bestax-migrate 1.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +30 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -3
- package/dist/runner.d.ts.map +1 -1
- package/dist/runner.js +17 -0
- package/package.json +27 -27
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Alex Smith
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# bestax-migrate
|
|
2
2
|
|
|
3
|
+
[](https://www.npmjs.com/package/bestax-migrate)
|
|
4
|
+
[](https://www.npmjs.com/package/bestax-migrate)
|
|
5
|
+
[](https://opensource.org/licenses/MIT)
|
|
6
|
+
[](https://socket.dev/npm/package/bestax-migrate/overview)
|
|
7
|
+
[](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)
|
|
8
|
+
[](https://www.npmjs.com/package/bestax-migrate#provenance)
|
|
9
|
+
[](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)
|
|
10
|
+
|
|
3
11
|
Codemods that migrate existing React apps to [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — the actively maintained React component library for **Bulma v1**.
|
|
4
12
|
|
|
5
13
|
Currently supported source libraries:
|
|
@@ -8,6 +16,14 @@ Currently supported source libraries:
|
|
|
8
16
|
| -------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
|
|
9
17
|
| [`react-bulma-components`](https://github.com/couds/react-bulma-components) (v4) | ✅ All 32 components mapped (a few patterns are flagged as TODOs) |
|
|
10
18
|
|
|
19
|
+
## Requirements
|
|
20
|
+
|
|
21
|
+
**Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the CLI
|
|
22
|
+
exits immediately with an explicit upgrade message.
|
|
23
|
+
|
|
24
|
+
This applies only to the Node version the codemod itself runs on. It places no requirement on
|
|
25
|
+
the app being migrated — the source is read as text and is never executed.
|
|
26
|
+
|
|
11
27
|
## Usage
|
|
12
28
|
|
|
13
29
|
```bash
|
|
@@ -54,6 +70,20 @@ npx skills add https://github.com/allxsmith/bestax --skill bestax-migrate
|
|
|
54
70
|
|
|
55
71
|
Full walkthrough: [react-bulma-components migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components).
|
|
56
72
|
|
|
73
|
+
## Hardened by default
|
|
74
|
+
|
|
75
|
+
A codemod rewrites your source in place, so how it is built and published matters:
|
|
76
|
+
|
|
77
|
+
- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/bestax-migrate#provenance), or run `npm audit signatures`.
|
|
78
|
+
- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.
|
|
79
|
+
- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.
|
|
80
|
+
- **The libraries this tool migrates away from are never installed here** — source fixtures are read as text only, so no unmaintained third-party package enters the dependency tree.
|
|
81
|
+
- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.
|
|
82
|
+
- **Every GitHub Action is pinned to a full commit SHA**, and CodeQL, Dependency Review, and Dependabot run continuously alongside a high-severity `pnpm audit` gate.
|
|
83
|
+
- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.
|
|
84
|
+
|
|
85
|
+
Full detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)
|
|
86
|
+
|
|
57
87
|
## License
|
|
58
88
|
|
|
59
89
|
MIT © Alex Smith
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG;AAOH,OAAO,EAAE,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -3,10 +3,11 @@
|
|
|
3
3
|
* bin entry for bestax-migrate. Keep this thin — the program lives in cli.ts
|
|
4
4
|
* so tests can drive it without spawning a process.
|
|
5
5
|
*/
|
|
6
|
-
import { createCLI } from './cli.js';
|
|
7
6
|
const [major] = process.versions.node.split('.').map(Number);
|
|
8
|
-
if (major <
|
|
9
|
-
console.error(`bestax-migrate requires Node
|
|
7
|
+
if (major < 22) {
|
|
8
|
+
console.error(`bestax-migrate requires Node 22 or newer (found ${process.versions.node}).`);
|
|
10
9
|
process.exit(1);
|
|
11
10
|
}
|
|
11
|
+
const { createCLI } = await import('./cli.js');
|
|
12
12
|
createCLI().parse();
|
|
13
|
+
export {};
|
package/dist/runner.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA+D3D,kEAAkE;AAClE,wBAAgB,OAAO,IAAI,GAAG,CAO7B;AAED,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,YAAY,CAC1B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,aAAa,EACzB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,SAAS,CASX"}
|
package/dist/runner.js
CHANGED
|
@@ -10,6 +10,23 @@ import jscodeshift from 'jscodeshift';
|
|
|
10
10
|
* jscodeshift's stock `tsx` parser options plus `deprecatedImportAssert`,
|
|
11
11
|
* so files using the legacy `import x from 'y' assert { type: 'json' }`
|
|
12
12
|
* syntax (still emitted by many tools) parse instead of crashing the run.
|
|
13
|
+
*
|
|
14
|
+
* This config pins @babel/parser to 7.x — do not take the 8.x major. Three of
|
|
15
|
+
* the options below are invalid under Babel 8, and the first breaks every run
|
|
16
|
+
* rather than only legacy input:
|
|
17
|
+
*
|
|
18
|
+
* - `pipelineOperator: { proposal: 'minimal' }` — Babel 8 accepts only
|
|
19
|
+
* `fsharp` and `hack`, and rejects the options object before reading any
|
|
20
|
+
* source, so *every* js/jsx/ts/tsx file fails to parse.
|
|
21
|
+
* - `deprecatedImportAssert` — removed with no replacement, taking the
|
|
22
|
+
* legacy `assert { type: 'json' }` form with it (see the regression test
|
|
23
|
+
* "parses the legacy import-assert syntax").
|
|
24
|
+
* - `declare module M {}` — rejected in 8.0.4 (babel/babel#18120), which
|
|
25
|
+
* older TypeScript still uses.
|
|
26
|
+
*
|
|
27
|
+
* A codemod that migrates older codebases must not crash on the syntax those
|
|
28
|
+
* codebases still contain. jscodeshift 17 bundles its own Babel 7 regardless,
|
|
29
|
+
* so staying on 7 also keeps a single parser in the tree rather than two.
|
|
13
30
|
*/
|
|
14
31
|
const PARSER_OPTIONS = {
|
|
15
32
|
sourceType: 'module',
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "bestax-migrate",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "2.0.1",
|
|
4
4
|
"description": "Codemods for migrating existing React apps from other Bulma libraries to @allxsmith/bestax-bulma",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -9,20 +9,6 @@
|
|
|
9
9
|
"files": [
|
|
10
10
|
"dist"
|
|
11
11
|
],
|
|
12
|
-
"scripts": {
|
|
13
|
-
"build": "tsc",
|
|
14
|
-
"dev": "tsc --watch",
|
|
15
|
-
"test": "NODE_OPTIONS=\"--experimental-vm-modules\" jest",
|
|
16
|
-
"test:watch": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --watch",
|
|
17
|
-
"test:coverage": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --coverage",
|
|
18
|
-
"lint": "eslint src e2e",
|
|
19
|
-
"typecheck": "tsc --noEmit",
|
|
20
|
-
"validate:corpus": "pnpm run build && node scripts/validate-corpus.mjs",
|
|
21
|
-
"format": "prettier --write \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
|
|
22
|
-
"format:check": "prettier --check \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
|
|
23
|
-
"clean": "rimraf dist",
|
|
24
|
-
"release": "npx semantic-release"
|
|
25
|
-
},
|
|
26
12
|
"keywords": [
|
|
27
13
|
"bestax",
|
|
28
14
|
"bulma",
|
|
@@ -35,7 +21,7 @@
|
|
|
35
21
|
"author": "Alex Smith",
|
|
36
22
|
"license": "MIT",
|
|
37
23
|
"engines": {
|
|
38
|
-
"node": ">=
|
|
24
|
+
"node": ">=22"
|
|
39
25
|
},
|
|
40
26
|
"repository": {
|
|
41
27
|
"type": "git",
|
|
@@ -48,9 +34,8 @@
|
|
|
48
34
|
"url": "https://github.com/allxsmith/bestax/issues"
|
|
49
35
|
},
|
|
50
36
|
"dependencies": {
|
|
51
|
-
"@allxsmith/bestax-bulma": "workspace:^",
|
|
52
37
|
"@babel/parser": "^7.26.0",
|
|
53
|
-
"chalk": "^
|
|
38
|
+
"chalk": "^6.0.0",
|
|
54
39
|
"commander": "^15.0.0",
|
|
55
40
|
"jscodeshift": "^17.3.0"
|
|
56
41
|
},
|
|
@@ -58,17 +43,32 @@
|
|
|
58
43
|
"@jest/globals": "^30.0.0",
|
|
59
44
|
"@types/jest": "^30.0.0",
|
|
60
45
|
"@types/jscodeshift": "^17.3.0",
|
|
61
|
-
"@types/node": "^26.
|
|
46
|
+
"@types/node": "^26.1.2",
|
|
62
47
|
"@types/react": "^19.0.0",
|
|
63
48
|
"@types/react-dom": "^19.0.0",
|
|
64
49
|
"jest": "^30.2.0",
|
|
65
|
-
"react": "^19.
|
|
66
|
-
"react-dom": "^19.
|
|
67
|
-
"ts-jest": "^29.4.
|
|
68
|
-
"typescript": "^6.0.3"
|
|
50
|
+
"react": "^19.2.8",
|
|
51
|
+
"react-dom": "^19.2.8",
|
|
52
|
+
"ts-jest": "^29.4.12",
|
|
53
|
+
"typescript": "^6.0.3",
|
|
54
|
+
"@allxsmith/bestax-bulma": "^5.11.1"
|
|
69
55
|
},
|
|
70
56
|
"publishConfig": {
|
|
71
|
-
"access": "public"
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
57
|
+
"access": "public"
|
|
58
|
+
},
|
|
59
|
+
"scripts": {
|
|
60
|
+
"build": "tsc",
|
|
61
|
+
"dev": "tsc --watch",
|
|
62
|
+
"test": "NODE_OPTIONS=\"--experimental-vm-modules\" jest",
|
|
63
|
+
"test:watch": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --watch",
|
|
64
|
+
"test:coverage": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --coverage",
|
|
65
|
+
"lint": "eslint src e2e",
|
|
66
|
+
"typecheck": "tsc --noEmit",
|
|
67
|
+
"validate:corpus": "pnpm run build && node scripts/validate-corpus.mjs",
|
|
68
|
+
"format": "prettier --write \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
|
|
69
|
+
"format:check": "prettier --check \"src/**/*.{ts,tsx}\" \"e2e/**/*.ts\"",
|
|
70
|
+
"clean": "rimraf dist",
|
|
71
|
+
"release": "npx semantic-release"
|
|
72
|
+
},
|
|
73
|
+
"readme": "# bestax-migrate\n\n[](https://www.npmjs.com/package/bestax-migrate)\n[](https://www.npmjs.com/package/bestax-migrate)\n[](https://opensource.org/licenses/MIT)\n[](https://socket.dev/npm/package/bestax-migrate/overview)\n[](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[](https://www.npmjs.com/package/bestax-migrate#provenance)\n[](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nCodemods that migrate existing React apps to [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — the actively maintained React component library for **Bulma v1**.\n\nCurrently supported source libraries:\n\n| Source | Status |\n| -------------------------------------------------------------------------------- | ----------------------------------------------------------------- |\n| [`react-bulma-components`](https://github.com/couds/react-bulma-components) (v4) | ✅ All 32 components mapped (a few patterns are flagged as TODOs) |\n\n## Requirements\n\n**Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the CLI\nexits immediately with an explicit upgrade message.\n\nThis applies only to the Node version the codemod itself runs on. It places no requirement on\nthe app being migrated — the source is read as text and is never executed.\n\n## Usage\n\n```bash\n# Preview what would change (no writes)\npnpm dlx bestax-migrate react-bulma-components src/ --dry\n\n# Apply the migration\npnpm dlx bestax-migrate react-bulma-components src/\n```\n\nnpm and yarn work too: `npx bestax-migrate …` / `yarn dlx bestax-migrate …`.\n\nThe codemod uses [jscodeshift](https://github.com/facebook/jscodeshift) to:\n\n- rewrite `react-bulma-components` imports to `@allxsmith/bestax-bulma` (including `const { Input } = Form` destructuring and namespace imports)\n- rename components and compound sub-components (`Form.Textarea` → `TextArea`, `Card.Footer.Item` → `Card.FooterItem`, `Hero.Footer` → `Hero.Foot`, …)\n- convert props (`renderAs` → `as`, `loading` → `isLoading`, numeric spacing/text sizes → string unions, `textAlign=\"center\"` → `textAlign=\"centered\"`, …)\n- flatten responsive breakpoint objects (`mobile={{ size: 4 }}` → `sizeMobile={4}`)\n- restructure patterns bestax models differently (`Table.Container`, Navbar dropdowns, `Form.Help`, icon-font children → `<Icon name=…>`)\n- migrate stylesheets: CSS imports converge on `@allxsmith/bestax-bulma/bestax.css`, and SCSS files move from Bulma 0.9's `@import` + `$var !default` overrides to `@use 'bulma/sass' with (…)` plus `@use '@allxsmith/bestax-bulma/scss/extras'`\n- update `package.json`: remove `react-bulma-components`, add `@allxsmith/bestax-bulma`, bump `bulma` to `^1`, and swap the dead `node-sass` for dart `sass` (no install is ever run)\n\nAnything without a safe automatic conversion is left in place with a `// TODO(bestax-migrate): …` comment, and the run ends with a report of every TODO by file and line. TODOs are expected output, not errors — resolve them with the [migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components), or let the [`bestax-migrate` Agent Skill](https://bestax.io/docs/skills/intro) walk them for you:\n\n```bash\nnpx skills add https://github.com/allxsmith/bestax --skill bestax-migrate\n```\n\n## Options\n\n| Flag | Description |\n| -------------------- | -------------------------------------------------------------- |\n| `--dry`, `-d` | Report what would change without writing files |\n| `--print`, `-p` | Print transformed sources to stdout |\n| `--extensions`, `-e` | File extensions to include (default `js,jsx,ts,tsx,scss,sass`) |\n| `--css <mode>` | Stylesheet target: `bestax` (default), `bulma`, or `keep` |\n| `--no-deps` | Skip updating package.json dependencies |\n\n## After the codemod\n\n1. Run your package manager's install (the codemod rewrote `package.json` but never installs)\n2. Search for `TODO(bestax-migrate)` and resolve each comment\n3. Typecheck/build and review the rendered app\n\nFull walkthrough: [react-bulma-components migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components).\n\n## Hardened by default\n\nA codemod rewrites your source in place, so how it is built and published matters:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/bestax-migrate#provenance), or run `npm audit signatures`.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **The libraries this tool migrates away from are never installed here** — source fixtures are read as text only, so no unmaintained third-party package enters the dependency tree.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, and CodeQL, Dependency Review, and Dependabot run continuously alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n## License\n\nMIT © Alex Smith\n"
|
|
74
|
+
}
|