorJobOptions` are removed along with the overloads that took them. Pass the definition itself — `startWorkflow({ workflow: myWorkflow, invoker: "admin" })`, `watchExecutorJob({ executor: myExecutor, jobId })` — which also types `arg` and `payload` from the definition (migration guidance: `v2/cli-typed-options`). The name-keyed entry points remain available as CLI commands (`tailor workflow start <name>`, `tailor executor trigger <name>`).
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`b3ff0b4`](https://github.com/tailor-platform/sdk/commit/b3ff0b43bfbfc69eea797541292eff840e1d8f87) Thanks [@toiroakr](https://github.com/toiroakr)! - The `v2/seed-exec-to-cli-plugin` migration now rewrites generated seed runner invocations automatically. `node <distPath>/exec.mjs [options] [types...]` becomes `tailor seed apply [options] [types...]` and `node <distPath>/exec.mjs validate` becomes `tailor seed validate`, in package.json scripts, shell scripts, CI configs, docs, and TypeScript sources, carrying node's `--env-file` / `--env-file-if-exists` over to the CLI flag form in both the `=` and space-separated spellings. Each invocation must sit on one line, so a command split across YAML sequence items or markdown bullets is reported for review rather than rewritten. Files that `fork()` the runner are left untouched and reported with their exact line, because replacing the forked child with a CLI call also unwinds the surrounding `await`/Promise plumbing; the migration prompt now covers that rewrite and the stale `exec.mjs` deletion.
+
+### Patch Changes
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`0379fe8`](https://github.com/tailor-platform/sdk/commit/0379fe8c2e7acb927d94f56204b39cf58fa4ac2a) Thanks [@toiroakr](https://github.com/toiroakr)! - Rewrite `tailor-sdk apply` to `tailor-sdk deploy` in source files that contain embedded CLI command strings.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`6519a54`](https://github.com/tailor-platform/sdk/commit/6519a5434f0cc664a609ef2cae2398b19cad4673) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename auth attribute module augmentation from `AttributeMap` to `Attributes`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`5e35c59`](https://github.com/tailor-platform/sdk/commit/5e35c59032156eadeb45ac4c1b1453ecad79163c) Thanks [@toiroakr](https://github.com/toiroakr)! - Add LLM-assisted review support to the codemod runner. A codemod can declare `suspiciousPatterns` plus a `prompt`; after running, files whose post-transform content still matches a suspicious pattern are reported as `llmReviews` (in the JSON output and on stderr) together with the codemod's migration prompt. This surfaces the cases a deterministic transform cannot safely complete (e.g. a value reached through a variable) so they can be finished with an LLM. The `auth.invoker(...)` codemod adopts this for its non-literal-argument cases.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`8b918f6`](https://github.com/tailor-platform/sdk/commit/8b918f68867240b5713c5f8340836971d1c30882) Thanks [@toiroakr](https://github.com/toiroakr)! - Generate the v2 migration guide (`packages/sdk/docs/migration/v2.md`) from the codemod registry, which is the single source of truth. Each entry renders its name, automation level (Automatic / Partially automatic / Manual), description, optional before/after `examples`, and — for changes the codemods cannot fully migrate on their own — the LLM/manual migration prompt. Run `pnpm codemod:docs:update` to regenerate and `pnpm codemod:docs:check` (wired into `pnpm check`) to verify it is in sync.
+  
+  `scriptPath` is now optional, so the registry can also describe codemod-less ("manual") migrations that ship only guidance (`examples` / `prompt` / `suspiciousPatterns`) with no automatic transform. A manual entry with a `prompt` but no scoping pattern is surfaced as a project-wide `llmReviews` entry at runtime.
+  
+  Add a `sdk-codemod list` command that prints every registered rule (id, name, kind, version range).
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`bfb9451`](https://github.com/tailor-platform/sdk/commit/bfb945122720cec94be23484e23d7ce7607257d8) Thanks [@toiroakr](https://github.com/toiroakr)! - Reduce false-positive v2 codemod warnings and LLM-review prompts from source comments, string literals, and identifier substring matches.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`752ca9d`](https://github.com/tailor-platform/sdk/commit/752ca9dea12c7ba56ac1ed8091efc3fb6e7812be) Thanks [@toiroakr](https://github.com/toiroakr)! - Report the codemod runner identity in the JSON summary, including the source checkout commit and local build command when run from a branch build, so prerelease migration validation can distinguish exact npm packages from branch-head behavior.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`1a055c9`](https://github.com/tailor-platform/sdk/commit/1a055c9909ac951f807fc2249c9abc1d5805398f) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename the TailorDB schema builder from `db.type()` to `db.table()`.
+  
+  Update TailorDB definitions:
+  
+  ```diff
+   import { db } from "@tailor-platform/sdk";
+  
+  -export const user = db.type("User", {
+  +export const user = db.table("User", {
+     name: db.string(),
+   });
+  ```
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`982dee1`](https://github.com/tailor-platform/sdk/commit/982dee1bb73d8ca1faf35f7d256eba0c5ed86957) Thanks [@toiroakr](https://github.com/toiroakr)! - Make the deprecation process mechanical: an `@deprecated` tag in the SDK now states the version it shipped in and the codemod that migrates callers off it (`@deprecated since 2.1.0 — use {@link newApi} instead. codemod: v2/old-to-new`), and `pnpm check:deprecations` fails when a tag misses either half, names a codemod that is not registered, or outlives its codemod's boundary — so the release PR that bumps to a major turns red while an API due for removal is still declared, instead of the alias shipping and being noticed releases later. While the shipping version is still undecided the tag carries the literal `NEXT_RELEASE`, which the release workflow rewrites to the version the release PR bumps to — the same step that already resolves `prereleaseUntil: V2_NEXT_PENDING` codemod boundaries.
+  
+  Registered codemods are validated more strictly too: a `since` that is not valid semver, or that is not older than `until`, now fails fast instead of surfacing as a semver error partway through `tailor upgrade` or as a codemod whose empty version range silently matches nothing.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`039389d`](https://github.com/tailor-platform/sdk/commit/039389d17ddf3014fc53ffdb756ec6ea1425826c) Thanks [@toiroakr](https://github.com/toiroakr)! - Generate the `Env` interface in `tailor.d.ts` from the type of each `defineConfig({ env })` value instead of the value itself. The resolved value used to be written in as a literal type, so running `generate` or `deploy` with real environment variables loaded stamped those values into a file that is normally committed.
+  
+  ```diff
+   interface Env {
+  -  API_BASE: "https://api.example.com";
+  -  RETRIES: 3;
+  -  VERBOSE: true;
+  +  API_BASE: string;
+  +  RETRIES: number;
+  +  VERBOSE: boolean;
+   }
+  ```
+  
+  `env` keys that aren't valid TypeScript identifiers (for example `"API-BASE"`) are now quoted as well; previously they were emitted bare and produced a `tailor.d.ts` that failed to parse.
+  
+  Run `tailor generate` after upgrading to refresh the file. Code that relied on the literal narrowing — comparing `env.STAGE` against a literal union, for example — has to widen its own types or read the value through a local narrowing check. If a `tailor.d.ts` you already committed contains a sensitive value, treat that value as exposed and rotate it; keep secrets in [Secret Manager](https://github.com/tailor-platform/sdk/blob/main/packages/sdk/docs/services/secret.md) rather than `env`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`a6038e2`](https://github.com/tailor-platform/sdk/commit/a6038e25151bf32694cc2d20fd3845b1ed959ccc) Thanks [@toiroakr](https://github.com/toiroakr)! - Move the TailorDB `erdSite` setting out of the core config schema into the ERD plugin's own configuration. `db.<namespace>.erdSite` is no longer accepted in `tailor.config.ts`; configure the ERD deploy target on the plugin instead:
+  
+  ```ts
+  import { definePlugins } from "@tailor-platform/sdk";
+  import { tailordbErdPlugin } from "@tailor-platform/sdk-plugin-tailordb-erd";
+  
+  export const plugins = definePlugins(
+    // TailorDB namespace name → static website name
+    tailordbErdPlugin({ sites: { tailordb: "my-erd-site" } }),
+  );
+  ```
+  
+  The `tailor tailordb erd` commands resolve deploy targets from `tailordbErdPlugin({ sites })` and now validate each namespace against `config.db` and each site name against `staticWebsites`, so typos surface when the config is loaded instead of at deploy time. The `v2/erd-site-to-plugin` codemod migrates existing configs automatically. For programmatic users, `loadTailorDBNamespaces()` additionally returns the config module's registered `plugins`, and namespace selector callbacks receive them as a second argument.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`4022203`](https://github.com/tailor-platform/sdk/commit/40222035a5de08e1d0d3e7b8d96047fdbd2b2d19) Thanks [@toiroakr](https://github.com/toiroakr)! - `executeScript` now takes its `arg` as a JSON-serializable value instead of a pre-serialized JSON string. Pass the value directly (e.g. `arg: { a: 1 }`) instead of `arg: JSON.stringify({ a: 1 })`.
+  
+  Add the `v2/execute-script-arg` codemod, which unwraps `JSON.stringify(...)` passed as the `executeScript` `arg` option. Indirect forms (a stringified value held in a variable, etc.) cannot be rewritten automatically and are surfaced as an LLM-assisted review task with a migration prompt.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`078418a`](https://github.com/tailor-platform/sdk/commit/078418afde150fc971aa7fec7eb87ffff014e134) Thanks [@toiroakr](https://github.com/toiroakr)! - Reduce noisy `executeScript` LLM-review prompts by flagging files only when unresolved `arg` stringification remains likely.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`54f4d08`](https://github.com/tailor-platform/sdk/commit/54f4d085e077913ae3a923bcb520362b9e57d876) Thanks [@toiroakr](https://github.com/toiroakr)! - `seedPlugin` no longer generates the `exec.mjs` seed runner. Seeding and validation move to the `tailor seed` commands provided by the `@tailor-platform/sdk-plugin-seed` CLI plugin: install it with `npm install -D @tailor-platform/sdk-plugin-seed`, replace `node <distPath>/exec.mjs` with `tailor seed apply` and `node <distPath>/exec.mjs validate` with `tailor seed validate`, and delete the stale generated `exec.mjs`. Seed data and schema generation (`data/*.jsonl`, `data/*.schema.ts`) is unchanged. Because the plugin reads the config at run time, `machineUserName` changes in seedPlugin options now take effect without regenerating. `@tailor-platform/sdk/cli` gains `loadSeedContext` (and `SeedContext` types) for this, `SeedData` is now JSON-typed, and `executeScript` accepts a plain object `invoker` (`ScriptInvoker`).
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`c8778f2`](https://github.com/tailor-platform/sdk/commit/c8778f22b4306705b085602b7c221f4166c31447) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix `tailor upgrade` reporting zero codemods across several v2 prerelease boundaries. `v2/db-type-to-table` and `v2/runtime-subpath-namespace` now trigger at `2.0.0-next.4` (where they actually shipped) instead of `2.0.0-next.3`, and `v2/forward-relation-name`, `v2/tailordb-validate-simplify`, and `v2/tailordb-hook-redesign` now trigger at `2.0.0-next.5` instead of `2.0.0-next.4`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`e79dc3f`](https://github.com/tailor-platform/sdk/commit/e79dc3fd6862f7f00df08ef8f2b8721f562afa8c) Thanks [@toiroakr](https://github.com/toiroakr)! - Apply the v2 `rename-bin` codemod to SDK CLI command strings in TypeScript and JavaScript source files.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`d69add3`](https://github.com/tailor-platform/sdk/commit/d69add3f24e944dd7153eef9da6e0c36a5e4a989) Thanks [@toiroakr](https://github.com/toiroakr)! - Run v2 codemods when the target version is a v2 prerelease.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`b6340d0`](https://github.com/tailor-platform/sdk/commit/b6340d086822fbf5bd6fffa16a7dba47ccc3a59a) Thanks [@toiroakr](https://github.com/toiroakr)! - Derive default TailorDB forward relation names from the relation field name by removing a trailing `ID`, `Id`, or `id`, instead of deriving them from the target table name.
+  
+  The v2 migration review identifies non-self relations without `toward.as`. Add an explicit name to preserve the v1 GraphQL field name, or update consumers to use the new field-based name.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`8cb5bcd`](https://github.com/tailor-platform/sdk/commit/8cb5bcdfe4d2494790b2b9ad72c7e1c43715f9e8) Thanks [@toiroakr](https://github.com/toiroakr)! - Flag `tailor generate --watch` / `-W` invocations and programmatic `generate({ watch })` usage for manual review as part of the v2 migration (the flag and its dependency watcher are removed in `@tailor-platform/sdk` v2).
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`d1405c0`](https://github.com/tailor-platform/sdk/commit/d1405c0b0dbd6205c1817c79b239fe980906c19b) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename the `defineIdp` option `publishUserEvents` to `publishEvents`, so all four services that publish events use one field name. A codemod rewrites the option key on `defineIdp` calls, including aliased and namespace imports, and rewrites a shorthand `{ publishUserEvents }` to `{ publishEvents: publishUserEvents }` so it keeps reading the same local. Occurrences it cannot rewrite — an options object built outside the call, a computed key, or a type declaration of the option — are reported for manual migration.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`cd48fda`](https://github.com/tailor-platform/sdk/commit/cd48fdab46746aa2e8f5d8dd43073e3b4832c07c) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename resolver, executor, workflow trigger, and typed workflow start machine-user options from `authInvoker` to `invoker`.
+  
+  Update create-sdk templates and the v2 auth invoker codemod to generate the new `invoker` option.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`28c0dde`](https://github.com/tailor-platform/sdk/commit/28c0dde9a33e4db39b04b083e22feb837e3605a7) Thanks [@toiroakr](https://github.com/toiroakr)! - Limit the `openDownloadStream` migration review prompt to files that reference deprecated download stream APIs.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`6374ec6`](https://github.com/tailor-platform/sdk/commit/6374ec64f3602c35ed2b2e45ba2260591327fafb) Thanks [@toiroakr](https://github.com/toiroakr)! - Replace `tailor skills install` with project-local `tailor skills add`, `list`, `remove`, and `sync` commands for bundled Tailor SDK agent skills.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`d9d9c49`](https://github.com/tailor-platform/sdk/commit/d9d9c49ab4c98034c64b0e5c6ba9cf106341a6c3) Thanks [@toiroakr](https://github.com/toiroakr)! - Flag files that need project-specific review after the v2 principal migration, including resolver helper adapters and nullable `caller` follow-ups.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`244fe8d`](https://github.com/tailor-platform/sdk/commit/244fe8d703b35f4aceaf31f918f94fc84e3be789) Thanks [@toiroakr](https://github.com/toiroakr)! - Report precise file-local findings for `principal-unify` review follow-ups, including nullable caller call sites and `context.user` helper adapters.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`5059c27`](https://github.com/tailor-platform/sdk/commit/5059c273d3f14c92239a17d3a7eeb44e0822ed99) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix `v2/principal-unify` review findings for nested SDK field parser invoker values and destructured context helper messages.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`7240c25`](https://github.com/tailor-platform/sdk/commit/7240c252546dc69989755a6f5af26c6062c36883) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove the deprecated `auth.getConnectionToken()` helper from values returned by `defineAuth()`. Use `authconnection.getConnectionToken(...)` from `@tailor-platform/sdk/runtime` in resolvers, executors, and workflows instead. The v2 codemod rewrites direct `auth.getConnectionToken(...)` calls when the `auth` binding is imported from `tailor.config`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`304a24a`](https://github.com/tailor-platform/sdk/commit/304a24af51cc130268a7f8145a10dc6b165f8d46) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove the v1 runtime globals compatibility layer. Importing from `@tailor-platform/sdk` no longer activates the ambient `tailor.*` / `tailordb.*` declarations; opt into globals with `@tailor-platform/sdk/runtime/globals` or use the typed wrappers from `@tailor-platform/sdk/runtime`.
+  
+  The capital-cased `Tailordb.*` namespace is removed. If your project still references `Tailordb.QueryResult`, `Tailordb.CommandType`, `Tailordb.Client`, or `typeof Tailordb.Client`, migrate before upgrading: run `pnpm dlx @tailor-platform/sdk-codemod v2/tailordb-namespace` to rewrite them to lowercase `tailordb.*`, then add `import "@tailor-platform/sdk/runtime/globals"` so the rewritten references resolve.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`88db10e`](https://github.com/tailor-platform/sdk/commit/88db10ef57fa575731e1ed557ea74b86edcf5c5c) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove deprecated CLI aliases for the v2 command surface. Use `tailor-sdk deploy` instead of `tailor-sdk apply`, `tailor-sdk crashreport` instead of `tailor-sdk crash-report`, and the hyphenated `--machine-user` option instead of the hidden `--machineuser` alias.
+  
+  Fix the v2 CLI rename codemod to migrate the hidden `--machineuser` option to `--machine-user`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`160b406`](https://github.com/tailor-platform/sdk/commit/160b4061ee38675df85dd74af23b7041fe8e4944) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename the CLI binary from `tailor-sdk` to `tailor`.
+  
+  The output directory default changes from `.tailor-sdk` to `.tailor`, and the GitHub Actions lock file path changes from `.github/tailor-sdk.lock` to `.github/tailor.lock`.
+  
+  Run the `v2/rename-bin` codemod to migrate `tailor-sdk` invocations in package.json scripts, shell scripts, CI workflows, and documentation:
+  
+  ```sh
+  npx @tailor-platform/sdk-codemod --from 1.x --to 2.0.0
+  ```
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`8b03f82`](https://github.com/tailor-platform/sdk/commit/8b03f827642e64f3b3af5a05ecdef405028a803a) Thanks [@toiroakr](https://github.com/toiroakr)! - Standardize SDK-owned environment variables on the `TAILOR_*` namespace.
+  
+  Replace the removed SDK-specific environment variables with their new names: `TAILOR_CONFIG_PATH`, `TAILOR_DTS_PATH`, `TAILOR_CI_ALLOW_ID_INJECTION`, `TAILOR_DEPLOY_BUILD_ONLY`, `TAILOR_BUILD_OUTPUT_DIR`, `TAILOR_SKILLS_SOURCE`, `TAILOR_TEMPLATE_SDK_VERSION`, `TAILOR_PLATFORM_URL`, `TAILOR_PLATFORM_OAUTH2_CLIENT_ID`, `TAILOR_INLINE_SOURCEMAP`, `TAILOR_QUERY_NEWLINE_ON_ENTER`, and `TAILOR_APP_LOG_LEVEL`. The deprecated `TAILOR_TOKEN` fallback is removed; use `TAILOR_PLATFORM_TOKEN`. The v2 codemod rewrites unambiguous removed SDK environment variable names and flags generic names such as `LOG_LEVEL` and `PLATFORM_URL` for manual review.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`1a8945d`](https://github.com/tailor-platform/sdk/commit/1a8945d183b990aaf1dfb1dd9ca9813a7277a118) Thanks [@toiroakr](https://github.com/toiroakr)! - Add a `V2_NEXT_PENDING` placeholder `prereleaseUntil` for codemods whose exact `2.0.0-next.N` release boundary isn't known yet at implementation time, plus a `pnpm codemod:resolve-pending` step (wired into the release workflow) that resolves it to the real version constant once the release PR bumps `@tailor-platform/sdk`'s version. Prevents codemod boundaries from drifting out of sync with the version they actually ship in, which previously required a manual follow-up fix after each release.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`3dcd82d`](https://github.com/tailor-platform/sdk/commit/3dcd82d54d6c059df90f2dc4788a7059fe4004ab) Thanks [@toiroakr](https://github.com/toiroakr)! - Restore Tailor field outputs for UUID, date, datetime, time, and decimal fields to plain string-compatible types and remove the strict scalar string migration guidance.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`fe1721e`](https://github.com/tailor-platform/sdk/commit/fe1721efa04f15d3d1ac3287c30c4c550220403e) Thanks [@toiroakr](https://github.com/toiroakr)! - Flag JavaScript files and embedded code strings that still reference ambient Tailor runtime globals during v2 migration review.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`5fc3a1d`](https://github.com/tailor-platform/sdk/commit/5fc3a1d027767d60e8a427adf1ff7e5f43dab331) Thanks [@toiroakr](https://github.com/toiroakr)! - Flag files that still reference ambient Tailor runtime globals so the v2 migration can opt them into `@tailor-platform/sdk/runtime/globals`.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`df3a772`](https://github.com/tailor-platform/sdk/commit/df3a77257823e9e8e7b7c89e418b3113964e9b20) Thanks [@toiroakr](https://github.com/toiroakr)! - Automatically migrate simple direct `tailor.idp.Client` runtime global usage to the typed `idp.Client` wrapper during v2 upgrades.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`04ca361`](https://github.com/tailor-platform/sdk/commit/04ca3619c4d2d88afe8ee3b25d4ba47ac799de51) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove flat value and default exports from `@tailor-platform/sdk/runtime/*` subpath modules. Import each subpath through its self-named namespace export instead, for example `import { iconv } from "@tailor-platform/sdk/runtime/iconv"`.
+  
+  The aggregate `@tailor-platform/sdk/runtime` entry remains named-only, and its deprecated `file.deleteFile` alias is removed in favor of `file.delete`. The v2 codemod rewrites straightforward namespace-star subpath imports, flat named value imports, and aggregate `file.deleteFile` calls to the new namespace-object style.
+  
+  `TailorContextAPI` and `TailorWorkflowAPI` now describe the SDK wrapper objects. Code that types the platform-provided `globalThis.tailor.context` or `globalThis.tailor.workflow` objects directly must use `PlatformContextAPI` or `PlatformWorkflowAPI` instead.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`c051dab`](https://github.com/tailor-platform/sdk/commit/c051dab12c233de65313c4fcee96a26c604ec5da) Thanks [@toiroakr](https://github.com/toiroakr)! - Mention the `--upsert` flag in the `v2/seed-exec-to-cli-plugin` migration guide's `tailor seed apply` option list.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`eba2728`](https://github.com/tailor-platform/sdk/commit/eba2728a7b473da7caa134cbfdfc53a714d9d328) Thanks [@toiroakr](https://github.com/toiroakr)! - Keep v2 codemods from reusing type-only runtime helper imports when adding runtime value imports.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`add2079`](https://github.com/tailor-platform/sdk/commit/add2079f4c89bcb950c0c7f55312880993b3dc7b) Thanks [@toiroakr](https://github.com/toiroakr)! - Add the `v2/tailor-output-ignore-dir` codemod so SDK upgrades rewrite exact `.tailor-sdk/` ignore-file entries to `.tailor/` while leaving other `.tailor-sdk` paths unchanged.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`b5a0d70`](https://github.com/tailor-platform/sdk/commit/b5a0d70f8e29d58f77809ef2514be9065e0a954f) Thanks [@toiroakr](https://github.com/toiroakr)! - Unify function principal context around `TailorPrincipal`.
+  
+  Resolver contexts now use `caller` and `invoker` as `TailorPrincipal | null`, workflow and executor invokers also use `TailorPrincipal | null`, and event executor `actor` uses `TailorPrincipal | null` with `id`/`type` fields. The legacy `TailorUser`, `TailorInvoker`, `TailorActor`, `TailorActorType`, and `unauthenticatedTailorUser` exports are removed.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`f1ec5b5`](https://github.com/tailor-platform/sdk/commit/f1ec5b5fbedce73d217830e2c6ac4a243b830a2d) Thanks [@toiroakr](https://github.com/toiroakr)! - Redesign TailorDB hooks and validators with several breaking changes:
+  
+  - Add shared `now` timestamp to all hooks — multiple fields stamped with the same `Date`
+  - Field-level hooks: `{ value, data, invoker }` → create `{ input, invoker, now }` / update `{ input, oldValue, invoker, now }` (`data` removed, `oldValue` added for update only)
+  - Type-level hooks: per-field mapping (`Hooks<F>`) → single `{ create, update }` object (`TypeHook<F>`) returning partial field overrides
+  - Type-level create hooks no longer receive `oldRecord`; update hooks receive non-nullable `oldRecord`
+  - Field-level validators: return type changed from `boolean` to `string | void` (return error message or void to pass); `[fn, message]` tuple form removed
+  - Type-level validators: `Validators<F>` per-field record → `TypeValidateFn<F>` single function with `issues(field, message)` callback
+  - Add `.default(value)` on fields to set a create-time default (makes required fields optional in create input)
+  - Remove exported types: `Hooks<F>`, `Validators<F>`, `ValidateConfig`
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`bf11bf8`](https://github.com/tailor-platform/sdk/commit/bf11bf8d3bad6195c86ed289c764490dc6d680ee) Thanks [@toiroakr](https://github.com/toiroakr)! - Update politty to v0.11.3
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`eeb235d`](https://github.com/tailor-platform/sdk/commit/eeb235debe910c05f755f036486878e7c763cb7e) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename `defineWaitPoint` and `defineWaitPoints` to `createWaitPoint` and `createWaitPoints`.
+  
+  These functions create runtime instances with `.wait()` and `.resolve()` methods that call the platform API at runtime, so the `create*` prefix is more accurate. Update any usages:
+  
+  ```diff
+  -import { defineWaitPoint, defineWaitPoints } from "@tailor-platform/sdk";
+  +import { createWaitPoint, createWaitPoints } from "@tailor-platform/sdk";
+  
+  -export const approval = defineWaitPoint<Payload, Result>("approval");
+  +export const approval = createWaitPoint<Payload, Result>("approval");
+  
+  -export const waitPoints = defineWaitPoints((define) => ({ ... }));
+  +export const waitPoints = createWaitPoints((define) => ({ ... }));
+  ```
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`93b68ac`](https://github.com/tailor-platform/sdk/commit/93b68ace83dcb0af2a8b0afa8aa3336cb18c818b) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename `Workflow.trigger()` (returned by `createWorkflow()`) and `WorkflowJob.trigger()` (returned by `createWorkflowJob()`) to `.start()`, aligning the SDK's ergonomic verb with the platform's `start*` RPC vocabulary:
+  
+  ```diff
+   const inventory = checkInventory.trigger({ orderId: input.orderId });
+  +const inventory = checkInventory.start({ orderId: input.orderId });
+  
+  -const workflowRunId = await orderProcessingWorkflow.trigger(args, { invoker: "manager" });
+  +const workflowRunId = await orderProcessingWorkflow.start(args, { invoker: "manager" });
+  ```
+  
+  `mockWorkflow()`'s `wf.job(definition)` / `wf.workflow(definition)` now return a mock of the `.start` method, and `wf.setTriggerHandler` / `wf.triggeredJobs` are renamed to `wf.setStartHandler` / `wf.startedJobs`. No codemod ships for the `.trigger()` → `.start()` call-site rename itself — see the `v2/workflow-start-rename` migration guide entry for manual migration steps.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`93b68ac`](https://github.com/tailor-platform/sdk/commit/93b68ace83dcb0af2a8b0afa8aa3336cb18c818b) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove the pre-alignment `tailor.workflow` names `triggerWorkflow`, `triggerJobFunction`, and `resumeWorkflow` (and their `TriggerWorkflowOptions` / `TriggerJobFunctionOptions` option types) from `@tailor-platform/sdk/runtime`, the ambient `@tailor-platform/sdk/runtime/globals` types, and the `mockWorkflow()` test facade. Use the canonical names instead:
+  
+  ```diff
+   import { workflow } from "@tailor-platform/sdk/runtime";
+  
+  -await workflow.triggerWorkflow("myWorkflow", { data: "value" });
+  +await workflow.startWorkflow("myWorkflow", { data: "value" });
+  -workflow.triggerJobFunction("myJob", { data: "value" });
+  +workflow.startJobFunction("myJob", { data: "value" });
+  -await workflow.resumeWorkflow("execution-id");
+  +await workflow.resumeWorkflowExecution("execution-id");
+  ```
+  
+  Run the `v2/workflow-trigger-rename` codemod to migrate call sites automatically.
+
+## 0.4.0-next.10
+
+### Minor Changes
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`a4cdee0`](https://github.com/tailor-platform/sdk/commit/a4cdee079707105213f8e5833dcaa613f39c8464) Thanks [@toiroakr](https://github.com/toiroakr)! - Remove the APIs that were marked `@deprecated` on the way to v2, so 2.0.0 ships without deprecated aliases. Each removal has migration coverage in `tailor upgrade`:
+  
+  - `@tailor-platform/sdk/cli` no longer re-exports `kyselyTypePlugin`, `enumConstantsPlugin`, `fileUtilsPlugin`, and `seedPlugin`. Import them from `@tailor-platform/sdk/plugin/kysely-type`, `/plugin/enum-constants`, `/plugin/file-utils`, and `/plugin/seed` (codemod `v2/plugin-cli-import`).
+  - `tailor.workflow.startJobFunction` and the `StartJobFunctionOptions` type are removed; use the canonical `execJobFunction` / `ExecJobFunctionOptions` (new codemod `v2/exec-job-function-rename`). `mockWorkflow()` no longer exposes the `startJobFunction` alias — assert on its `execJobFunction` mock instead — and `v2/workflow-trigger-rename` now rewrites `triggerJobFunction` straight to `execJobFunction`.
+  - `@tailor-platform/sdk/test` no longer exports the platform-global mocks `setupTailordbMock`, `setupWorkflowMock`, `setupWaitPointMock`, `setupInvokerMock`, and `setupTailorErrorsMock`, nor the bundled-output helper `createImportMain`. Use the `tailor-runtime` environment from `@tailor-platform/sdk/vitest` with `mockTailordb` / `mockWorkflow` (migration guidance: `v2/sdk-test-mocks-to-vitest`). `createTailorDBHook`, `createStandardSchema`, and `unauthenticatedTailorUser` are unchanged.
+  - The programmatic CLI functions no longer accept name-keyed options: `GetWorkflowOptions`, `StartWorkflowOptions`, `ListWorkflowExecutionsOptions`, `GetExecutorOptions`, `TriggerExecutorOptions`, `ListExecutorJobsOptions`, `GetExecutorJobOptions`, and `WatchExecutorJobOptions` are removed along with the overloads that took them. Pass the definition itself — `startWorkflow({ workflow: myWorkflow, invoker: "admin" })`, `watchExecutorJob({ executor: myExecutor, jobId })` — which also types `arg` and `payload` from the definition (migration guidance: `v2/cli-typed-options`). The name-keyed entry points remain available as CLI commands (`tailor workflow start <name>`, `tailor executor trigger <name>`).
+
+- [#1912](https://github.com/tailor-platform/sdk/pull/1912) [`d9f8a52`](https://github.com/tailor-platform/sdk/commit/d9f8a528e2f9f597a71a4c42f004f050d9ef9643) Thanks [@dqn](https://github.com/dqn)! - The `v2/seed-exec-to-cli-plugin` migration now rewrites generated seed runner invocations automatically. `node <distPath>/exec.mjs [options] [types...]` becomes `tailor seed apply [options] [types...]` and `node <distPath>/exec.mjs validate` becomes `tailor seed validate`, in package.json scripts, shell scripts, CI configs, docs, and TypeScript sources, carrying node's `--env-file` / `--env-file-if-exists` over to the CLI flag form in both the `=` and space-separated spellings. Each invocation must sit on one line, so a command split across YAML sequence items or markdown bullets is reported for review rather than rewritten. Files that `fork()` the runner are left untouched and reported with their exact line, because replacing the forked child with a CLI call also unwinds the surrounding `await`/Promise plumbing; the migration prompt now covers that rewrite and the stale `exec.mjs` deletion.
+
+### Patch Changes
+
+- [#1923](https://github.com/tailor-platform/sdk/pull/1923) [`1015816`](https://github.com/tailor-platform/sdk/commit/101581679c4b586a5bfdcb4d72a292b56a81bc2c) Thanks [@toiroakr](https://github.com/toiroakr)! - Make the deprecation process mechanical: an `@deprecated` tag in the SDK now states the version it shipped in and the codemod that migrates callers off it (`@deprecated since 2.1.0 — use {@link newApi} instead. codemod: v2/old-to-new`), and `pnpm check:deprecations` fails when a tag misses either half, names a codemod that is not registered, or outlives its codemod's boundary — so the release PR that bumps to a major turns red while an API due for removal is still declared, instead of the alias shipping and being noticed releases later. While the shipping version is still undecided the tag carries the literal `NEXT_RELEASE`, which the release workflow rewrites to the version the release PR bumps to — the same step that already resolves `prereleaseUntil: V2_NEXT_PENDING` codemod boundaries.
+  
+  Registered codemods are validated more strictly too: a `since` that is not valid semver, or that is not older than `until`, now fails fast instead of surfacing as a semver error partway through `tailor upgrade` or as a codemod whose empty version range silently matches nothing.
+
+- [#1915](https://github.com/tailor-platform/sdk/pull/1915) [`dc691ec`](https://github.com/tailor-platform/sdk/commit/dc691ec1e2181400c6715233f0588a1b5150038f) Thanks [@toiroakr](https://github.com/toiroakr)! - Generate the `Env` interface in `tailor.d.ts` from the type of each `defineConfig({ env })` value instead of the value itself. The resolved value used to be written in as a literal type, so running `generate` or `deploy` with real environment variables loaded stamped those values into a file that is normally committed.
+  
+  ```diff
+   interface Env {
+  -  API_BASE: "https://api.example.com";
+  -  RETRIES: 3;
+  -  VERBOSE: true;
+  +  API_BASE: string;
+  +  RETRIES: number;
+  +  VERBOSE: boolean;
+   }
+  ```
+  
+  `env` keys that aren't valid TypeScript identifiers (for example `"API-BASE"`) are now quoted as well; previously they were emitted bare and produced a `tailor.d.ts` that failed to parse.
+  
+  Run `tailor generate` after upgrading to refresh the file. Code that relied on the literal narrowing — comparing `env.STAGE` against a literal union, for example — has to widen its own types or read the value through a local narrowing check. If a `tailor.d.ts` you already committed contains a sensitive value, treat that value as exposed and rotate it; keep secrets in [Secret Manager](https://github.com/tailor-platform/sdk/blob/main/packages/sdk/docs/services/secret.md) rather than `env`.
+
+- [#1926](https://github.com/tailor-platform/sdk/pull/1926) [`a7343a5`](https://github.com/tailor-platform/sdk/commit/a7343a5976ece5ae66febe713ae04e97dfd9bee5) Thanks [@toiroakr](https://github.com/toiroakr)! - Rename the `defineIdp` option `publishUserEvents` to `publishEvents`, so all four services that publish events use one field name. A codemod rewrites the option key on `defineIdp` calls, including aliased and namespace imports, and rewrites a shorthand `{ publishUserEvents }` to `{ publishEvents: publishUserEvents }` so it keeps reading the same local. Occurrences it cannot rewrite — an options object built outside the call, a computed key, or a type declaration of the option — are reported for manual migration.
+
+- [#1808](https://github.com/tailor-platform/sdk/pull/1808) [`d8564db`](https://github.com/tailor-platform/sdk/commit/d8564db44a1a59e5269f1f6236fdb75005270063) Thanks [@toiroakr](https://github.com/toiroakr)! - Mention the `--upsert` flag in the `v2/seed-exec-to-cli-plugin` migration guide's `tailor seed apply` option list.
+
 ## 0.4.0-next.9
 
 ### Patch Changes
@@ -261,6 +533,14 @@
 
 - [#1435](https://github.com/tailor-platform/sdk/pull/1435) [`49c0cc9`](https://github.com/tailor-platform/sdk/commit/49c0cc99171d7e317a50a18804a21067d89f9493) Thanks [@dqn](https://github.com/dqn)! - Add the `v2/plugin-cli-import` codemod so `tailor-sdk upgrade` rewrites deprecated plugin imports from `@tailor-platform/sdk/cli` (`kyselyTypePlugin`, `enumConstantsPlugin`, `fileUtilsPlugin`, `seedPlugin`) to their dedicated `@tailor-platform/sdk/plugin/*` subpaths, splitting any non-plugin specifiers onto a separate import.
 
+## 0.3.9
+
+### Patch Changes
+
+- [#1901](https://github.com/tailor-platform/sdk/pull/1901) [`7d1974f`](https://github.com/tailor-platform/sdk/commit/7d1974f52952a8f39a7adfc06644404b2510f1c3) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency politty to v0.11.6
+
+- [#1903](https://github.com/tailor-platform/sdk/pull/1903) [`83c5bc4`](https://github.com/tailor-platform/sdk/commit/83c5bc453a77a734599b665ebe2873ff6b305f1d) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency @ast-grep/napi to v0.45.0
+
 ## 0.3.8
 
 ### Patch Changes

package/dist/codemods/v2/exec-job-function-rename/scripts/transform.js

@@ -0,0 +1,95 @@
+import { a as importSource, c as localDeclarationNames, i as importBindings, o as importSpecNames, r as findImportStatements } from "../../../ast-grep-helpers-CXtWn3RB.js";
+import { Lang, parse } from "@ast-grep/napi";
+//#region codemods/v2/exec-job-function-rename/scripts/transform.ts
+const DEPRECATED_METHOD = "startJobFunction";
+const CANONICAL_METHOD = "execJobFunction";
+const DEPRECATED_OPTIONS = "StartJobFunctionOptions";
+const CANONICAL_OPTIONS = "ExecJobFunctionOptions";
+const WORKFLOW_MODULE_SOURCES = /* @__PURE__ */ new Set(["@tailor-platform/sdk/runtime", "@tailor-platform/sdk/runtime/workflow"]);
+function quickFilter(source) {
+	return source.includes(DEPRECATED_METHOD) || source.includes(DEPRECATED_OPTIONS);
+}
+function sourceLang(filePath, source) {
+	const lower = filePath.toLowerCase();
+	if (lower.endsWith(".tsx") || lower.endsWith(".jsx")) return Lang.Tsx;
+	return source.includes("</") || source.includes("/>") ? Lang.Tsx : Lang.TypeScript;
+}
+function collectWorkflowLocals(root, imports) {
+	const locals = /* @__PURE__ */ new Set();
+	for (const importStmt of imports) for (const binding of importBindings(importStmt)) if (binding.importedName === "workflow" && WORKFLOW_MODULE_SOURCES.has(binding.source)) locals.add(binding.localName);
+	const declaredNames = localDeclarationNames(root);
+	for (const name of locals) if (declaredNames.has(name)) locals.delete(name);
+	return locals;
+}
+function tailorIsAmbientGlobal(root, imports) {
+	if (localDeclarationNames(root).has("tailor")) return false;
+	return !imports.some((stmt) => importBindings(stmt).some((b) => b.localName === "tailor"));
+}
+function isAmbientTailorWorkflow(object) {
+	if (!object || object.kind() !== "member_expression") return false;
+	const base = object.field("object");
+	const property = object.field("property");
+	return base?.kind() === "identifier" && base.text() === "tailor" && property?.text() === "workflow";
+}
+/**
+* Rename `StartJobFunctionOptions` import specifiers from the runtime module,
+* plus the type references that resolve to them when the import is not aliased.
+* @param root - Parsed file root
+* @param imports - Top-level import statements
+* @returns Edits renaming the deprecated options type
+*/
+function optionsTypeEdits(root, imports) {
+	const edits = [];
+	for (const importStmt of imports) {
+		const source = importSource(importStmt);
+		if (source === null || !WORKFLOW_MODULE_SOURCES.has(source)) continue;
+		const specs = importStmt.findAll({ rule: { kind: "import_specifier" } });
+		if (specs.some((spec) => importSpecNames(spec)?.importedName === CANONICAL_OPTIONS)) continue;
+		for (const spec of specs) {
+			const names = importSpecNames(spec);
+			if (names?.importedName !== DEPRECATED_OPTIONS) continue;
+			const importedNode = spec.children().find((child) => child.kind() === "identifier");
+			if (!importedNode) continue;
+			edits.push(importedNode.replace(CANONICAL_OPTIONS));
+			if (names.localName !== DEPRECATED_OPTIONS) continue;
+			for (const reference of root.findAll({ rule: {
+				kind: "type_identifier",
+				regex: `^${DEPRECATED_OPTIONS}$`
+			} })) edits.push(reference.replace(CANONICAL_OPTIONS));
+		}
+	}
+	return edits;
+}
+/**
+* Rewrite `.startJobFunction(` member accesses — on the ambient
+* `tailor.workflow` global or on a `workflow` value imported from
+* `@tailor-platform/sdk/runtime(/workflow)` — to the canonical
+* `execJobFunction`, and rename the `StartJobFunctionOptions` type alias.
+* @param source - File contents
+* @param filePath - Absolute path to the file
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!quickFilter(source)) return null;
+	const root = parse(sourceLang(filePath ?? "", source), source).root();
+	const imports = findImportStatements(root);
+	const workflowLocals = collectWorkflowLocals(root, imports);
+	const tailorIsAmbient = tailorIsAmbientGlobal(root, imports);
+	const edits = optionsTypeEdits(root, imports);
+	for (const member of root.findAll({ rule: { kind: "member_expression" } })) {
+		const property = member.field("property");
+		if (!property || property.kind() !== "property_identifier") continue;
+		if (property.text() !== DEPRECATED_METHOD) continue;
+		const object = member.field("object");
+		if (!object) continue;
+		const isWorkflowImportReceiver = object.kind() === "identifier" && workflowLocals.has(object.text());
+		const isAmbientReceiver = tailorIsAmbient && isAmbientTailorWorkflow(object);
+		if (!isWorkflowImportReceiver && !isAmbientReceiver) continue;
+		edits.push(property.replace(CANONICAL_METHOD));
+	}
+	if (edits.length === 0) return null;
+	const result = root.commitEdits(edits);
+	return result === source ? null : result;
+}
+//#endregion
+export { transform as default };

package/dist/codemods/v2/idp-publish-events-rename/scripts/transform.js

@@ -0,0 +1,186 @@
+import { a as importSource, c as localDeclarationNames, i as importBindings, l as stringValue, r as findImportStatements, s as isTypeOnlyImport } from "../../../ast-grep-helpers-CXtWn3RB.js";
+import { Lang, parse } from "@ast-grep/napi";
+//#region codemods/v2/idp-publish-events-rename/scripts/transform.ts
+const SDK_MODULE = "@tailor-platform/sdk";
+const DEFINE_IDP = "defineIdp";
+const LEGACY_KEY = "publishUserEvents";
+const NEW_KEY = "publishEvents";
+function sourceLang(filePath, source) {
+	return filePath.endsWith(".tsx") || filePath.endsWith(".jsx") || source.includes("</") ? Lang.Tsx : Lang.TypeScript;
+}
+function collectDefineIdpNames(root) {
+	const direct = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	for (const importStmt of findImportStatements(root)) {
+		if (importSource(importStmt) !== SDK_MODULE || isTypeOnlyImport(importStmt)) continue;
+		for (const binding of importBindings(importStmt)) if (binding.importedName === DEFINE_IDP) direct.add(binding.localName);
+		for (const namespaceImport of importStmt.findAll({ rule: { kind: "namespace_import" } })) for (const identifier of namespaceImport.children()) if (identifier.kind() === "identifier") namespaces.add(identifier.text());
+	}
+	return {
+		direct,
+		namespaces
+	};
+}
+function memberProperty(member) {
+	return member.children().findLast((child) => child.kind() === "property_identifier" || child.kind() === "identifier") ?? null;
+}
+function isDefineIdpCall(call, names) {
+	const callee = call.children()[0];
+	if (!callee) return false;
+	if (callee.kind() === "identifier") return names.direct.has(callee.text());
+	if (callee.kind() !== "member_expression") return false;
+	const object = callee.field("object");
+	return object?.kind() === "identifier" && names.namespaces.has(object.text()) && memberProperty(callee)?.text() === DEFINE_IDP;
+}
+function objectArguments(call) {
+	const args = call.children().find((child) => child.kind() === "arguments");
+	if (!args) return [];
+	return args.children().filter((child) => child.kind() === "object");
+}
+function findLegacyEntries(object) {
+	const entries = [];
+	for (const child of object.children()) {
+		if (child.kind() === "shorthand_property_identifier" && child.text() === LEGACY_KEY) {
+			entries.push({
+				node: child,
+				shorthand: true
+			});
+			continue;
+		}
+		if (child.kind() !== "pair") continue;
+		const key = child.children()[0];
+		if (!key) continue;
+		if (key.kind() !== "property_identifier" && key.kind() !== "string") continue;
+		if (stringValue(key) !== LEGACY_KEY) continue;
+		entries.push({
+			node: key,
+			shorthand: false
+		});
+	}
+	return entries;
+}
+function renameEdit(entry) {
+	if (entry.shorthand) return entry.node.replace(`${NEW_KEY}: ${LEGACY_KEY}`);
+	const text = entry.node.text();
+	if (entry.node.kind() !== "string") return entry.node.replace(NEW_KEY);
+	const quote = text.startsWith("'") ? "'" : text.startsWith("`") ? "`" : "\"";
+	return entry.node.replace(`${quote}${NEW_KEY}${quote}`);
+}
+function parseRoot(source, filePath) {
+	try {
+		return parse(sourceLang(filePath, source), source).root();
+	} catch {
+		return null;
+	}
+}
+function shadowsDefineIdp(root, names) {
+	const declared = localDeclarationNames(root);
+	return [...names.direct, ...names.namespaces].some((name) => declared.has(name));
+}
+/**
+* Rename the `publishUserEvents` option to `publishEvents` on `defineIdp` calls.
+* @param source - File contents
+* @param filePath - Path to the file being transformed
+* @returns Transformed source, or null when nothing matched
+*/
+function transform(source, filePath = "") {
+	if (!source.includes(LEGACY_KEY) || !source.includes(SDK_MODULE)) return null;
+	const root = parseRoot(source, filePath);
+	if (!root) return null;
+	const names = collectDefineIdpNames(root);
+	if (names.direct.size === 0 && names.namespaces.size === 0) return null;
+	if (shadowsDefineIdp(root, names)) return null;
+	const edits = [];
+	for (const call of root.findAll({ rule: { kind: "call_expression" } })) {
+		if (!isDefineIdpCall(call, names)) continue;
+		for (const object of objectArguments(call)) for (const entry of findLegacyEntries(object)) edits.push(renameEdit(entry));
+	}
+	return edits.length > 0 ? root.commitEdits(edits) : null;
+}
+function lineOf(node) {
+	return node.range().start.line + 1;
+}
+function excerptOf(node) {
+	return node.text().split("\n", 1)[0].trim();
+}
+function coversIndex(ranges, index) {
+	return ranges.some((range) => index >= range.start && index < range.end);
+}
+/** Quoted keys, e.g. `{ "publishUserEvents": true }`, whose node kind is a string. */
+function quotedLegacyKeys(root) {
+	return root.findAll({ rule: { kind: "pair" } }).flatMap((pair) => {
+		const key = pair.children()[0];
+		return key?.kind() === "string" && stringValue(key) === LEGACY_KEY ? [key] : [];
+	});
+}
+/** Computed keys whose value cannot be read statically, e.g. `[key]: value`. */
+function computedKeyEntries(object) {
+	return object.children().filter((child) => child.kind() === "pair").flatMap((pair) => {
+		const key = pair.children()[0];
+		return key?.kind() === "computed_property_name" ? [key] : [];
+	});
+}
+/**
+* Report `publishUserEvents` occurrences the transform cannot rewrite.
+*
+* Occurrences nested deeper inside a `defineIdp` options object belong to a
+* different option shape (e.g. `userAuthPolicy`) and are left alone, so only
+* what the transform genuinely missed is reported.
+* @param source - File contents
+* @param filePath - Path to the file being reviewed
+* @param relativePath - Repository-relative path reported to the user
+* @returns Findings for occurrences needing a manual rename
+*/
+function reviewFindings(source, filePath, relativePath) {
+	if (!source.includes(LEGACY_KEY) || !source.includes(SDK_MODULE)) return [];
+	const root = parseRoot(source, filePath);
+	if (!root) return [];
+	const names = collectDefineIdpNames(root);
+	const hasDefineIdp = names.direct.size > 0 || names.namespaces.size > 0;
+	if (hasDefineIdp && shadowsDefineIdp(root, names)) return [{
+		file: relativePath,
+		line: 1,
+		message: `A local declaration shadows the SDK ${DEFINE_IDP} import; rename ${LEGACY_KEY} to ${NEW_KEY} by hand.`,
+		excerpt: LEGACY_KEY
+	}];
+	const rewritten = /* @__PURE__ */ new Set();
+	const optionRanges = [];
+	const findings = [];
+	if (hasDefineIdp) for (const call of root.findAll({ rule: { kind: "call_expression" } })) {
+		if (!isDefineIdpCall(call, names)) continue;
+		for (const object of objectArguments(call)) {
+			const range = object.range();
+			optionRanges.push({
+				start: range.start.index,
+				end: range.end.index
+			});
+			for (const entry of findLegacyEntries(object)) rewritten.add(entry.node.range().start.index);
+			for (const key of computedKeyEntries(object)) findings.push({
+				file: relativePath,
+				line: lineOf(key),
+				message: `A computed ${DEFINE_IDP} option key may be ${LEGACY_KEY}; rename it to ${NEW_KEY} if so.`,
+				excerpt: excerptOf(key)
+			});
+		}
+	}
+	const residual = [...root.findAll({ rule: { any: [{
+		kind: "property_identifier",
+		regex: `^${LEGACY_KEY}$`
+	}, {
+		kind: "shorthand_property_identifier",
+		regex: `^${LEGACY_KEY}$`
+	}] } }), ...quotedLegacyKeys(root)];
+	for (const node of residual) {
+		const index = node.range().start.index;
+		if (rewritten.has(index) || coversIndex(optionRanges, index)) continue;
+		findings.push({
+			file: relativePath,
+			line: lineOf(node),
+			message: `Rename the IdP option ${LEGACY_KEY} to ${NEW_KEY}.`,
+			excerpt: excerptOf(node)
+		});
+	}
+	return findings;
+}
+//#endregion
+export { transform as default, reviewFindings };

package/dist/codemods/v2/sdk-skills-shim/scripts/transform.js

@@ -1,9 +1,10 @@
 import * as path from "pathe";
 //#region codemods/v2/sdk-skills-shim/scripts/transform.ts
-const SHIM_PATTERN = /\btailor-sdk-skills(?:@[^\s'"`]+)?(?:[ \t]+install)?\b(?!-)/g;
-const REPLACEMENT = "tailor skills add";
+const SHIM_PATTERN = new RegExp(`((?<![\\w.-])(?:npx|bunx|(?:pnpm|yarn)[ \\t]+dlx|npm[ \\t]+exec)(?:[ \\t]+-{1,2}[\\w-]*)*[ \\t]+)?\\btailor-sdk-skills(?:@[^\\s'"\`]+)?(?:[ \\t]+install)?\\b(?!-)`, "g");
+const CLI_BINARY = "tailor";
+const CLI_PACKAGE = "@tailor-platform/sdk";
 function replaceShim(value) {
-	return value.replace(SHIM_PATTERN, REPLACEMENT);
+	return value.replace(SHIM_PATTERN, (_match, runner) => `${runner ?? ""}${runner == null ? CLI_BINARY : CLI_PACKAGE} skills add`);
 }
 function transformText(source) {
 	if (!SHIM_PATTERN.test(source)) return null;

package/dist/codemods/v2/seed-exec-to-cli-plugin/scripts/transform.js

@@ -0,0 +1,125 @@
+import * as path from "pathe";
+//#region codemods/v2/seed-exec-to-cli-plugin/scripts/transform.ts
+const NODE_BINARY = "(?<![\\w.-])node(?![\\w-])";
+const ARG_VALUE = `(?:[^\\s'"\`;&|]+|'[^']*'|"(?:(?:\\\\.)|[^"\\\\])*")`;
+const SPACE = String.raw`(?:[^\S\n\r]|\\\r?\n)+`;
+const VALUE_NODE_FLAG = "(?:--env-file|--env-file-if-exists|--import|--require|-r)";
+const BOOLEAN_NODE_FLAG = "(?:--[^\\s'\"`;&|]+|-[^\\s'\"`;&|=-][^\\s'\"`;&|=]*)";
+const NODE_FLAGS = `(?:(?:${SPACE}${VALUE_NODE_FLAG}(?:=${ARG_VALUE}|${SPACE}${ARG_VALUE}))|(?:${SPACE}${BOOLEAN_NODE_FLAG}))*`;
+const RUNNER_PATH = `(?:[\\w.@~-]+/)+exec\\.mjs`;
+const RUNNER_PATTERN = new RegExp(`${NODE_BINARY}(${NODE_FLAGS})${SPACE}(['"]?)(?:\\./)?${RUNNER_PATH}\\2(${SPACE}validate(?![-\\w=.:/]))?`, "g");
+const FORK_PATTERN = /(?<![\w.$])fork\s*\(/;
+const FORK_RUNNER_PATTERN = new RegExp(`${FORK_PATTERN.source}\\s*(['"\`])${RUNNER_PATH}\\1`, "gs");
+const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const NODE_FLAG_PATTERN = new RegExp(`(${VALUE_NODE_FLAG})(?:=(${ARG_VALUE})|${SPACE}(${ARG_VALUE}))|(${BOOLEAN_NODE_FLAG})`, "g");
+const ENV_FILE_FLAG = /^--env-file(?:-if-exists)?$/;
+const RUNNER_PREFIX_PATTERN = new RegExp(`(?<![\\w.-])(pnpm|npm|yarn|bunx|bun|npx)(?:${SPACE}(run|exec|dlx))?${SPACE}$`);
+const RUNNER_PREFIX_WINDOW = 64;
+const CLI_BINARY = "tailor";
+const CLI_PACKAGE = "@tailor-platform/sdk";
+const PACKAGE_RUNNER = `npx ${CLI_PACKAGE}`;
+/** Whether a runner installs names it cannot resolve from the project. */
+function installsMissingNames(runner, subcommand) {
+	if (runner === "npx" || runner === "bunx") return true;
+	if (subcommand === "dlx") return true;
+	return runner === "npm" && subcommand === "exec";
+}
+/** Translate the leading `node` flags into flags the CLI command accepts. */
+function carriedOverFlags(nodeFlags) {
+	return [...nodeFlags.matchAll(NODE_FLAG_PATTERN)].filter((match) => match[1] != null && ENV_FILE_FLAG.test(match[1])).map((match) => ` ${match[1]} ${match[2] ?? match[3]}`).join("");
+}
+/**
+* Rewrite runner invocations. The runner spells validation as its first
+* positional argument, so a consumed `validate` selects the subcommand.
+*/
+function rewrite(value, inventedHead = CLI_BINARY) {
+	return value.replace(RUNNER_PATTERN, (_match, nodeFlags, _quote, validate, offset) => {
+		const command = validate ? "validate" : "apply";
+		const before = value.slice(Math.max(0, offset - RUNNER_PREFIX_WINDOW), offset);
+		const existing = RUNNER_PREFIX_PATTERN.exec(before);
+		return `${existing ? installsMissingNames(existing[1], existing[2]) ? CLI_PACKAGE : CLI_BINARY : inventedHead} seed ${command}${carriedOverFlags(nodeFlags)}`;
+	});
+}
+function transformText(source) {
+	const updated = rewrite(source);
+	return updated === source ? null : updated;
+}
+/**
+* Source files reach the plugin through a package runner rather than the bare
+* binary, since the plugin executable is resolved from the project's
+* node_modules rather than the PATH.
+*/
+function transformSourceText(source) {
+	const updated = rewrite(source, PACKAGE_RUNNER);
+	if (FORK_PATTERN.test(source) && updated.includes("exec.mjs")) return null;
+	return updated === source ? null : updated;
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	const scripts = parsed.scripts;
+	if (typeof scripts !== "object" || scripts == null || Array.isArray(scripts)) return null;
+	let modified = false;
+	for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		const updated = rewrite(value);
+		if (updated !== value) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Rewrite generated seed runner invocations to the `tailor seed` CLI plugin.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch package.json vs source vs text)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!source.includes("exec.mjs")) return null;
+	const ext = path.extname(filePath).toLowerCase();
+	if (ext === ".json") return transformPackageJson(source);
+	if (SOURCE_EXTENSIONS.has(ext)) return transformSourceText(source);
+	return transformText(source);
+}
+/**
+* Report `fork()` call sites the transform declined, so the migration surfaces
+* the async-plumbing rewrite instead of silently leaving a stale invocation.
+* @param source - Post-transform file contents
+* @param filePath - Absolute path to the file
+* @param relativePath - Path relative to the transformed project root
+* @returns Locations that need manual migration.
+*/
+function reviewFindings(source, filePath, relativePath) {
+	const ext = path.extname(filePath).toLowerCase();
+	if (!SOURCE_EXTENSIONS.has(ext)) return [];
+	if (!source.includes("exec.mjs") || !FORK_PATTERN.test(source)) return [];
+	const lines = source.split(/\r\n|\n|\r/);
+	return [...source.matchAll(FORK_RUNNER_PATTERN)].map((match) => {
+		const index = source.slice(0, match.index).split(/\r\n|\n|\r/).length - 1;
+		return {
+			file: relativePath,
+			line: index + 1,
+			message: "Replace the fork()-based seed runner call with execSync(\"npx @tailor-platform/sdk seed apply\"), forwarding env/stdio, and unwind the surrounding await/Promise plumbing.",
+			excerpt: lines[index].trim()
+		};
+	});
+}
+//#endregion
+export { transform as default, reviewFindings };

package/dist/codemods/v2/workflow-trigger-rename/scripts/transform.js

@@ -3,7 +3,7 @@ import { Lang, parse } from "@ast-grep/napi";
 //#region codemods/v2/workflow-trigger-rename/scripts/transform.ts
 const RENAMES = {
 	triggerWorkflow: "startWorkflow",
-	triggerJobFunction: "startJobFunction",
+	triggerJobFunction: "execJobFunction",
 	resumeWorkflow: "resumeWorkflowExecution"
 };
 const WORKFLOW_MODULE_SOURCES = /* @__PURE__ */ new Set(["@tailor-platform/sdk/runtime", "@tailor-platform/sdk/runtime/workflow"]);
@@ -83,7 +83,8 @@ function findInvokerOptionEdit(member) {
 }
 /**
 * Rewrite `.triggerWorkflow(`, `.triggerJobFunction(`, and `.resumeWorkflow(`
-* member accesses to their canonical `start*`/`resumeWorkflowExecution` names,
+* member accesses to their canonical `startWorkflow`/`execJobFunction`/
+* `resumeWorkflowExecution` names,
 * either on the ambient `tailor.workflow` global or on a `workflow` value
 * imported from `@tailor-platform/sdk/runtime(/workflow)`.
 * @param source - File contents

package/dist/index.js

@@ -121,6 +121,7 @@ const V2_NEXT_5 = "2.0.0-next.5";
 const V2_NEXT_6 = "2.0.0-next.6";
 const V2_NEXT_7 = "2.0.0-next.7";
 const V2_NEXT_9 = "2.0.0-next.9";
+const V2_NEXT_11 = "2.0.0-next.11";
 /** All registered codemods, in registration order. */
 const allCodemods = [
 	{
@@ -204,13 +205,16 @@ const allCodemods = [
 		examples: [{
 			lang: "sh",
 			before: "npx tailor-sdk-skills",
-			after: "tailor skills add"
+			after: "npx @tailor-platform/sdk skills add"
 		}],
 		prompt: [
 			"The standalone tailor-sdk-skills binary is removed in v2; call the skills add",
 			"subcommand on the main tailor CLI instead. Replace any remaining",
 			"tailor-sdk-skills invocations the codemod did not rewrite with",
-			"`tailor skills add`."
+			"`tailor skills add`, or `npx @tailor-platform/sdk skills add` when the",
+			"invocation runs through a package runner (npx, bunx, pnpm/yarn dlx, npm exec)",
+			"— those resolve a package name, and `npx tailor` reaches an unrelated",
+			"`tailor` package on npm."
 		].join("\n")
 	},
 	{
@@ -676,6 +680,39 @@ const allCodemods = [
 			after: "await executeScript({ ...opts, arg: { a: 1 } });"
 		}]
 	},
+	{
+		id: "v2/idp-publish-events-rename",
+		name: "defineIdp publishUserEvents → publishEvents",
+		description: "Rename the `defineIdp` option `publishUserEvents` to `publishEvents`, matching the field name TailorDB types, resolvers, and workflows already use.",
+		since: "1.5.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		scriptPath: "v2/idp-publish-events-rename/scripts/transform.js",
+		examples: [{
+			before: "import { defineIdp } from \"@tailor-platform/sdk\";\n\nexport const idp = defineIdp(\"my-idp\", {\n  clients: [\"my-client\"],\n  publishUserEvents: true,\n});",
+			after: "import { defineIdp } from \"@tailor-platform/sdk\";\n\nexport const idp = defineIdp(\"my-idp\", {\n  clients: [\"my-client\"],\n  publishEvents: true,\n});"
+		}, {
+			caption: "A shorthand option keeps reading the same local:",
+			before: "defineIdp(\"my-idp\", { clients, publishUserEvents });",
+			after: "defineIdp(\"my-idp\", { clients, publishEvents: publishUserEvents });"
+		}],
+		prompt: [
+			"In Tailor SDK v2, the IdP option `publishUserEvents` is renamed to",
+			"`publishEvents`, so all four services that publish events use one field name.",
+			"The codemod rewrites the option key on `defineIdp` calls whose callee resolves",
+			"to the SDK export, including aliased and namespace imports, and rewrites a",
+			"shorthand `{ publishUserEvents }` to `{ publishEvents: publishUserEvents }` so",
+			"it keeps reading the same local.",
+			"",
+			"Also review, and migrate by hand:",
+			"- An options object built in a variable or spread into the call — the codemod",
+			"  only rewrites object literals passed directly to `defineIdp`.",
+			"- A computed key (e.g. `[key]: value`) that resolves to `publishUserEvents`.",
+			"- Type annotations or interfaces that declare the option themselves.",
+			"- A file where a local declaration shadows the `defineIdp` import; the codemod",
+			"  skips it because the call may not be the SDK export."
+		].join("\n")
+	},
 	{
 		id: "v2/wait-point-rename",
 		name: "defineWaitPoint/defineWaitPoints → createWaitPoint/createWaitPoints",
@@ -691,8 +728,8 @@ const allCodemods = [
 	},
 	{
 		id: "v2/workflow-trigger-rename",
-		name: "workflow.triggerWorkflow/triggerJobFunction/resumeWorkflow → startWorkflow/startJobFunction/resumeWorkflowExecution",
-		description: "Rename tailor.workflow call sites from the pre-alignment triggerWorkflow/triggerJobFunction/resumeWorkflow names to the canonical startWorkflow/startJobFunction/resumeWorkflowExecution names, on both the ambient tailor.workflow global and a workflow value imported from @tailor-platform/sdk/runtime(/workflow). For a renamed triggerWorkflow call, also renames a literal `invoker` option key to `authInvoker` — startWorkflow's options expect the platform shape directly, unlike the removed triggerWorkflow wrapper, which converted invoker to authInvoker internally.",
+		name: "workflow.triggerWorkflow/triggerJobFunction/resumeWorkflow → startWorkflow/execJobFunction/resumeWorkflowExecution",
+		description: "Rename tailor.workflow call sites from the pre-alignment triggerWorkflow/triggerJobFunction/resumeWorkflow names to the canonical startWorkflow/execJobFunction/resumeWorkflowExecution names, on both the ambient tailor.workflow global and a workflow value imported from @tailor-platform/sdk/runtime(/workflow). For a renamed triggerWorkflow call, also renames a literal `invoker` option key to `authInvoker` — startWorkflow's options expect the platform shape directly, unlike the removed triggerWorkflow wrapper, which converted invoker to authInvoker internally.",
 		since: "1.0.0",
 		until: "2.0.0",
 		prereleaseUntil: V2_NEXT_6,
@@ -714,7 +751,7 @@ const allCodemods = [
 		prompt: [
 			"The pre-alignment tailor.workflow names triggerWorkflow, triggerJobFunction, and",
 			"resumeWorkflow are removed from the SDK's type surface in v2; use the canonical",
-			"startWorkflow, startJobFunction, and resumeWorkflowExecution names instead. The",
+			"startWorkflow, execJobFunction, and resumeWorkflowExecution names instead. The",
 			"codemod rewrites direct member-access call sites on the ambient tailor.workflow",
 			"global and on a workflow value imported from @tailor-platform/sdk/runtime or",
 			"@tailor-platform/sdk/runtime/workflow (including aliased imports). It skips a",
@@ -731,12 +768,45 @@ const allCodemods = [
 			"- Destructured references (e.g. const { triggerWorkflow } = workflow) — the",
 			"  codemod only rewrites direct member-access calls.",
 			"- Imported TriggerWorkflowOptions / TriggerJobFunctionOptions types — rename",
-			"  them to StartWorkflowOptions / StartJobFunctionOptions.",
+			"  them to StartWorkflowOptions / ExecJobFunctionOptions.",
 			"- An invoker option passed via a variable or spread (not a literal object) —",
 			"  the codemod only inspects literal object arguments; rename the invoker key",
 			"  to authInvoker in the options object's own definition."
 		].join("\n")
 	},
+	{
+		id: "v2/exec-job-function-rename",
+		name: "workflow.startJobFunction → execJobFunction",
+		description: "`tailor.workflow.startJobFunction` and the `StartJobFunctionOptions` type are removed in v2. Use the canonical `execJobFunction` / `ExecJobFunctionOptions`: `Exec*` blocks and returns the job's result, while `Start*` returns only an execution ID. The codemod rewrites member-access call sites on the ambient `tailor.workflow` global and on a `workflow` value imported from @tailor-platform/sdk/runtime(/workflow), and renames `StartJobFunctionOptions` imports along with the type references that resolve to them.",
+		since: "1.0.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		scriptPath: "v2/exec-job-function-rename/scripts/transform.js",
+		filePatterns: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"],
+		legacyPatterns: ["startJobFunction", "StartJobFunctionOptions"],
+		examples: [{
+			before: "import { workflow } from \"@tailor-platform/sdk/runtime\";\n\nconst result = workflow.startJobFunction(\"myJob\", { data: \"value\" });",
+			after: "import { workflow } from \"@tailor-platform/sdk/runtime\";\n\nconst result = workflow.execJobFunction(\"myJob\", { data: \"value\" });"
+		}],
+		prompt: [
+			"startJobFunction is removed from the SDK's workflow runtime surface in v2;",
+			"execJobFunction is the canonical name for a blocking job call that returns the",
+			"job's result. The codemod rewrites direct member-access calls on the ambient",
+			"tailor.workflow global and on a workflow value imported from",
+			"@tailor-platform/sdk/runtime or @tailor-platform/sdk/runtime/workflow (including",
+			"aliased imports), and renames the StartJobFunctionOptions type. It skips a file",
+			"entirely when a local declaration shadows the workflow import or the ambient",
+			"tailor name, to avoid rewriting an unrelated same-named value.",
+			"",
+			"Also review, and migrate by hand:",
+			"- Destructured references (e.g. const { startJobFunction } = workflow) — the",
+			"  codemod only rewrites direct member-access calls.",
+			"- mockWorkflow().startJobFunction in tests — assert on the execJobFunction vi.fn",
+			"  instead; the alias was the same mock function.",
+			"- A file that already imports ExecJobFunctionOptions alongside the removed type —",
+			"  rename the remaining references by hand and drop the duplicate specifier."
+		].join("\n")
+	},
 	{
 		id: "v2/open-download-stream",
 		name: "openDownloadStream → downloadStream",
@@ -885,6 +955,15 @@ const allCodemods = [
 			"   where they describe this SDK verb specifically, not unrelated event terminology."
 		].join("\n")
 	},
+	{
+		id: "v2/publish-events-recomputed-per-deploy",
+		name: "publishEvents recomputed from the executors in each deploy",
+		description: "An unset `publishEvents` is recomputed on every `deploy` from the executors taking part in the run, in both directions: adding a subscribing trigger turns publishing on, and removing the last one turns it back off. Previously a workflow or job kept publishing once it had been enabled, so a workflow whose subscribing trigger is already gone stops publishing on the next `deploy` — declare `publishEvents: true` on it if something outside this project consumes those events. `deploy` also stops instead of applying when a subscription cannot be satisfied: when a trigger names a resource no config in the run declares, when a workflow or job combines `publishEvents: false` with a subscribing trigger, and when a config that resolves without an `id` subscribes across configs. Each of those errors names the resource and both ways to resolve it.",
+		since: "1.0.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		notice: true
+	},
 	{
 		id: "v2/cli-token-keyring-storage",
 		name: "CLI tokens stored in the OS keyring",
@@ -1179,12 +1258,18 @@ const allCodemods = [
 	{
 		id: "v2/seed-exec-to-cli-plugin",
 		name: "Generated seed exec.mjs → tailor seed CLI plugin",
-		description: "`seedPlugin` no longer generates the `exec.mjs` seed runner. Seeding and validation move to the `tailor seed` commands provided by the `@tailor-platform/sdk-plugin-seed` CLI plugin: install it as a devDependency, replace `node <distPath>/exec.mjs` invocations with `tailor seed apply` and `node <distPath>/exec.mjs validate` with `tailor seed validate`, and delete the stale generated `<distPath>/exec.mjs` file. Seed data and schema generation (`data/*.jsonl`, `data/*.schema.ts`) is unchanged, and the `tailor seed apply` options mirror the old script (`--machine-user`, `--namespace`, `--skip-idp`, `--truncate`, `--yes`, type-name arguments).",
+		description: "`seedPlugin` no longer generates the `exec.mjs` seed runner. Seeding and validation move to the `tailor seed` commands provided by the `@tailor-platform/sdk-plugin-seed` CLI plugin: install it as a devDependency, replace `node <distPath>/exec.mjs` invocations with `tailor seed apply` and `node <distPath>/exec.mjs validate` with `tailor seed validate`, and delete the stale generated `<distPath>/exec.mjs` file. Seed data and schema generation (`data/*.jsonl`, `data/*.schema.ts`) is unchanged, and the `tailor seed apply` options mirror the old script (`--machine-user`, `--namespace`, `--skip-idp`, `--truncate`, `--yes`, type-name arguments), plus a new `--upsert` flag to update existing rows instead of failing on duplicate ids.",
 		since: "1.0.0",
 		until: "2.0.0",
 		prereleaseUntil: V2_NEXT_9,
-		filePatterns: ["**/package.json", "**/*.{sh,yml,yaml,md,mjs,ts}"],
-		suspiciousPatterns: ["exec.mjs"],
+		scriptPath: "v2/seed-exec-to-cli-plugin/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh,yml,yaml}",
+			"**/*.md",
+			"**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"
+		],
+		suspiciousPatterns: [/[\w./@~${}-]+\/exec\.mjs/],
 		sourceStringSuspiciousPatterns: ["exec.mjs"],
 		examples: [{
 			before: "\"seed\": \"node ./seed/exec.mjs\",\n\"seed:validate\": \"node ./seed/exec.mjs validate\"",
@@ -1199,11 +1284,122 @@ const allCodemods = [
 			"  @tailor-platform/sdk.",
 			"- Replace `node <distPath>/exec.mjs [options] [types...]` invocations with",
 			"  `tailor seed apply [options] [types...]` (same options: --machine-user/-m,",
-			"  --namespace/-n, --skip-idp, --truncate, --yes, and type-name arguments).",
+			"  --namespace/-n, --skip-idp, --truncate, --yes, and type-name arguments,",
+			"  plus a new --upsert flag to update existing rows instead of failing on",
+			"  duplicate ids).",
 			"- Replace `node <distPath>/exec.mjs validate [path]` with",
 			"  `tailor seed validate [path]`.",
+			"- Rewrite `fork(\"<distPath>/exec.mjs\", ...)` call sites (test setup files",
+			"  typically fork the runner and await a hand-rolled Promise around",
+			"  `child.on(\"close\", ...)`). The plugin is a CLI-dispatched binary rather",
+			"  than a forkable JS module, so call it synchronously instead —",
+			"  `execSync(\"npx @tailor-platform/sdk seed apply\", { env, stdio: \"inherit\" })` — keeping",
+			"  the original `env` and `stdio` forwarding, and unwind the surrounding",
+			"  Promise wrapper (drop the now-unused `await`, and the `async` keyword when",
+			"  nothing else in the function awaits). Note that `execSync` throws on a",
+			"  nonzero exit, replacing the wrapper's explicit reject.",
 			"- Delete the stale generated `<distPath>/exec.mjs` file; keep the data/",
-			"  directory (JSONL data and generated schemas) as-is."
+			"  directory (JSONL data and generated schemas) as-is. Nothing removes it",
+			"  automatically, and a leftover runner keeps working while no longer being",
+			"  regenerated."
+		].join("\n")
+	},
+	{
+		id: "v2/sdk-test-mocks-to-vitest",
+		name: "@tailor-platform/sdk/test global mocks → @tailor-platform/sdk/vitest",
+		description: "The global platform mocks exported from `@tailor-platform/sdk/test` (`setupTailordbMock`, `setupWorkflowMock`, `setupWaitPointMock`, `setupInvokerMock`, `setupTailorErrorsMock`) and the bundled-output helper `createImportMain` are removed in v2. Use the `tailor-runtime` environment from `@tailor-platform/sdk/vitest` together with `mockTailordb` / `mockWorkflow`: the environment injects `TailorErrors` for you, `setWaitHandler` / `setResolveHandler` replace the wait-point stubs, and the invoker is driven through `globalThis.tailor.context.getInvoker` (or passed directly to `.body()` when testing the TypeScript source). No codemod ships for this migration: it replaces per-test global stubs with a Vitest environment plus disposable mocks, which changes the Vitest config, the setup shape, and the assertions of every affected test. The other `@tailor-platform/sdk/test` exports (`createTailorDBHook`, `createStandardSchema`, `unauthenticatedTailorUser`) are unchanged.",
+		since: "1.0.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		suspiciousPatterns: [
+			"setupTailordbMock",
+			"setupWorkflowMock",
+			"setupWaitPointMock",
+			"setupInvokerMock",
+			"setupTailorErrorsMock",
+			"createImportMain"
+		],
+		examples: [{
+			caption: "Job mocks move from a global stub to a disposable mock:",
+			before: "import { setupWorkflowMock } from \"@tailor-platform/sdk/test\";\n\nconst { startedJobs } = setupWorkflowMock(() => ({ ok: true }));",
+			after: "import { mockWorkflow } from \"@tailor-platform/sdk/vitest\";\n\nusing wf = mockWorkflow();\nwf.setJobHandler(() => ({ ok: true }));\n// wf.startedJobs replaces the returned startedJobs array"
+		}],
+		prompt: [
+			"The global platform mocks from @tailor-platform/sdk/test are removed in v2.",
+			"Migrate each affected test to the tailor-runtime Vitest environment:",
+			"",
+			"1. Add the environment for the test files that need platform globals — set",
+			"   environment: \"tailor-runtime\" in the Vitest project config, or add the",
+			"   // @vitest-environment tailor-runtime docblock to the file. The environment",
+			"   ships in @tailor-platform/sdk/vitest and installs TailorErrors and the base",
+			"   tailor/tailordb globals, so setupTailorErrorsMock has no replacement — delete it.",
+			"2. Replace setupTailordbMock(resolver) with using db = mockTailordb() and",
+			"   configure query results on that mock; read its recorded calls instead of the",
+			"   returned executedQueries / createdClients arrays.",
+			"3. Replace setupWorkflowMock(handler) with using wf = mockWorkflow() plus",
+			"   wf.setJobHandler(handler) (or wf.enqueueResult(...) for order-based results),",
+			"   and read wf.startedJobs.",
+			"4. Replace setupWaitPointMock({ onWait, onResolve }) with the same mockWorkflow()",
+			"   handle: wf.setWaitHandler / wf.setResolveHandler, asserting on wf.waitCalls /",
+			"   wf.resolveCalls.",
+			"5. Replace setupInvokerMock(invoker) with",
+			"   vi.spyOn(globalThis.tailor.context, \"getInvoker\").mockReturnValue(raw) for a",
+			"   bundled test, or pass invoker directly to .body() when unit-testing a",
+			"   resolver/executor/workflow job against the TypeScript source.",
+			"6. Drop createImportMain and the tests that import bundled output through it.",
+			"   Bundling integrity is the SDK's responsibility: unit-test the TypeScript",
+			"   source and cover deployed behavior with E2E tests instead.",
+			"",
+			"See the SDK testing guide for the full environment setup."
+		].join("\n")
+	},
+	{
+		id: "v2/cli-typed-options",
+		name: "Programmatic CLI name options → workflow/executor definitions",
+		description: "The name-keyed option types exported from `@tailor-platform/sdk/cli` — `GetWorkflowOptions`, `StartWorkflowOptions`, `ListWorkflowExecutionsOptions`, `GetExecutorOptions`, `TriggerExecutorOptions`, `ListExecutorJobsOptions`, `GetExecutorJobOptions`, `WatchExecutorJobOptions` — are removed in v2, together with the function overloads that accepted them. Pass the workflow or executor definition itself instead: `{ workflow: myWorkflow, invoker: \"admin\" }` / `{ executor: myExecutor }`, matching the `*TypedOptions` shape that types `arg` and `payload` from the definition. No codemod ships for this migration: rewriting a name string into a definition requires importing the module that defines the workflow or executor, which a source-local transform cannot resolve.",
+		since: "1.0.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		suspiciousPatterns: [
+			["@tailor-platform/sdk/cli", "executorName"],
+			["@tailor-platform/sdk/cli", "workflowName"],
+			["@tailor-platform/sdk/cli", "GetWorkflowOptions"],
+			["@tailor-platform/sdk/cli", "StartWorkflowOptions"],
+			["@tailor-platform/sdk/cli", "ListWorkflowExecutionsOptions"],
+			["@tailor-platform/sdk/cli", "GetExecutorOptions"],
+			["@tailor-platform/sdk/cli", "TriggerExecutorOptions"],
+			["@tailor-platform/sdk/cli", "ListExecutorJobsOptions"],
+			["@tailor-platform/sdk/cli", "GetExecutorJobOptions"],
+			["@tailor-platform/sdk/cli", "WatchExecutorJobOptions"]
+		],
+		examples: [{
+			before: "import { startWorkflow } from \"@tailor-platform/sdk/cli\";\n\nconst { executionId } = await startWorkflow({ name: \"user-sync\", machineUser: \"admin\" });",
+			after: "import { startWorkflow } from \"@tailor-platform/sdk/cli\";\nimport userSync from \"./workflows/userSync\";\n\nconst { executionId } = await startWorkflow({ workflow: userSync, invoker: \"admin\" });"
+		}, {
+			caption: "Executor commands take the executor definition:",
+			before: "const result = await watchExecutorJob({ executorName: \"daily-sync\", jobId });",
+			after: "const result = await watchExecutorJob({ executor: dailySync, jobId });"
+		}],
+		prompt: [
+			"The programmatic CLI functions in @tailor-platform/sdk/cli no longer accept a",
+			"workflow or executor name; they take the definition object instead. For each",
+			"flagged call site:",
+			"",
+			"1. Import the workflow or executor definition — the module whose default export",
+			"   is createWorkflow(...) or whose export is createExecutor(...) with that name.",
+			"2. Replace name: \"my-workflow\" with workflow: myWorkflow, and",
+			"   executorName: \"my-executor\" with executor: myExecutor. For",
+			"   listWorkflowExecutions, workflowName becomes workflow.",
+			"3. startWorkflow's machine user moves from machineUser to the required",
+			"   invoker, typed against the machine users declared in tailor.config.ts.",
+			"4. Replace imported option types with the *TypedOptions equivalent",
+			"   (e.g. GetWorkflowOptions → GetWorkflowTypedOptions<typeof myWorkflow>).",
+			"   Note that arg (startWorkflow) and payload (triggerExecutor) are now typed",
+			"   from the definition, so a mistyped argument becomes a type error.",
+			"",
+			"When the name is only known at runtime (read from argv or an environment",
+			"variable), the CLI command itself — `tailor workflow start <name>` /",
+			"`tailor executor trigger <name>` — remains the name-keyed entry point."
 		].join("\n")
 	},
 	{
@@ -1221,6 +1417,40 @@ const allCodemods = [
 		since: "1.0.0",
 		until: "2.0.0",
 		notice: true
+	},
+	{
+		id: "v2/dts-env-value-types",
+		name: "tailor.d.ts Env uses value types instead of literal values",
+		description: "The `Env` interface in `tailor.d.ts` is generated from the type of each `defineConfig({ env })` value (`string`, `number`, or `boolean`) instead of the value itself, so the generated file no longer carries whatever the config resolved to when it was generated. Keys that aren't valid TypeScript identifiers are quoted, which previously produced a file that failed to parse. Run `tailor generate` to refresh the file, then widen any code that depended on the old literal types. If a `tailor.d.ts` you already committed contains a sensitive value, treat that value as exposed and rotate it; keep secrets in Secret Manager rather than `env`.",
+		since: "1.0.0",
+		until: "2.0.0",
+		prereleaseUntil: V2_NEXT_11,
+		examples: [{
+			lang: "ts",
+			caption: "An env value can no longer stand in for a literal union; narrow it explicitly:",
+			before: "const stage: \"production\" | \"staging\" = env.STAGE;",
+			after: "const stage = env.STAGE === \"staging\" ? \"staging\" : \"production\";"
+		}],
+		prompt: [
+			"Tailor SDK v2 generates the `Env` interface in `tailor.d.ts` from the type of",
+			"each `defineConfig({ env })` value (`string`, `number`, `boolean`) instead of",
+			"the resolved value, so `Env` properties no longer carry literal types.",
+			"",
+			"Run `tailor generate` first to refresh `tailor.d.ts`, then review the places",
+			"that depended on the old literal types:",
+			"",
+			"- An env value assigned or passed where a literal union is required, e.g.",
+			"  `const stage: \"production\" | \"staging\" = env.STAGE`. Narrow it with a",
+			"  comparison or a validation helper instead of relying on the declared type.",
+			"- A generic argument, conditional type, or template-literal type parameterized",
+			"  by an env value.",
+			"- `as const` / `satisfies` assertions that assumed one specific literal.",
+			"",
+			"Plain comparisons (`env.STAGE === \"production\"`) and arithmetic on numeric env",
+			"values keep working and need no change. Do not restore the old behavior by",
+			"editing `tailor.d.ts`: it is generated and will be overwritten, and embedding",
+			"env values there is what leaked configured secrets into version control."
+		].join("\n")
 	}
 ];
 /**
@@ -1238,23 +1468,45 @@ function reachesCodemodBoundary(toVersion, codemod) {
 	const boundary = parse(codemod.until);
 	return target.prerelease.length > 0 && target.major === boundary.major && target.minor === boundary.minor && target.patch === boundary.patch;
 }
+/**
+* The version a codemod's migration is due by: its `prereleaseUntil` while that
+* names a concrete prerelease, and `until` otherwise.
+* @param codemod - The registered codemod
+* @returns The version its boundary sits at
+*/
 function effectiveCodemodBoundary(codemod) {
 	if (codemod.prereleaseUntil === "pending") return codemod.until;
 	return codemod.prereleaseUntil ?? codemod.until;
 }
 function assertCodemodBoundaries(codemods) {
 	for (const codemod of codemods) {
+		if (valid(codemod.since) === null) throw new Error(`Codemod ${codemod.id} since must be a valid semver version: ${codemod.since}`);
 		const boundary = parse(codemod.until);
 		if (boundary === null) throw new Error(`Codemod ${codemod.id} until must be a valid semver version: ${codemod.until}`);
 		if (boundary.prerelease.length > 0) throw new Error(`Codemod ${codemod.id} until must be a stable version: ${codemod.until}`);
-		if (codemod.prereleaseUntil === void 0 || codemod.prereleaseUntil === "pending") continue;
+		if (codemod.prereleaseUntil === void 0 || codemod.prereleaseUntil === "pending") {
+			assertNonEmptyRange(codemod);
+			continue;
+		}
 		const prereleaseBoundary = parse(codemod.prereleaseUntil);
 		if (prereleaseBoundary === null) throw new Error(`Codemod ${codemod.id} prereleaseUntil must be a valid semver version: ${codemod.prereleaseUntil}`);
 		if (prereleaseBoundary.prerelease.length === 0) throw new Error(`Codemod ${codemod.id} prereleaseUntil must be a prerelease version: ${codemod.prereleaseUntil}`);
 		if (prereleaseBoundary.major !== boundary.major || prereleaseBoundary.minor !== boundary.minor || prereleaseBoundary.patch !== boundary.patch) throw new Error(`Codemod ${codemod.id} prereleaseUntil must target the same version as until: ${codemod.prereleaseUntil}`);
+		assertNonEmptyRange(codemod);
 	}
 }
 /**
+* A codemod applies while `since <= from < boundary`, so a `since` at or past the
+* boundary leaves an empty range and the codemod can never apply. The boundary is
+* `prereleaseUntil` once that names a concrete prerelease, which is earlier than
+* `until` — comparing against `until` alone would let that case through.
+* @param codemod - The registered codemod, with its boundaries already validated
+*/
+function assertNonEmptyRange(codemod) {
+	const boundary = effectiveCodemodBoundary(codemod);
+	if (!lt(codemod.since, boundary)) throw new Error(`Codemod ${codemod.id} since must be older than the boundary it applies up to: ${codemod.since} >= ${boundary}`);
+}
+/**
 * Get codemod packages applicable for a version range.
 * A codemod applies when: since <= fromVersion < boundary <= toVersion.
 * A target prerelease reaches `until` only when the codemod declares `prereleaseUntil`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk-codemod",
-  "version": "0.4.0-next.9",
+  "version": "0.4.1",
   "description": "Codemod runner for Tailor Platform SDK upgrades",
   "license": "MIT",
   "repository": {
@@ -16,13 +16,13 @@
   ],
   "type": "module",
   "dependencies": {
-    "@ast-grep/napi": "0.44.1",
+    "@ast-grep/napi": "0.45.0",
     "chalk": "5.6.2",
     "diff": "9.0.0",
     "pathe": "2.0.3",
     "picomatch": "4.0.5",
     "pkg-types": "2.3.1",
-    "politty": "0.11.3",
+    "politty": "0.11.6",
     "semver": "7.8.5",
     "zod": "4.4.3"
   },
@@ -30,9 +30,9 @@
     "@types/node": "24.13.3",
     "@types/picomatch": "4.0.3",
     "@types/semver": "7.7.1",
-    "eslint-plugin-zod": "4.7.0",
-    "oxlint": "1.74.0",
-    "tsdown": "0.22.12",
+    "eslint-plugin-zod": "4.9.0",
+    "oxlint": "1.76.0",
+    "tsdown": "0.22.14",
     "typescript": "6.0.3",
     "vitest": "4.1.10"
   },