# Conflicts:
#	example/package.json
#	package.json
#	packages/create-sdk/package.json
#	packages/sdk-codemod/package.json
#	packages/sdk/CHANGELOG.md
#	packages/sdk/src/cli/commands/login.test.ts
#	packages/sdk/src/cli/commands/login.ts
#	packages/sdk/src/cli/commands/profile/update.ts
#	packages/sdk/src/cli/commands/user/pat/list.test.ts
#	packages/sdk/src/cli/commands/user/pat/user.ts
#	packages/sdk/src/cli/commands/user/switch.test.ts
#	packages/sdk/src/cli/commands/user/switch.ts
#	packages/sdk/src/cli/shared/context.test.ts
#	packages/sdk/src/cli/shared/context.ts
#	packages/sdk/src/cli/shared/type-generator.ts
#	packages/sdk/src/configure/services/auth/types.ts
#	packages/sdk/src/configure/services/tailordb/schema.ts
#	packages/sdk/tsdown.config.ts
#	pnpm-lock.yaml

# Conflicts:
#	packages/create-sdk/CHANGELOG.md
#	packages/create-sdk/package.json
#	packages/sdk/CHANGELOG.md
#	packages/sdk/docs/cli/application.md
#	packages/sdk/package.json
#	packages/sdk/src/cli/commands/deploy/deploy.ts
#	packages/sdk/src/cli/commands/deploy/executor.ts
#	packages/sdk/src/cli/commands/deploy/index.ts

Running `tailor <name>` for an unknown subcommand execs an external
`tailor-<name>` binary resolved from the project's node_modules/.bin
(nearest first) or PATH, forwarding all following args. Works for unknown
subcommands nested under a known command too (`tailor tailordb erd` ->
`tailor-tailordb-erd`). Builtins always take precedence, matching stops at
the first unknown segment, and a command that defines its own run is never
replaced.

Before dispatching, the CLI injects the current platform context as env so
plugins do not re-implement auth or re-resolve the active workspace:
TAILOR_PLATFORM_TOKEN, TAILOR_PLATFORM_URL, TAILOR_PLATFORM_OAUTH2_CLIENT_ID,
TAILOR_PLATFORM_WORKSPACE_ID, TAILOR_PLATFORM_USER, TAILOR_CONFIG_PATH,
TAILOR_VERSION, and TAILOR_BIN. Token, workspace, and user are best-effort so
auth-free plugins still run when not logged in.

Adds `tailor auth token` (print a valid access token, refreshing it if
expired, for plugins/scripts) and `tailor plugin list` (list discovered
plugins and where they resolve from). The root --help notes point users to
`tailor plugin list`.

Adapts CLI plugin support to v2's refactored client API (getPlatformBaseUrl/getOAuth2ClientId) and docs template format, and marks the plugin feature as beta in the CLI help, docs, and changeset.

Resolve conflicts from parallel test refactors on v2: reconcile
test.each table-driven rewrites with this branch's UUIDString/
DateString/Timestamp scalar tightening, restoring date/datetime
edge-case coverage that the v2 shrink pass had dropped.

…e-types

feat(sdk): tighten Tailor field output types

buildPluginEnv now resolves the active profile's platform URL and OAuth2 client ID (via loadPlatformClientConfig) so a plugin dispatched under a profile targeting a non-default platform receives a consistent URL/token/workspace instead of the default endpoint.

Also hardens Windows executable handling: buildSpawnTarget runs .com like a native .exe and dispatches .ps1 through PowerShell, isExecutable rejects files whose extension is not in PATHEXT (so data files are not listed as plugins), and the PATHEXT fallback includes .COM.

resolvePlugin now rejects plugin names containing path separators or NUL before joining them into a filesystem path, so a name like `../evil` cannot escape the `<cli>-` prefix and resolve an unintended executable.

Also enables the plugin test suites on Windows (cross-platform capture fixture using a `.cmd` wrapper) and adds a dedicated `Plugin tests (Windows)` CI job, since the main SDK unit suite only runs on Linux and the Windows PATHEXT/`.cmd`/`.ps1` dispatch branches were previously untested. Corrects the auth/token readonly-guard comment to note it may refresh via the OAuth server and persist tokens locally, without mutating workspace/platform state.

node:fs globSync yields backslash paths on Windows, which vitest treats as invalid include globs (backslash is an escape in the matcher), so the Plugin tests (Windows) job resolved zero files and exited 1. Normalize the classified unit-test paths to forward slashes so discovery and the vitest run <file> filter work on win32 (no-op on POSIX).

Replace the separator-sensitive positional file filter (which resolved zero files on Windows) with a dedicated "unit-plugin" vitest project that includes only the CLI plugin test. The Windows CI job selects it with --project unit-plugin, and the unit* glob still runs it on Linux; it is excluded from the general unit split so it does not run twice. Reverts the earlier forward-slash include normalization, now unnecessary.

feat(cli): plugin dispatch with shared auth (root & nested)

Register the v2/strict-scalar-strings migration guidance for the strict
UUID/date/datetime/time/decimal field string types introduced on v2. The
entry documents the new scalar shapes and is*/parse*/assert*String helpers
in the generated migration guide, and flags likely-affected files
(getDB / toISOString / mockIdp usage and old "mock-id" fixtures) for
LLM-assisted review during tailor upgrade.

Pattern-scoped review flags miss projects whose only breakage does not
mention getDB / toISOString / mockIdp (e.g. invalid id fixtures), so drop
the suspicious patterns and let the runner emit the prompt as project-wide
guidance.

feat(codemod): add v2 strict scalar strings migration entry

# Conflicts:
#	.github/workflows/changeset-check.yml
#	docs/getting-started.md
#	llm-challenge/package.json
#	package.json
#	packages/create-sdk/CHANGELOG.md
#	packages/create-sdk/package.json
#	packages/sdk-codemod/CHANGELOG.md
#	packages/sdk-codemod/package.json
#	packages/sdk/CHANGELOG.md
#	packages/sdk/package.json
#	packages/sdk/src/cli/commands/deploy/resolver.ts
#	packages/sdk/src/configure/services/tailordb/schema.ts
#	packages/sdk/src/configure/types/type.ts
#	pnpm-lock.yaml

Field and type-level hooks and validators are now compiled into a single per-type create/update script. Hooks receive a `now` (Date) shared across every field hooked in the same operation, so multiple fields can be stamped with one identical timestamp.

… preserve Create-input optionality

The platform derives GraphQL Create-input optionality from the presence of a field-level create hook, not from type_hook. Emit a passthrough create hook (`_value`) per field so required hooked fields stay optional in input; the real shared-now logic in type_hook runs afterward and overwrites the value.

…oto field

Add .default() builder method for TailorDBField with TypeLevelError
type guards. Regenerate proto bindings to use optionalOnCreate instead
of field-level hook placeholder, resolving type_hook coexistence conflict.

…y field validators

- Add type-level validate function form to .validate() accepting (args, issues) callback
- Field validators now return string (error) | void (pass) instead of [fn, message] tuple
- Type-safe field path autocomplete for issues() via DottedPaths utility type
- Full pipeline: configure -> parser -> bundler -> snapshot -> manifest
- Hook functions use newRecord/oldRecord args matching platform _input/_oldRecord variables
- Field validators receive { newValue, oldValue } only

…to single function

Replace Hooks<F> (per-field mapping) with TypeHook<F> ({ create?, update? })
where each function receives { input, oldRecord, invoker, now } and returns
partial field overrides. Also rename HookFn parameter from newRecord to input
since hooks operate on pre-record input.

- Add TypeHookFn and TypeHook types to configure/services/tailordb/types.ts
- Change .hooks() builder to store _typeHook instead of distributing to fields
- Add typeHook to Zod schema and regenerate types
- Update createTailorDBHook test helper to apply type-level hooks
- Update buildTypeScripts to accept options object with typeHookExpr
- Update example and template code to new hooks API

…eld-level hooks

…tax validators

- Simplify ValidateFn from { newValue, oldValue } to { value } only
- Remove Validators<F> record-syntax overload from type-level validate
- Block .default() on optional fields with TypeLevelError
- Migrate all examples, templates, and tests to new API

Fields with .default() now produce Generated<T> in Kysely types,
matching the optionalOnCreate behavior sent to the platform.
Update inventory-management template to reflect type-level hook
migration (totalPrice no longer has a per-field hook).

…totalPrice

…changes

…e now timestamp in test helper

…ype-level hooks

Sync FieldMetadataSchema (used by resolver/executor/workflow fields) with
DBFieldMetadataSchema: add default key and update validate to accept
Function[] only. Regenerate example migrations for hooks drift and update
zinfer-generated types.