feat!: merge the v2 release line into main

.agents/rules/schema-types.md

@@ -27,7 +27,7 @@ modules** — files named `types.ts` (or `*.types.ts` under `configure/`):
 | `parser/service/tailordb/types.ts`                                 | Parsed data structures (`TailorDBType`, `ParsedField`, permissions, ...) |
 | `parser/service/idp/types.ts`                                      | Normalized IdP permission types shared by parser and CLI                 |
 | `plugin/types.ts`                                                  | Plugin authoring types, generation hook contexts, generator config       |
-| `runtime/types.ts`                                                 | Runtime principal/env types (`TailorUser`, `TailorActor`, `TailorEnv`)   |
+| `runtime/types.ts`                                                 | Runtime principal/env types (`TailorPrincipal`, `TailorEnv`)             |
 
 Rules for pure type modules (enforced by oxlint):
 

.agents/rules/sdk-internals.md

@@ -1,5 +1,20 @@
 # SDK Internals
 
+## API Naming: `define*` vs `create*`
+
+Public functions in `src/configure/` follow a strict naming convention.
+
+| Prefix    | Meaning                                 | Output                                                                                             | Where used                                                               |
+| --------- | --------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `define*` | Declarative resource specification      | Pure data/config struct (no SDK-managed runtime methods)                                           | `tailor.config.ts` as resource entries                                   |
+| `create*` | Instantiation of a runtime-capable unit | Object with runtime-capable methods (`trigger`, `wait`, `resolve`) or user-written `body` function | Standalone files as default/named exports, or inside workflow job bodies |
+
+**`define*` examples:** `defineConfig`, `defineAuth`, `defineIdp`, `defineStaticWebSite`, `defineAIGateway`, `defineSecretManager`, `definePlugins`
+
+**`create*` examples:** `createResolver`, `createExecutor`, `createWorkflow`, `createWorkflowJob`, `createWaitPoint`, `createWaitPoints`, `createHttpAdapter`
+
+Decision rule: if the result has a method that calls the platform at runtime (`.trigger()`, `.wait()`, `.resolve()`, etc.) or carries a user-written `body` function, use `create*`. If the result is purely a typed config object that tooling/deployer reads, use `define*`.
+
 ## Module Architecture and Import Rules
 
 The SDK enforces strict module boundaries to maintain a clean architecture:

.agents/skills/e2e-test/AUTH.md

@@ -8,12 +8,12 @@ Official reference: [Tailor SDK user and login commands](https://docs.tailor.tec
 ## Authentication Order
 
 1. If a trusted caller supplied `TAILOR_PLATFORM_TOKEN`, use it without printing or persisting it.
-2. Otherwise run `pnpm exec tailor-sdk workspace list`. A config-backed user access token refreshes
+2. Otherwise run `pnpm exec tailor workspace list`. A config-backed user access token refreshes
    automatically while its refresh token remains valid.
 3. If the command reports `Failed to refresh token. Your session may have expired.`, do not assume
    expiry is the only cause; revocation, service errors, and network failures can produce the same
    message. Report the raw error.
-4. When login recovery is required, ask the user to run `pnpm exec tailor-sdk login`. Browser login
+4. When login recovery is required, ask the user to run `pnpm exec tailor login`. Browser login
    is a user-only action, then the agent can retry the original verification command.
 
 Never read, copy, print, persist, or edit the refresh token. An environment access token has no

.agents/skills/e2e-test/SUITES.md

@@ -12,7 +12,7 @@ Confirm the saved workspace still hosts `my-app`:
 ```sh
 /bin/bash .agents/skills/e2e-test/scripts/with-e2e-ids.sh \
   .agents/skills/e2e-test/ids.local.env -- \
-  pnpm exec tailor-sdk workspace app list
+  pnpm exec tailor workspace app list
 ```
 
 Treat a reused workspace as shared until its users and ownership are known. List its Platform users
@@ -21,25 +21,25 @@ before any redeploy:
 ```sh
 /bin/bash .agents/skills/e2e-test/scripts/with-e2e-ids.sh \
   .agents/skills/e2e-test/ids.local.env -- \
-  pnpm exec tailor-sdk workspace user list
+  pnpm exec tailor workspace user list
 ```
 
 If another person or automation may rely on it, ask the user before changing it. With a valid
 profile, run both checks with the same `TAILOR_PLATFORM_PROFILE` instead of the ID loader.
 
 If the workspace is missing or no longer hosts the application:
 
-1. Verify login with `pnpm exec tailor-sdk workspace list`.
+1. Verify login with `pnpm exec tailor workspace list`.
 2. Resolve existing organization and folder IDs only when they are not saved:
    ```sh
-   pnpm exec tailor-sdk organization list
-   pnpm exec tailor-sdk organization folder list --organization-id <organization-id>
+   pnpm exec tailor organization list
+   pnpm exec tailor organization folder list --organization-id <organization-id>
    ```
 3. Ask before creating a long-lived workspace. Use `example-e2e` unless it collides.
 4. Save its ID to `ids.local.env`, set mode `0600`, deploy, and confirm `my-app`:
    ```sh
    TAILOR_PLATFORM_WORKSPACE_ID=<workspace-id> pnpm --filter example run deploy
-   pnpm exec tailor-sdk workspace app list --workspace-id <workspace-id>
+   pnpm exec tailor workspace app list --workspace-id <workspace-id>
    ```
 
 Use `run deploy`; pnpm's built-in `deploy` shadows the package script when `run` is omitted.
@@ -70,8 +70,8 @@ This suite creates disposable workspaces and uses `TAILOR_PLATFORM_ORGANIZATION_
 If either ID is missing, discover an existing value and save it to `ids.local.env` with mode `0600`:
 
 ```sh
-pnpm exec tailor-sdk organization list
-pnpm exec tailor-sdk organization folder list --organization-id <organization-id>
+pnpm exec tailor organization list
+pnpm exec tailor organization folder list --organization-id <organization-id>
 ```
 
 Run through the wrapper so every workspace created for the run receives one namespace and cleanup is

.agents/skills/e2e-test/scripts/run-sdk-e2e.sh

@@ -62,7 +62,7 @@ fi
 test_pid=""
 trap - HUP INT TERM
 
-"$cleanup_node" "$workspace_cleanup" "$run_id" -- pnpm exec tailor-sdk
+"$cleanup_node" "$workspace_cleanup" "$run_id" -- pnpm exec tailor
 cleanup_status=$?
 
 echo "E2E test status: $test_status; cleanup status: $cleanup_status" >&2

.agents/skills/e2e-test/test/fixtures/bin/pnpm

@@ -22,7 +22,7 @@ if [[ ${1:-} == "run" && ${2:-} == "test:e2e" ]]; then
   exit "${E2E_TEST_STATUS:-0}"
 fi
 
-if [[ ${1:-} == "exec" && ${2:-} == "tailor-sdk" ]]; then
+if [[ ${1:-} == "exec" && ${2:-} == "tailor" ]]; then
   shift 2
   exec "$E2E_FAKE_NODE" "$E2E_FAKE_CLI" "$@"
 fi

.agents/skills/e2e-test/test/skill.test.sh

@@ -8,7 +8,7 @@ cleanup_helper="$skill_dir/scripts/cleanup-e2e-workspaces.mjs"
 ids_helper="$skill_dir/scripts/with-e2e-ids.sh"
 runner="$skill_dir/scripts/run-sdk-e2e.sh"
 fixtures="$skill_dir/test/fixtures"
-fake_cli="$fixtures/fake-tailor-sdk.mjs"
+fake_cli="$fixtures/fake-tailor.mjs"
 fake_pnpm_source="$fixtures/bin/pnpm"
 
 fail() {

.agents/skills/llm-challenge/CREATING_PROBLEMS.md

@@ -18,7 +18,7 @@ Rules:
 - `verify.json`, when present, contains visible minimum-correctness checks only. Checks should encode conditions where missing evidence is definitely wrong, similar to type checking; do not put ideal implementations, hidden answers, scores, or broad quality judgments there.
 - Write `prompt.md` in English.
 - For `sdk-api`, do not include SDK API names, imports, code examples, or direct solution hints.
-- For `cli`, the prompt may name the `tailor-sdk` binary, but must not name the target subcommand or exact arguments.
+- For `cli`, the prompt may name the `tailor` binary, but must not name the target subcommand or exact arguments.
 - Keep `scaffold/` minimal and runnable enough for the task. Do not add `solution/`, evaluator tests, scoring metadata, or hidden hints.
 
 Validate discovery and focused behavior with narrow tests or a targeted dry run when practical.

.agents/skills/tailor

@@ -0,0 +1 @@
+../../packages/sdk/agent-skills/tailor

.changeset/add-erd-plugin-package.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-plugin-tailordb-erd": minor
+---
+
+New Tailor CLI plugin providing the `tailor tailordb erd` commands (export, diff, serve, deploy), extracted from `@tailor-platform/sdk`.

.changeset/apply-deploy-source-strings.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Rewrite `tailor-sdk apply` to `tailor-sdk deploy` in source files that contain embedded CLI command strings.

.changeset/auth-attributes-rename.md

@@ -0,0 +1,7 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/create-sdk": patch
+"@tailor-platform/sdk-codemod": patch
+---
+
+Rename auth attribute module augmentation from `AttributeMap` to `Attributes`.

.changeset/cli-plugin-schema-api.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": minor
+---
+
+Add `loadTailorDBNamespaces`, `deployStaticWebsite`, `assertWritable`, and `isPluginGeneratedType` (with their related types) to `@tailor-platform/sdk/cli`, so CLI plugins and scripts can load local TailorDB schema data and deploy static websites through the public API.

.changeset/cli-plugins.md

@@ -0,0 +1,10 @@
+---
+"@tailor-platform/sdk": minor
+---
+
+Add CLI plugin support (beta). Running `tailor <name>` for an unknown subcommand now executes an external `tailor-<name>` executable found on your PATH or in `node_modules/.bin` (project-local takes precedence), forwarding all following arguments. This also works for unknown subcommands nested under a known command — e.g. `tailor tailordb erd` dispatches to `tailor-tailordb-erd`. Builtins always take precedence, matching stops at the first unknown segment, and a command that takes its own arguments is never replaced by a plugin. The plugin receives the current Tailor Platform context via environment variables (`TAILOR_PLATFORM_TOKEN`, `TAILOR_PLATFORM_URL`, `TAILOR_PLATFORM_OAUTH2_CLIENT_ID`, `TAILOR_PLATFORM_WORKSPACE_ID`, `TAILOR_PLATFORM_USER`, `TAILOR_CONFIG_PATH`, `TAILOR_VERSION`, `TAILOR_BIN`); token, workspace, and user are best-effort, so auth-free plugins still run when you are not logged in. When the forwarded arguments include an explicit `--profile`/`-p`, the injected context is resolved for that profile; when they include `--env-file`/`-e`/`--env-file-if-exists`, platform context injection is skipped so the env file's values take effect in the plugin.
+
+Also adds:
+
+- `tailor auth token` — print a valid access token (refreshing it if expired) for use by plugins and scripts.
+- `tailor plugin list` — list discovered plugins and their executable paths.

.changeset/codemod-llm-review.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Add LLM-assisted review support to the codemod runner. A codemod can declare `suspiciousPatterns` plus a `prompt`; after running, files whose post-transform content still matches a suspicious pattern are reported as `llmReviews` (in the JSON output and on stderr) together with the codemod's migration prompt. This surfaces the cases a deterministic transform cannot safely complete (e.g. a value reached through a variable) so they can be finished with an LLM. The `auth.invoker(...)` codemod adopts this for its non-literal-argument cases.

.changeset/codemod-migration-docs.md

@@ -0,0 +1,10 @@
+---
+"@tailor-platform/sdk-codemod": patch
+"@tailor-platform/sdk": patch
+---
+
+Generate the v2 migration guide (`packages/sdk/docs/migration/v2.md`) from the codemod registry, which is the single source of truth. Each entry renders its name, automation level (Automatic / Partially automatic / Manual), description, optional before/after `examples`, and — for changes the codemods cannot fully migrate on their own — the LLM/manual migration prompt. Run `pnpm codemod:docs:update` to regenerate and `pnpm codemod:docs:check` (wired into `pnpm check`) to verify it is in sync.
+
+`scriptPath` is now optional, so the registry can also describe codemod-less ("manual") migrations that ship only guidance (`examples` / `prompt` / `suspiciousPatterns`) with no automatic transform. A manual entry with a `prompt` but no scoping pattern is surfaced as a project-wide `llmReviews` entry at runtime.
+
+Add a `sdk-codemod list` command that prints every registered rule (id, name, kind, version range).

.changeset/codemod-residual-matching.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Reduce false-positive v2 codemod warnings and LLM-review prompts from source comments, string literals, and identifier substring matches.

.changeset/codemod-runner-metadata.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Report the codemod runner identity in the JSON summary, including the source checkout commit and local build command when run from a branch build, so prerelease migration validation can distinguish exact npm packages from branch-head behavior.

.changeset/db-table-builder.md

@@ -0,0 +1,18 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/create-sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+Rename the TailorDB schema builder from `db.type()` to `db.table()`.
+
+Update TailorDB definitions:
+
+```diff
+ import { db } from "@tailor-platform/sdk";
+
+-export const user = db.type("User", {
++export const user = db.table("User", {
+   name: db.string(),
+ });
+```

.changeset/execute-script-json-arg.md

@@ -0,0 +1,8 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+`executeScript` now takes its `arg` as a JSON-serializable value instead of a pre-serialized JSON string. Pass the value directly (e.g. `arg: { a: 1 }`) instead of `arg: JSON.stringify({ a: 1 })`.
+
+Add the `v2/execute-script-arg` codemod, which unwraps `JSON.stringify(...)` passed as the `executeScript` `arg` option. Indirect forms (a stringified value held in a variable, etc.) cannot be rewritten automatically and are surfaced as an LLM-assisted review task with a migration prompt.

.changeset/execute-script-review-scope.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Reduce noisy `executeScript` LLM-review prompts by flagging files only when unresolved `arg` stringification remains likely.

.changeset/extract-erd-plugin.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Remove the built-in `tailordb erd` commands. They are now provided by the `@tailor-platform/sdk-plugin-tailordb-erd` CLI plugin: install it with `npm install -D @tailor-platform/sdk-plugin-tailordb-erd` and keep running `tailor tailordb erd <command>` as before — the CLI dispatches to the plugin automatically and suggests the install command when the plugin is missing. The `erdSite` TailorDB setting is unchanged.

.changeset/field-parse-runtime-layer.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix `tailor function test-run` crashing with `TypeError: Cannot convert undefined or null to object` when `--arg` is a non-object JSON value such as `null`. The argument is now forwarded to the server, which reports the validation error. Local input validation also runs the same logic as deployed resolvers.

.changeset/fix-mockfile-open-download-stream.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Remove the `openDownloadStream` method from `mockFile()` (`@tailor-platform/sdk/vitest`), matching the runtime file API, which no longer exposes it. Use `downloadStream` instead.

.changeset/fix-next5-codemod-boundaries.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Fix `tailor upgrade` reporting zero codemods across several v2 prerelease boundaries. `v2/db-type-to-table` and `v2/runtime-subpath-namespace` now trigger at `2.0.0-next.4` (where they actually shipped) instead of `2.0.0-next.3`, and `v2/forward-relation-name`, `v2/tailordb-validate-simplify`, and `v2/tailordb-hook-redesign` now trigger at `2.0.0-next.5` instead of `2.0.0-next.4`.

.changeset/fix-optional-attributes-permission-keys.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix IdP and TailorDB permission condition types breaking when `Attributes` fields are optional. Since machine user attribute keys started mirroring the source field's optionality, the `user` operand key helpers leaked `undefined` into their key unions — failing typecheck against the generated permission types even for `_loggedIn`-only conditions — and rejected attribute keys derived from optional fields. Optional attribute fields are now valid operand keys and `undefined` no longer appears in the unions.

.changeset/fix-rename-bin-source-files.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Apply the v2 `rename-bin` codemod to SDK CLI command strings in TypeScript and JavaScript source files.

.changeset/fix-ts-hook-dotted-basename.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix `tailor` CLI failing with `ERR_MODULE_NOT_FOUND` when resolving extensionless relative imports of files whose basename contains a dot (e.g. `./permissions.generated`).

.changeset/fix-ts-hook-paths-without-baseurl.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix `tailor` CLI failing with `ERR_MODULE_NOT_FOUND` when resolving `tsconfig.json` path aliases (`compilerOptions.paths`) in projects that omit `baseUrl`, which is the standard style since TypeScript 5.0. Also fix path alias resolution to match TypeScript's `extends` behavior: a child config's `baseUrl` is now correctly inherited from an extended config, and a child config's own `paths` now replaces (rather than merges with) inherited `paths`.

.changeset/fix-v2-prerelease-codemods.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Run v2 codemods when the target version is a v2 prerelease.

.changeset/fix-validate-issues-generic-field.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix a spurious `TS2719` type error when a `db.table()` type built with custom fields is passed across module boundaries (e.g. into another package's factory function) and its `.validate()` callback's `issues()` field parameter is compared for assignability. The `issues()` field argument type no longer uses a self-generic parameter, so structurally-equal `TailorDBType` instances derived through different generic instantiation paths are recognized as compatible.

.changeset/forward-relation-name.md

@@ -0,0 +1,8 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+Derive default TailorDB forward relation names from the relation field name by removing a trailing `ID`, `Id`, or `id`, instead of deriving them from the target table name.
+
+The v2 migration review identifies non-self relations without `toward.as`. Add an explicit name to preserve the v1 GraphQL field name, or update consumers to use the new field-based name.

.changeset/generate-watch-codemod.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Flag `tailor generate --watch` / `-W` invocations and programmatic `generate({ watch })` usage for manual review as part of the v2 migration (the flag and its dependency watcher are removed in `@tailor-platform/sdk` v2).

.changeset/invoker-option-rename.md

@@ -0,0 +1,9 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+"@tailor-platform/create-sdk": patch
+---
+
+Rename resolver, executor, workflow trigger, and typed workflow start machine-user options from `authInvoker` to `invoker`.
+
+Update create-sdk templates and the v2 auth invoker codemod to generate the new `invoker` option.

.changeset/keyring-default-storage.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Store CLI login tokens in the OS keyring by default when available. If the keyring is unavailable, tokens are stored in the platform config file.

.changeset/kysely-date-timestamp.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Fix generated Kysely types for `db.date()` fields to use `Timestamp` instead of `string`, matching `db.datetime()` and allowing `insertInto`/`updateTable` calls to accept a `Date` value.

.changeset/open-download-review-scope.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk-codemod": patch
+---
+
+Limit the `openDownloadStream` migration review prompt to files that reference deprecated download stream APIs.

.changeset/parser-schema-strict.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": major
+---
+
+Reject unknown keys in SDK parser schemas instead of silently dropping them from application definitions.

.changeset/politty-skill-command-cleanup.md

@@ -0,0 +1,5 @@
+---
+"@tailor-platform/sdk": patch
+---
+
+Upgrade politty to 0.11.2 and simplify the `skills` command wiring to use its new `globalArgs`/`commandMap`/`unknownKeys` customization options instead of hand-rolled schema rewriting.

.changeset/politty-skill-management.md

@@ -0,0 +1,6 @@
+---
+"@tailor-platform/sdk": major
+"@tailor-platform/sdk-codemod": patch
+---
+
+Replace `tailor skills install` with project-local `tailor skills add`, `list`, `remove`, and `sync` commands for bundled Tailor SDK agent skills.