bestax-migrate 2.1.6 → 2.2.1

package/dist/sources/_shared/semver-range.js

@@ -0,0 +1,186 @@
+/**
+ * Minimal semver-range reading for the manifest passes, shared by every source.
+ *
+ * Not a semver implementation: the workspace deliberately carries no `semver`
+ * dependency for this, and the two questions the passes ask are narrow. Both
+ * are answered conservatively, so an unrecognised shape is left alone rather
+ * than guessed at. The one thing this file must never do is rewrite a value it
+ * does not understand, so every accepting path below goes through one grammar.
+ */
+const NUMERIC = String.raw `(?:0|[1-9]\d*)`;
+const WILD = String.raw `(?:x|X|\*)`;
+// SemVer's own identifier grammar: dot-separated, non-empty, no leading zero on
+// a numeric prerelease identifier. Looser fragments accepted `0.9.0-alpha..1`,
+// `0.9.0-01` and `0.9.0+foo..bar` as complete versions and overwrote them.
+const PRE_ID = String.raw `(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const PRERELEASE = String.raw `-${PRE_ID}(?:\.${PRE_ID})*`;
+const BUILD = String.raw `\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*`;
+/**
+ * An exclusive upper bound that sits exactly at 1.0.0: `1`, `1.0`, `1.0.0`,
+ * and the x-ranges that desugar to it (`1.x`, `1.0.x`, `1.*`), optionally with
+ * build metadata, which carries no precedence. `1.1.x` desugars to 1.1.0 and
+ * still admits 1.0.x, so it is deliberately not here.
+ */
+const STABLE_ONE_BOUND = new RegExp(`^1(?:\\.(?:0|${WILD}))?(?:\\.(?:0|${WILD}))?(?:${BUILD})?$`);
+/**
+ * A plain version or x-range: `N`, `N.N`, `N.N.N[-pre][+build]`, `N.x`,
+ * `N.x.x`, `N.N.x`. SemVer forbids leading zeros in numeric parts, and once a
+ * component is a wildcard everything after it must be a wildcard or omitted.
+ */
+const VERSION = new RegExp(`^(${NUMERIC})(?:\\.(?:${NUMERIC}(?:\\.(?:${WILD}|${NUMERIC}(?:${PRERELEASE})?(?:${BUILD})?))?|${WILD}(?:\\.${WILD})?))?$`);
+/**
+ * True only when `range` PROVABLY admits no version >= 1.0.0.
+ *
+ * The first version of this matched a leading `0` and nothing else, so a range
+ * written as comparators (`>=0.7 <1`) was left on 0.x and then reported as
+ * already v1. It lived in the rbx source only; the react-bulma-components
+ * manifest pass kept the regex until review found the unported half.
+ * This walks each `||` alternative and its comparators: a set is pre-v1 when
+ * some comparator caps it below 1.0.0 and none of them opens it at 1 or above.
+ *
+ * Conservative by design: an unrecognised shape returns false and the range is
+ * left alone (and reported as such). Bumping a range that might already admit
+ * v1 would be the best-guess rewrite this package refuses to make.
+ */
+export function isPreV1(range) {
+    const alternatives = range.trim().split(/\s*\|\|\s*/);
+    return alternatives.length > 0 && alternatives.every(setIsPreV1);
+}
+function setIsPreV1(set) {
+    // npm accepts whitespace between an operator and its version
+    // (`>= 0.7.0 < 1.0.0`); splitting on whitespace first made the operator a
+    // token of its own, so the range parsed as unrecognised and was left alone.
+    const text = glueOperators(set);
+    if (text === '' || /^(\*|x|X|latest)$/.test(text))
+        return false;
+    const hyphen = text.match(/^(\S+)\s+-\s+(\S+)$/);
+    if (hyphen) {
+        // Both endpoints must be plain versions; `not-a-range - 0.9.4` was
+        // accepted on its upper bound alone and overwritten.
+        const lower = versionMajor(hyphen[1]);
+        const upper = versionMajor(hyphen[2]);
+        if (lower === null || upper === null)
+            return false;
+        return upper === 0 || (upper === 1 && isPrereleaseOfOne(hyphen[2]));
+    }
+    let cappedBelowOne = false;
+    for (const token of text.split(/\s+/)) {
+        const match = token.match(/^(>=|<=|>|<|=)?(.*)$/);
+        if (!match)
+            return false;
+        const [, op = '', version] = match;
+        // After a comparator only a plain version may follow: `==0.9.4` and
+        // `<^0.9` were each read by stripping a second operator, then overwritten.
+        const major = op ? versionMajor(version) : majorOf(version);
+        if (major === null)
+            return false;
+        const plain = version.replace(/^v/, '');
+        switch (op) {
+            case '>':
+            case '>=':
+                // A lower bound on a 1.0.0 prerelease (`>=1.0.0-rc.1`) does not open
+                // the range at a stable v1; keep scanning for an upper cap.
+                if (major >= 1 && !isPrereleaseOfOne(version))
+                    return false;
+                break;
+            case '<':
+                // `<1`, `<1.0`, `<1.0.0` (build metadata carries no precedence, so
+                // `<1.0.0+build.1` is the same) exclude every stable v1, as does a
+                // prerelease of 1.0.0 (`<1.0.0-0`, `<1.0.0-rc.1`); `<0.9` does too.
+                // A higher upper bound (`<2` in `<1 <2`) never widens the set, so it
+                // is neutral rather than disqualifying; the result still needs some
+                // other comparator to cap it. Alone, `<2` therefore stays unbumped.
+                if (major === 0 ||
+                    (major === 1 && STABLE_ONE_BOUND.test(plain)) ||
+                    isPrereleaseOfOne(version)) {
+                    cappedBelowOne = true;
+                }
+                break;
+            case '<=':
+                // `<=1.0.0-0` caps at the lowest 1.0.0 prerelease, so it excludes
+                // every stable v1 just as `<1.0.0-0` does. A higher inclusive bound
+                // is neutral for the same reason as above.
+                if (major === 0 || isPrereleaseOfOne(version)) {
+                    cappedBelowOne = true;
+                }
+                break;
+            default:
+                // `0.9.4`, `=0.9.4`, `^0.9`, `~0.7.5`, `0.x`: caret and tilde never
+                // cross a major, so major 0 stays below 1. An exact `1.0.0-rc.1` pins
+                // a prerelease and admits no stable v1 either; `^1.0.0-rc.1` does.
+                if (major === 0) {
+                    cappedBelowOne = true;
+                }
+                else if (!/^[~^]/.test(version) &&
+                    isPrereleaseOfOne(version.replace(/^=/, ''))) {
+                    cappedBelowOne = true;
+                }
+                else {
+                    return false;
+                }
+        }
+    }
+    return cappedBelowOne;
+}
+/**
+ * `1.0.0-0`, `1.0.0-rc.1`: a prerelease of exactly 1.0.0 orders below every
+ * stable 1.x, so as an upper bound or an exact pin it admits no usable v1.
+ * Three numeric parts only, matching semver; `1.0-beta` is not a token this
+ * parser reads and is left alone. A caret or tilde on one is different
+ * (`^1.0.0-rc.1` admits 1.0.4), which is why the callers check the operator.
+ * Accepts the same optional `v` that the version grammar does.
+ */
+function isPrereleaseOfOne(version) {
+    return /^v?1\.0\.0-/.test(version);
+}
+function glueOperators(set) {
+    // Only when what follows starts a plain version. Gluing unconditionally
+    // turned the invalid `> =0.7` into a valid `>=0.7`, which was then bumped.
+    // node-semver normalises a spaced tilde or caret (`~ 0.7.5`) the same way.
+    return set.trim().replace(/(>=|<=|>|<|=|~|\^)\s+(?=[0-9vxX*])/g, '$1');
+}
+/**
+ * True when every comparator in every alternative parses to a semver major,
+ * so the headline can tell "already v1" apart from "not a version range at
+ * all" (`latest`, a git URL) rather than calling both v1.
+ */
+export function isRecognisedRange(range) {
+    return range
+        .trim()
+        .split(/\s*\|\|\s*/)
+        .every(alt => {
+        const text = glueOperators(alt);
+        if (/^(\*|x|X)$/.test(text))
+            return true;
+        const hyphen = text.match(/^(\S+)\s+-\s+(\S+)$/);
+        if (hyphen) {
+            return (versionMajor(hyphen[1]) !== null && versionMajor(hyphen[2]) !== null);
+        }
+        return text.split(/\s+/).every(tok => {
+            const m = tok.match(/^(>=|<=|>|<|=)?(.*)$/);
+            if (!m)
+                return false;
+            const [, op = '', v] = m;
+            return (op ? versionMajor(v) : majorOf(v)) !== null;
+        });
+    });
+}
+/**
+ * The major of a COMPLETE plain version or x-range, or null. npm's optional
+ * leading `v` is the only prefix allowed here. Reading a numeric prefix alone
+ * accepted a dist-tag like `0.next` as major 0, and the manifest was then
+ * overwritten with `^1.0.4`, which is the one thing this parser must never do
+ * to a value it does not understand.
+ */
+function versionMajor(version) {
+    const m = version.replace(/^v/, '').match(VERSION);
+    return m ? Number(m[1]) : null;
+}
+/**
+ * The major of a BARE token, which may carry exactly one range prefix (`^`,
+ * `~`, `=`) before the version. Stripping any run of prefix characters
+ * accepted `^^0.9.4` and `vv0.9.4` as major 0 and overwrote them.
+ */
+function majorOf(token) {
+    return versionMajor(token.replace(/^[~^=]/, ''));
+}

package/dist/sources/_shared/specials-utils.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Building blocks shared by every source's structural handlers: picking a
+ * target from an align-style prop, stripping Bulma modifier props off an
+ * element on its way to becoming plain HTML, merging a consumed `className`,
+ * and reading an icon-font class string.
+ *
+ * Source-agnostic. `makeStripModifierProps` is a factory precisely because
+ * the modifier vocabulary is the one thing here that differs per source.
+ */
+import type { ASTPath } from 'jscodeshift';
+import type { PropAction } from '../../types.js';
+import { type TransformContext } from './jsx-utils.js';
+export interface SpecialResult {
+    /** Override the mapping's `target` for the rename step. */
+    target?: string;
+    /** The node was replaced outright — skip rename and prop passes. */
+    replaced?: boolean;
+    /** Prop names the handler consumed; skipped by the later prop passes. */
+    handledProps?: string[];
+}
+export type SpecialHandler = (ctx: TransformContext, path: ASTPath<any>, element: any) => SpecialResult;
+/** Pick a target based on a literal align-style prop, removing the prop. */
+export declare function alignTarget(ctx: TransformContext, path: ASTPath<any>, element: any, prop: string, targets: Record<string, string>, fallback: string): SpecialResult;
+/**
+ * Build the modifier-prop filter for one source: it needs that source's own
+ * universal-prop and breakpoint tables to know what counts as a modifier.
+ *
+ * The returned function filters Bulma modifier props out of an attribute list
+ * bound for a plain HTML element (they only exist on bestax components),
+ * leaving a TODO when any were dropped.
+ */
+export declare function makeStripModifierProps(universalProps: Record<string, PropAction>, responsiveBreakpoints: Record<string, string | null>): (ctx: TransformContext, path: ASTPath<any>, attrs: any[], where: string) => any[];
+/**
+ * Consume the element's `className` so a plain-element rewrite can merge it
+ * with its hard-coded Bulma class instead of dropping it. A dynamic value
+ * can't be merged safely — keep the base class and leave a TODO.
+ */
+export declare function mergeClassName(ctx: TransformContext, path: ASTPath<any>, element: any, base: string | undefined, where: string): string | undefined;
+/** Parse an icon-font <i className="..."> into bestax Icon name/library/variant. */
+export declare function parseIconClasses(className: string): {
+    name: string;
+    library?: string;
+    variant?: string;
+} | null;
+//# sourceMappingURL=specials-utils.d.ts.map

package/dist/sources/_shared/specials-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specials-utils.d.ts","sourceRoot":"","sources":["../../../src/sources/_shared/specials-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAClB,OAAO,EAAE,GAAG,KACT,aAAa,CAAC;AAEnB,4EAA4E;AAC5E,wBAAgB,WAAW,CACzB,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAClB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,GACf,aAAa,CAuBf;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1C,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,IAGlD,KAAK,gBAAgB,EACrB,MAAM,OAAO,CAAC,GAAG,CAAC,EAClB,OAAO,GAAG,EAAE,EACZ,OAAO,MAAM,KACZ,GAAG,EAAE,CAuBT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAClB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAiBpB;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA2C7D"}

package/dist/sources/_shared/specials-utils.js

@@ -0,0 +1,124 @@
+/**
+ * Building blocks shared by every source's structural handlers: picking a
+ * target from an align-style prop, stripping Bulma modifier props off an
+ * element on its way to becoming plain HTML, merging a consumed `className`,
+ * and reading an icon-font class string.
+ *
+ * Source-agnostic. `makeStripModifierProps` is a factory precisely because
+ * the modifier vocabulary is the one thing here that differs per source.
+ */
+import { addTodo, findAttr, literalValueOf, removeAttr, } from './jsx-utils.js';
+/** Pick a target based on a literal align-style prop, removing the prop. */
+export function alignTarget(ctx, path, element, prop, targets, fallback) {
+    const attr = findAttr(element, prop);
+    if (!attr)
+        return { target: fallback };
+    const literal = literalValueOf(attr);
+    if (literal.kind === 'string' && targets[literal.value]) {
+        removeAttr(element, attr);
+        ctx.dirty = true;
+        return { target: targets[literal.value] };
+    }
+    if (literal.kind === 'string') {
+        removeAttr(element, attr);
+        ctx.dirty = true;
+        return { target: fallback };
+    }
+    addTodo(ctx, path, `prop:${prop}`, `\`${prop}\` has a dynamic value; pick between ${Object.values(targets).join(' / ')} by hand`);
+    removeAttr(element, attr);
+    ctx.dirty = true;
+    return { target: fallback };
+}
+/**
+ * Build the modifier-prop filter for one source: it needs that source's own
+ * universal-prop and breakpoint tables to know what counts as a modifier.
+ *
+ * The returned function filters Bulma modifier props out of an attribute list
+ * bound for a plain HTML element (they only exist on bestax components),
+ * leaving a TODO when any were dropped.
+ */
+export function makeStripModifierProps(universalProps, responsiveBreakpoints) {
+    return function stripModifierProps(ctx, path, attrs, where) {
+        const kept = [];
+        const dropped = [];
+        for (const attr of attrs) {
+            const name = attr?.name?.name;
+            if (name && (universalProps[name] || name in responsiveBreakpoints)) {
+                dropped.push(name);
+            }
+            else {
+                kept.push(attr);
+            }
+        }
+        if (dropped.length > 0) {
+            addTodo(ctx, path, 'plain-element', `${where} became a plain element; the Bulma helper prop(s) ${dropped
+                .map(d => `\`${d}\``)
+                .join(', ')} were dropped — restyle with classes`);
+        }
+        return kept;
+    };
+}
+/**
+ * Consume the element's `className` so a plain-element rewrite can merge it
+ * with its hard-coded Bulma class instead of dropping it. A dynamic value
+ * can't be merged safely — keep the base class and leave a TODO.
+ */
+export function mergeClassName(ctx, path, element, base, where) {
+    const attr = findAttr(element, 'className');
+    if (!attr)
+        return base;
+    const literal = literalValueOf(attr);
+    removeAttr(element, attr);
+    if (literal.kind === 'string') {
+        return base ? `${base} ${literal.value}` : literal.value;
+    }
+    addTodo(ctx, path, 'prop:className', base
+        ? `dynamic ${where} className; merge it with the \`${base}\` class by hand`
+        : `dynamic ${where} className; re-apply it to the emitted element by hand`);
+    return base;
+}
+/** Parse an icon-font <i className="..."> into bestax Icon name/library/variant. */
+export function parseIconClasses(className) {
+    const tokens = className.trim().split(/\s+/);
+    const faVariant = {
+        fas: 'solid',
+        far: 'regular',
+        fab: 'brands',
+        fal: 'light',
+        fad: 'duotone',
+        fat: 'thin',
+        // Font Awesome 6 spells the style out, and has been the default since
+        // 2022 — matching only the v5 short forms meant the common case fell
+        // through to the "migrate this icon by hand" TODO.
+        'fa-solid': 'solid',
+        'fa-regular': 'regular',
+        'fa-brands': 'brands',
+        'fa-light': 'light',
+        'fa-duotone': 'duotone',
+        'fa-thin': 'thin',
+    };
+    const faStyle = tokens.find(t => faVariant[t]);
+    // Every `fa-*` that is a MODIFIER rather than an icon name — including
+    // v6's spelled-out style and family words, which are `fa-` prefixed and
+    // would otherwise be read as the icon (`fa-solid fa-home` → name="solid").
+    // The old list
+    // covered only sizing and spin, so a class string that puts a modifier
+    // first — `fas fa-rotate-90 fa-home`, which Font Awesome's own docs show —
+    // yielded name="rotate-90". Ordering is not guaranteed, so the filter has
+    // to be exhaustive rather than positional.
+    const FA_MODIFIER = /^fa-(?:solid|regular|brands|light|duotone|thin|sharp|classic|2xs|xs|sm|lg|xl|2xl|\d{1,2}x|fw|ul|li|border|inverse|stack|stack-1x|stack-2x|pull-(?:left|right)|spin|spin-pulse|spin-reverse|pulse|beat|fade|beat-fade|bounce|flash|shake|swap-opacity|rotate-(?:90|180|270|by)|flip-(?:horizontal|vertical|both))$/;
+    const faName = tokens.find(t => /^fa-/.test(t) && !FA_MODIFIER.test(t));
+    if (faStyle && faName) {
+        return {
+            name: faName.replace(/^fa-/, ''),
+            library: 'fa',
+            variant: faVariant[faStyle],
+        };
+    }
+    if (tokens.includes('mdi')) {
+        const mdiName = tokens.find(t => /^mdi-/.test(t) && t !== 'mdi');
+        if (mdiName)
+            return { name: mdiName.replace(/^mdi-/, ''), library: 'mdi' };
+    }
+    return null;
+}

package/dist/sources/rbx/deps.d.ts

@@ -0,0 +1,18 @@
+/**
+ * package.json migration: swap rbx for @allxsmith/bestax-bulma and clear out
+ * the stylesheet dependencies rbx dragged in with it. Pure data-in/data-out —
+ * the CLI owns file IO, and no package manager is ever invoked (the report
+ * tells the user to install).
+ *
+ * This is the step with the biggest visible payoff for an rbx app. Unlike
+ * react-bulma-components, which peer-depends on Bulma and lets the app pick a
+ * version, rbx ships `bulma@0.7.5` as a *direct* dependency plus four Bulma
+ * extensions — so an rbx app cannot move to Bulma v1 at all while rbx is
+ * installed. Removing rbx is what frees that, and the report says so; its
+ * four Bulma extensions are reported for the user to remove, not deleted —
+ * see the note on that below.
+ * says so by name.
+ */
+import type { DependenciesUpdate } from '../../types.js';
+export declare const updateDependencies: DependenciesUpdate;
+//# sourceMappingURL=deps.d.ts.map

package/dist/sources/rbx/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../src/sources/rbx/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAsBzD,eAAO,MAAM,kBAAkB,EAAE,kBAqLhC,CAAC"}

package/dist/sources/rbx/deps.js

@@ -0,0 +1,192 @@
+/**
+ * package.json migration: swap rbx for @allxsmith/bestax-bulma and clear out
+ * the stylesheet dependencies rbx dragged in with it. Pure data-in/data-out —
+ * the CLI owns file IO, and no package manager is ever invoked (the report
+ * tells the user to install).
+ *
+ * This is the step with the biggest visible payoff for an rbx app. Unlike
+ * react-bulma-components, which peer-depends on Bulma and lets the app pick a
+ * version, rbx ships `bulma@0.7.5` as a *direct* dependency plus four Bulma
+ * extensions — so an rbx app cannot move to Bulma v1 at all while rbx is
+ * installed. Removing rbx is what frees that, and the report says so; its
+ * four Bulma extensions are reported for the user to remove, not deleted —
+ * see the note on that below.
+ * says so by name.
+ */
+import { isPreV1, isRecognisedRange } from '../_shared/semver-range.js';
+const BESTAX_RANGE = '^5';
+const BULMA_RANGE = '^1.0.4';
+// Bulma v1's sass tree uses `color.channel(…)` — needs dart-sass ≥ 1.79.
+const SASS_RANGE = '^1.79.0';
+/**
+ * The Bulma extensions rbx depends on directly. Bulma v1 and bestax cover all
+ * four: badge and tooltip became bestax components, the page loader became
+ * `Loading`, and the divider became `Divider`.
+ */
+const RBX_STYLE_DEPS = [
+    'bulma-badge',
+    'bulma-divider',
+    'bulma-pageloader',
+    'bulma-tooltip',
+];
+const DEP_SECTIONS = ['dependencies', 'devDependencies'];
+export const updateDependencies = (filePath, pkg, collector, options) => {
+    const changes = [];
+    const next = pkg;
+    const section = (name) => (next[name] ?? undefined);
+    const note = (message) => {
+        changes.push(message);
+        collector?.add({ file: filePath, line: null, rule: 'deps', message });
+    };
+    // rbx goes away entirely.
+    const removed = [];
+    for (const name of DEP_SECTIONS) {
+        const deps = section(name);
+        if (deps && 'rbx' in deps) {
+            delete deps.rbx;
+            removed.push('rbx');
+            note(`removed rbx from ${name}`);
+        }
+    }
+    // The four Bulma extensions are REPORTED, not removed.
+    //
+    // rbx declares them as its own dependencies, so an app gets them
+    // transitively through the lockfile — they do not appear in the app's
+    // manifest unless the author put them there deliberately. A manifest entry
+    // is therefore a direct declaration, and an app may well be importing
+    // `bulma-tooltip`'s Sass on its own, outside anything rbx rendered.
+    // Deleting it because rbx happens to be present is precisely the
+    // best-guess rewrite this package refuses to make.
+    const extensions = [];
+    if (removed.includes('rbx')) {
+        for (const name of DEP_SECTIONS) {
+            const deps = section(name);
+            if (!deps)
+                continue;
+            for (const extension of RBX_STYLE_DEPS) {
+                if (extension in deps)
+                    extensions.push(extension);
+            }
+        }
+    }
+    if (extensions.length > 0) {
+        collector?.add({
+            file: filePath,
+            line: null,
+            rule: 'deps',
+            message: `${extensions.join(', ')} ${extensions.length === 1 ? 'is a Bulma extension' : 'are Bulma extensions'} rbx depended on, and bestax ships ${extensions.length === 1 ? 'its' : 'their'} equivalent${extensions.length === 1 ? '' : 's'} (Badge, Divider, Loading, Tooltip). Declared in this manifest, so removing ${extensions.length === 1 ? 'it' : 'them'} is your call — drop ${extensions.length === 1 ? 'it' : 'them'} unless your own Sass imports ${extensions.length === 1 ? 'it' : 'them'} directly`,
+        });
+    }
+    // @allxsmith/bestax-bulma comes in (runtime dependency).
+    const dependencies = (next.dependencies ??= {});
+    if (!dependencies['@allxsmith/bestax-bulma'] &&
+        !section('devDependencies')?.['@allxsmith/bestax-bulma']) {
+        dependencies['@allxsmith/bestax-bulma'] = BESTAX_RANGE;
+        note(`added @allxsmith/bestax-bulma ${BESTAX_RANGE} to dependencies`);
+    }
+    // Bulma: rbx pinned 0.7.5 as a direct dependency, so this almost always
+    // fires. Add it back only when sources still reference bulma/… directly —
+    // otherwise it arrives transitively via bestax-bulma.
+    let bulmaDeclared = false;
+    let declaredBulma = '';
+    let bulmaBumped = false;
+    let bulmaAdded = false;
+    for (const name of DEP_SECTIONS) {
+        const deps = section(name);
+        if (deps?.bulma) {
+            bulmaDeclared = true;
+            declaredBulma = deps.bulma;
+            if (isPreV1(deps.bulma)) {
+                deps.bulma = BULMA_RANGE;
+                bulmaBumped = true;
+                note(`bumped bulma to ${BULMA_RANGE} in ${name} (was pre-1.0)`);
+            }
+        }
+    }
+    if (!bulmaDeclared && options.bulmaReferenced) {
+        dependencies.bulma = BULMA_RANGE;
+        bulmaAdded = true;
+        note(`added bulma ${BULMA_RANGE} to dependencies (sources import bulma/… directly)`);
+    }
+    // The transform deliberately keeps a trimmed rbx import for components
+    // with no bestax equivalent (Tile, Generic, List, …) so a partially
+    // migrated app still runs. Removing the package from the manifest strands
+    // exactly those imports once the user runs the install the report asks for,
+    // so say so rather than letting them find out at build time.
+    if (removed.includes('rbx') && options.sourceStillImported) {
+        collector?.add({
+            file: filePath,
+            line: null,
+            rule: 'deps',
+            message: 'rbx was removed from package.json, but some files still import it for components with no bestax equivalent — resolve those `TODO(bestax-migrate)` imports before installing, or re-add rbx until you have',
+        });
+    }
+    // The headline result: rbx pinned Bulma 0.7.5 as a DIRECT dependency, so
+    // removing rbx is what frees the app to choose its own Bulma version.
+    //
+    // What it must NOT claim is a manifest change that did not happen. In the
+    // common rbx-app shape — `{ "dependencies": { "rbx": "^2.2.0" } }` with no
+    // direct `bulma/…` imports — bulma is neither bumped nor added, because it
+    // arrives transitively via bestax-bulma. Saying "bumped bulma" there
+    // described a pin the user would not find in their manifest.
+    if (removed.includes('rbx')) {
+        collector?.add({
+            file: filePath,
+            line: null,
+            rule: 'deps',
+            message: `removed rbx ${bulmaBumped
+                ? `and bumped bulma to ${BULMA_RANGE}`
+                : bulmaAdded
+                    ? `and added bulma ${BULMA_RANGE}`
+                    : bulmaDeclared
+                        ? isRecognisedRange(declaredBulma)
+                            ? 'and left your declared bulma range alone (already v1)'
+                            : `and left your declared bulma specifier alone (${JSON.stringify(declaredBulma)} is not a version range this tool can read; make sure it resolves to Bulma 1.x)`
+                        : '— bulma now arrives transitively via @allxsmith/bestax-bulma'} — rbx pinned Bulma 0.7.5 as a direct dependency, so the app can now choose its own Bulma version${extensions.length > 0 ? `; ${extensions.length} Bulma extension(s) are reported above for you to remove` : ''}`,
+        });
+    }
+    // bestax-bulma requires React 18/19; rbx peer-depends on ^16.8.6, and React
+    // 19 removed the `defaultProps` its forwardRefAs base is built on — so this
+    // is the other half of why an rbx app is stuck. Report only: a React major
+    // upgrade is the app's own migration step.
+    for (const name of DEP_SECTIONS) {
+        const range = section(name)?.react;
+        if (range && /^[~^]?(?:[0-9]|1[0-7])(?:[.x]|$)/.test(range.trim())) {
+            collector?.add({
+                file: filePath,
+                line: null,
+                rule: 'peer-deps',
+                message: `react ${range} predates bestax-bulma's peer range (^18 || ^19) — upgrade react and react-dom to 18 or 19 before installing`,
+            });
+        }
+    }
+    // Font Awesome older than 6 conflicts with bestax-bulma's optional peer
+    // range and makes `npm install` fail with ERESOLVE. Report only — icon
+    // names change across FA majors, so upgrading is the app's decision.
+    for (const name of DEP_SECTIONS) {
+        const range = section(name)?.['@fortawesome/fontawesome-free'];
+        if (range && /^[~^]?[0-5](?:[.x]|$)/.test(range.trim())) {
+            collector?.add({
+                file: filePath,
+                line: null,
+                rule: 'peer-deps',
+                message: `@fortawesome/fontawesome-free ${range} predates bestax-bulma's optional peer range (^6.7.2 || ^7.0.0) — upgrade it, or install with \`npm install --legacy-peer-deps\``,
+            });
+        }
+    }
+    // node-sass is dead; dart-sass replaces it in the same section. rbx's own
+    // customisation guide told people to install node-sass, so this is common.
+    for (const name of DEP_SECTIONS) {
+        const deps = section(name);
+        if (deps && 'node-sass' in deps) {
+            delete deps['node-sass'];
+            note(`removed node-sass from ${name}`);
+            const sassDeclared = DEP_SECTIONS.some(s => section(s)?.sass);
+            if (!sassDeclared) {
+                deps.sass = SASS_RANGE;
+                note(`added sass ${SASS_RANGE} to ${name} (replaces node-sass)`);
+            }
+        }
+    }
+    return changes.length > 0 ? next : null;
+};

package/dist/sources/rbx/index.d.ts

@@ -0,0 +1,3 @@
+import type { MigrationSource } from '../../types.js';
+export declare const rbx: MigrationSource;
+//# sourceMappingURL=index.d.ts.map

package/dist/sources/rbx/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sources/rbx/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,eAAO,MAAM,GAAG,EAAE,eAMjB,CAAC"}

package/dist/sources/rbx/index.js

@@ -0,0 +1,10 @@
+import transform from './transform.js';
+import { transformStyles } from './styles.js';
+import { updateDependencies } from './deps.js';
+export const rbx = {
+    name: 'rbx',
+    label: 'rbx (v2) → @allxsmith/bestax-bulma',
+    transform,
+    transformStyles,
+    updateDependencies,
+};

package/dist/sources/rbx/mapping.d.ts

@@ -0,0 +1,49 @@
+/**
+ * rbx (v2) → @allxsmith/bestax-bulma mapping tables.
+ *
+ * Data only — no AST work. `MAPPING` is the single source of truth for what
+ * the transform does with each rbx export; `RBX_EXPORTS` vendors rbx's public
+ * surface so `mapping-coverage.test.ts` can close it in both directions.
+ *
+ * rbx and bestax both target Bulma, and rbx's helper vocabulary lines up with
+ * `useBulmaClasses` far more closely than react-bulma-components' did — most
+ * of the value unions below are identical on both sides, so they pass through
+ * rather than being value-mapped. Where they diverge it is because Bulma v1
+ * itself changed (`is-marginless` became `m-0`), and those are recorded as
+ * explicit conversions rather than guesses.
+ */
+import type { ComponentMapping, PropAction } from '../../types.js';
+/**
+ * Helper props rbx mixes into every component via `HelpersProps`. Applied
+ * after each component's own prop map, to whatever attributes are left.
+ *
+ * `badge*`, `tooltip*` and `responsive` are deliberately absent: they are
+ * consumed structurally (see specials.ts / responsive.ts) before this pass
+ * runs, and letting them fall through here would be wrong — bestax has its
+ * own unrelated `responsive` prop (`'mobile' | 'narrow'`), so a pass-through
+ * would silently produce a type error rather than a TODO.
+ */
+export declare const UNIVERSAL_PROPS: Record<string, PropAction>;
+/** rbx badge helper props → bestax `<Badge>` props. */
+export declare const BADGE_PROPS: Record<string, string | null>;
+/** rbx tooltip helper props → bestax `<Tooltip>` props. */
+export declare const TOOLTIP_PROPS: Record<string, string | null>;
+/**
+ * rbx breakpoints → the suffix bestax uses on its viewport-aware helper props
+ * (`displayTablet`, `textSizeDesktop`, …). `null` means bestax has no
+ * equivalent viewport, so the value becomes a TODO rather than a guess.
+ */
+export declare const RESPONSIVE_BREAKPOINTS: Record<string, string | null>;
+export declare const MAPPING: Record<string, ComponentMapping>;
+/**
+ * rbx's public export surface, vendored from its five `index.ts` barrels at
+ * the pinned SHA. Values are the dot-notation sub-paths each export carries.
+ *
+ * `mapping-coverage.test.ts` walks this against `MAPPING` in both directions,
+ * so rbx coverage cannot silently regress and `MAPPING` cannot grow an entry
+ * for something rbx never exported.
+ */
+export declare const RBX_EXPORTS: Record<string, string[]>;
+/** Walk a dotted component path through `MAPPING`. */
+export declare function resolveMapping(path: string[]): ComponentMapping | undefined;
+//# sourceMappingURL=mapping.d.ts.map

package/dist/sources/rbx/mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapping.d.ts","sourceRoot":"","sources":["../../../src/sources/rbx/mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAuCnE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAiCtD,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOrD,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQvD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAShE,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAosBpD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA2FhD,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAM3E"}