@trackunit/css-class-variance-utilities 1.14.28 → 2.0.0

package/README.md

@@ -1,6 +1,65 @@
 # Trackunit css-class-variance-utilities
 
-The `@trackunit/css-class-variance-utilities` package is the home of Trackunits custom implementation of the CVA and twMerge npm packages.
+The `@trackunit/css-class-variance-utilities` package is a thin wrapper around the upstream [`cva`](https://cva.style/beta) package with [`tailwind-merge`](https://github.com/dcastil/tailwind-merge) wired into its `onComplete` hook, so later conflicting utilities win and callers do not need to call `twMerge` themselves. Use `cva` for a variant table and `cx` from this package to join class strings — both go through that hook.
+
+## Usage
+
+Import `cva` and `cx` from this package rather than from `cva` directly:
+
+```ts
+import { cva } from "@trackunit/css-class-variance-utilities";
+
+export const cvaPage = cva({
+  base: ["grid", "h-full"],
+  variants: {
+    layout: {
+      content: ["grid-rows-1"],
+      none: [],
+    },
+  },
+  defaultVariants: { layout: "none" },
+});
+```
+
+Because `cx` goes through the same hook, it resolves conflicts too: `cx("p-2", "p-4")` returns `"p-4"`.
+
+Authoring guide (what to write in a `.variants.ts` file, and when to use `cx`): Storybook [Foundations → Styling variants](https://design.iris.trackunit.com/?path=/docs/foundations-styling-variants--docs).
+
+To compose variant functions, use the `composes` property on a `cva` config.
+
+## Migrating from `cvaMerge`
+
+`cvaMerge` is **gone**. There is no compatibility shim: bumping this package without running the migration is a compile failure, not a deprecation warning.
+
+The old call took the base classes as a positional argument; `cva` takes a single config object with a `base` property:
+
+```ts
+// before
+cvaMerge(["grid", "h-full"], { variants: { … } });
+// after
+cva({ base: ["grid", "h-full"], variants: { … } });
+```
+
+Run these two commands in the consuming repo after bumping the dependency:
+
+```bash
+nx g @trackunit/migrations:migrate
+nx g @trackunit/migrations:run-migrations
+```
+
+`migrate` discovers this package's pending migration and writes it to `trackunit-migrations.json`. `run-migrations` applies it. A second run is a no-op — already-applied identities are recorded and skipped.
+
+The codemod rewrites the imports and the call shape, preserving comments and formatting. Any call site it can't rewrite with confidence — a base or config built at runtime, or an aliased import — is **left untouched and printed with its file and line**. Fix those by hand; the run never guesses at classnames it wasn't sure about.
+
+### `null` variant props
+
+cva 0.7 accepted `null` for a variant prop and suppressed that variant. cva 1.0's types reject `null`, and at runtime `null` falls through to the variant's `defaultVariants` entry. The codemod rewrites variant *definitions*, not their consumers, so these surface as type errors after migrating.
+
+`undefined` is the replacement, but the two are only equivalent when that variant key has **no** `defaultVariants` entry. Where a default exists, `undefined` silently applies the default class instead of no class.
+
+### Pinned prerelease
+
+This package depends on `cva@1.0.0-beta.8`, pinned exactly (no caret). The bare `cva` npm name's `latest` dist-tag resolves to an unrelated squatted package, and a future stable 1.0.0 may require another migration — the composition primitive in particular has already changed shape between betas.
 
 For more info and a full guide on Iris App SDK Development, please visit our [Developer Hub](https://developers.trackunit.com/).
 

package/index.cjs.js

@@ -1,16 +1,25 @@
 'use strict';
 
-var classVarianceAuthority = require('class-variance-authority');
+var cva$1 = require('cva');
 var tailwindMerge = require('tailwind-merge');
 
-// This _is_ the wrapper, so it's the only place we need to import directly from class-variance-authority.
+// This _is_ the wrapper, so it's the only place we need to import directly from the cva package.
 // eslint-disable-next-line no-restricted-imports
 /**
- * A wrapper around CVA that uses tailwind-merge to merge the classes.
+ * `cva` and `cx`, bound to a shared config whose `onComplete` hook runs every
+ * generated class string through tailwind-merge.
+ *
+ * Note that because of that hook, this `cx` resolves Tailwind conflicts rather than
+ * merely concatenating like the upstream `cx`/`clsx` of the same name: given
+ * `cx("p-2", "p-4")` the losing `p-2` is dropped.
+ *
+ * Composition is available through the `composes` property on a `cva` config;
+ * `defineConfig` also returns a `compose` function, but it is deprecated upstream
+ * in favour of `composes`, so it is deliberately not re-exported here.
  */
-const cvaMerge = (base, config) => {
-    const classes = classVarianceAuthority.cva(base, config);
-    return props => tailwindMerge.twMerge(classes(props));
-};
+const { cva, cx } = cva$1.defineConfig({
+    hooks: { onComplete: className => tailwindMerge.twMerge(className) },
+});
 
-exports.cvaMerge = cvaMerge;
+exports.cva = cva;
+exports.cx = cx;

package/index.esm.js

@@ -1,14 +1,22 @@
-import { cva } from 'class-variance-authority';
+import { defineConfig } from 'cva';
 import { twMerge } from 'tailwind-merge';
 
-// This _is_ the wrapper, so it's the only place we need to import directly from class-variance-authority.
+// This _is_ the wrapper, so it's the only place we need to import directly from the cva package.
 // eslint-disable-next-line no-restricted-imports
 /**
- * A wrapper around CVA that uses tailwind-merge to merge the classes.
+ * `cva` and `cx`, bound to a shared config whose `onComplete` hook runs every
+ * generated class string through tailwind-merge.
+ *
+ * Note that because of that hook, this `cx` resolves Tailwind conflicts rather than
+ * merely concatenating like the upstream `cx`/`clsx` of the same name: given
+ * `cx("p-2", "p-4")` the losing `p-2` is dropped.
+ *
+ * Composition is available through the `composes` property on a `cva` config;
+ * `defineConfig` also returns a `compose` function, but it is deprecated upstream
+ * in favour of `composes`, so it is deliberately not re-exported here.
  */
-const cvaMerge = (base, config) => {
-    const classes = cva(base, config);
-    return props => twMerge(classes(props));
-};
+const { cva, cx } = defineConfig({
+    hooks: { onComplete: className => twMerge(className) },
+});
 
-export { cvaMerge };
+export { cva, cx };

package/migrations/utils/ast-utils.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logSummary = exports.lineOf = exports.applyEdits = exports.hasSyntaxErrors = exports.parseTs = exports.visitTsFiles = void 0;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+const ts = tslib_1.__importStar(require("typescript"));
+/**
+ * Migrations are compiled per package (`tsconfig.migrations.json` sets `rootDir: "."`),
+ * so these helpers deliberately mirror `libs/react/components/migrations/utils/jsx-utils.ts`
+ * rather than importing it across package boundaries.
+ */
+/**
+ * Plain JavaScript is included because consumer repos running these migrations
+ * aren't all TypeScript, and a skipped file is a silent miss rather than a flag.
+ */
+const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+const isTsFile = (filePath) => SOURCE_EXTENSIONS.some(ext => filePath.endsWith(ext));
+const isUnderNodeModules = (filePath) => filePath.includes("/node_modules/") || filePath.startsWith("node_modules/");
+const isUnderDist = (filePath) => filePath.includes("/dist/") || filePath.startsWith("dist/") || filePath.includes("/.nx/");
+/**
+ * Visits every TypeScript file under the workspace root and invokes the callback
+ * with the file path and its contents. Files not containing the marker substring
+ * are skipped, which keeps a ~30k-file workspace cheap to scan.
+ */
+const visitTsFiles = (tree, marker, callback) => {
+    let touched = 0;
+    (0, devkit_1.visitNotIgnoredFiles)(tree, "/", filePath => {
+        if (!isTsFile(filePath))
+            return;
+        if (isUnderNodeModules(filePath) || isUnderDist(filePath))
+            return;
+        const content = tree.read(filePath, "utf-8");
+        if (content === null)
+            return;
+        if (!content.includes(marker))
+            return;
+        const updated = callback(filePath, content);
+        if (updated !== null && updated !== undefined && updated !== content) {
+            tree.write(filePath, updated);
+            touched += 1;
+        }
+    });
+    return touched;
+};
+exports.visitTsFiles = visitTsFiles;
+/**
+ * `.tsx`/`.jsx` need `ScriptKind.TSX` so JSX is recognised; anything else needs a
+ * non-JSX kind, because TSX reinterprets angle brackets. A `.ts` file containing
+ * `<TValue>(value: TValue) => …` (a generic arrow) or `<Foo>expr` (an old-style
+ * assertion) parses as JSX under TSX instead, which silently produces zero call
+ * sites rather than the file this codemod is meant to see.
+ */
+const scriptKindOf = (fileName) => {
+    if (fileName.endsWith(".tsx") || fileName.endsWith(".jsx"))
+        return ts.ScriptKind.TSX;
+    if (fileName.endsWith(".js") || fileName.endsWith(".mjs") || fileName.endsWith(".cjs"))
+        return ts.ScriptKind.JS;
+    return ts.ScriptKind.TS;
+};
+/**
+ * Parses `content` for its extension's grammar. `setParentNodes` is on because the
+ * codemod relies on `getStart(sourceFile)` for text-range edits.
+ */
+const parseTs = (content, fileName = "file.ts") => ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true, scriptKindOf(fileName));
+exports.parseTs = parseTs;
+/**
+ * True when `content` does not parse cleanly as its extension's grammar. Checked
+ * through the public `transpileModule` API -- syntactic diagnostics only, no
+ * type-checking -- so a file this codemod cannot safely analyse is flagged instead
+ * of silently skipped or, worse, misread as some other file type's grammar.
+ */
+const hasSyntaxErrors = (content, fileName) => {
+    const { diagnostics } = ts.transpileModule(content, {
+        fileName,
+        reportDiagnostics: true,
+        compilerOptions: { jsx: ts.JsxEmit.ReactJSX },
+    });
+    return (diagnostics ?? []).length > 0;
+};
+exports.hasSyntaxErrors = hasSyntaxErrors;
+/**
+ * Applies edits back onto the original source text, highest offset first so
+ * earlier offsets stay valid. Rewriting text ranges rather than re-printing the
+ * AST is what preserves comments and formatting outside the edited spans.
+ *
+ * Overlapping edits are rejected rather than applied: because every replacement is
+ * built by slicing the *original* text, applying two edits over the same range
+ * corrupts the file silently. A codemod that crashes is recoverable; one that
+ * quietly emits broken source is not.
+ */
+const applyEdits = (content, edits) => {
+    const ordered = [...edits].sort((a, b) => b.start - a.start);
+    for (const [index, edit] of ordered.entries()) {
+        const next = ordered[index + 1];
+        if (next !== undefined && next.end > edit.start) {
+            throw new Error(`applyEdits received overlapping edits: [${next.start}, ${next.end}) overlaps [${edit.start}, ${edit.end})`);
+        }
+    }
+    let updated = content;
+    for (const { start, end, text } of ordered) {
+        updated = updated.slice(0, start) + text + updated.slice(end);
+    }
+    return updated;
+};
+exports.applyEdits = applyEdits;
+/** Resolves a node offset to a 1-based line number. */
+const lineOf = (sourceFile, position) => sourceFile.getLineAndCharacterOfPosition(position).line + 1;
+exports.lineOf = lineOf;
+/**
+ * Logs a one-line summary plus, when present, every flagged call site with a
+ * resolvable `file:line` so a developer can work through them by hand.
+ */
+const logSummary = (migrationName, touched, flagged) => {
+    if (touched === 0) {
+        devkit_1.logger.info(`  ${migrationName}: no files changed`);
+    }
+    else {
+        devkit_1.logger.info(`  ${migrationName}: updated ${touched} file(s)`);
+    }
+    if (flagged.length === 0)
+        return;
+    devkit_1.logger.warn(`  ${migrationName}: ${flagged.length} call site(s) need manual migration:`);
+    for (const site of flagged) {
+        devkit_1.logger.warn(`    ${site.filePath}:${site.line} — ${site.reason}`);
+        devkit_1.logger.warn(`      ${site.snippet}`);
+    }
+};
+exports.logSummary = logSummary;
+//# sourceMappingURL=ast-utils.js.map

package/migrations/v2-0-0/cva-merge-to-cva.js

@@ -0,0 +1,425 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cvaMergeToCva = exports.collectFlaggedSites = void 0;
+const tslib_1 = require("tslib");
+const ts = tslib_1.__importStar(require("typescript"));
+const ast_utils_1 = require("../utils/ast-utils");
+const MIGRATION_NAME = "v2-0-0-cva-merge-to-cva";
+const MODULE = "@trackunit/css-class-variance-utilities";
+const LEGACY_EXPORT = "cvaMerge";
+const NEXT_EXPORT = "cva";
+const MAX_SNIPPET_LENGTH = 100;
+const findImportUsage = (sourceFile) => {
+    let legacySpecifier = null;
+    let hasNextExport = false;
+    let namedImports = null;
+    let unsupportedShape = null;
+    const isOwnModule = (moduleSpecifier) => moduleSpecifier !== undefined && ts.isStringLiteral(moduleSpecifier) && moduleSpecifier.text === MODULE;
+    for (const statement of sourceFile.statements) {
+        // `export { cvaMerge } from "…"` re-publishes the old name, so rewriting the
+        // re-export would break whoever imports it from here.
+        if (ts.isExportDeclaration(statement) && isOwnModule(statement.moduleSpecifier)) {
+            const clause = statement.exportClause;
+            if (clause !== undefined &&
+                ts.isNamedExports(clause) &&
+                clause.elements.some(element => (element.propertyName?.text ?? element.name.text) === LEGACY_EXPORT)) {
+                unsupportedShape ?? (unsupportedShape = {
+                    reason: `${LEGACY_EXPORT} is re-exported from this file, so removing it would break importers`,
+                    node: statement,
+                });
+            }
+            continue;
+        }
+        if (!ts.isImportDeclaration(statement))
+            continue;
+        if (!isOwnModule(statement.moduleSpecifier))
+            continue;
+        const bindings = statement.importClause?.namedBindings;
+        if (bindings === undefined)
+            continue;
+        // `import * as utils` then `utils.cvaMerge(...)` — the call sites are property
+        // accesses, which this codemod doesn't rewrite.
+        if (ts.isNamespaceImport(bindings)) {
+            unsupportedShape ?? (unsupportedShape = {
+                reason: `${MODULE} is imported as a namespace, so ${LEGACY_EXPORT} call sites were left untouched`,
+                node: statement,
+            });
+            continue;
+        }
+        if (!ts.isNamedImports(bindings))
+            continue;
+        for (const element of bindings.elements) {
+            const importedName = element.propertyName?.text ?? element.name.text;
+            if (importedName === LEGACY_EXPORT) {
+                namedImports = bindings;
+                if (element.propertyName !== undefined) {
+                    // `cvaMerge as somethingElse` — call sites don't spell `cvaMerge`, so
+                    // rewriting them safely would mean tracking the alias everywhere.
+                    unsupportedShape ?? (unsupportedShape = {
+                        reason: `${LEGACY_EXPORT} is imported under an alias, so its call sites were left untouched`,
+                        node: element,
+                    });
+                }
+                else {
+                    legacySpecifier = element;
+                }
+            }
+            if (importedName === NEXT_EXPORT && element.propertyName === undefined) {
+                hasNextExport = true;
+            }
+        }
+    }
+    return { legacySpecifier, hasNextExport, namedImports, unsupportedShape };
+};
+const findLegacyCalls = (sourceFile) => {
+    const calls = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === LEGACY_EXPORT) {
+            calls.push(node);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return calls;
+};
+/**
+ * Every use of the bare identifier, excluding the import specifier that declares it
+ * and `x.cvaMerge` property accesses that resolve elsewhere. Used to decide whether
+ * retiring the import would leave a dangling reference behind.
+ */
+const findIdentifierReferences = (sourceFile, name) => {
+    const references = [];
+    const visit = (node) => {
+        if (ts.isIdentifier(node) && node.text === name) {
+            const { parent } = node;
+            const declaresTheBinding = ts.isImportSpecifier(parent);
+            const isMemberName = ts.isPropertyAccessExpression(parent) && parent.name === node;
+            if (!declaresTheBinding && !isMemberName) {
+                references.push(node);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return references;
+};
+/**
+ * True when a binding name -- a plain identifier, or a (possibly nested)
+ * destructuring pattern -- binds `name` anywhere inside it. `const { cva } = registry`
+ * is idiomatic in this package's own `src/cva.ts` (`export const { cva, cx } =
+ * defineConfig(...)`), so a plain `ts.isIdentifier` check on the top-level name misses
+ * exactly the shape most likely to appear here.
+ */
+const bindingNameBinds = (bindingName, name) => {
+    if (ts.isIdentifier(bindingName)) {
+        return bindingName.text === name;
+    }
+    return bindingName.elements.some(element => !ts.isOmittedExpression(element) && bindingNameBinds(element.name, name));
+};
+/** True when the file declares `name` itself, which would shadow or collide with an import. */
+const declaresNameLocally = (sourceFile, name) => {
+    let found = null;
+    const visit = (node) => {
+        if (found !== null)
+            return;
+        if ((ts.isVariableDeclaration(node) || ts.isParameter(node)) && bindingNameBinds(node.name, name)) {
+            found = node;
+            return;
+        }
+        const isSimpleNamedDeclaration = ts.isFunctionDeclaration(node) ||
+            ts.isClassDeclaration(node) ||
+            ts.isTypeAliasDeclaration(node) ||
+            ts.isInterfaceDeclaration(node) ||
+            ts.isEnumDeclaration(node);
+        if (isSimpleNamedDeclaration && node.name !== undefined && node.name.text === name) {
+            found = node;
+            return;
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return found;
+};
+/**
+ * Any binding of `name` other than the already-tracked unaliased `cva` import from
+ * this library (`hasNextExport`, checked by the caller before this runs).
+ *
+ * Every import declaration is scanned, including ones from this library: an aliased
+ * import such as `import { twMerge as cva, cvaMerge } from MODULE` binds `cva` just as
+ * much as one from any other module does, and skipping this library's own imports
+ * wholesale used to let exactly that alias through unnoticed.
+ */
+const bindsForeignName = (sourceFile, name) => {
+    for (const statement of sourceFile.statements) {
+        if (!ts.isImportDeclaration(statement))
+            continue;
+        const clause = statement.importClause;
+        if (clause === undefined)
+            continue;
+        if (clause.name?.text === name)
+            return statement;
+        const bindings = clause.namedBindings;
+        if (bindings === undefined)
+            continue;
+        if (ts.isNamespaceImport(bindings)) {
+            if (bindings.name.text === name)
+                return statement;
+            continue;
+        }
+        if (bindings.elements.some(element => element.name.text === name))
+            return statement;
+    }
+    return declaresNameLocally(sourceFile, name);
+};
+/**
+ * A base argument is safe to relocate when it is a literal we can move verbatim.
+ * Array literals qualify regardless of what their elements are — spreads and call
+ * expressions inside are moved along with the literal, never interpreted.
+ */
+const isRelocatableBase = (node) => ts.isArrayLiteralExpression(node) || ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node);
+const isRelocatableConfig = (node) => {
+    if (node === undefined)
+        return true;
+    if (!ts.isObjectLiteralExpression(node))
+        return false;
+    // A spread could itself carry a `base` key, which would then race with the
+    // `base` we are introducing. Not worth guessing at.
+    return !node.properties.some(property => ts.isSpreadAssignment(property));
+};
+/**
+ * The replacement re-emits the arguments but not the punctuation between them, so
+ * a comment living in that punctuation would be dropped silently.
+ */
+const hasCommentOutsideArguments = (content, sourceFile, call) => {
+    const [base, config] = call.arguments;
+    if (base === undefined)
+        return false;
+    const carriesComment = (from, to) => {
+        const between = content.slice(from, to);
+        return between.includes("//") || between.includes("/*");
+    };
+    // Covers the callee → `(` → base span too: `buildReplacement` re-emits only
+    // `baseText` and the config interior, so a comment anywhere else in the call
+    // -- including here -- would otherwise disappear silently.
+    if (carriesComment(call.getStart(sourceFile), base.getStart(sourceFile)))
+        return true;
+    if (config === undefined)
+        return carriesComment(base.getEnd(), call.getEnd());
+    return carriesComment(base.getEnd(), config.getStart(sourceFile)) || carriesComment(config.getEnd(), call.getEnd());
+};
+/**
+ * Two legacy calls where one encloses the other would produce overlapping edits,
+ * because each replacement is built by slicing the *original* text.
+ */
+const findOverlappingCalls = (calls, sourceFile) => {
+    const overlapping = new Set();
+    for (const outer of calls) {
+        for (const inner of calls) {
+            if (outer === inner)
+                continue;
+            if (outer.getStart(sourceFile) <= inner.getStart(sourceFile) && outer.getEnd() >= inner.getEnd()) {
+                overlapping.add(outer);
+                overlapping.add(inner);
+            }
+        }
+    }
+    return overlapping;
+};
+/** Why a call site was left for a human, phrased for the migration report. */
+const rejectionReason = (content, sourceFile, call, overlapping) => {
+    if (overlapping.has(call)) {
+        return `nested ${LEGACY_EXPORT} calls cannot be rewritten as one edit; migrate the innermost call by hand first`;
+    }
+    if (call.arguments.length > 2) {
+        return `unexpected argument count (${call.arguments.length}); ${LEGACY_EXPORT} takes at most 2`;
+    }
+    const [base, config] = call.arguments;
+    if (base !== undefined && !isRelocatableBase(base)) {
+        return "base is not an array or string literal, so it cannot be folded into `base:` automatically";
+    }
+    if (config !== undefined && !isRelocatableConfig(config)) {
+        return ts.isObjectLiteralExpression(config)
+            ? "config object uses a spread, which may itself define `base`"
+            : "config is not an object literal, so its properties cannot be merged into the new config";
+    }
+    if (hasCommentOutsideArguments(content, sourceFile, call)) {
+        return "a comment sits between the arguments, which the rewrite would discard";
+    }
+    return null;
+};
+const buildReplacement = (content, sourceFile, call) => {
+    const [base, config] = call.arguments;
+    if (base === undefined)
+        return `${NEXT_EXPORT}({})`;
+    const baseText = content.slice(base.getStart(sourceFile), base.getEnd());
+    let inner = "";
+    if (config !== undefined) {
+        // Slice between the braces so interior comments and formatting survive.
+        inner = content.slice(config.getStart(sourceFile) + 1, config.getEnd() - 1).trim();
+    }
+    if (inner === "")
+        return `${NEXT_EXPORT}({ base: ${baseText} })`;
+    // The closing brace goes on its own line: the sliced interior can end in a `//`
+    // comment, which would otherwise swallow it. Prettier reflows short configs back
+    // onto one line afterwards.
+    return `${NEXT_EXPORT}({\n  base: ${baseText},\n  ${inner}\n})`;
+};
+const COMMENT = /\/\*[\s\S]*?\*\/|\/\/[^\n]*/;
+/**
+ * Removes a named import specifier along with the comma that joins it to its
+ * neighbour, so `{ cva, cvaMerge }` becomes `{ cva }` rather than `{ cva,  }`.
+ *
+ * When a comment lives in that joining span, the comma is left in place instead —
+ * a trailing comma in a named import list is legal, and keeping it is what lets the
+ * comment survive.
+ */
+const buildSpecifierRemoval = (content, sourceFile, namedImports, specifier) => {
+    const elements = namedImports.elements;
+    if (elements.length === 1) {
+        // Emptying the list would leave `import {} from "…";` behind.
+        const declaration = namedImports.parent.parent;
+        return { start: declaration.getStart(sourceFile), end: declaration.getEnd(), text: "" };
+    }
+    const index = elements.indexOf(specifier);
+    const previous = index > 0 ? elements[index - 1] : undefined;
+    const next = elements[index + 1];
+    const start = previous === undefined ? specifier.getStart(sourceFile) : previous.getEnd();
+    const end = previous === undefined && next !== undefined ? next.getStart(sourceFile) : specifier.getEnd();
+    if (COMMENT.test(content.slice(start, end))) {
+        return { start: specifier.getStart(sourceFile), end: specifier.getEnd(), text: "" };
+    }
+    return { start, end, text: "" };
+};
+const analyzeFile = (filePath, content) => {
+    // Checked before parsing for this codemod's own purposes: a file that doesn't
+    // parse cleanly can't be trusted to report an accurate call-site list, so it's
+    // flagged instead of silently analysed with whatever the parser recovered.
+    if ((0, ast_utils_1.hasSyntaxErrors)(content, filePath)) {
+        return { updated: null, flagged: [{ filePath, line: 1, reason: "file does not parse cleanly", snippet: "" }] };
+    }
+    const sourceFile = (0, ast_utils_1.parseTs)(content, filePath);
+    const { legacySpecifier, hasNextExport, namedImports, unsupportedShape } = findImportUsage(sourceFile);
+    const snippetOf = (node) => {
+        const text = content.slice(node.getStart(sourceFile), node.getEnd()).replace(/\s+/g, " ");
+        return text.length > MAX_SNIPPET_LENGTH ? `${text.slice(0, MAX_SNIPPET_LENGTH)}…` : text;
+    };
+    const bail = (node, reason) => ({
+        updated: null,
+        flagged: [{ filePath, line: (0, ast_utils_1.lineOf)(sourceFile, node.getStart(sourceFile)), reason, snippet: snippetOf(node) }],
+    });
+    if (unsupportedShape !== null) {
+        return bail(unsupportedShape.node, unsupportedShape.reason);
+    }
+    // Not imported from our module — a same-named local helper, or an unrelated file.
+    if (legacySpecifier === null || namedImports === null) {
+        return { updated: null, flagged: [] };
+    }
+    // A local `cvaMerge` shadows the import inside its scope, so a bare `cvaMerge(...)`
+    // may not be this library's function at all. Rewriting it would change behaviour
+    // without a compile error to catch it.
+    const shadow = declaresNameLocally(sourceFile, LEGACY_EXPORT);
+    if (shadow !== null) {
+        return bail(shadow, `this file also declares its own ${LEGACY_EXPORT}, so call sites are ambiguous`);
+    }
+    // Introducing `cva` on top of an existing `cva` binding is a duplicate identifier
+    // in TypeScript and a silent shadow in plain JavaScript.
+    if (!hasNextExport) {
+        const collision = bindsForeignName(sourceFile, NEXT_EXPORT);
+        if (collision !== null) {
+            return bail(collision, `the name ${NEXT_EXPORT} is already bound in this file, so the import cannot be renamed`);
+        }
+    }
+    const calls = findLegacyCalls(sourceFile);
+    const overlapping = findOverlappingCalls(calls, sourceFile);
+    const edits = [];
+    const flagged = [];
+    /** Offsets of the callee identifiers this run consumed, keyed by position. */
+    const rewrittenCallees = new Set();
+    for (const call of calls) {
+        const reason = rejectionReason(content, sourceFile, call, overlapping);
+        if (reason !== null) {
+            flagged.push({
+                filePath,
+                line: (0, ast_utils_1.lineOf)(sourceFile, call.getStart(sourceFile)),
+                reason,
+                snippet: snippetOf(call),
+            });
+            continue;
+        }
+        edits.push({
+            start: call.getStart(sourceFile),
+            end: call.getEnd(),
+            text: buildReplacement(content, sourceFile, call),
+        });
+        rewrittenCallees.add(call.expression.getStart(sourceFile));
+    }
+    if (rewrittenCallees.size === 0) {
+        return { updated: null, flagged };
+    }
+    // The import can only be retired once *every* reference is gone, not just every
+    // call: `export { cvaMerge }` and `typeof cvaMerge` keep needing the binding.
+    const leftoverReferences = findIdentifierReferences(sourceFile, LEGACY_EXPORT).filter(reference => !rewrittenCallees.has(reference.getStart(sourceFile)));
+    for (const reference of leftoverReferences) {
+        if (ts.isCallExpression(reference.parent) && reference.parent.expression === reference)
+            continue;
+        flagged.push({
+            filePath,
+            line: (0, ast_utils_1.lineOf)(sourceFile, reference.getStart(sourceFile)),
+            reason: `${LEGACY_EXPORT} is used here without being called, so the import was kept`,
+            snippet: snippetOf(reference.parent),
+        });
+    }
+    if (leftoverReferences.length === 0) {
+        edits.push(hasNextExport
+            ? buildSpecifierRemoval(content, sourceFile, namedImports, legacySpecifier)
+            : {
+                start: legacySpecifier.getStart(sourceFile),
+                end: legacySpecifier.getEnd(),
+                text: NEXT_EXPORT,
+            });
+    }
+    else if (!hasNextExport) {
+        edits.push({
+            start: legacySpecifier.getStart(sourceFile),
+            end: legacySpecifier.getStart(sourceFile),
+            text: `${NEXT_EXPORT}, `,
+        });
+    }
+    return { updated: (0, ast_utils_1.applyEdits)(content, edits), flagged };
+};
+/**
+ * Reports every `cvaMerge` call site the codemod would decline to rewrite,
+ * without modifying the tree. Exported so the bulk cutover can preview the
+ * manual work before committing to a run.
+ */
+const collectFlaggedSites = (tree) => {
+    const flagged = [];
+    (0, ast_utils_1.visitTsFiles)(tree, LEGACY_EXPORT, (filePath, content) => {
+        flagged.push(...analyzeFile(filePath, content).flagged);
+        return null;
+    });
+    return flagged;
+};
+exports.collectFlaggedSites = collectFlaggedSites;
+/**
+ * Rewrites `cvaMerge(base, config)` call sites to cva 1.0's `cva({ base, ...config })`
+ * shape and updates the corresponding imports.
+ *
+ * Call sites that cannot be rewritten with confidence are left exactly as they are
+ * and reported instead. A missed rewrite costs one manual edit; a wrong rewrite
+ * silently changes rendered classnames, which the upgrade explicitly forbids.
+ *
+ * Running twice is a no-op: migrated code calls `cva`, which this codemod ignores.
+ */
+const cvaMergeToCva = (tree) => {
+    const flagged = [];
+    const touched = (0, ast_utils_1.visitTsFiles)(tree, LEGACY_EXPORT, (filePath, content) => {
+        const analysis = analyzeFile(filePath, content);
+        flagged.push(...analysis.flagged);
+        return analysis.updated;
+    });
+    (0, ast_utils_1.logSummary)(MIGRATION_NAME, touched, flagged);
+};
+exports.cvaMergeToCva = cvaMergeToCva;
+exports.default = exports.cvaMergeToCva;
+//# sourceMappingURL=cva-merge-to-cva.js.map

package/migrations.json

@@ -1,3 +1,9 @@
 {
-  "generators": {}
+  "generators": {
+    "v2-0-0-cva-merge-to-cva": {
+      "version": "2.0.0",
+      "description": "Rewrite cvaMerge(base, config) call sites to cva 1.0's cva({ base, ...config }) shape, and report any call site that cannot be rewritten safely.",
+      "implementation": "./migrations/v2-0-0/cva-merge-to-cva"
+    }
+  }
 }

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@trackunit/css-class-variance-utilities",
-  "version": "1.14.28",
+  "version": "2.0.0",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "engines": {
     "node": ">=24.x"
   },
   "dependencies": {
-    "class-variance-authority": "^0.7.0",
+    "cva": "1.0.0-beta.8",
     "tailwind-merge": "^2.0.0"
   },
   "migrations": "./migrations.json",

package/src/cva.d.ts

@@ -1,8 +1,17 @@
-import { cva as OriginalCva, type VariantProps as OriginalVariantProps } from "class-variance-authority";
+import { type VariantProps as OriginalVariantProps } from "cva";
 export type VariantProps<TComponent extends (...args: any) => any> = OriginalVariantProps<TComponent> & {
     className: string;
 };
 /**
- * A wrapper around CVA that uses tailwind-merge to merge the classes.
+ * `cva` and `cx`, bound to a shared config whose `onComplete` hook runs every
+ * generated class string through tailwind-merge.
+ *
+ * Note that because of that hook, this `cx` resolves Tailwind conflicts rather than
+ * merely concatenating like the upstream `cx`/`clsx` of the same name: given
+ * `cx("p-2", "p-4")` the losing `p-2` is dropped.
+ *
+ * Composition is available through the `composes` property on a `cva` config;
+ * `defineConfig` also returns a `compose` function, but it is deprecated upstream
+ * in favour of `composes`, so it is deliberately not re-exported here.
  */
-export declare const cvaMerge: typeof OriginalCva;
+export declare const cva: import("cva").CVA, cx: import("cva").CX;