@akinon/projectzero 2.0.20-rc.0 → 2.0.20

package/codemods/fix-login-form-action/transform.js

@@ -0,0 +1,43 @@
+/**
+ * jscodeshift transform for fix-login-form-action.
+ *
+ * Replaces every JSXAttribute named `action` whose value is the string
+ * "/api/auth/signin/credentials" with a no-op arrow function expression
+ * (`action={() => {}}`), and attaches an explanatory leading comment block.
+ *
+ * Returns null (no source change) when no matching attribute is found.
+ */
+module.exports = function transform(fileInfo, api) {
+  const j = api.jscodeshift;
+  const root = j(fileInfo.source);
+  let changed = false;
+
+  root.find(j.JSXAttribute, { name: { name: 'action' } }).forEach((p) => {
+    const v = p.node.value;
+    if (!v) return;
+
+    // String values can show up as either Literal or StringLiteral depending
+    // on the parser version. Match both.
+    const isString = v.type === 'Literal' || v.type === 'StringLiteral';
+    if (!isString || v.value !== '/api/auth/signin/credentials') return;
+
+    const arrow = j.arrowFunctionExpression([], j.blockStatement([]));
+    p.node.value = j.jsxExpressionContainer(arrow);
+
+    // Leading block comment explains why the action is a no-op. Attaching
+    // to the attribute keeps the comment adjacent in the printed output.
+    const comment = j.commentBlock(
+      ' React 19 belt-and-suspenders: passing a function to `action` makes\n' +
+        '         React itself call preventDefault on the native submit before any\n' +
+        '         listener runs, so a hydration race cannot leak credentials into\n' +
+        '         the URL bar. onSubmit still drives the actual signIn flow. ',
+      true,
+      false
+    );
+    p.node.comments = [comment];
+
+    changed = true;
+  });
+
+  return changed ? root.toSource({ quote: 'single' }) : null;
+};

package/codemods/fix-template-currenturl/index.js

@@ -0,0 +1,85 @@
+/**
+ * fix-template-currenturl
+ *
+ * Rewrites the JSON-LD canonical url construction in
+ * src/app/** /template.tsx from
+ *
+ *   const currentUrl = URL + pathname + searchParams;
+ *
+ * to
+ *
+ *   const currentUrl = `${URL}${pathname}`;
+ *
+ * Why: in the Next 16 / React 19 model `searchParams` is a
+ * ReadonlyURLSearchParams that string-coerces differently on the server
+ * and the client. The mismatched output lands inside a JSON-LD
+ * <script dangerouslySetInnerHTML> tag, breaks hydration of the entire
+ * route subtree, and races sibling client component hydration — auth
+ * forms in particular have shipped credentials into the URL as native
+ * GETs because their onSubmit listener was not yet attached when the
+ * user clicked submit.
+ *
+ * Handles both base forms observed across brands:
+ *   const currentUrl = URL + pathname + searchParams;
+ *   const currentUrl = process.env.NEXT_PUBLIC_URL + pathname + searchParams;
+ *
+ * Files outside src/app/** /template.tsx are skipped. Files that already
+ * use the template-literal form are no-ops.
+ *
+ * Usage:
+ *   node codemods/fix-template-currenturl/index.js [--dry-run]
+ *   npx @akinon/projectzero codemod --codemod=fix-template-currenturl [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs');
+const jscodeshift = require('jscodeshift/src/Runner');
+
+function log(msg) {
+  const ts = new Date().toISOString().replace('T', ' ').slice(0, 19);
+  console.log(`[${ts}] ${msg}`);
+}
+
+const transform = () => {
+  const cwd = path.resolve(process.cwd());
+  const dryRun = process.argv.includes('--dry-run');
+  const transformPath = path.join(__dirname, 'transform.js');
+  const srcPath = path.join(cwd, 'src', 'app');
+
+  if (!fs.existsSync(srcPath)) {
+    log(`fix-template-currenturl: no src/app at ${cwd}, skipping`);
+    return Promise.resolve();
+  }
+
+  log(
+    `fix-template-currenturl: scanning ${srcPath}${dryRun ? ' (dry-run)' : ''}`
+  );
+
+  return jscodeshift
+    .run(transformPath, [srcPath], {
+      verbose: 0,
+      dry: dryRun,
+      print: dryRun,
+      extensions: 'tsx',
+      parser: 'tsx',
+      ignorePattern: '**/node_modules/**',
+      silent: true
+    })
+    .then((res) => {
+      log(
+        `fix-template-currenturl: ${res.ok} ok, ${res.nochange} unchanged, ${res.skip} skipped, ${res.error} errors`
+      );
+    });
+};
+
+module.exports = { transform };
+
+if (require.main === module) {
+  const result = transform();
+  if (result && typeof result.then === 'function') {
+    result.catch((err) => {
+      console.error(err);
+      process.exit(1);
+    });
+  }
+}

package/codemods/fix-template-currenturl/transform.js

@@ -0,0 +1,91 @@
+/**
+ * jscodeshift transform for fix-template-currenturl.
+ *
+ * Matches:
+ *   const currentUrl = (URL | process.env.NEXT_PUBLIC_URL) + pathname + searchParams;
+ *
+ * Replaces the right-hand side with the template literal
+ *   `${X}${pathname}`
+ *
+ * Only runs against files whose path ends in `/app/**\/template.tsx`. Returns
+ * null (no source change) when no match is found in the file or the
+ * declarator already has a non-binary initializer.
+ */
+
+function isUrlBase(node) {
+  if (!node) return false;
+  if (node.type === 'Identifier' && node.name === 'URL') return true;
+  if (
+    node.type === 'MemberExpression' &&
+    node.object &&
+    node.object.type === 'MemberExpression' &&
+    node.object.object &&
+    node.object.object.type === 'Identifier' &&
+    node.object.object.name === 'process' &&
+    node.object.property &&
+    node.object.property.type === 'Identifier' &&
+    node.object.property.name === 'env' &&
+    node.property &&
+    node.property.type === 'Identifier' &&
+    node.property.name === 'NEXT_PUBLIC_URL'
+  ) {
+    return true;
+  }
+  return false;
+}
+
+function flattenAdd(node, out) {
+  if (
+    node &&
+    node.type === 'BinaryExpression' &&
+    node.operator === '+'
+  ) {
+    flattenAdd(node.left, out);
+    flattenAdd(node.right, out);
+  } else {
+    out.push(node);
+  }
+}
+
+module.exports = function transform(fileInfo, api) {
+  // Restrict to template.tsx under any nested app/ segment. Brand routing
+  // depth varies (e.g. [commerce]/[locale]/[currency] vs deeper member-type
+  // splits) but the file name is constant.
+  if (!/[\\/]app[\\/].*template\.tsx$/.test(fileInfo.path)) {
+    return null;
+  }
+
+  const j = api.jscodeshift;
+  const root = j(fileInfo.source);
+  let changed = false;
+
+  root
+    .find(j.VariableDeclarator, { id: { name: 'currentUrl' } })
+    .forEach((p) => {
+      const init = p.node.init;
+      if (
+        !init ||
+        init.type !== 'BinaryExpression' ||
+        init.operator !== '+'
+      ) {
+        return;
+      }
+
+      const parts = [];
+      flattenAdd(init, parts);
+      if (parts.length !== 3) return;
+
+      const [base, mid, tail] = parts;
+      if (mid.type !== 'Identifier' || mid.name !== 'pathname') return;
+      if (tail.type !== 'Identifier' || tail.name !== 'searchParams') return;
+      if (!isUrlBase(base)) return;
+
+      // Build: `${base}${pathname}`
+      const empty = () => j.templateElement({ raw: '', cooked: '' }, false);
+      const tail2 = j.templateElement({ raw: '', cooked: '' }, true);
+      p.node.init = j.templateLiteral([empty(), empty(), tail2], [base, mid]);
+      changed = true;
+    });
+
+  return changed ? root.toSource({ quote: 'single' }) : null;
+};

package/codemods/upgrade-to-2/index.js

@@ -12,8 +12,10 @@
  *   7.  Run sentry-9 codemod (only when @sentry/nextjs is present)
  *   8.  Run migrate-eslint codemod (ESLint v9 flat config)
  *   9.  Run migrate-page-types codemod (PageProps -> Async/Resolved)
- *   10. yarn build (validation)
- *   11. Summary report
+ *   10. Run fix-template-currenturl codemod (template.tsx JSON-LD url)
+ *   11. Run fix-login-form-action codemod (login form React 19 hardening)
+ *   12. yarn build (validation)
+ *   13. Summary report
  *
  * Out of scope in this first version:
  *   - Tailwind v3 -> v4 migration (run manually with @tailwindcss/upgrade)
@@ -34,6 +36,8 @@
  *     --skip-sentry         Do not run sentry-9 (auto-skipped if not needed)
  *     --skip-eslint         Do not run migrate-eslint
  *     --skip-page-types     Do not run migrate-page-types
+ *     --skip-template-url   Do not run fix-template-currenturl
+ *     --skip-login-action   Do not run fix-login-form-action
  *     --skip-install        Do not run yarn install
  *     --skip-build          Do not run yarn build
  *     --interactive         Pause for confirmation after each step
@@ -49,6 +53,8 @@ const AUTH_CODEMOD = path.resolve(__dirname, '..', 'migrate-auth-v5');
 const SENTRY_CODEMOD = path.resolve(__dirname, '..', 'sentry-9');
 const ESLINT_CODEMOD = path.resolve(__dirname, '..', 'migrate-eslint');
 const PAGE_TYPES_CODEMOD = path.resolve(__dirname, '..', 'migrate-page-types');
+const TEMPLATE_URL_CODEMOD = path.resolve(__dirname, '..', 'fix-template-currenturl');
+const LOGIN_ACTION_CODEMOD = path.resolve(__dirname, '..', 'fix-login-form-action');
 
 const TARGET_MATRIX = {
   dependencies: {
@@ -56,7 +62,11 @@ const TARGET_MATRIX = {
     react: '19.2.5',
     'react-dom': '19.2.5',
     'next-auth': '5.0.0-beta.25',
-    '@akinon/next': 'latest'
+    '@akinon/next': 'latest',
+    // 2.17.1 declared React peer as ^16-^18 and reads the old
+    // ReactSharedInternals shape, throwing on the checkout shipping address
+    // step under React 19. 2.20.8 is same-major and declares React 19.
+    '@react-google-maps/api': '2.20.8'
   },
   devDependencies: {
     '@types/react': '19.2.14',
@@ -138,6 +148,8 @@ function parseArgs(argv) {
     skipSentry: argv.includes('--skip-sentry'),
     skipEslint: argv.includes('--skip-eslint'),
     skipPageTypes: argv.includes('--skip-page-types'),
+    skipTemplateUrl: argv.includes('--skip-template-url'),
+    skipLoginAction: argv.includes('--skip-login-action'),
     skipInstall: argv.includes('--skip-install'),
     skipBuild: argv.includes('--skip-build'),
     interactive: argv.includes('--interactive'),
@@ -158,7 +170,7 @@ function writePackageJson(cwd, pkg) {
 }
 
 function stepPreflight(cwd, flags) {
-  logStep('[1/11] Preflight', 'starting');
+  logStep('[1/13] Preflight', 'starting');
 
   const pkg = readPackageJson(cwd);
   if (!pkg) {
@@ -192,19 +204,19 @@ function stepPreflight(cwd, flags) {
   log(`  Current: next@${currentNext} react@${currentReact} next-auth@${currentAuth} @akinon/next@${currentAkinon}`);
   log(`  Target:  next@${TARGET_MATRIX.dependencies.next} react@${TARGET_MATRIX.dependencies.react} next-auth@${TARGET_MATRIX.dependencies['next-auth']} @akinon/next@${TARGET_MATRIX.dependencies['@akinon/next']}`);
 
-  logStep('[1/11] Preflight', 'ok');
+  logStep('[1/13] Preflight', 'ok');
 }
 
 function stepBackup(cwd, flags) {
   if (flags.skipBackup) {
-    logStep('[2/11] Backup branch', 'skipped');
+    logStep('[2/13] Backup branch', 'skipped');
     return null;
   }
   const today = new Date().toISOString().slice(0, 10).replace(/-/g, '');
   const branchName = `pre-upgrade-2-${today}`;
 
   if (flags.dryRun) {
-    logStep('[2/11] Backup branch', `[DRY] git branch ${branchName}`);
+    logStep('[2/13] Backup branch', `[DRY] git branch ${branchName}`);
     return branchName;
   }
 
@@ -214,7 +226,7 @@ function stepBackup(cwd, flags) {
     { cwd, encoding: 'utf-8' }
   );
   if (existing.status === 0) {
-    logStep('[2/11] Backup branch', `already exists: ${branchName}`);
+    logStep('[2/13] Backup branch', `already exists: ${branchName}`);
     return branchName;
   }
 
@@ -225,7 +237,7 @@ function stepBackup(cwd, flags) {
   if (result.status !== 0) {
     throw new Error(`Failed to create backup branch ${branchName}`);
   }
-  logStep('[2/11] Backup branch', `created ${branchName}`);
+  logStep('[2/13] Backup branch', `created ${branchName}`);
   return branchName;
 }
 
@@ -323,7 +335,7 @@ function pinNextScriptsToWebpack(pkg) {
 
 function stepBump(cwd, flags) {
   if (flags.skipBump) {
-    logStep('[3/11] Bump deps', 'skipped');
+    logStep('[3/13] Bump deps', 'skipped');
     return { hasSentry: false, changes: [] };
   }
 
@@ -371,16 +383,16 @@ function stepBump(cwd, flags) {
   allChanges.push(...scriptChanges);
 
   if (allChanges.length === 0) {
-    logStep('[3/11] Bump deps', 'already at target, no changes');
+    logStep('[3/13] Bump deps', 'already at target, no changes');
     return { hasSentry, changes: [] };
   }
 
   if (flags.dryRun) {
-    logStep('[3/11] Bump deps', `[DRY] ${allChanges.length} changes`);
+    logStep('[3/13] Bump deps', `[DRY] ${allChanges.length} changes`);
     allChanges.forEach((c) => log(`  - ${c}`));
   } else {
     writePackageJson(cwd, pkg);
-    logStep('[3/11] Bump deps', `${allChanges.length} changes applied`);
+    logStep('[3/13] Bump deps', `${allChanges.length} changes applied`);
     if (flags.verbose) allChanges.forEach((c) => log(`  - ${c}`));
   }
 
@@ -389,28 +401,28 @@ function stepBump(cwd, flags) {
 
 function stepNextCodemod(cwd, flags) {
   if (flags.skipNextCodemod) {
-    logStep('[5/11] Next codemod', 'skipped');
+    logStep('[5/13] Next codemod', 'skipped');
     return { ok: true };
   }
   const cmd = flags.dryRun
     ? 'npx --yes @next/codemod@latest upgrade latest --verbose'
     : 'npx --yes @next/codemod@latest upgrade latest';
-  logStep('[5/11] Next codemod', `running ${cmd}`);
+  logStep('[5/13] Next codemod', `running ${cmd}`);
   const result = runCommand(cmd, { cwd, dryRun: false, verbose: flags.verbose });
   if (result.status !== 0) {
-    logStep('[5/11] Next codemod', `FAILED (exit ${result.status})`);
+    logStep('[5/13] Next codemod', `FAILED (exit ${result.status})`);
     return { ok: false };
   }
-  logStep('[5/11] Next codemod', 'ok');
+  logStep('[5/13] Next codemod', 'ok');
   return { ok: true };
 }
 
 function stepAuthCodemod(cwd, flags) {
   if (flags.skipAuth) {
-    logStep('[6/11] Auth codemod', 'skipped');
+    logStep('[6/13] Auth codemod', 'skipped');
     return { ok: true };
   }
-  logStep('[6/11] Auth codemod', 'running migrate-auth-v5');
+  logStep('[6/13] Auth codemod', 'running migrate-auth-v5');
   try {
     const prevArgv = process.argv;
     process.argv = [
@@ -430,21 +442,21 @@ function stepAuthCodemod(cwd, flags) {
       return result.then(
         () => {
           finish();
-          logStep('[6/11] Auth codemod', 'ok');
+          logStep('[6/13] Auth codemod', 'ok');
           return { ok: true };
         },
         (err) => {
           finish();
-          logStep('[6/11] Auth codemod', `FAILED: ${err.message}`);
+          logStep('[6/13] Auth codemod', `FAILED: ${err.message}`);
           return { ok: false };
         }
       );
     }
     finish();
-    logStep('[6/11] Auth codemod', 'ok');
+    logStep('[6/13] Auth codemod', 'ok');
     return { ok: true };
   } catch (err) {
-    logStep('[6/11] Auth codemod', `FAILED: ${err.message}`);
+    logStep('[6/13] Auth codemod', `FAILED: ${err.message}`);
     return { ok: false };
   }
 }
@@ -452,34 +464,34 @@ function stepAuthCodemod(cwd, flags) {
 function stepSentryCodemod(cwd, flags, hasSentry) {
   if (flags.skipSentry || !hasSentry) {
     const reason = flags.skipSentry ? 'skipped' : 'no @sentry/nextjs, skipping';
-    logStep('[7/11] Sentry codemod', reason);
+    logStep('[7/13] Sentry codemod', reason);
     return { ok: true };
   }
   if (flags.dryRun) {
-    logStep('[7/11] Sentry codemod', '[DRY] would run sentry-9');
+    logStep('[7/13] Sentry codemod', '[DRY] would run sentry-9');
     return { ok: true };
   }
-  logStep('[7/11] Sentry codemod', 'running sentry-9');
+  logStep('[7/13] Sentry codemod', 'running sentry-9');
   try {
     const savedCwd = process.cwd();
     process.chdir(cwd);
     const codemod = require(SENTRY_CODEMOD);
     codemod.transform();
     process.chdir(savedCwd);
-    logStep('[7/11] Sentry codemod', 'ok');
+    logStep('[7/13] Sentry codemod', 'ok');
     return { ok: true };
   } catch (err) {
-    logStep('[7/11] Sentry codemod', `FAILED: ${err.message}`);
+    logStep('[7/13] Sentry codemod', `FAILED: ${err.message}`);
     return { ok: false };
   }
 }
 
 function stepEslintCodemod(cwd, flags) {
   if (flags.skipEslint) {
-    logStep('[8/11] ESLint codemod', 'skipped');
+    logStep('[8/13] ESLint codemod', 'skipped');
     return { ok: true };
   }
-  logStep('[8/11] ESLint codemod', 'running migrate-eslint');
+  logStep('[8/13] ESLint codemod', 'running migrate-eslint');
   try {
     const prevArgv = process.argv;
     process.argv = [
@@ -493,20 +505,20 @@ function stepEslintCodemod(cwd, flags) {
     codemod.transform();
     process.chdir(savedCwd);
     process.argv = prevArgv;
-    logStep('[8/11] ESLint codemod', 'ok');
+    logStep('[8/13] ESLint codemod', 'ok');
     return { ok: true };
   } catch (err) {
-    logStep('[8/11] ESLint codemod', `FAILED: ${err.message}`);
+    logStep('[8/13] ESLint codemod', `FAILED: ${err.message}`);
     return { ok: false };
   }
 }
 
 function stepPageTypesCodemod(cwd, flags) {
   if (flags.skipPageTypes) {
-    logStep('[9/11] Page types codemod', 'skipped');
+    logStep('[9/13] Page types codemod', 'skipped');
     return { ok: true };
   }
-  logStep('[9/11] Page types codemod', 'running migrate-page-types');
+  logStep('[9/13] Page types codemod', 'running migrate-page-types');
   try {
     const prevArgv = process.argv;
     process.argv = [
@@ -526,35 +538,123 @@ function stepPageTypesCodemod(cwd, flags) {
       return result.then(
         () => {
           finish();
-          logStep('[9/11] Page types codemod', 'ok');
+          logStep('[9/13] Page types codemod', 'ok');
           return { ok: true };
         },
         (err) => {
           finish();
-          logStep('[9/11] Page types codemod', `FAILED: ${err.message}`);
+          logStep('[9/13] Page types codemod', `FAILED: ${err.message}`);
           return { ok: false };
         }
       );
     }
     finish();
-    logStep('[9/11] Page types codemod', 'ok');
+    logStep('[9/13] Page types codemod', 'ok');
     return { ok: true };
   } catch (err) {
-    logStep('[9/11] Page types codemod', `FAILED: ${err.message}`);
+    logStep('[9/13] Page types codemod', `FAILED: ${err.message}`);
+    return { ok: false };
+  }
+}
+
+function stepTemplateUrlCodemod(cwd, flags) {
+  if (flags.skipTemplateUrl) {
+    logStep('[10/13] Template currentUrl codemod', 'skipped');
+    return { ok: true };
+  }
+  logStep('[10/13] Template currentUrl codemod', 'running fix-template-currenturl');
+  try {
+    const prevArgv = process.argv;
+    process.argv = [
+      process.argv[0],
+      process.argv[1],
+      ...(flags.dryRun ? ['--dry-run'] : [])
+    ];
+    const savedCwd = process.cwd();
+    process.chdir(cwd);
+    const codemod = require(TEMPLATE_URL_CODEMOD);
+    const result = codemod.transform();
+    const finish = () => {
+      process.chdir(savedCwd);
+      process.argv = prevArgv;
+    };
+    if (result && typeof result.then === 'function') {
+      return result.then(
+        () => {
+          finish();
+          logStep('[10/13] Template currentUrl codemod', 'ok');
+          return { ok: true };
+        },
+        (err) => {
+          finish();
+          logStep('[10/13] Template currentUrl codemod', `FAILED: ${err.message}`);
+          return { ok: false };
+        }
+      );
+    }
+    finish();
+    logStep('[10/13] Template currentUrl codemod', 'ok');
+    return { ok: true };
+  } catch (err) {
+    logStep('[10/13] Template currentUrl codemod', `FAILED: ${err.message}`);
+    return { ok: false };
+  }
+}
+
+function stepLoginActionCodemod(cwd, flags) {
+  if (flags.skipLoginAction) {
+    logStep('[11/13] Login form action codemod', 'skipped');
+    return { ok: true };
+  }
+  logStep('[11/13] Login form action codemod', 'running fix-login-form-action');
+  try {
+    const prevArgv = process.argv;
+    process.argv = [
+      process.argv[0],
+      process.argv[1],
+      ...(flags.dryRun ? ['--dry-run'] : [])
+    ];
+    const savedCwd = process.cwd();
+    process.chdir(cwd);
+    const codemod = require(LOGIN_ACTION_CODEMOD);
+    const result = codemod.transform();
+    const finish = () => {
+      process.chdir(savedCwd);
+      process.argv = prevArgv;
+    };
+    if (result && typeof result.then === 'function') {
+      return result.then(
+        () => {
+          finish();
+          logStep('[11/13] Login form action codemod', 'ok');
+          return { ok: true };
+        },
+        (err) => {
+          finish();
+          logStep('[11/13] Login form action codemod', `FAILED: ${err.message}`);
+          return { ok: false };
+        }
+      );
+    }
+    finish();
+    logStep('[11/13] Login form action codemod', 'ok');
+    return { ok: true };
+  } catch (err) {
+    logStep('[11/13] Login form action codemod', `FAILED: ${err.message}`);
     return { ok: false };
   }
 }
 
 function stepInstall(cwd, flags) {
   if (flags.skipInstall) {
-    logStep('[4/11] yarn install', 'skipped');
+    logStep('[4/13] yarn install', 'skipped');
     return { ok: true };
   }
   if (flags.dryRun) {
-    logStep('[4/11] yarn install', '[DRY] yarn clean && yarn');
+    logStep('[4/13] yarn install', '[DRY] yarn clean && yarn');
     return { ok: true };
   }
-  logStep('[4/11] yarn install', 'running yarn clean && yarn');
+  logStep('[4/13] yarn install', 'running yarn clean && yarn');
   const clean = runCommand('yarn clean', {
     cwd,
     dryRun: false,
@@ -569,33 +669,33 @@ function stepInstall(cwd, flags) {
     verbose: flags.verbose
   });
   if (install.status !== 0) {
-    logStep('[4/11] yarn install', `FAILED (exit ${install.status})`);
+    logStep('[4/13] yarn install', `FAILED (exit ${install.status})`);
     return { ok: false };
   }
-  logStep('[4/11] yarn install', 'ok');
+  logStep('[4/13] yarn install', 'ok');
   return { ok: true };
 }
 
 function stepBuild(cwd, flags) {
   if (flags.skipBuild) {
-    logStep('[10/11] yarn build', 'skipped');
+    logStep('[12/13] yarn build', 'skipped');
     return { ok: true };
   }
   if (flags.dryRun) {
-    logStep('[10/11] yarn build', '[DRY] yarn build');
+    logStep('[12/13] yarn build', '[DRY] yarn build');
     return { ok: true };
   }
-  logStep('[10/11] yarn build', 'running');
+  logStep('[12/13] yarn build', 'running');
   const result = runCommand('yarn build', {
     cwd,
     dryRun: false,
     verbose: flags.verbose
   });
   if (result.status !== 0) {
-    logStep('[10/11] yarn build', `FAILED (exit ${result.status})`);
+    logStep('[12/13] yarn build', `FAILED (exit ${result.status})`);
     return { ok: false };
   }
-  logStep('[10/11] yarn build', 'ok');
+  logStep('[12/13] yarn build', 'ok');
   return { ok: true };
 }
 
@@ -607,7 +707,7 @@ function countTodoMarkers(cwd) {
 }
 
 function stepReport(cwd, results) {
-  logStep('[11/11] Report', 'summary');
+  logStep('[13/13] Report', 'summary');
   const pkg = readPackageJson(cwd) || {};
   const todoCount = countTodoMarkers(cwd);
 
@@ -667,7 +767,7 @@ async function transform() {
       results.preflight = true;
       await maybePause(flags, 'preflight');
     } else {
-      logStep('[1/11] Preflight', 'skipped');
+      logStep('[1/13] Preflight', 'skipped');
       results.preflight = true;
     }
 
@@ -709,6 +809,22 @@ async function transform() {
     results.pageTypesCodemod = pageTypesAwaited.ok;
     await maybePause(flags, 'page-types-codemod');
 
+    const templateUrlResult = stepTemplateUrlCodemod(cwd, flags);
+    const templateUrlAwaited =
+      templateUrlResult && typeof templateUrlResult.then === 'function'
+        ? await templateUrlResult
+        : templateUrlResult;
+    results.templateUrlCodemod = templateUrlAwaited.ok;
+    await maybePause(flags, 'template-url-codemod');
+
+    const loginActionResult = stepLoginActionCodemod(cwd, flags);
+    const loginActionAwaited =
+      loginActionResult && typeof loginActionResult.then === 'function'
+        ? await loginActionResult
+        : loginActionResult;
+    results.loginActionCodemod = loginActionAwaited.ok;
+    await maybePause(flags, 'login-action-codemod');
+
     results.build = stepBuild(cwd, flags).ok;
   } catch (err) {
     log(`FATAL: ${err.message}`);