@tailor-platform/sdk 2.0.0-next.1 → 2.0.0-next.3

package/docs/services/resolver.md

@@ -208,7 +208,7 @@ Validation functions receive:
 
 - `value` - The field value being validated
 - `data` - The entire input object
-- `user` - The user performing the operation
+- `invoker` - The principal performing the operation
 
 You can specify validation as:
 
@@ -234,8 +234,8 @@ Validation runs automatically before the `body` function executes. When validati
 Define actual resolver logic in the `body` function. Function arguments include:
 
 - `input` - Input data from GraphQL request
-- `user` - The user who called this resolver; unaffected by `authInvoker`
-- `invoker` - The principal running this function; equals `user` by default, or the machine user set by `authInvoker`. `null` for anonymous calls.
+- `caller` - The user or machine user who called this resolver; unaffected by `invoker`. `null` for anonymous calls.
+- `invoker` - The principal running this function; equals `caller` by default, or the machine user configured through the resolver `invoker` option. `null` for anonymous calls.
 - `env` - Environment variables declared in `tailor.config.ts`
 
 ### Using Kysely for Database Access
@@ -306,7 +306,7 @@ createResolver({
 
 - When `publishEvents: true`, resolver execution events are published
 - When not specified, it is **automatically set to `true`** if an executor uses this resolver with `resolverExecutedTrigger`
-- When explicitly set to `false` while an executor uses this resolver, an error is thrown during `tailor-sdk deploy`
+- When explicitly set to `false` while an executor uses this resolver, an error is thrown during `tailor deploy`
 
 **Use cases:**
 
@@ -352,7 +352,7 @@ createResolver({
 
 ## Authentication
 
-Specify an `authInvoker` to execute the resolver with machine user credentials. Pass the machine user name as a plain string — it is type-narrowed to the names you defined in your auth config:
+Specify an `invoker` to execute the resolver with machine user credentials. Pass the machine user name as a plain string — it is type-narrowed to the names you defined in your auth config:
 
 ```typescript
 import { createResolver, t } from "@tailor-platform/sdk";
@@ -365,10 +365,10 @@ export default createResolver({
     // Executes as "batch-processor" machine user
     return { result: "ok" };
   },
-  authInvoker: "batch-processor",
+  invoker: "batch-processor",
 });
 ```
 
 The machine user name is looked up in the auth service configured on your app (`machineUsers` in `defineAuth`). The namespace is resolved automatically — no need to import `auth` from `tailor.config.ts` in resolver files.
 
-**Note:** `authInvoker` controls the permissions for database operations and other platform actions. The `user` object passed to `body` still reflects the original caller, while `invoker` reflects the principal actually running the body.
+**Note:** The `invoker` option controls the permissions for database operations and other platform actions. The `caller` object passed to `body` still reflects the original caller, while the `invoker` body field reflects the principal actually running the body.

package/docs/services/secret.md

@@ -34,11 +34,11 @@ Secrets are key-value pairs stored within a vault. Secret values are encrypted a
 
 ## Managing Secrets
 
-There are two ways to manage secrets: declaratively via `defineSecretManager()` in `tailor.config.ts`, or imperatively via the [CLI](#cli-management). Management is scoped per vault — **do not mix both approaches for the same vault**. When a vault is defined in config, the config becomes the source of truth: any secrets in that vault not present in the config will be deleted on `tailor-sdk deploy`.
+There are two ways to manage secrets: declaratively via `defineSecretManager()` in `tailor.config.ts`, or imperatively via the [CLI](#cli-management). Management is scoped per vault — **do not mix both approaches for the same vault**. When a vault is defined in config, the config becomes the source of truth: any secrets in that vault not present in the config will be deleted on `tailor deploy`.
 
 ### Declarative Configuration
 
-Define your secrets in `tailor.config.ts` using `defineSecretManager()`. Each key is a vault name, and its value is a record of secret names to their values. These values are deployed to each vault on `tailor-sdk deploy`.
+Define your secrets in `tailor.config.ts` using `defineSecretManager()`. Each key is a vault name, and its value is a record of secret names to their values. These values are deployed to each vault on `tailor deploy`.
 
 Since secret values should not be committed to source control, use environment variables:
 
@@ -87,7 +87,7 @@ When `ignoreNullishValues: true`:
 - Skipped secrets are shown in the deploy output for visibility
 - Secrets removed from the config entirely are still deleted (orphan cleanup)
 
-This allows you to set secret values once (e.g., via local `tailor-sdk deploy` or the CLI) and then deploy from CI without needing the actual values in CI environment variables.
+This allows you to set secret values once (e.g., via local `tailor deploy` or the CLI) and then deploy from CI without needing the actual values in CI environment variables.
 
 ## Using Secrets
 
@@ -175,25 +175,25 @@ At runtime, these references are replaced with the actual secret values.
 
 Use the CLI to manage vaults that are **not** defined in `defineSecretManager()`. If you attempt to modify a vault that is managed by the config, the CLI will show a warning and ask for confirmation. Once confirmed, the CLI releases the vault's ownership label so it is no longer managed by config.
 
-After ownership is released, the next `tailor-sdk deploy` will treat the vault as an unmanaged resource and prompt for confirmation before taking any action on it.
+After ownership is released, the next `tailor deploy` will treat the vault as an unmanaged resource and prompt for confirmation before taking any action on it.
 
 ### Create a Vault
 
 ```bash
-tailor-sdk secret vault create --name api-keys
+tailor secret vault create --name api-keys
 ```
 
 ### Add Secrets
 
 ```bash
 # Create a secret
-tailor-sdk secret create \
+tailor secret create \
   --vault-name api-keys \
   --name stripe-secret-key \
   --value sk_live_xxxxx
 
 # Update a secret
-tailor-sdk secret update \
+tailor secret update \
   --vault-name api-keys \
   --name stripe-secret-key \
   --value sk_live_yyyyy
@@ -203,20 +203,20 @@ tailor-sdk secret update \
 
 ```bash
 # List vaults
-tailor-sdk secret vault list
+tailor secret vault list
 
 # List secrets in a vault (values are hidden)
-tailor-sdk secret list --vault-name api-keys
+tailor secret list --vault-name api-keys
 ```
 
 ### Delete Secrets
 
 ```bash
 # Delete a secret
-tailor-sdk secret delete --vault-name api-keys --name old-key --yes
+tailor secret delete --vault-name api-keys --name old-key --yes
 
 # Delete a vault (must be empty)
-tailor-sdk secret vault delete --name old-vault --yes
+tailor secret vault delete --name old-vault --yes
 ```
 
 See [Secret CLI Commands](../cli/secret.md) for full documentation.

package/docs/services/staticwebsite.md

@@ -72,7 +72,7 @@ defineStaticWebSite("my-website", {
 });
 ```
 
-After deploying, use `tailor-sdk staticwebsite domain get <domain>` to check domain status and retrieve the CNAME targets required for DNS configuration.
+After deploying, use `tailor staticwebsite domain get <domain>` to check domain status and retrieve the CNAME targets required for DNS configuration.
 
 A domain can be associated with only one workspace at a time. To set custom domains only in the workspace that owns the domain, see [Multi-Environment Configuration](../multi-environment.md#settings-that-belong-to-a-single-environment).
 
@@ -124,8 +124,14 @@ const website = defineStaticWebSite("my-frontend", {
 });
 
 const idp = defineIdp("my-idp", {
-  authorization: "loggedIn",
   clients: ["default-client"],
+  permission: {
+    create: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+    read: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+    update: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+    delete: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+    sendPasswordResetEmail: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }],
+  },
 });
 
 const auth = defineAuth("my-auth", {

package/docs/services/tailordb-migration.md

@@ -12,7 +12,7 @@ For the CLI command reference, see [`tailordb migration`](../cli/tailordb.md#tai
 
 - **Local snapshot–based diff detection** — each migration is generated by diffing your current type definitions against the previous snapshot stored in `migrations/<NNNN>/`.
 - **Transaction-wrapped data migrations** — each `migrate.ts` script runs inside a database transaction on the platform; if the script throws, all changes in that migration roll back.
-- **Automatic execution during `apply`** — `tailor-sdk deploy` detects pending migrations, runs the two-stage type update (pre-migration → script → post-migration), and updates the migration checkpoint label.
+- **Automatic execution during `apply`** — `tailor deploy` detects pending migrations, runs the two-stage type update (pre-migration → script → post-migration), and updates the migration checkpoint label.
 - **Type-safe scripts** — the generated `db.ts` provides Kysely types that reflect the schema state **before** the migration runs, so transformations are written against the actual data shape.
 
 **Files in `migrations/`**
@@ -42,24 +42,24 @@ When you start with no `migrations/` directory:
 2. Define your initial types in `tailordb/`.
 3. Generate the initial migration:
    ```bash
-   tailor-sdk tailordb migration generate
+   tailor tailordb migration generate
    ```
    This creates `migrations/0000/schema.json` from your current types.
-4. Run `tailor-sdk deploy`. The migration label is set to `0000` on the deployed namespace.
+4. Run `tailor deploy`. The migration label is set to `0000` on the deployed namespace.
 
 ### Adding migrations to an existing project
 
 If you already have a deployed workspace whose schema matches your local type definitions:
 
 1. Add the `migration` block to `tailor.config.ts`.
-2. Run `tailor-sdk tailordb migration generate` to create `0000/schema.json` from current local types.
-3. Run `tailor-sdk deploy`. Because remote schema already matches, no script runs; only the migration label is set.
+2. Run `tailor tailordb migration generate` to create `0000/schema.json` from current local types.
+3. Run `tailor deploy`. Because remote schema already matches, no script runs; only the migration label is set.
 
 If your local types and remote schema have **diverged**, reconcile them before introducing migrations — either update local types to match remote, or accept that the first non-`0000` migration will reflect that gap.
 
 ### Resetting
 
-`tailor-sdk tailordb migration generate --init` deletes the existing `migrations/` directory and starts over from `0000`. Use this only on projects that are not yet deployed, or when you have decided to re-baseline (the next `apply` will see all migrations as new and require coordination — see [Resetting a deployed project](#resetting-a-deployed-project)).
+`tailor tailordb migration generate --init` deletes the existing `migrations/` directory and starts over from `0000`. Use this only on projects that are not yet deployed, or when you have decided to re-baseline (the next `apply` will see all migrations as new and require coordination — see [Resetting a deployed project](#resetting-a-deployed-project)).
 
 ## Migration Workflow
 
@@ -79,7 +79,7 @@ A typical change cycle:
 2. **Generate the migration.**
 
    ```bash
-   tailor-sdk tailordb migration generate --name "add email to user"
+   tailor tailordb migration generate --name "add email to user"
    ```
 
    Output:
@@ -109,7 +109,7 @@ A typical change cycle:
 
 4. **Apply.**
    ```bash
-   tailor-sdk deploy
+   tailor deploy
    ```
    The pre-migration phase relaxes the new field to optional, the script runs and populates values, then the post-migration phase enforces `required: true`.
 
@@ -126,10 +126,10 @@ Warning: data loss possible:
 No `migrate.ts` is generated automatically because the schema change itself is non-breaking, but the existing data is dropped during the post-migration phase. If you need to preserve or transform that data first (for example, copy a column into another table before it disappears), add a script with:
 
 ```bash
-tailor-sdk tailordb migration script 0002
+tailor tailordb migration script 0002
 ```
 
-This writes `migrations/0002/migrate.ts` and `migrations/0002/db.ts` next to the existing `diff.json`. The removed field stays readable inside `migrate.ts` because the pre-migration phase keeps it on the type until the script finishes (see [Per-migration phases](#per-migration-phases)). The next `tailor-sdk deploy` runs the script automatically — `migrate.ts` is executed whenever the file exists on disk, regardless of whether the diff itself required it.
+This writes `migrations/0002/migrate.ts` and `migrations/0002/db.ts` next to the existing `diff.json`. The removed field stays readable inside `migrate.ts` because the pre-migration phase keeps it on the type until the script finishes (see [Per-migration phases](#per-migration-phases)). The next `tailor deploy` runs the script automatically — `migrate.ts` is executed whenever the file exists on disk, regardless of whether the diff itself required it.
 
 ## Configuration
 
@@ -245,7 +245,7 @@ The same pattern works for switching between scalar and array.
 
 ## Automatic Migration Execution
 
-When you run `tailor-sdk deploy`, the SDK detects pending migrations (anything past the current `sdk-migration` label on the deployed namespace) and runs them in order before continuing with the rest of the apply.
+When you run `tailor deploy`, the SDK detects pending migrations (anything past the current `sdk-migration` label on the deployed namespace) and runs them in order before continuing with the rest of the apply.
 
 ### Per-migration phases
 
@@ -275,10 +275,12 @@ Namespace: tailordb
     - Field 'email': required: remote=false, expected=true
 ```
 
+The error also points you at `migration status`, `migration generate`, `migration sync`, and `migration set` — see [Remote schema drift detected](#remote-schema-drift-detected) for which one applies.
+
 To bypass both checks (not recommended outside of recovery scenarios):
 
 ```bash
-tailor-sdk deploy --no-schema-check
+tailor deploy --no-schema-check
 ```
 
 ### Example output
@@ -297,7 +299,7 @@ tailor-sdk deploy --no-schema-check
 
 ## `migration set` Semantics
 
-`tailor-sdk tailordb migration set <N>` updates the `sdk-migration` label on the deployed namespace's metadata. **It does not modify any data or schema.** It only changes which migrations the next `apply` will consider pending.
+`tailor tailordb migration set <N>` updates the `sdk-migration` label on the deployed namespace's metadata. **It does not modify any data or schema.** It only changes which migrations the next `apply` will consider pending.
 
 | Movement                         | Effect on next `apply`                                                    | Effect on data                                                |
 | -------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------- |
@@ -314,7 +316,7 @@ Use cases:
 
 ## `migration sync` Semantics
 
-`tailor-sdk tailordb migration sync <N>` reconstructs the schema snapshot at migration `N` from the working tree's migration history and **overwrites the remote schema to match it**, then sets the `sdk-migration` label to `N`. Unlike `migration set`, it changes the remote schema as well as the bookkeeping. Like `set`, it never runs `migrate.ts` scripts itself — it only changes what the next `apply` considers pending:
+`tailor tailordb migration sync <N>` reconstructs the schema snapshot at migration `N` from the working tree's migration history and **overwrites the remote schema to match it**, then sets the `sdk-migration` label to `N`. Unlike `migration set`, it changes the remote schema as well as the bookkeeping. Like `set`, it never runs `migrate.ts` scripts itself — it only changes what the next `apply` considers pending:
 
 | Movement                         | Effect on next `apply`                                                                    | Effect on data                                                                                             |
 | -------------------------------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
@@ -325,7 +327,7 @@ Before anything is sent to the remote, `sync` verifies that replaying the full m
 
 Because syncing backward causes already-applied scripts to re-execute on the next deploy, **write `migrate.ts` scripts to be idempotent** (see [Performance and Large Tables](#performance-and-large-tables) for resumable `where` clauses).
 
-The main use case is recovering from drift after a `deploy --no-schema-check` from an older revision: instead of checking out that revision, run `migration sync <N>` to restore the remote to a known snapshot, then `tailor-sdk deploy` to apply the remaining migrations from the working tree.
+The main use case is recovering from drift after a `deploy --no-schema-check` from an older revision: instead of checking out that revision, run `migration sync <N>` to restore the remote to a known snapshot, then `tailor deploy` to apply the remaining migrations from the working tree.
 
 ## Team Workflow and CI/CD
 
@@ -340,7 +342,7 @@ Migration numbers are assigned sequentially, so two developers branching off the
 ### CI / CD
 
 - For non-interactive environments, pass `--yes` to `migration generate` and `--yes` to `apply`. `apply` runs migrations automatically when the `migrations/` directory is configured.
-- Run `tailor-sdk tailordb migration status` in CI to detect "developer forgot to commit a migration" situations early. The exit code is non-zero only on errors, so check the output.
+- Run `tailor tailordb migration status` in CI to detect "developer forgot to commit a migration" situations early. The exit code is non-zero only on errors, so check the output.
 - Avoid running migrations in parallel against the same workspace — there is no locking. Serialize deploys per environment.
 
 ### Resetting a deployed project
@@ -348,8 +350,8 @@ Migration numbers are assigned sequentially, so two developers branching off the
 `migration generate --init` is destructive locally but does not touch the deployed workspace. Re-baselining a deployed project requires:
 
 1. Run `migration generate --init` to start over from `0000`.
-2. Run `tailor-sdk tailordb migration set 0` against the deployed namespace.
-3. Run `tailor-sdk deploy` — the new `0000` becomes the baseline.
+2. Run `tailor tailordb migration set 0` against the deployed namespace.
+3. Run `tailor deploy` — the new `0000` becomes the baseline.
 
 Coordinate this with your team because everyone else's local migrations will be invalidated.
 
@@ -367,7 +369,7 @@ After a failure:
 
 1. Read the `Logs:` block in the apply output to find the cause.
 2. Fix `migrate.ts` (or the data it depends on).
-3. Re-run `tailor-sdk deploy`. The same migration runs again because its label was never bumped, and the prior-checkpoint schema is a clean baseline to retry against.
+3. Re-run `tailor deploy`. The same migration runs again because its label was never bumped, and the prior-checkpoint schema is a clean baseline to retry against.
 
 If a migration **succeeds in script** but the **post-migration phase** fails (rare; usually a constraint violation the script should have prevented), the pre-migration changes are **not** rolled back: the script's data changes are already committed and the post-migration phase may have dropped removed columns or types, which cannot be reverted without data loss. Investigate, fix, and re-run.
 
@@ -396,7 +398,7 @@ The machine user needs read/write access to every type the migration script touc
 
 If you see `No machine user available for migration execution`, either:
 
-- Add `machineUsers: { ... }` to your auth config and `tailor-sdk deploy` it, or
+- Add `machineUsers: { ... }` to your auth config and `tailor deploy` it, or
 - Set `migration.machineUser` to an existing machine user name in the db config.
 
 ## Multi-Namespace Coordination
@@ -439,7 +441,7 @@ For genuinely different schemas across environments, prefer separate workspaces
 
 **Resolution:**
 
-1. `tailor-sdk tailordb migration status` to see local vs remote.
+1. `tailor tailordb migration status` to see local vs remote.
 2. Compare with teammates — has someone applied different migrations?
 3. If remote was changed manually, decide whether to update local migrations to match or to use `migration set <N>` to align bookkeeping.
 4. To force the remote schema back to a known snapshot, use `migration sync <N>` (see [`migration sync` Semantics](#migration-sync-semantics)).
@@ -471,7 +473,7 @@ For genuinely different schemas across environments, prefer separate workspaces
 
 **Cause:** Runtime error in your `migrate.ts`, a permission error from the machine user, or a constraint violation when post-migration tightens types.
 
-**Resolution:** Read the `Logs:` block. Fix the script or the data assumption it relies on, and re-run `tailor-sdk deploy`. The label is not bumped on failure, so the same migration retries.
+**Resolution:** Read the `Logs:` block. Fix the script or the data assumption it relies on, and re-run `tailor deploy`. The label is not bumped on failure, so the same migration retries.
 
 ### `migrate.ts` not found for a migration that needs one
 

package/docs/services/tailordb.md

@@ -254,13 +254,36 @@ type User {
 - `toward.as` - Customizes the field name for accessing the related type from this type
 - `backward` - Customizes the field name for accessing this type from the related type
 
+Relation names share the same GraphQL field namespace as fields, files, and other relations on
+the type. The SDK rejects duplicate or empty relation names. Use `toward.as` when multiple fields
+on the same type point to the same target type, because their default forward names are derived
+from the target type name:
+
+```typescript
+const post = db.type("Post", {
+  authorID: db.uuid().relation({
+    type: "n-1",
+    toward: { type: user, as: "author" },
+    backward: "authoredPosts",
+  }),
+  reviewerID: db.uuid().relation({
+    type: "n-1",
+    toward: { type: user, as: "reviewer" },
+    backward: "reviewedPosts",
+  }),
+});
+```
+
+Use `toward.as` or `backward` when a generated relation name would conflict with an existing
+field, files entry, or relation on the same type.
+
 ### Hooks
 
 Add hooks to execute functions during data creation or update. Hooks receive three arguments:
 
 - `value`: User input if provided, otherwise existing value on update or null on create
 - `data`: Entire record data (for accessing other field values)
-- `user`: User performing the operation
+- `invoker`: Principal performing the operation
 
 #### Field-level Hooks
 
@@ -268,7 +291,7 @@ Set hooks directly on individual fields:
 
 ```typescript
 db.string().hooks({
-  create: ({ user }) => user.id,
+  create: ({ invoker }) => invoker?.id ?? "",
   update: ({ value }) => value,
 });
 ```
@@ -323,7 +346,7 @@ Add validation rules to fields. Validators receive three arguments (executed aft
 
 - `value`: Field value after hook transformation
 - `data`: Entire record data after hook transformations (for accessing other field values)
-- `user`: User performing the operation
+- `invoker`: Principal performing the operation
 
 Validators return `true` for success, `false` for failure. Use array form `[validator, errorMessage]` for custom error messages.
 
@@ -409,6 +432,8 @@ export const user = db.type("User", {
 });
 ```
 
+`db.fields.timestamps()` adds non-null `createdAt` and `updatedAt` datetime fields. Both fields are populated when a record is created; provided values are preserved so seed data can use historical timestamps. `updatedAt` is also refreshed automatically when a record is updated.
+
 ## Type Modifiers
 
 ### Composite Indexes
@@ -461,7 +486,7 @@ db.type("User", {
 
 - When `publishEvents: true`, record creation/update/deletion events are published
 - When not specified, it is **automatically set to `true`** if an executor uses this type with `recordCreatedTrigger`, `recordUpdatedTrigger`, or `recordDeletedTrigger`
-- When explicitly set to `false` while an executor uses this type, an error is thrown during `tailor-sdk deploy`
+- When explicitly set to `false` while an executor uses this type, an error is thrown during `tailor deploy`
 
 **Use cases:**
 
@@ -516,8 +541,8 @@ const user = db.type("User", {
   ...db.fields.timestamps(),
 });
 
-// Pick id and createdAt, making them optional
-user.pickFields(["id", "createdAt"], { optional: true });
+// Pick id, createdAt, and updatedAt, making them optional
+user.pickFields(["id", "createdAt", "updatedAt"], { optional: true });
 ```
 
 Available options:
@@ -532,8 +557,8 @@ Available options:
 Return all fields except the specified ones:
 
 ```typescript
-// All fields except id and createdAt
-user.omitFields(["id", "createdAt"]);
+// All fields except id, createdAt, and updatedAt
+user.omitFields(["id", "createdAt", "updatedAt"]);
 ```
 
 #### Common Pattern: Input Schema Composition
@@ -548,9 +573,9 @@ export default createResolver({
   name: "createUser",
   operation: "mutation",
   input: {
-    // id/createdAt are optional (auto-generated), other fields are required
-    ...user.pickFields(["id", "createdAt"], { optional: true }),
-    ...user.omitFields(["id", "createdAt"]),
+    // id/createdAt/updatedAt are optional (auto-generated), other fields are required
+    ...user.pickFields(["id", "createdAt", "updatedAt"], { optional: true }),
+    ...user.omitFields(["id", "createdAt", "updatedAt"]),
   },
   output: t.object({ id: t.uuid() }),
   body: async (context) => {
@@ -567,8 +592,8 @@ import { t } from "@tailor-platform/sdk";
 import { invoice } from "../../tailordb/invoice";
 
 const schemaType = t.object({
-  ...invoice.pickFields(["id", "createdAt"], { optional: true }),
-  ...invoice.omitFields(["id", "createdAt", "invoiceNumber", "sequentialId"]),
+  ...invoice.pickFields(["id", "createdAt", "updatedAt"], { optional: true }),
+  ...invoice.omitFields(["id", "createdAt", "updatedAt", "invoiceNumber", "sequentialId"]),
 });
 ```
 
@@ -620,6 +645,6 @@ db.type("User", {
 
 ## Migrations
 
-When you change a TailorDB type definition, the SDK can generate a migration that captures the diff and, for breaking changes, runs a data transformation script during `tailor-sdk deploy`. See the [TailorDB Migrations guide](./tailordb-migration.md) for the full workflow, configuration, supported change types, team coordination, and troubleshooting.
+When you change a TailorDB type definition, the SDK can generate a migration that captures the diff and, for breaking changes, runs a data transformation script during `tailor deploy`. See the [TailorDB Migrations guide](./tailordb-migration.md) for the full workflow, configuration, supported change types, team coordination, and troubleshooting.
 
 For the CLI command reference, see [`tailordb migration`](../cli/tailordb.md#tailordb-migration).

package/docs/services/workflow.md

@@ -180,8 +180,8 @@ export const processOrder = createWorkflowJob({
   name: "process-order",
   body: (input: { customerId: string }, { env, invoker }) => {
     // `env` contains values from `tailor.config.ts` -> `env`.
-    // `invoker` is the principal running this job, overridden by `authInvoker`
-    // when set; `null` for anonymous calls.
+    // `invoker` is the principal running this job, or the machine user
+    // configured through the trigger `invoker` option; `null` for anonymous calls.
     // Trigger other jobs by calling .trigger() on the job object.
     const customer = fetchCustomer.trigger({
       customerId: input.customerId,
@@ -207,23 +207,23 @@ Wait points allow a workflow job to suspend execution and wait for an external s
 
 ### Defining Wait Points
 
-Use `defineWaitPoint` to declare a single typed wait point:
+Use `createWaitPoint` to create a single typed wait point:
 
 ```typescript
-import { defineWaitPoint } from "@tailor-platform/sdk";
+import { createWaitPoint } from "@tailor-platform/sdk";
 
-export const approval = defineWaitPoint<
+export const approval = createWaitPoint<
   { message: string; requestId: string },
   { approved: boolean }
 >("approval");
 ```
 
-For multiple wait points, use `defineWaitPoints` with a builder callback. Property names become wait point keys, and JSDoc on each property is preserved in IDE autocompletion:
+For multiple wait points, use `createWaitPoints` with a builder callback. Property names become wait point keys, and JSDoc on each property is preserved in IDE autocompletion:
 
 ```typescript
-import { defineWaitPoints } from "@tailor-platform/sdk";
+import { createWaitPoints } from "@tailor-platform/sdk";
 
-export const waitPoints = defineWaitPoints((define) => ({
+export const waitPoints = createWaitPoints((define) => ({
   /** Manager approval step */
   managerApproval: define<{ amount: number }, { approved: boolean }>(),
   /** Finance review step */
@@ -245,9 +245,9 @@ Both must be JsonValue-compatible (plain objects/arrays; no class instances or f
 Call `.wait()` inside a workflow job body to suspend execution:
 
 ```typescript
-import { createWorkflow, createWorkflowJob, defineWaitPoint } from "@tailor-platform/sdk";
+import { createWaitPoint, createWorkflow, createWorkflowJob } from "@tailor-platform/sdk";
 
-export const approval = defineWaitPoint<
+export const approval = createWaitPoint<
   { message: string; requestId: string },
   { approved: boolean }
 >("approval");
@@ -356,7 +356,7 @@ export default createWorkflow({
 You can start a workflow execution from a resolver using `workflow.trigger()`.
 
 - `workflow.trigger(args, options?)` returns a workflow run ID (`Promise<string>`).
-- To run with machine-user permissions, pass `{ authInvoker: "<machine-user>" }`. The name is type-narrowed to the machine users defined in your auth config.
+- To run with machine-user permissions, pass `{ invoker: "<machine-user>" }`. The name is type-narrowed to the machine users defined in your auth config.
 
 ```typescript
 import { createResolver, t } from "@tailor-platform/sdk";
@@ -372,7 +372,7 @@ export default createResolver({
   body: async ({ input }) => {
     const workflowRunId = await orderProcessingWorkflow.trigger(
       { orderId: input.orderId, customerId: input.customerId },
-      { authInvoker: "manager-machine-user" },
+      { invoker: "manager-machine-user" },
     );
 
     return { workflowRunId };
@@ -406,22 +406,22 @@ Manage workflows using the CLI:
 
 ```bash
 # List workflows
-tailor-sdk workflow list
+tailor workflow list
 
 # Get workflow details
-tailor-sdk workflow get <name>
+tailor workflow get <name>
 
 # Start a workflow
-tailor-sdk workflow start <name> -m <machine-user> -a '{"key": "value"}'
+tailor workflow start <name> -m <machine-user> -a '{"key": "value"}'
 
 # List executions
-tailor-sdk workflow executions
+tailor workflow executions
 
 # Get execution details with logs
-tailor-sdk workflow executions <execution-id> --logs
+tailor workflow executions <execution-id> --logs
 
 # Resume a failed execution
-tailor-sdk workflow resume <execution-id>
+tailor workflow resume <execution-id>
 ```
 
 See [Workflow CLI Commands](../cli/workflow.md) for full documentation.