bestax-migrate 0.0.1 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +30 -0
  2. package/dist/index.d.ts.map +1 -1
  3. package/dist/index.js +4 -3
  4. package/package.json +12 -10
package/README.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # bestax-migrate
2
2
 
3
+ [![npm version](https://img.shields.io/npm/v/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)
4
+ [![npm downloads](https://img.shields.io/npm/dm/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)
5
+ [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
6
+ [![Socket Badge](https://socket.dev/api/badge/npm/package/bestax-migrate)](https://socket.dev/npm/package/bestax-migrate/overview)
7
+ [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)
8
+ [![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/bestax-migrate#provenance)
9
+ [![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)
10
+
3
11
  Codemods that migrate existing React apps to [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — the actively maintained React component library for **Bulma v1**.
4
12
 
5
13
  Currently supported source libraries:
@@ -8,6 +16,14 @@ Currently supported source libraries:
8
16
  | -------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
9
17
  | [`react-bulma-components`](https://github.com/couds/react-bulma-components) (v4) | ✅ All 32 components mapped (a few patterns are flagged as TODOs) |
10
18
 
19
+ ## Requirements
20
+
21
+ **Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the CLI
22
+ exits immediately with an explicit upgrade message.
23
+
24
+ This applies only to the Node version the codemod itself runs on. It places no requirement on
25
+ the app being migrated — the source is read as text and is never executed.
26
+
11
27
  ## Usage
12
28
 
13
29
  ```bash
@@ -54,6 +70,20 @@ npx skills add https://github.com/allxsmith/bestax --skill bestax-migrate
54
70
 
55
71
  Full walkthrough: [react-bulma-components migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components).
56
72
 
73
+ ## Hardened by default
74
+
75
+ A codemod rewrites your source in place, so how it is built and published matters:
76
+
77
+ - **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/bestax-migrate#provenance), or run `npm audit signatures`.
78
+ - **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.
79
+ - **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.
80
+ - **The libraries this tool migrates away from are never installed here** — source fixtures are read as text only, so no unmaintained third-party package enters the dependency tree.
81
+ - **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.
82
+ - **Every GitHub Action is pinned to a full commit SHA**, and CodeQL, Dependency Review, and Dependabot run continuously alongside a high-severity `pnpm audit` gate.
83
+ - **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.
84
+
85
+ Full detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)
86
+
57
87
  ## License
58
88
 
59
89
  MIT © Alex Smith
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG;AAOH,OAAO,EAAE,CAAC"}
package/dist/index.js CHANGED
@@ -3,10 +3,11 @@
3
3
  * bin entry for bestax-migrate. Keep this thin — the program lives in cli.ts
4
4
  * so tests can drive it without spawning a process.
5
5
  */
6
- import { createCLI } from './cli.js';
7
6
  const [major] = process.versions.node.split('.').map(Number);
8
- if (major < 18) {
9
- console.error(`bestax-migrate requires Node 18 or newer (found ${process.versions.node}).`);
7
+ if (major < 22) {
8
+ console.error(`bestax-migrate requires Node 22 or newer (found ${process.versions.node}).`);
10
9
  process.exit(1);
11
10
  }
11
+ const { createCLI } = await import('./cli.js');
12
12
  createCLI().parse();
13
+ export {};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bestax-migrate",
3
- "version": "0.0.1",
3
+ "version": "2.0.0",
4
4
  "description": "Codemods for migrating existing React apps from other Bulma libraries to @allxsmith/bestax-bulma",
5
5
  "type": "module",
6
6
  "bin": {
@@ -21,7 +21,9 @@
21
21
  "format": "prettier --write \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
22
22
  "format:check": "prettier --check \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
23
23
  "clean": "rimraf dist",
24
- "release": "npx semantic-release"
24
+ "release": "npx semantic-release",
25
+ "prepack": "node scripts/pack-manifest.mjs prepack",
26
+ "postpack": "node scripts/pack-manifest.mjs postpack"
25
27
  },
26
28
  "keywords": [
27
29
  "bestax",
@@ -35,7 +37,7 @@
35
37
  "author": "Alex Smith",
36
38
  "license": "MIT",
37
39
  "engines": {
38
- "node": ">=18.0.0"
40
+ "node": ">=22"
39
41
  },
40
42
  "repository": {
41
43
  "type": "git",
@@ -48,27 +50,27 @@
48
50
  "url": "https://github.com/allxsmith/bestax/issues"
49
51
  },
50
52
  "dependencies": {
51
- "@allxsmith/bestax-bulma": "workspace:^",
52
53
  "@babel/parser": "^7.26.0",
53
- "chalk": "^5.6.2",
54
+ "chalk": "^6.0.0",
54
55
  "commander": "^15.0.0",
55
56
  "jscodeshift": "^17.3.0"
56
57
  },
57
58
  "devDependencies": {
59
+ "@allxsmith/bestax-bulma": "^5.8.0",
58
60
  "@jest/globals": "^30.0.0",
59
61
  "@types/jest": "^30.0.0",
60
62
  "@types/jscodeshift": "^17.3.0",
61
- "@types/node": "^26.0.1",
63
+ "@types/node": "^26.1.2",
62
64
  "@types/react": "^19.0.0",
63
65
  "@types/react-dom": "^19.0.0",
64
66
  "jest": "^30.2.0",
65
- "react": "^19.0.0",
66
- "react-dom": "^19.0.0",
67
- "ts-jest": "^29.4.6",
67
+ "react": "^19.2.8",
68
+ "react-dom": "^19.2.8",
69
+ "ts-jest": "^29.4.12",
68
70
  "typescript": "^6.0.3"
69
71
  },
70
72
  "publishConfig": {
71
73
  "access": "public",
72
- "provenance": "false"
74
+ "provenance": true
73
75
  }
74
76
  }