@mittwald/flow-codemods 1.2.0-next.3 → 1.2.0-next.30

package/README.md

@@ -1,19 +1,28 @@
 # @mittwald/flow-codemods
 
 Codemods and an upgrade CLI for consumers of [Flow](https://flow.mittwald.de),
-mittwald's design system. Run it with `npx` — there is no reason to install it
-as a dependency.
+mittwald's design system. Run it one-off — there is no reason to install it as a
+dependency.
 
 ```shell
 npx @mittwald/flow-codemods@latest upgrade
 ```
 
+Use whatever your project's package manager calls that: `npx …` (npm, and Yarn
+Classic, which has no `dlx`), `pnpm dlx …`, `yarn dlx …`, `bun x …`. Every
+command the CLI prints for you to copy uses the form it detected for your
+project, so the examples below stay on `npx` only because a README cannot know.
+
 ## Commands
 
 ### `upgrade [revision]`
 
-Bumps every `@mittwald/flow-*` dependency in `package.json` to a resolved
-target, installs, then runs the codemod of every migration up to that target.
+Bumps every Flow-line dependency in `package.json` to a resolved target,
+installs, then runs the codemod of every migration up to that target.
+
+"Flow line" is wider than `@mittwald/flow-*`: every package published from the
+Flow monorepo shares one version, so `@mittwald/ext-bridge`,
+`@mittwald/mstudio-ext-react-components` and `@mittwald/react-tunnel` move too.
 
 `revision` is one of:
 
@@ -33,6 +42,24 @@ versions your package supports, not one it installs, and narrowing `^1.0.0` to
 `^1.0.14` would change what _your_ consumers are allowed to install. That is
 your call, not the command's.
 
+#### Which package manager installs
+
+Detected by walking **up** from the directory you run in: lockfiles first, then
+`packageManager`, then `devEngines.packageManager`, then the metadata a manager
+leaves in `node_modules`. Walking up is what makes a workspace package work — it
+has no lockfile of its own, and detecting in that directory alone used to fall
+back to `npm install`, which on a `workspace:*` manifest fails outright. npm
+stays the fallback when nothing says anything: it is always there next to Node.
+
+A `packageManager` pin is honoured. If the binary on `PATH` already satisfies
+it, that one runs; otherwise the install goes through corepack (with the
+download prompt disabled, since this runs unattended). If neither works, the
+command refuses **before** installing and names the pin, the version it found,
+and where to get the right one — rather than installing with the wrong manager.
+
+The log line names the agent, the pin and the command it actually ran, so a
+wrong detection is visible instead of silent.
+
 After installing, `upgrade` runs the codemod of every migration whose `since` is
 at or below the target and prints the ones with no codemod, for you to apply by
 hand.
@@ -65,8 +92,10 @@ Shows migrations — codemod and by-hand alike — without touching the project.
 read-only planning entry point: run it before `upgrade` to see what a bump would
 involve.
 
-- `list` (no argument) — the whole catalogue. Offline: reads no manifest, hits
-  no network.
+- `list` (no argument) — the whole catalogue. Hits no network. It does read
+  lockfiles and `package.json` up the tree, but only to work out whether the
+  commands it prints should say `npx`, `pnpm dlx`, `yarn dlx` or `bun x` — a
+  command you can paste is worth more than never touching a manifest.
 - `list [revision]` — the same manifest read, registry fetch, and revision
   resolution `upgrade [revision]` does, showing exactly the range it would act
   on, without writing anything. `revision` takes the same values as `upgrade`'s

package/dist/cli/codemod.d.ts

@@ -15,6 +15,22 @@ import { runCodemod } from "../run/jscodeshift.js";
  * a different `cwd`.
  */
 export declare const resolveSourcePath: (explicit: string | undefined, cwd: string, exists?: (path: string) => boolean) => string;
+/**
+ * The same choice as `resolveSourcePath`, in the form a reader would type.
+ *
+ * `list` prints a runnable command per codemod entry, and it used to hardcode
+ * `src` there. On a project whose sources are anywhere else, pasting that line
+ * runs the codemod against a directory that does not exist — and the run then
+ * reports "no files under <path> were processed. Is the path right?", sending
+ * the reader after a path they were handed. So the printed command has to carry
+ * the path actually in use.
+ *
+ * Relative, not the absolute result of `resolveSourcePath`: a copy-pasteable
+ * command should stay short and keep working from the same directory the reader
+ * already is in. `"."` when the resolved path is `cwd` itself — a bare command
+ * with no argument would default back to `src` and pick the wrong tree.
+ */
+export declare const displaySourcePath: (explicit: string | undefined, cwd: string, exists?: (path: string) => boolean) => string;
 export interface CodemodCommandDeps {
     cwd: string;
     log: (message: string) => void;

package/dist/cli/codemod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codemod.d.ts","sourceRoot":"","sources":["../../src/cli/codemod.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAmB,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,aAClB,MAAM,GAAG,SAAS,OACvB,MAAM,WACH,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,KAChC,MAKF,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;CACzB;AAED,eAAO,MAAM,gBAAgB,WACnB,aAAa,qBACW,kBAAkB,KACjD,OAAO,CAAC,MAAM,CA6DhB,CAAC"}
+{"version":3,"file":"codemod.d.ts","sourceRoot":"","sources":["../../src/cli/codemod.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAmB,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,aAClB,MAAM,GAAG,SAAS,OACvB,MAAM,WACH,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,KAChC,MAKF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,aAClB,MAAM,GAAG,SAAS,OACvB,MAAM,WACH,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,KAChC,MAKF,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;CACzB;AAED,eAAO,MAAM,gBAAgB,WACnB,aAAa,qBACW,kBAAkB,KACjD,OAAO,CAAC,MAAM,CA6DhB,CAAC"}

package/dist/cli/codemod.js

@@ -22,6 +22,27 @@ export const resolveSourcePath = (explicit, cwd, exists = existsSync) => {
     }
     return exists(join(cwd, "src")) ? join(cwd, "src") : cwd;
 };
+/**
+ * The same choice as `resolveSourcePath`, in the form a reader would type.
+ *
+ * `list` prints a runnable command per codemod entry, and it used to hardcode
+ * `src` there. On a project whose sources are anywhere else, pasting that line
+ * runs the codemod against a directory that does not exist — and the run then
+ * reports "no files under <path> were processed. Is the path right?", sending
+ * the reader after a path they were handed. So the printed command has to carry
+ * the path actually in use.
+ *
+ * Relative, not the absolute result of `resolveSourcePath`: a copy-pasteable
+ * command should stay short and keep working from the same directory the reader
+ * already is in. `"."` when the resolved path is `cwd` itself — a bare command
+ * with no argument would default back to `src` and pick the wrong tree.
+ */
+export const displaySourcePath = (explicit, cwd, exists = existsSync) => {
+    if (explicit !== undefined) {
+        return explicit;
+    }
+    return exists(join(cwd, "src")) ? "src" : ".";
+};
 export const runSingleCodemod = async (parsed, { cwd, log, run = runCodemod }) => {
     const id = parsed.id ?? "";
     const entry = allEntries.find((candidate) => candidate.id === id);

package/dist/cli/list.d.ts

@@ -17,6 +17,24 @@ export interface RenderListInput {
     color?: boolean;
     /** Terminal width to wrap prose to. */
     width?: number;
+    /**
+     * How to invoke this package in a printed command — e.g. `npx
+     * @mittwald/flow-codemods@latest` or `pnpm dlx …`.
+     *
+     * Defaults to the `npx` form, which is right for npm and for Yarn Classic
+     * (which has no `dlx`). A pnpm, Yarn Berry or Bun project gets a command it
+     * cannot paste otherwise.
+     */
+    invoke?: string;
+    /**
+     * The path argument to print in each codemod entry's runnable command.
+     *
+     * Defaults to `src` — the same default `resolveSourcePath` applies — but a
+     * caller that knows better must say so, or the printed command sends the
+     * reader at a directory their project does not have. See
+     * `displaySourcePath`.
+     */
+    path?: string;
     /**
      * Render the frame around the entries: the context on top (the range, the
      * catch-up legend) and the summary at the bottom (the counts). On by default.
@@ -30,6 +48,13 @@ export interface RenderListInput {
     frame?: boolean;
 }
 export declare const stripAnsi: (text: string) => string;
+/**
+ * The invocation to print when nobody says otherwise.
+ *
+ * `npx` is also correct for Yarn Classic, which has no `dlx` — the library
+ * resolves both to it.
+ */
+export declare const defaultInvoke = "npx @mittwald/flow-codemods@latest";
 /**
  * The migrations for a version range, as text or JSON.
  *
@@ -42,7 +67,7 @@ export declare const stripAnsi: (text: string) => string;
  * so the rendering is deterministic in a test — `painter` builds its palette
  * from `color` alone, never from the terminal. `cli.ts` supplies them.
  */
-export declare const renderList: ({ entries, range, json, color, width, frame, }: RenderListInput) => string;
+export declare const renderList: ({ entries, range, json, color, width, path, invoke, frame, }: RenderListInput) => string;
 export interface ListDeps extends RangeDeps {
     /**
      * Raw output writer — matches `process.stdout.write`'s own contract: no
@@ -51,6 +76,10 @@ export interface ListDeps extends RangeDeps {
     write: (text: string) => void;
     color?: boolean;
     width?: number;
+    /** Printed in each codemod entry's command — see `RenderListInput.path`. */
+    path?: string;
+    /** Printed as the command's prefix — see `RenderListInput.invoke`. */
+    invoke?: string;
 }
 export declare const defaultListDeps: (cwd: string) => ListDeps;
 /**

package/dist/cli/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/cli/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAkCD,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAgC,CAAC;AAoO1E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,mDAOpB,eAAe,KAAG,MA0DpB,CAAC;AAEF,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,QAG5C,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,OAAO,WACV,aAAa,QACf,QAAQ,KACb,OAAO,CAAC,MAAM,CA+BhB,CAAC"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/cli/list.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAkCD,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,MAAgC,CAAC;AAkE1E;;;;;GAKG;AACH,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAsKlE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,iEASpB,eAAe,KAAG,MAiEpB,CAAC;AAEF,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,QAG5C,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,OAAO,WACV,aAAa,QACf,QAAQ,KACb,OAAO,CAAC,MAAM,CAmChB,CAAC"}

package/dist/cli/list.js

@@ -83,6 +83,13 @@ const painter = (color) => {
         blue: palette.blue,
     };
 };
+/**
+ * The invocation to print when nobody says otherwise.
+ *
+ * `npx` is also correct for Yarn Classic, which has no `dlx` — the library
+ * resolves both to it.
+ */
+export const defaultInvoke = "npx @mittwald/flow-codemods@latest";
 const indent = "  ";
 const labelWidth = 8;
 /** One `apply` row: dim label, wrapped body beside it. */
@@ -105,7 +112,7 @@ const field = (label, value, width, paint) => {
  * see `selectEntries`.
  */
 const isCatchUp = (entry, current) => current !== undefined && lte(entry.since, current);
-const renderEntry = (entry, width, color, catchUp) => {
+const renderEntry = (entry, width, color, catchUp, path, invoke) => {
     const paint = painter(color);
     const action = actions[entry.action];
     // Hollow vs filled: catch-up shipped at or before `current`, so it may
@@ -127,7 +134,7 @@ const renderEntry = (entry, width, color, catchUp) => {
         ...field("apply", entry.apply, width, paint),
     ];
     if (entry.action === "codemod") {
-        lines.push("", `${indent}${paint.dim("$")} ${paint.code(`npx @mittwald/flow-codemods@latest ${entry.id} src`)}`);
+        lines.push("", `${indent}${paint.dim("$")} ${paint.code(`${invoke} ${entry.id} ${path}`)}`);
     }
     return lines.join("\n");
 };
@@ -203,7 +210,7 @@ const renderSummary = (selected, color) => {
  * so the rendering is deterministic in a test — `painter` builds its palette
  * from `color` alone, never from the terminal. `cli.ts` supplies them.
  */
-export const renderList = ({ entries, range, json, color = false, width = 80, frame = true, }) => {
+export const renderList = ({ entries, range, json, color = false, width = 80, path = "src", invoke = defaultInvoke, frame = true, }) => {
     // The two paths differ in their bounds, deliberately: unbounded, this is a
     // plain catalogue browse — every entry, sorted, regardless of whether it
     // would apply to any given range. Bounded, it answers "what does this
@@ -234,7 +241,7 @@ export const renderList = ({ entries, range, json, color = false, width = 80, fr
         return "Nothing to migrate in that range.\n";
     }
     const body = selected
-        .map((entry) => renderEntry(entry, width, color, isCatchUp(entry, range?.from)))
+        .map((entry) => renderEntry(entry, width, color, isCatchUp(entry, range?.from), path, invoke))
         .join("\n\n");
     if (!frame) {
         return `${body}\n`;
@@ -274,6 +281,8 @@ export const runList = async (parsed, deps) => {
             json: parsed.json,
             color: deps.color,
             width: deps.width,
+            path: deps.path,
+            invoke: deps.invoke,
         }));
         return 0;
     }
@@ -288,6 +297,8 @@ export const runList = async (parsed, deps) => {
         json: parsed.json,
         color: deps.color,
         width: deps.width,
+        path: deps.path,
+        invoke: deps.invoke,
     }));
     return 0;
 };

package/dist/cli/upgrade.d.ts

@@ -13,6 +13,13 @@ export interface UpgradeDeps {
     isDirty: (cwd: string) => boolean;
     readInstalledVersion: (cwd: string, name: string) => string | undefined;
     log: (message: string) => void;
+    /**
+     * Emit ANSI colour in the by-hand list. Off by default so a test sees plain
+     * text.
+     */
+    color?: boolean;
+    /** Terminal width to wrap the by-hand list's prose to. */
+    width?: number;
 }
 export declare const defaultUpgradeDeps: (cwd: string) => UpgradeDeps;
 /**

package/dist/cli/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/cli/upgrade.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAItE,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAsB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI/C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,KAAG,WAS/C,CAAC;AA2BH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,WACb,aAAa,QACf,WAAW,KAChB,OAAO,CAAC,MAAM,CAwMhB,CAAC"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/cli/upgrade.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAItE,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAsB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI/C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,KAAG,WAS/C,CAAC;AA2BH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,WACb,aAAa,QACf,WAAW,KAChB,OAAO,CAAC,MAAM,CAqNhB,CAAC"}

package/dist/cli/upgrade.js

@@ -5,12 +5,12 @@ import { allEntries } from "../catalog/entries.js";
 import { selectEntries } from "../catalog/select.js";
 import { flowPackages } from "../flowPackages.generated.js";
 import { hasUncommittedChanges } from "../git.js";
-import { detectPackageManagerIn, runInstall, } from "../install.js";
+import { detectPackageManagerIn, resolveInvoke, runInstall, } from "../install.js";
 import { applyTarget, isWritable } from "../manifest.js";
 import { fetchVersions } from "../resolve/registry.js";
 import { readInstalledVersion, resolveRange } from "../resolve/range.js";
 import { runCodemod } from "../run/jscodeshift.js";
-import { resolveSourcePath } from "./codemod.js";
+import { displaySourcePath, resolveSourcePath } from "./codemod.js";
 import { renderList } from "./list.js";
 export const defaultUpgradeDeps = (cwd) => ({
     cwd,
@@ -121,13 +121,16 @@ export const runUpgrade = async (parsed, deps) => {
         const indent = detectIndent(manifestRaw);
         writeFileSync(manifestPath, `${JSON.stringify(applyTarget(manifest, target, flowPackages), null, indent)}\n`, "utf8");
         reportDependencies();
-        const manager = detectPackageManagerIn(cwd);
-        log(`Installing with ${manager}`);
+        const manager = await detectPackageManagerIn(cwd);
         try {
-            deps.install(manager, cwd);
+            // Logged after the run, not before: `install` returns what it actually
+            // ran — agent, pin and command line — so a wrong detection is visible in
+            // the output instead of hidden behind a bare manager name. On a throw the
+            // recovery message below carries the reason anyway.
+            log(`Installed with ${deps.install(manager, cwd)}`);
         }
         catch (error) {
-            log(`The dependency bump was written but the install failed, so package.json is on\n${target} while node_modules still holds ${current}.\n\nEither re-run this command once the install works, or undo the bump with\n  git checkout package.json\n\n${error instanceof Error ? error.message : error}`);
+            log(`The dependency bump was written but the install failed, so package.json is on\n${target} while node_modules still holds ${current}.\n\nDetected package manager: ${manager.agent}${manager.version === undefined ? "" : ` (pinned ${manager.version})`}. If that is wrong, finish the install yourself with the right one —\nthe bump in package.json is already correct.\n\nOtherwise re-run this command once the install works, or undo the bump with\n  git checkout package.json\n\n${error instanceof Error ? error.message : error}`);
             return 1;
         }
     }
@@ -184,32 +187,40 @@ export const runUpgrade = async (parsed, deps) => {
             log(`  ${entry.id}: ${result.changed} file(s) changed`);
         }
     }
-    // Selection has no lower bound (see `selectEntries`), so this loop can run
-    // every codemod in the catalogue on a project that never crossed a version
-    // at all — "N run, 0 changed" is the confirmation that there was nothing to
-    // catch up on, not a list of new work.
-    if (ranCount > 0) {
-        log(`\n${ranCount} codemod${ranCount === 1 ? "" : "s"} run, ${changedCount} changed something.`);
-    }
     if (byHand.length > 0) {
         log(`\n${byHand.length} migration(s) in this range have no codemod — apply them by hand:\n`);
-        // `frame: false` — this already printed the heading above and, further
-        // down, its own aggregate ("N codemods run, N changed something");
-        // renderList's own frame (the range/legend on top, the counts at the
-        // bottom) would just repeat both for the same list. `range` is still
-        // passed so each entry gets its catch-up mark — a manual entry that
-        // shipped at or before `current` may already be done, and the mark is
-        // the only thing left that says so now that hiding it is gone.
+        // `frame: false` — this already printed the heading above, and the
+        // closing summaries below cover the same aggregate ("N codemods run, N
+        // changed something") renderList's own frame would otherwise repeat.
+        // `range` is still passed so each entry gets its catch-up mark — a manual
+        // entry that shipped at or before `current` may already be done, and the
+        // mark is the only thing left that says so now that hiding it is gone.
         log(renderList({
             entries: byHand,
             range: { from: current, to: target },
             json: false,
+            color: deps.color,
+            width: deps.width,
+            // The same path this run used, so a command copied out of the by-hand
+            // block works instead of falling back to a hardcoded `src`.
+            path: displaySourcePath(parsed.path, cwd),
+            invoke: await resolveInvoke(cwd),
             frame: false,
         }));
     }
     else {
         log("\nNo migration in this range required a change by hand.");
     }
+    // Both closing summaries trail everything else, not just each other: a
+    // multi-screen by-hand list would otherwise scroll them out of sight before
+    // the reader reaches the end — exactly when they want the counts. Selection
+    // has no lower bound (see `selectEntries`), so this loop can run every
+    // codemod in the catalogue on a project that never crossed a version at
+    // all — "N run, 0 changed" is the confirmation that there was nothing to
+    // catch up on, not a list of new work.
+    if (ranCount > 0) {
+        log(`\n${ranCount} codemod${ranCount === 1 ? "" : "s"} run, ${changedCount} changed something.`);
+    }
     if (incomplete.length > 0) {
         log(`\n${incomplete.length} codemod(s) did not complete: ${incomplete.join(", ")}`);
     }

package/dist/cli.js

@@ -2,7 +2,8 @@
 import { readFileSync } from "node:fs";
 import { parseArguments } from "./cli/args.js";
 import { createChoose } from "./cli/choose.js";
-import { runSingleCodemod } from "./cli/codemod.js";
+import { displaySourcePath, runSingleCodemod } from "./cli/codemod.js";
+import { resolveInvoke } from "./install.js";
 import { defaultListDeps, runList } from "./cli/list.js";
 import { defaultUpgradeDeps, runUpgrade } from "./cli/upgrade.js";
 const usage = `flow-codemods — migrate a codebase across Flow versions
@@ -65,6 +66,16 @@ const main = async () => {
                 // (or none at all), and beyond ~100 columns long prose gets harder to
                 // read rather than easier.
                 width: Math.min(Math.max(process.stdout.columns ?? 80, 60), 100),
+                // The per-entry command `list` prints has to name the path this project
+                // actually uses; hardcoding `src` handed readers a command that fails on
+                // any other layout. `--path` wins, otherwise the same `src`-or-cwd
+                // choice a real run would make.
+                path: displaySourcePath(parsed.path, process.cwd()),
+                // `npx` is wrong for a pnpm, Yarn Berry or Bun project. Detecting the
+                // manager here costs the bare `list` its "reads no manifest" property —
+                // a deliberate trade: a command the reader can actually paste beats the
+                // purity of that claim. It still hits no network.
+                invoke: await resolveInvoke(process.cwd()),
             });
         case "codemod":
             return await runSingleCodemod(parsed, {
@@ -96,6 +107,10 @@ const main = async () => {
             return runUpgrade(parsed, {
                 ...defaultUpgradeDeps(process.cwd()),
                 choose,
+                // Same rule as `list`: colour only for a person at a real terminal,
+                // off under `NO_COLOR` or a pipe so the output stays greppable.
+                color: process.stdout.isTTY === true && process.env.NO_COLOR === undefined,
+                width: Math.min(Math.max(process.stdout.columns ?? 80, 60), 100),
             });
         }
         default:

package/dist/install.d.ts

@@ -1,13 +1,34 @@
-export type PackageManager = "pnpm" | "npm" | "yarn" | "bun";
+import type { Agent, DetectResult } from "package-manager-detector";
 /**
- * The package manager a project uses, from the lockfiles present.
+ * The project's package manager, as `upgrade` needs to know it.
  *
- * Npm is the fallback: it is the one manager that is always available next to
- * Node, so a project with no lockfile still gets an install rather than an
- * error.
+ * `agent` is what resolves a command (`yarn` and `yarn@berry` want different
+ * ones); `version` is the pin from `packageManager`, when there is one, and is
+ * the string `"berry"` rather than a number for Yarn 2+ — see `pinnedRange`.
  */
-export declare const detectPackageManager: (present: string[]) => PackageManager;
-export declare const detectPackageManagerIn: (cwd: string) => PackageManager;
+export type PackageManager = Pick<DetectResult, "name" | "agent" | "version">;
+/**
+ * The package manager for the project at `cwd`.
+ *
+ * Detection walks **up** from `cwd`, which is the whole point: the previous
+ * implementation looked for lockfiles in `cwd` only, and a workspace package
+ * has none of its own. In a Yarn or pnpm monorepo it therefore fell through to
+ * the npm default and ran `npm install`, which on a workspace manifest dies
+ * with `EUNSUPPORTEDPROTOCOL Unsupported URL Type "workspace:"` — after
+ * `upgrade` had already rewritten `package.json`. It also ignored
+ * `packageManager` entirely.
+ *
+ * Per directory the strategies are applied in order, so a lockfile in `cwd`
+ * still beats a `packageManager` pin in a parent — and when the lockfile
+ * strategy hits, the library reads that same directory's `package.json` and
+ * lets its pin win. That is the precedence we want, and it is the library's,
+ * not ours.
+ *
+ * Npm on `null`, preserving the old fallback: it is the one manager always
+ * present next to Node, so a project with no signal gets an install rather than
+ * an error.
+ */
+export declare const detectPackageManagerIn: (cwd: string) => Promise<PackageManager>;
 export interface InstallCommand {
     command: string;
     args: string[];
@@ -15,7 +36,7 @@ export interface InstallCommand {
     env: Record<string, string>;
 }
 /**
- * How to install with a given manager, so that the install actually updates the
+ * How to install with `agent`, so that the install actually updates the
  * lockfile.
  *
  * `upgrade` has just rewritten `package.json`, so the lockfile is deliberately
@@ -23,15 +44,93 @@ export interface InstallCommand {
  * themselves when they detect CI, where an install then _fails_ instead of
  * updating — and CI is exactly where this runs unattended. pnpm takes a flag;
  * Yarn's flag differs between Classic and Berry, so it gets the environment
- * variable instead, which Classic ignores harmlessly.
+ * variable instead, which Classic ignores harmlessly. Keeping the env var also
+ * keeps this one code path rather than branching on a Berry detection being
+ * right.
+ *
+ * The command itself comes from the library. Its `"install"` is the plain
+ * install for every agent — the frozen variants are a separate command there —
+ * so these quirks stay ours.
+ */
+export declare const installCommand: (agent: Agent) => InstallCommand;
+/**
+ * The pin as a semver range, or `undefined` when there is nothing to check.
+ *
+ * Two values have to be filtered out. `"berry"` is what the library reports for
+ * Yarn 2+ — a specifier, not a version — and for an unparseable
+ * `packageManager` it hands back the raw string. Neither is a range, and
+ * `satisfies` would throw on both.
+ *
+ * A full pin like `8.15.0` is a valid range meaning exactly that version, so
+ * one comparison covers both `pnpm@8` and `pnpm@8.15.0`. That is also why this
+ * is `satisfies` and not a string compare: the library reports the
+ * `\d+(\.\d+){0,2}` match out of the field, so `packageManager: "pnpm@8"`
+ * yields the pin `"8"` while the binary reports `8.15.0` — a string compare
+ * would send a perfectly fine setup through corepack.
+ */
+export declare const pinnedRange: (version: string | undefined) => string | undefined;
+/**
+ * Runs a command and returns its trimmed stdout, or `undefined` if it fails.
+ *
+ * Injected so the pin logic is testable without shelling out — the same reason
+ * `InstallRunner` exists. It is not a CLI flag: the seam belongs in the code.
+ */
+export type Probe = (command: string, args: string[]) => string | undefined;
+export declare const runProbe: Probe;
+export interface InstallPlan {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    /** How this reads in the log — agent, pin, and the command actually run. */
+    description: string;
+}
+/**
+ * What to run for `manager`, honouring a `packageManager` pin.
+ *
+ * The decision tree, and why it checks before reaching for corepack:
+ *
+ * | Situation                                         | Behaviour                 |
+ * | ------------------------------------------------- | ------------------------- |
+ * | No pin, or the `"berry"` specifier                | run directly              |
+ * | Pin, binary present, version satisfies it         | run directly              |
+ * | Pin, mismatch or binary missing, corepack present | run under corepack        |
+ * | Pin, mismatch or missing, no corepack             | throw, before any install |
+ *
+ * Corepack ignores `PATH` and downloads into its own cache, so "always
+ * corepack" would send every project that has a `packageManager` field — most
+ * of them — through a download, offline CI included. pnpm 9.7+ additionally
+ * installs its own pinned version, so for pnpm the direct path is usually
+ * already right.
+ *
+ * `COREPACK_ENABLE_DOWNLOAD_PROMPT=0` is required rather than tidy: corepack
+ * prompts interactively before a first download, and `upgrade` runs unattended
+ * (`-y` is implied with no TTY). Only one `install` is spawned under corepack —
+ * no nested per-task spawns — so the corepack footgun in the repo's root
+ * `AGENTS.md` does not apply.
  */
-export declare const installCommand: (manager: PackageManager) => InstallCommand;
+export declare const planInstall: (manager: PackageManager, probe?: Probe) => InstallPlan;
 /**
  * Runs the install.
  *
  * A named type rather than a bare call so tests can substitute it. There is no
  * `--no-install` flag: the seam belongs in the code, not in the CLI surface.
+ *
+ * Returns the plan's description so the caller can log what actually ran — a
+ * wrong detection then shows up in the output instead of silently installing
+ * with the wrong manager.
  */
-export type InstallRunner = (manager: PackageManager, cwd: string) => void;
+export type InstallRunner = (manager: PackageManager, cwd: string) => string;
 export declare const runInstall: InstallRunner;
+/**
+ * How to tell a reader to invoke this package, for the manager they use.
+ *
+ * `npx …` for npm and Yarn Classic (which has no `dlx`), `pnpm dlx …`, `yarn
+ * dlx …`, `bun x …`. The package name is passed as an argument rather than
+ * baked in, so the library decides the whole prefix.
+ *
+ * Falls back to the `npx` form when the agent has no `execute` command: a
+ * printed hint is worth more than a gap, and npx is the one form every reader
+ * can run.
+ */
+export declare const resolveInvoke: (cwd: string, pkg?: string) => Promise<string>;
 //# sourceMappingURL=install.d.ts.map

package/dist/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAe7D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAAa,MAAM,EAAE,KAAG,cAOxD,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,cAKlD,CAAC;AAEJ,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,YAAa,cAAc,KAAG,cAkBxD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAE3E,eAAO,MAAM,UAAU,EAAE,aAOxB,CAAC"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAiB9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,QAC5B,MAAM,KACV,OAAO,CAAC,cAAc,CACyC,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,cAAc,UAAW,KAAK,KAAG,cAiB7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,YAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAGpD,CAAC;AAEhB;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS,CAAC;AAE5E,eAAO,MAAM,QAAQ,EAAE,KAUtB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,WAAW,YACb,cAAc,UAChB,KAAK,KACX,WAuCF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAE7E,eAAO,MAAM,UAAU,EAAE,aAYxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QACnB,MAAM,mBAEV,OAAO,CAAC,MAAM,CAMhB,CAAC"}

package/dist/install.js

@@ -1,38 +1,45 @@
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-/** Lockfile to manager, in precedence order. */
-const lockfiles = [
-    ["pnpm-lock.yaml", "pnpm"],
-    // Both Bun lockfile names: `bun.lock` (text) is the default only from Bun
-    // 1.2; before that Bun writes the binary `bun.lockb`, which plenty of
-    // projects still have. Missing it would fall through to the npm default and
-    // run `npm install` on a Bun project, leaving a stray package-lock.json.
-    ["bun.lock", "bun"],
-    ["bun.lockb", "bun"],
-    ["yarn.lock", "yarn"],
-    ["package-lock.json", "npm"],
+import { satisfies, validRange } from "semver";
+import { resolveCommand } from "package-manager-detector/commands";
+import { INSTALL_PAGE } from "package-manager-detector/constants";
+import { detect } from "package-manager-detector/detect";
+/** Every strategy the library offers, in the order it applies them. */
+const strategies = [
+    "lockfile",
+    "packageManager-field",
+    "devEngines-field",
+    // Not in the library's default set. `upgrade` always runs on an installed
+    // project — it reads `node_modules` to learn the current Flow version — so the
+    // marker a manager leaves in there is a real signal, and the last one before
+    // the npm fallback.
+    "install-metadata",
 ];
+/** What a project with no signal at all gets. */
+const fallback = { name: "npm", agent: "npm" };
 /**
- * The package manager a project uses, from the lockfiles present.
+ * The package manager for the project at `cwd`.
  *
- * Npm is the fallback: it is the one manager that is always available next to
- * Node, so a project with no lockfile still gets an install rather than an
- * error.
+ * Detection walks **up** from `cwd`, which is the whole point: the previous
+ * implementation looked for lockfiles in `cwd` only, and a workspace package
+ * has none of its own. In a Yarn or pnpm monorepo it therefore fell through to
+ * the npm default and ran `npm install`, which on a workspace manifest dies
+ * with `EUNSUPPORTEDPROTOCOL Unsupported URL Type "workspace:"` — after
+ * `upgrade` had already rewritten `package.json`. It also ignored
+ * `packageManager` entirely.
+ *
+ * Per directory the strategies are applied in order, so a lockfile in `cwd`
+ * still beats a `packageManager` pin in a parent — and when the lockfile
+ * strategy hits, the library reads that same directory's `package.json` and
+ * lets its pin win. That is the precedence we want, and it is the library's,
+ * not ours.
+ *
+ * Npm on `null`, preserving the old fallback: it is the one manager always
+ * present next to Node, so a project with no signal gets an install rather than
+ * an error.
  */
-export const detectPackageManager = (present) => {
-    for (const [lockfile, manager] of lockfiles) {
-        if (present.includes(lockfile)) {
-            return manager;
-        }
-    }
-    return "npm";
-};
-export const detectPackageManagerIn = (cwd) => detectPackageManager(lockfiles
-    .map(([lockfile]) => lockfile)
-    .filter((lockfile) => existsSync(join(cwd, lockfile))));
+export const detectPackageManagerIn = async (cwd) => (await detect({ cwd, strategies: [...strategies] })) ?? fallback;
 /**
- * How to install with a given manager, so that the install actually updates the
+ * How to install with `agent`, so that the install actually updates the
  * lockfile.
  *
  * `upgrade` has just rewritten `package.json`, so the lockfile is deliberately
@@ -40,32 +47,138 @@ export const detectPackageManagerIn = (cwd) => detectPackageManager(lockfiles
  * themselves when they detect CI, where an install then _fails_ instead of
  * updating — and CI is exactly where this runs unattended. pnpm takes a flag;
  * Yarn's flag differs between Classic and Berry, so it gets the environment
- * variable instead, which Classic ignores harmlessly.
+ * variable instead, which Classic ignores harmlessly. Keeping the env var also
+ * keeps this one code path rather than branching on a Berry detection being
+ * right.
+ *
+ * The command itself comes from the library. Its `"install"` is the plain
+ * install for every agent — the frozen variants are a separate command there —
+ * so these quirks stay ours.
+ */
+export const installCommand = (agent) => {
+    const frozenOptOut = agent.startsWith("pnpm") ? ["--no-frozen-lockfile"] : [];
+    const resolved = resolveCommand(agent, "install", frozenOptOut);
+    if (resolved === null) {
+        throw new Error(`${agent} has no install command. Install the dependencies yourself, then re-run this command.`);
+    }
+    return {
+        command: resolved.command,
+        args: resolved.args,
+        env: agent.startsWith("yarn")
+            ? { YARN_ENABLE_IMMUTABLE_INSTALLS: "false" }
+            : {},
+    };
+};
+/**
+ * The pin as a semver range, or `undefined` when there is nothing to check.
+ *
+ * Two values have to be filtered out. `"berry"` is what the library reports for
+ * Yarn 2+ — a specifier, not a version — and for an unparseable
+ * `packageManager` it hands back the raw string. Neither is a range, and
+ * `satisfies` would throw on both.
+ *
+ * A full pin like `8.15.0` is a valid range meaning exactly that version, so
+ * one comparison covers both `pnpm@8` and `pnpm@8.15.0`. That is also why this
+ * is `satisfies` and not a string compare: the library reports the
+ * `\d+(\.\d+){0,2}` match out of the field, so `packageManager: "pnpm@8"`
+ * yields the pin `"8"` while the binary reports `8.15.0` — a string compare
+ * would send a perfectly fine setup through corepack.
  */
-export const installCommand = (manager) => {
-    switch (manager) {
-        case "pnpm":
-            return {
-                command: "pnpm",
-                args: ["install", "--no-frozen-lockfile"],
-                env: {},
-            };
-        case "yarn":
-            return {
-                command: "yarn",
-                args: ["install"],
-                env: { YARN_ENABLE_IMMUTABLE_INSTALLS: "false" },
-            };
-        case "npm":
-        case "bun":
-            return { command: manager, args: ["install"], env: {} };
+export const pinnedRange = (version) => version !== undefined && version !== "berry" && validRange(version) !== null
+    ? version
+    : undefined;
+export const runProbe = (command, args) => {
+    try {
+        return execFileSync(command, args, {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            shell: process.platform === "win32",
+        }).trim();
+    }
+    catch {
+        return undefined;
     }
 };
+/**
+ * What to run for `manager`, honouring a `packageManager` pin.
+ *
+ * The decision tree, and why it checks before reaching for corepack:
+ *
+ * | Situation                                         | Behaviour                 |
+ * | ------------------------------------------------- | ------------------------- |
+ * | No pin, or the `"berry"` specifier                | run directly              |
+ * | Pin, binary present, version satisfies it         | run directly              |
+ * | Pin, mismatch or binary missing, corepack present | run under corepack        |
+ * | Pin, mismatch or missing, no corepack             | throw, before any install |
+ *
+ * Corepack ignores `PATH` and downloads into its own cache, so "always
+ * corepack" would send every project that has a `packageManager` field — most
+ * of them — through a download, offline CI included. pnpm 9.7+ additionally
+ * installs its own pinned version, so for pnpm the direct path is usually
+ * already right.
+ *
+ * `COREPACK_ENABLE_DOWNLOAD_PROMPT=0` is required rather than tidy: corepack
+ * prompts interactively before a first download, and `upgrade` runs unattended
+ * (`-y` is implied with no TTY). Only one `install` is spawned under corepack —
+ * no nested per-task spawns — so the corepack footgun in the repo's root
+ * `AGENTS.md` does not apply.
+ */
+export const planInstall = (manager, probe = runProbe) => {
+    const { command, args, env } = installCommand(manager.agent);
+    const line = [command, ...args].join(" ");
+    const pin = pinnedRange(manager.version);
+    if (pin === undefined) {
+        return { command, args, env, description: `${manager.agent} — ${line}` };
+    }
+    const found = probe(command, ["--version"]);
+    if (found !== undefined && satisfies(found, pin)) {
+        return {
+            command,
+            args,
+            env,
+            description: `${manager.agent} ${found} — ${line}`,
+        };
+    }
+    if (probe("corepack", ["--version"]) === undefined) {
+        throw new Error(`This project pins ${manager.name}@${pin} in "packageManager", but ${found === undefined
+            ? `${command} is not on PATH`
+            : `the ${command} on PATH is ${found}`}, and corepack is not available to bridge the gap.\n\nInstall ${manager.name}@${pin} (${INSTALL_PAGE[manager.agent]}) or enable corepack, then re-run this command. Nothing has been installed.`);
+    }
+    return {
+        command: "corepack",
+        args: [command, ...args],
+        env: { ...env, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" },
+        description: `${manager.agent} ${pin} via corepack — corepack ${line}`,
+    };
+};
 export const runInstall = (manager, cwd) => {
-    const { command, args, env } = installCommand(manager);
-    execFileSync(command, args, {
+    const plan = planInstall(manager);
+    execFileSync(plan.command, plan.args, {
         cwd,
         stdio: "inherit",
-        env: { ...process.env, ...env },
+        env: { ...process.env, ...plan.env },
+        // Node has refused to spawn `.cmd`/`.bat` without a shell since 2024, which
+        // is why every non-npm manager died with ENOENT on Windows. Every argument
+        // here is our own literal or the library's, so there is no quoting hazard.
+        shell: process.platform === "win32",
     });
+    return plan.description;
+};
+/**
+ * How to tell a reader to invoke this package, for the manager they use.
+ *
+ * `npx …` for npm and Yarn Classic (which has no `dlx`), `pnpm dlx …`, `yarn
+ * dlx …`, `bun x …`. The package name is passed as an argument rather than
+ * baked in, so the library decides the whole prefix.
+ *
+ * Falls back to the `npx` form when the agent has no `execute` command: a
+ * printed hint is worth more than a gap, and npx is the one form every reader
+ * can run.
+ */
+export const resolveInvoke = async (cwd, pkg = "@mittwald/flow-codemods@latest") => {
+    const { agent } = await detectPackageManagerIn(cwd);
+    const resolved = resolveCommand(agent, "execute", [pkg]);
+    return resolved === null
+        ? `npx ${pkg}`
+        : [resolved.command, ...resolved.args].join(" ");
 };

package/dist/migrations.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,sEAAsE;AACtE,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAoPpD,CAAC"}
+{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,sEAAsE;AACtE,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAwQpD,CAAC"}

package/dist/migrations.generated.js

@@ -3,6 +3,15 @@
 // Source: packages/codemods/src/migrations/<id>/entry.md
 /** Every migration, newest first. Bodies live in `src/migrations`. */
 export const migrations = [
+    {
+        id: "option-value-inferred-from-mixed-children",
+        since: "1.1.12",
+        title: "Option: value is inferred from mixed children",
+        kind: "migration",
+        action: "none",
+        remotePackage: true,
+        apply: "No code change required for the option itself. An `Option` whose children are text plus an element — text and a `Badge`, text and an icon — now carries that text as its key, where it previously fell back to react-aria's generated `react-aria-N`. Check anywhere such a key was read back: a stored or server-side selection, a `defaultValue`/`value` matched against it, or a test asserting on it. Pass an explicit `value` to pin the key to something other than the display text.",
+    },
     {
         id: "use-design-tokens-build-metadata-removed",
         since: "1.0.16",
@@ -75,6 +84,15 @@ export const migrations = [
         remotePackage: false,
         apply: "Replace the import path `@mittwald/flow-react-components/password-tools` with `@mittwald/flow-react-components/mittwald-password-tools-js`.",
     },
+    {
+        id: "tabs-navigation-usage-to-tab-navigation",
+        since: "0.2.0-alpha.977",
+        title: "Tabs restyled; navigation usage moves to TabNavigation",
+        kind: "migration",
+        action: "manual",
+        remotePackage: true,
+        apply: "Tabs' rendering changed: the tab list now fills the available width with equal-size tabs and a shared, animated indicator that slides between them, replacing the previous fit-content tabs that each carried their own hover/pressed/selected background. Nothing else about `Tabs` changed, and a `Tabs` that switches content within a page needs no code change — the new look applies on upgrade. Where `Tabs` was used to fake real navigation instead — a `TabTitle` given an `href` (`Aria.Tab`'s routing props: `href`, `target`, `routerOptions`, …) so selecting it pushed a real route change — replace it with `TabNavigation`: plain `Link` children instead of `Tab`/`TabTitle`/panels, `aria-current=\"page\"` on the active `Link` instead of `selectedKey`/`defaultSelectedKey`/`onSelectionChange`. `TabNavigation` keeps the visual language the old `Tabs` used to have, because it now owns that use case.",
+    },
     {
         id: "table-column-width-props",
         since: "0.2.0-alpha.956",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mittwald/flow-codemods",
-  "version": "1.2.0-next.3",
+  "version": "1.2.0-next.30",
   "type": "module",
   "description": "Codemods and an upgrade CLI for consumers of Flow, mittwald's design system",
   "homepage": "https://flow.mittwald.de",
@@ -22,6 +22,7 @@
   "dependencies": {
     "@inquirer/prompts": "^7.9.0",
     "jscodeshift": "^17.3.0",
+    "package-manager-detector": "^1.8.0",
     "picocolors": "^1.1.1",
     "registry-url": "^7.2.0",
     "semver": "^7.8.5"
@@ -36,5 +37,5 @@
     "vitest": "^4.1.11",
     "yaml": "^2.8.1"
   },
-  "gitHead": "308539dabbc9256b6481b6291035ed69207e021a"
+  "gitHead": "eaef842a55bfc5311e8ce05a2c0cbd60cb28c8e9"
 }