@tailor-platform/sdk-codemod 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @tailor-platform/sdk-codemod
 
+## 0.7.0
+
+### Minor Changes
+
+- [#2088](https://github.com/tailor-platform/sdk/pull/2088) [`c9f91d9`](https://github.com/tailor-platform/sdk/commit/c9f91d944e4b041250979ec4438c36cabf818e14) Thanks [@dqn](https://github.com/dqn)! - The `--branch` option of `tailor setup branch` is renamed to `--target`, so it no longer collides with the subcommand name. The old spelling keeps working as a deprecated alias until v3 and prints a deprecation warning when used; `tailor upgrade` offers the `v3/setup-branch-flag-rename` codemod to rewrite `setup branch --branch` invocations across package.json scripts, shell and Windows scripts, YAML, Markdown, and JavaScript/TypeScript sources. The `--branch` option of `setup tag`, `setup preview`, and `setup coordinate` is unchanged.
+
+### Patch Changes
+
+- [#2137](https://github.com/tailor-platform/sdk/pull/2137) [`d38497a`](https://github.com/tailor-platform/sdk/commit/d38497ac214f547483028e2622d53dbf1414ecb2) Thanks [@dqn](https://github.com/dqn)! - Keep LLM review detection working in multi-major upgrades: each codemod's review detector and suspicious patterns now inspect the file as of that codemod's position in the transform chain, so a later codemod's rewrite can no longer silently hide an earlier codemod's review findings.
+
+- [#2138](https://github.com/tailor-platform/sdk/pull/2138) [`870c8cd`](https://github.com/tailor-platform/sdk/commit/870c8cdaa007adcbb8f565fe9b4d238d98c00e6d) Thanks [@dqn](https://github.com/dqn)! - Stop exporting internal declarations that were only used within their own module.
+
+- [#2089](https://github.com/tailor-platform/sdk/pull/2089) [`90948e6`](https://github.com/tailor-platform/sdk/commit/90948e6f6e1f3624a9c30595b3ff3a46ffbbced0) Thanks [@toiroakr](https://github.com/toiroakr)! - Add a targeted hint to the `Remote schema drift detected` error when every reported drift is a missing script hash — the pattern left by an environment last deployed with the pre-v2 CLI, which never wrote script hashes. The hint points at `migration sync <N>`, which is already listed as one of the general resolution options. The v2 migration guide (`docs/migration/v2.md`) now also documents that the first `tailor deploy` against such an environment needs a `migration sync` first.
+
 ## 0.6.0
 
 ### Minor Changes

package/dist/codemods/v3/setup-branch-flag-rename/scripts/transform.js

@@ -0,0 +1,76 @@
+import * as path from "pathe";
+//#region codemods/v3/setup-branch-flag-rename/scripts/transform.ts
+const TOKEN_SEPARATOR = "(?:[ \\t]|\\\\\\r?\\n)+";
+const COMMAND_START = new RegExp(`(?<![\\w.-])tailor(?:-sdk)?(?:\\.(?:cmd|ps1|exe))?${TOKEN_SEPARATOR}setup${TOKEN_SEPARATOR}branch(?![\\w.-])`, "g");
+const NEXT_TOKEN = new RegExp(`${TOKEN_SEPARATOR}("[^"\\n]*"|'[^'\\n]*'|[^\\s;&|]+)`, "y");
+function replaceCommand(value) {
+	let result = "";
+	let cursor = 0;
+	COMMAND_START.lastIndex = 0;
+	for (let match = COMMAND_START.exec(value); match; match = COMMAND_START.exec(value)) {
+		let pos = COMMAND_START.lastIndex;
+		result += value.slice(cursor, pos);
+		NEXT_TOKEN.lastIndex = pos;
+		for (let token = NEXT_TOKEN.exec(value); token; token = NEXT_TOKEN.exec(value)) {
+			const chunk = token[0];
+			const word = token[1];
+			if (word.startsWith("#")) break;
+			const quoted = /^(['"])(--branch(?:=.*)?)\1$/.exec(word);
+			const quote = quoted ? quoted[1] : "";
+			const bare = quoted ? quoted[2] : word;
+			if (bare === "--branch" || bare.startsWith("--branch=")) {
+				const separator = chunk.slice(0, chunk.length - word.length);
+				result += `${separator}${quote}--target${bare.slice(8)}${quote}`;
+			} else result += chunk;
+			pos = NEXT_TOKEN.lastIndex;
+			if (/\$\(|`|<\(|>\(/.test(word)) break;
+		}
+		cursor = pos;
+		COMMAND_START.lastIndex = pos;
+	}
+	result += value.slice(cursor);
+	return result;
+}
+function transformText(source) {
+	const updated = replaceCommand(source);
+	return updated === source ? null : updated;
+}
+function transformPackageJson(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch {
+		return null;
+	}
+	let modified = false;
+	const scripts = parsed.scripts;
+	if (typeof scripts === "object" && scripts != null && !Array.isArray(scripts)) for (const [name, value] of Object.entries(scripts)) {
+		if (typeof value !== "string") continue;
+		const updated = replaceCommand(value);
+		if (updated !== value) {
+			scripts[name] = updated;
+			modified = true;
+		}
+	}
+	if (!modified) return null;
+	const trailing = source.endsWith("\n") ? "\n" : "";
+	return JSON.stringify(parsed, null, 2) + trailing;
+}
+/**
+* Rename the `--branch` option of `tailor setup branch` invocations to
+* `--target`.
+*
+* `--branch` remains as a deprecated alias until v3, where only
+* `--target` is recognized. `setup tag`, `setup preview`, and
+* `setup coordinate` keep their own `--branch` option unchanged.
+* @param source - File contents
+* @param filePath - Absolute path to the file (used to dispatch package.json vs text)
+* @returns Transformed source or null when nothing matched.
+*/
+function transform(source, filePath) {
+	if (!source.includes("--branch")) return null;
+	if (path.extname(filePath).toLowerCase() === ".json") return transformPackageJson(source);
+	return transformText(source);
+}
+//#endregion
+export { transform as default };

package/dist/index.js

@@ -123,6 +123,7 @@ const V2_NEXT_6 = "2.0.0-next.6";
 const V2_NEXT_7 = "2.0.0-next.7";
 const V2_NEXT_9 = "2.0.0-next.9";
 const V2_NEXT_11 = "2.0.0-next.11";
+const SETUP_BRANCH_RESIDUAL_FLAG = /(?:(?<![\w.-])tailor(?:-sdk)?(?:\.(?:cmd|ps1|exe))?|@tailor-platform\/sdk(?:@\S{1,32})?)[\s\\^`]{1,16}setup[\s\\^`]{1,16}branch\b(?:'[^'\n]*'|"[^"\n]*"|[^\n;&|'"#]|[\\^`]\r?\n)*(?:[ \t]|[\\^`]\r?\n)--branch(?![\w-])/;
 /** All registered codemods, in registration order. */
 const allCodemods = [
 	{
@@ -816,7 +817,11 @@ const allCodemods = [
 			"  them to StartWorkflowOptions / ExecJobFunctionOptions.",
 			"- An invoker option passed via a variable or spread (not a literal object) —",
 			"  the codemod only inspects literal object arguments; rename the invoker key",
-			"  to authInvoker in the options object's own definition."
+			"  to authInvoker in the options object's own definition.",
+			"- A renamed triggerJobFunction call whose target is another workflow job —",
+			"  rewrite it further to that job's own .start() method (e.g. worker.start(args)).",
+			"  Calling execJobFunction directly is not detected as a build-time dependency",
+			"  and fails the build."
 		].join("\n")
 	},
 	{
@@ -849,7 +854,45 @@ const allCodemods = [
 			"- mockWorkflow().startJobFunction in tests — assert on the execJobFunction vi.fn",
 			"  instead; the alias was the same mock function.",
 			"- A file that already imports ExecJobFunctionOptions alongside the removed type —",
-			"  rename the remaining references by hand and drop the duplicate specifier."
+			"  rename the remaining references by hand and drop the duplicate specifier.",
+			"- A renamed call whose target is another workflow job — rewrite it further to",
+			"  that job's own .start() method (e.g. worker.start(args)). Calling",
+			"  execJobFunction directly is not detected as a build-time dependency and fails",
+			"  the build."
+		].join("\n")
+	},
+	{
+		id: "v3/remove-workflow-exec-job-function",
+		name: "workflow.execJobFunction (imported) removed — use job.start()",
+		description: "`execJobFunction` on the `workflow` value imported from @tailor-platform/sdk/runtime(/workflow) is removed in v3. Calling it directly from a workflow job body to reach another job is not detected as a build-time dependency and has no working use; the target job's own `.start()` method is the only supported way to call it. This does not affect the ambient `tailor.workflow.execJobFunction` global — that's what `.start()` itself compiles down to at build time, and it remains fully supported.",
+		since: "1.0.0",
+		until: "3.0.0",
+		filePatterns: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"],
+		suspiciousPatterns: ["execJobFunction"],
+		examples: [{
+			before: "import { workflow } from \"@tailor-platform/sdk/runtime\";\n\nawait workflow.execJobFunction(\"worker\", { id: 1 });",
+			after: "import { worker } from \"./jobs/worker\";\n\nawait worker.start({ id: 1 });"
+		}],
+		prompt: [
+			"workflow.execJobFunction — the value imported from",
+			"@tailor-platform/sdk/runtime or @tailor-platform/sdk/runtime/workflow — is",
+			"removed in v3. Replace each call with the target job's own .start() method:",
+			"import the WorkflowJob the call names and call <job>.start(args, options)",
+			"instead of workflow.execJobFunction(\"<job-name>\", args, options).",
+			"",
+			"This only removes the re-export from @tailor-platform/sdk/runtime. It does",
+			"not affect the ambient tailor.workflow.execJobFunction global, which stays",
+			"fully supported and is what .start() itself compiles down to at build time.",
+			"This codemod does not rewrite ambient tailor.workflow.execJobFunction(...)",
+			"call sites, since removing the import re-export does not affect them — but",
+			"if such a call site sits inside workflow job source and calls another job",
+			"by name, a separate build-time check already rejects it; migrate that call",
+			"to the target job's own .start() method too.",
+			"",
+			"If the job name passed to execJobFunction is not a string literal (a truly",
+			"dynamic dispatch), there is currently no supported replacement — .start()",
+			"only targets a statically known job. Flag this case for a human instead of",
+			"guessing a rewrite."
 		].join("\n")
 	},
 	{
@@ -1450,7 +1493,7 @@ const allCodemods = [
 	{
 		id: "v2/node-minimum-22-15-0",
 		name: "Node.js minimum version raised to 22.15.0",
-		description: "v2 requires Node.js **22.15.0** or later. This is the first version that includes `module.registerHooks()`, which the SDK uses to register its TypeScript loader hook synchronously in the main thread. The actual floor is now **22.18.0**: Node 22.15.0–22.17.x has a bug ([nodejs/node#58607](https://github.com/nodejs/node/issues/58607)) that crashes `tailor seed validate` when requiring `node:`-scheme-only builtins such as `node:sqlite`, fixed upstream in 22.18.0. No source change is required; ensure your environment runs Node.js 22.18.0+.",
+		description: "v2 requires Node.js **22.15.0** or later. This is the first version that includes `module.registerHooks()`, which the SDK uses to register its TypeScript loader hook synchronously in the main thread. The actual floor is now **22.18.0**: Node 22.15.0–22.17.x has a bug that crashes `tailor seed validate` when requiring `node:`-scheme-only builtins such as `node:sqlite`, fixed upstream by [nodejs/node#58612](https://github.com/nodejs/node/pull/58612) in 22.18.0. No source change is required; ensure your environment runs Node.js 22.18.0+.",
 		since: "1.0.0",
 		until: "2.0.0",
 		notice: true
@@ -1463,6 +1506,14 @@ const allCodemods = [
 		until: "2.0.0",
 		notice: true
 	},
+	{
+		id: "v2/tailordb-script-hash-migration-sync",
+		name: "First v2 deploy to a v1-deployed environment needs migration sync",
+		description: "The pre-v2 CLI never wrote a script hash into deployed schemas, so the first `tailor deploy` against an environment last deployed with it reports `Remote schema drift detected` with every scripted type showing `has no script hash on remote`. Run `tailor tailordb migration sync <current migration number>` once for that environment to write the missing hashes, then `tailor deploy` as usual. Preview/PR workspaces don't hit this, since they're built with v2 from the start. No source change is required.",
+		since: "1.0.0",
+		until: "2.0.0",
+		notice: true
+	},
 	{
 		id: "v2/dts-env-value-types",
 		name: "tailor.d.ts Env uses value types instead of literal values",
@@ -1525,6 +1576,36 @@ const allCodemods = [
 			"`function run`. Leave prose that merely mentions the old subcommand name",
 			"unchanged unless it documents a command to type."
 		].join("\n")
+	},
+	{
+		id: "v3/setup-branch-flag-rename",
+		name: "setup branch --branch → --target",
+		description: "Rename the `--branch` option of `tailor setup branch` invocations to `--target`. `--branch` remains as a deprecated alias until it is removed in v3. The `--branch` option of `setup tag`, `setup preview`, and `setup coordinate` is unchanged.",
+		since: "1.72.0",
+		until: "3.0.0",
+		scriptPath: "v3/setup-branch-flag-rename/scripts/transform.js",
+		filePatterns: [
+			"**/package.json",
+			"**/*.{sh,bash,zsh,ps1,cmd,bat,yml,yaml}",
+			"**/*.md",
+			"**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"
+		],
+		legacyPatterns: [SETUP_BRANCH_RESIDUAL_FLAG],
+		sourceStringLegacyPatterns: [SETUP_BRANCH_RESIDUAL_FLAG],
+		examples: [{
+			lang: "sh",
+			before: "tailor setup branch --name my-app-stg --branch main",
+			after: "tailor setup branch --name my-app-stg --target main"
+		}],
+		prompt: [
+			"The `--branch` option of `tailor setup branch` is renamed to `--target`;",
+			"the old spelling is removed in v3. Replace any remaining `--branch` options of",
+			"`setup branch` invocations the codemod did not rewrite (e.g. wrapped across",
+			"lines or invoked through a package runner such as `npx @tailor-platform/sdk`)",
+			"with `--target`. Do not touch the `--branch` option of `setup tag`,",
+			"`setup preview`, or `setup coordinate`, which keeps its name, and leave prose",
+			"that merely mentions the option unchanged unless it documents a command to type."
+		].join("\n")
 	}
 ];
 /**
@@ -2025,6 +2106,27 @@ function legacyPatternWarnings(relative, content, sourceStringContent, sourceTex
 		return [`${relative}: contains ${Array.from(found).join(", ")} but was not migrated automatically (rule: ${lt.id}). Manual migration may be needed.`];
 	});
 }
+function lineRemapper(before, after) {
+	const hunks = structuredPatch("", "", before, after, "", "", { context: 0 }).hunks;
+	const lastLine = Math.max(1, after.split("\n").length - (after.endsWith("\n") ? 1 : 0));
+	const map = (line) => {
+		let offset = 0;
+		for (const hunk of hunks) {
+			if (line < hunk.oldStart) break;
+			if (hunk.oldLines === 0) {
+				offset += hunk.newLines;
+				continue;
+			}
+			if (line < hunk.oldStart + hunk.oldLines) {
+				if (hunk.newLines === 0) return hunk.newStart;
+				return Math.min(hunk.newStart + (line - hunk.oldStart), hunk.newStart + hunk.newLines - 1);
+			}
+			offset += hunk.newLines - hunk.oldLines;
+		}
+		return line + offset;
+	};
+	return (line) => Math.min(lastLine, Math.max(1, map(line)));
+}
 function compareReviewFindings(a, b) {
 	return a.file.localeCompare(b.file) || a.line - b.line || a.message.localeCompare(b.message) || a.excerpt.localeCompare(b.excerpt);
 }
@@ -2032,6 +2134,9 @@ function compareReviewFindings(a, b) {
 * Run multiple codemods on a project directory using in-memory chaining.
 * Each file is processed through all transforms whose filePatterns match it.
 * Later transforms see earlier transforms' output — even in dry-run mode.
+* Review detection (reviewFindings and suspicious patterns) runs against each
+* codemod's own position in the transform chain, so a later codemod's rewrite
+* cannot hide an earlier codemod's findings.
 *
 * In dry-run mode, colorized diffs are printed to stderr.
 * @param codemods - Codemod packages to run (with resolved script paths)
@@ -2077,25 +2182,41 @@ async function runCodemods(codemods, targetPath, dryRun) {
 			continue;
 		}
 		let current = original;
+		const reviewTargets = [];
 		for (const lt of matchedTransforms) {
-			if (!lt.transform) continue;
-			const result = await lt.transform(current, absolute);
-			if (result != null) {
-				current = result;
-				appliedCodemodIds.add(lt.id);
+			if (lt.transform) {
+				const result = await lt.transform(current, absolute);
+				if (result != null) {
+					current = result;
+					appliedCodemodIds.add(lt.id);
+				}
 			}
+			if (lt.prompt) reviewTargets.push({
+				lt,
+				snapshot: current
+			});
 		}
 		if (current !== original) {
 			filesModified.push(absolute);
 			if (dryRun) printDiff(absolute, original, current);
 			else await fs.promises.writeFile(absolute, current, "utf-8");
 		}
-		const residualContent = contentForResidualMatching(relative, current);
-		const sourceStringContent = sourceStringContentForResidualMatching(relative, current);
+		const residualBySnapshot = /* @__PURE__ */ new Map();
+		const residualFor = (content) => {
+			let entry = residualBySnapshot.get(content);
+			if (!entry) {
+				entry = {
+					residual: contentForResidualMatching(relative, content),
+					sourceString: sourceStringContentForResidualMatching(relative, content)
+				};
+				residualBySnapshot.set(content, entry);
+			}
+			return entry;
+		};
+		const { residual: residualContent, sourceString: sourceStringContent } = residualFor(current);
 		const sourceTextContent = sourceTextContentForResidualMatching(relative, current);
 		warnings.push(...legacyPatternWarnings(relative, residualContent, sourceStringContent, sourceTextContent, matchedTransforms));
-		for (const lt of matchedTransforms) {
-			if (!lt.prompt) continue;
+		for (const { lt, snapshot } of reviewTargets) {
 			const filesForReview = () => {
 				let files = suspiciousByCodemod.get(lt.id);
 				if (!files) {
@@ -2105,7 +2226,14 @@ async function runCodemods(codemods, targetPath, dryRun) {
 				return files;
 			};
 			if (lt.reviewFindings) {
-				const findings = await lt.reviewFindings(current, absolute, relative);
+				let findings = await lt.reviewFindings(snapshot, absolute, relative);
+				if (snapshot !== current && findings.length > 0) {
+					const remap = lineRemapper(snapshot, current);
+					findings = findings.map((finding) => ({
+						...finding,
+						line: remap(finding.line)
+					}));
+				}
 				if (findings.length > 0) {
 					const files = filesForReview();
 					for (const finding of findings) files.add(finding.file);
@@ -2117,7 +2245,9 @@ async function runCodemods(codemods, targetPath, dryRun) {
 					existing.push(...findings);
 				}
 			}
-			if (lt.suspiciousPatterns.some((p) => matchResidualPattern(residualContent, p) !== null) || sourceStringContent != null && lt.sourceStringSuspiciousPatterns.some((p) => matchResidualPattern(sourceStringContent, p) !== null)) filesForReview().add(relative);
+			if (lt.suspiciousPatterns.length === 0 && lt.sourceStringSuspiciousPatterns.length === 0) continue;
+			const { residual, sourceString } = residualFor(snapshot);
+			if (lt.suspiciousPatterns.some((p) => matchResidualPattern(residual, p) !== null) || sourceString != null && lt.sourceStringSuspiciousPatterns.some((p) => matchResidualPattern(sourceString, p) !== null)) filesForReview().add(relative);
 		}
 	}
 	const llmReviews = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailor-platform/sdk-codemod",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Codemod runner for Tailor Platform SDK upgrades",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,8 @@
     "@types/picomatch": "4.0.3",
     "@types/semver": "7.8.0",
     "eslint-plugin-zod": "4.9.1",
-    "oxlint": "1.76.0",
+    "oxlint": "1.78.0",
+    "oxlint-tsgolint": "7.0.2001",
     "tsdown": "0.22.14",
     "typescript": "6.0.3",
     "vitest": "4.1.10",
@@ -42,8 +43,9 @@
   },
   "scripts": {
     "build": "tsdown",
-    "lint": "oxlint .",
-    "lint:fix": "oxlint . --fix",
+    "lint": "oxlint --type-aware .",
+    "lint:fix": "oxlint --type-aware . --fix",
+    "knip": "knip",
     "typecheck": "tsc --noEmit",
     "test": "vitest",
     "prepublish": "pnpm run build",