bestax-migrate 2.31.1 → 2.31.3

package/README.md

@@ -93,6 +93,17 @@ Run it from your app root. `--param paths="src lib"` (default `src`) and `--para
 | `--css <mode>`       | Stylesheet target: `bestax`, `bulma`, or `keep` (default `bestax`; `keep` for `bulma-classes`) |
 | `--no-deps`          | Skip updating package.json dependencies                                                        |
 
+## Exit codes
+
+| Code  | Meaning                                                                                                                                                                                                                  |
+| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `0`   | The run finished. TODOs are expected output and leave it at 0                                                                                                                                                            |
+| `1`   | A file could not be parsed or transformed. It is marked `✖`, listed in the report and left as it was, and every other file is still migrated. Fix it and run the codemod on it again. A run like that sends no telemetry |
+| `1`   | The command was refused before the run: an unknown source, flag or `--css` mode, a path that isn't there, an HTML page for a source that reads none, or Node older than 22                                               |
+| `130` | Ctrl-C at the telemetry question, which comes after the run                                                                                                                                                              |
+
+`--help` lists them too. With `--dry`, a file that fails to parse still makes the exit code 1, so a preview in CI catches it. A file the run can't read at all stops it there instead, with Node's error and exit code 1, before `package.json` is updated.
+
 ## After the codemod
 
 1. Run your package manager's install (the codemod rewrote `package.json` but never installs)

package/dist/cli.d.ts

@@ -10,7 +10,9 @@
  * .html/.htm → a new module beside the page, for a source that reads HTML),
  * updates the nearest package.json (unless --no-deps), writes results back
  * (unless --dry), and prints the run report. TODO annotations are expected
- * output — the exit code is 0 whenever the run itself succeeds.
+ * output, and leave the exit code at 0. A file that fails to parse or
+ * transform makes it 1, once every other file has been migrated: see
+ * `EXIT_CODES`.
  */
 import { createInterface } from 'node:readline/promises';
 import type { Readable, Writable } from 'node:stream';

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAIV,eAAe,EAEhB,MAAM,YAAY,CAAC;AA2BpB;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,GAAE,SAAS,MAAM,EAAO,GAC5B,MAAM,EAAE,CAwBV;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAkB5D;AAED,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgDlD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsBvD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAEpE;AA2QD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,KAAK,EACT,KAAK,GAAE,QAAwB,EAC/B,MAAM,GAAE,QAAyB,EAGjC,aAAa,GAAE,OAAO,eAAiC,GACtD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAyBzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,GAAG,SAAS,EACzB,EAAE,EAAE,KAAK,EACT,aAAa,GAAE,CAAC,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAA0B,GAC7E,OAAO,CAAC,IAAI,CAAC,CAqBf;AAYD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAkD,GACrD,OAAO,CAmJT"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAIV,eAAe,EAEhB,MAAM,YAAY,CAAC;AAyCpB;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,GAAE,SAAS,MAAM,EAAO,GAC5B,MAAM,EAAE,CAwBV;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAkB5D;AAED,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgDlD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsBvD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAEpE;AA2RD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,KAAK,EACT,KAAK,GAAE,QAAwB,EAC/B,MAAM,GAAE,QAAyB,EAGjC,aAAa,GAAE,OAAO,eAAiC,GACtD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAyBzB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,OAAO,GAAG,SAAS,EACzB,EAAE,EAAE,KAAK,EACT,aAAa,GAAE,CAAC,EAAE,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAA0B,GAC7E,OAAO,CAAC,IAAI,CAAC,CAqBf;AAYD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAkD,GACrD,OAAO,CA+JT"}

package/dist/cli.js

@@ -10,7 +10,9 @@
  * .html/.htm → a new module beside the page, for a source that reads HTML),
  * updates the nearest package.json (unless --no-deps), writes results back
  * (unless --dry), and prints the run report. TODO annotations are expected
- * output — the exit code is 0 whenever the run itself succeeds.
+ * output, and leave the exit code at 0. A file that fails to parse or
+ * transform makes it 1, once every other file has been migrated: see
+ * `EXIT_CODES`.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -31,6 +33,19 @@ const SKIP_DIRS = new Set([
 ]);
 const STYLE_EXTENSIONS = new Set(['scss', 'sass']);
 const CSS_MODES = ['bestax', 'bulma', 'keep'];
+/**
+ * The exit codes, for `--help` and the README's "Exit codes", which says the
+ * same. Commander exits 1 on a command line it refuses, and so does the bin
+ * entry on a Node older than it supports.
+ */
+const EXIT_CODES = [
+    'Exit codes:',
+    '  0    the run finished; TODO(bestax-migrate) comments are expected output',
+    '  1    a file could not be parsed or transformed (each is marked ✖ and',
+    '       listed in the report, and the other files are still migrated), or',
+    '       the command was refused before the run',
+    '  130  Ctrl-C at the telemetry question, after the run',
+].join('\n');
 /** HTML pages, which only a source with `htmlExtensions` reads. */
 const HTML_EXTENSIONS = ['html', 'htm'];
 /**
@@ -230,11 +245,19 @@ function migrateFiles(source, files, reporter, io, options, project) {
     const pkg = sourcePackage(source);
     const sourceImportRe = pkg === null ? null : makeSourceImportRe(pkg);
     for (const file of files) {
+        // Outside the failure handling on purpose: a file the run can't read at
+        // all stops it here, before the manifest pass, which could not tell
+        // whether that file still imports the source.
         const sourceText = fs.readFileSync(file, 'utf8');
         const collector = reporter.startFile();
         const extension = extensionOf(file);
         if (source.transformHtml && source.htmlExtensions?.includes(extension)) {
-            const written = migrateHtmlPage(source.transformHtml, file, sourceText, collector, io, { ...options, project });
+            const page = migrateHtmlPage(source.transformHtml, file, sourceText, collector, io, { ...options, project });
+            if ('error' in page) {
+                reporter.failFile(file, page.error, collector.entries);
+                continue;
+            }
+            const written = page.written;
             // The module is what the app will import from, as a JSX file's output
             // is: one that imports bulma/… needs `bulma` declared.
             if (written !== null && /['"](?:~?bulma\/)/.test(written)) {
@@ -261,7 +284,8 @@ function migrateFiles(source, files, reporter, io, options, project) {
             }
         }
         catch (error) {
-            io.error(chalk.red(`✖ ${file}: ${error.message}`));
+            const message = error.message;
+            io.error(chalk.red(`✖ ${file}: ${message}`));
             // Read the signals off the ORIGINAL text before bailing. A parse
             // failure in the only file importing the source library would
             // otherwise let the manifest pass remove the package with no warning —
@@ -270,7 +294,7 @@ function migrateFiles(source, files, reporter, io, options, project) {
                 bulmaReferenced = true;
             if (importsSource(sourceImportRe, sourceText))
                 sourceStillImported = true;
-            reporter.finishFile(file, false, collector.entries);
+            reporter.failFile(file, message, collector.entries);
             continue;
         }
         if (/['"](?:~?bulma\/)/.test(output ?? sourceText)) {
@@ -292,7 +316,7 @@ function migrateFiles(source, files, reporter, io, options, project) {
 /**
  * One HTML page: its module is written beside it (never over a file already
  * there; the source checks), and the page itself is left as it was. Returns
- * the module, or null when there is none to write.
+ * the module, null when there is none to write, or why the page failed.
  */
 function migrateHtmlPage(transformHtml, file, sourceText, collector, io, options) {
     let result;
@@ -303,11 +327,12 @@ function migrateHtmlPage(transformHtml, file, sourceText, collector, io, options
         });
     }
     catch (error) {
-        io.error(chalk.red(`✖ ${file}: ${error.message}`));
-        return null;
+        const message = error.message;
+        io.error(chalk.red(`✖ ${file}: ${message}`));
+        return { error: message };
     }
     if (result.output === null)
-        return null;
+        return { written: null };
     if (options.print)
         io.log(result.output);
     if (options.dry) {
@@ -317,7 +342,7 @@ function migrateHtmlPage(transformHtml, file, sourceText, collector, io, options
         fs.writeFileSync(result.outputPath, result.output);
         io.log(chalk.green(`Wrote ${result.outputPath} from ${file}.`));
     }
-    return result.output;
+    return { written: result.output };
 }
 /**
  * HTML pages a folder walk found but `--extensions` left out, reported when
@@ -402,6 +427,7 @@ function migrateDependencies(source, targets, reporter, io, options, deps) {
     for (const pkgPath of findPackageJsons(targets)) {
         const collector = reporter.startFile();
         let changed = false;
+        let failure;
         try {
             const raw = fs.readFileSync(pkgPath, 'utf8');
             const pkg = JSON.parse(raw);
@@ -421,7 +447,12 @@ function migrateDependencies(source, targets, reporter, io, options, deps) {
             }
         }
         catch (error) {
-            io.error(chalk.red(`✖ ${pkgPath}: ${error.message}`));
+            failure = error.message;
+            io.error(chalk.red(`✖ ${pkgPath}: ${failure}`));
+        }
+        if (failure !== undefined) {
+            reporter.failFile(pkgPath, failure, collector.entries);
+            continue;
         }
         reporter.finishFile(pkgPath, changed, collector.entries);
         if (changed) {
@@ -530,6 +561,7 @@ export function createCLI(io = { log: console.log, error: console.error }) {
         .option('--no-deps', 'skip updating package.json dependencies')
         .option('--telemetry', 'enable anonymous usage telemetry (https://bestax.io/docs/guides/telemetry)')
         .option('--no-telemetry', 'disable anonymous usage telemetry')
+        .addHelpText('after', `\n${EXIT_CODES}`)
         .action(async (sourceName, targets, options) => {
         const source = getSource(sourceName);
         if (!source) {
@@ -584,6 +616,16 @@ export function createCLI(io = { log: console.log, error: console.error }) {
             depSignals.sourceStillImported = true;
         migrateDependencies(source, targets, reporter, io, runOptions, depSignals);
         io.log(reporter.render(source.label + (runOptions.dry ? ' (dry run)' : '')));
+        // A file that failed leaves the migration unfinished, whatever the
+        // rest did, so the exit code says so: a script or CI step that runs
+        // the codemod must not read it as success. Every other file has been
+        // migrated by now. Not `program.error`, which exits at once and could
+        // cut the report short on its way down a pipe. The run is not a
+        // successful one, so it ends here, with no nudge and no telemetry.
+        if (reporter.failures.length > 0) {
+            process.exitCode = 1;
+            return;
+        }
         displayStarNudge(io);
         // Success path only: rule names and counts, never file/line/message.
         const stats = {

package/dist/report.d.ts

@@ -1,7 +1,8 @@
 /**
  * Run reporting: collects per-file results and prints the end-of-run summary.
  * TODO annotations are expected output, not failures — the CLI exits 0 when
- * files were transformed and TODOs remain.
+ * files were transformed and TODOs remain. A file that could not be parsed or
+ * transformed is a failure, and the CLI exits 1 for it.
  */
 import type { FileResult, TodoCollector, TodoEntry } from './types.js';
 export declare class Reporter {
@@ -11,8 +12,11 @@ export declare class Reporter {
         entries: TodoEntry[];
     };
     finishFile(file: string, changed: boolean, todos: TodoEntry[]): void;
+    /** A file that could not be parsed or transformed, and why. */
+    failFile(file: string, error: string, todos: TodoEntry[]): void;
     get files(): FileResult[];
     get changedCount(): number;
+    get failures(): FileResult[];
     get todos(): TodoEntry[];
     /** TODO counts grouped by rule, highest first. */
     todosByRule(): Array<{

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAoB;IAEnC,2EAA2E;IAC3E,SAAS,IAAI,aAAa,GAAG;QAAE,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE;IAUrD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;IAIpE,IAAI,KAAK,IAAI,UAAU,EAAE,CAExB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,KAAK,IAAI,SAAS,EAAE,CAEvB;IAED,kDAAkD;IAClD,WAAW,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC;IAY5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CA8B9B"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAoB;IAEnC,2EAA2E;IAC3E,SAAS,IAAI,aAAa,GAAG;QAAE,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE;IAUrD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;IAIpE,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;IAI/D,IAAI,KAAK,IAAI,UAAU,EAAE,CAExB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,QAAQ,IAAI,UAAU,EAAE,CAE3B;IAED,IAAI,KAAK,IAAI,SAAS,EAAE,CAEvB;IAED,kDAAkD;IAClD,WAAW,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC;IAY5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAiD9B"}

package/dist/report.js

@@ -1,7 +1,8 @@
 /**
  * Run reporting: collects per-file results and prints the end-of-run summary.
  * TODO annotations are expected output, not failures — the CLI exits 0 when
- * files were transformed and TODOs remain.
+ * files were transformed and TODOs remain. A file that could not be parsed or
+ * transformed is a failure, and the CLI exits 1 for it.
  */
 import chalk from 'chalk';
 export class Reporter {
@@ -19,12 +20,19 @@ export class Reporter {
     finishFile(file, changed, todos) {
         this.results.push({ file, changed, todos });
     }
+    /** A file that could not be parsed or transformed, and why. */
+    failFile(file, error, todos) {
+        this.results.push({ file, changed: false, todos, error });
+    }
     get files() {
         return this.results;
     }
     get changedCount() {
         return this.results.filter(r => r.changed).length;
     }
+    get failures() {
+        return this.results.filter(r => r.error !== undefined);
+    }
     get todos() {
         return this.results.flatMap(r => r.todos);
     }
@@ -44,9 +52,20 @@ export class Reporter {
         const lines = [];
         lines.push('');
         lines.push(chalk.bold(`bestax-migrate — ${label}`));
+        const failures = this.failures;
         lines.push(`${this.results.length} file(s) scanned, ` +
             `${chalk.green(String(this.changedCount))} transformed, ` +
+            (failures.length > 0
+                ? `${chalk.red(String(failures.length))} failed, `
+                : '') +
             `${chalk.yellow(String(this.todos.length))} TODO(s) left`);
+        if (failures.length > 0) {
+            lines.push('');
+            lines.push(chalk.red(`  failed (${failures.length})`));
+            for (const { file, error } of failures) {
+                lines.push(`    ${file} — ${error}`);
+            }
+        }
         for (const { rule, entries } of this.todosByRule()) {
             lines.push('');
             lines.push(chalk.yellow(`  ${rule} (${entries.length})`));
@@ -60,6 +79,10 @@ export class Reporter {
             lines.push(`Search for ${chalk.bold('TODO(bestax-migrate)')} comments to finish the migration by hand,`);
             lines.push('or let the bestax-migrate skill walk them: https://bestax.io/docs/skills/intro');
         }
+        if (failures.length > 0) {
+            lines.push('');
+            lines.push(chalk.red(`${failures.length} file(s) failed and were left as they were: fix each one and run the codemod on it again.`));
+        }
         lines.push('');
         return lines.join('\n');
     }

package/dist/sources/_shared/html/parse.d.ts

@@ -25,6 +25,23 @@ export interface HtmlParseError {
     code: string;
     line: number;
     col: number;
+    /**
+     * For a `duplicate-attribute` on an element's start tag, which attribute
+     * it is. Absent where the tag made no element (an end tag, a second
+     * `<body>`), or the name can't be read back out of the source.
+     */
+    attribute?: DuplicateAttribute;
+}
+/**
+ * An attribute a start tag writes twice. A browser keeps the first and drops
+ * the rest, so `kept` is what the element has and `dropped` is the copy this
+ * error is about, each as the page writes it (`placeholder="Email"`).
+ */
+export interface DuplicateAttribute {
+    /** The name, lowercased as the parser reads it. */
+    name: string;
+    kept: string;
+    dropped: string;
 }
 export interface ParsedHtml {
     kind: 'document' | 'fragment';

package/dist/sources/_shared/html/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/sources/_shared/html/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAE1B,KAAK,KAAK,EACX,MAAM,QAAQ,CAAC;AAEhB,MAAM,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACjD,MAAM,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACzD,MAAM,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B;;;OAGG;IACH,IAAI,EAAE,OAAO,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAQD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,OAAO,CAErD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,QAAQ,CAEnD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,WAAW,CAEzD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,EAAE,CAIxD;AAQD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CA6CpD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../src/sources/_shared/html/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAE1B,KAAK,KAAK,EACX,MAAM,QAAQ,CAAC;AAEhB,MAAM,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACjD,MAAM,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACzD,MAAM,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B;;;OAGG;IACH,IAAI,EAAE,OAAO,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAQD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,OAAO,CAErD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,QAAQ,CAEnD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,WAAW,CAEzD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,EAAE,CAIxD;AA2ED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CA0DpD"}

package/dist/sources/_shared/html/parse.js

@@ -39,8 +39,64 @@ export function childrenOf(node) {
 function find(nodes, tag) {
     return nodes.find((node) => isElement(node) && node.tagName === tag);
 }
+/** The element whose start tag holds `offset`, anywhere under `node`. */
+function elementAt(node, offset) {
+    for (const child of childrenOf(node)) {
+        if (!isElement(child))
+            continue;
+        const tag = child.sourceCodeLocation?.startTag;
+        if (tag && tag.startOffset < offset && offset < tag.endOffset) {
+            return child;
+        }
+        const inside = elementAt(child, offset);
+        if (inside)
+            return inside;
+    }
+    return undefined;
+}
+/** What may sit just before an attribute's name in a start tag. */
+const BEFORE_NAME = /[\t\n\f\r /"']/;
+/**
+ * The value written after an attribute's name, if any: `="a"`, `='a'`, `=a`,
+ * with the whitespace the tokenizer allows around the `=`.
+ */
+const VALUE_AFTER_NAME = /[\t\n\f\r ]*=[\t\n\f\r ]*(?:"[^"]*"?|'[^']*'?|[^\t\n\f\r >]*)/y;
+const asciiLower = (text) => text.replace(/[A-Z]/g, letter => letter.toLowerCase());
+/**
+ * An attribute as the page writes it, from where its name starts. Read from
+ * the source rather than parse5's end offset, which stops at the name when
+ * the next attribute follows a quoted value with no space between them.
+ */
+function writtenAt(source, start, name) {
+    VALUE_AFTER_NAME.lastIndex = start + name.length;
+    const end = VALUE_AFTER_NAME.exec(source)
+        ? VALUE_AFTER_NAME.lastIndex
+        : start + name.length;
+    return source.slice(start, end).trimEnd();
+}
+/**
+ * Which attribute a `duplicate-attribute` error is about. parse5 reports it
+ * where the second copy's name ends, and the tag keeps only the first copy,
+ * whose name and place it records; so the name is the longest of the
+ * element's that the source spells just before the error.
+ */
+function duplicateAt(source, tree, offset) {
+    const attrs = elementAt(tree, offset)?.sourceCodeLocation?.attrs ?? {};
+    const name = Object.keys(attrs)
+        .filter(key => asciiLower(source.slice(offset - key.length, offset)) === key &&
+        BEFORE_NAME.test(source.charAt(offset - key.length - 1)))
+        .sort((a, b) => b.length - a.length)[0];
+    if (name === undefined)
+        return undefined;
+    return {
+        name,
+        kept: writtenAt(source, attrs[name].startOffset, name),
+        dropped: writtenAt(source, offset - name.length, name),
+    };
+}
 export function parseHtml(source) {
     const errors = [];
+    const offsets = [];
     const options = {
         sourceCodeLocationInfo: true,
         scriptingEnabled: false,
@@ -50,12 +106,25 @@ export function parseHtml(source) {
                 line: error.startLine,
                 col: error.startCol,
             });
+            offsets.push(error.startOffset);
         },
     };
+    // Each duplicate is named once the tree is built, since its element is.
+    const nameDuplicates = (tree) => {
+        errors.forEach((error, index) => {
+            if (error.code !== 'duplicate-attribute')
+                return;
+            const attribute = duplicateAt(source, tree, offsets[index]);
+            if (attribute)
+                error.attribute = attribute;
+        });
+    };
     if (!isDocument(source)) {
+        const fragment = parseFragment(source, options);
+        nameDuplicates(fragment);
         return {
             kind: 'fragment',
-            root: parseFragment(source, options),
+            root: fragment,
             head: [],
             htmlAttributes: [],
             bodyAttributes: [],
@@ -64,6 +133,7 @@ export function parseHtml(source) {
         };
     }
     const document = parse(source, options);
+    nameDuplicates(document);
     // The parser always builds `<html>`, and inside it `<head>` and `<body>`
     // (a `<frameset>` page has no body, and gets an empty one here).
     const html = find(document.childNodes, 'html');

package/dist/sources/bulma-classes/html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/sources/bulma-classes/html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAEV,UAAU,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAexB,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,+BAA+B,CAAC;AAiEvC;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAYjE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,SAoB3B,CAAC;AAsBF;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAgBnE;AAYD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAQR;AAsBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU3E;AA4KD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,wCAAsC,CAAC;AAyxBhE;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA4BjD;AAID,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAWD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,GAAE,gBAAqB,GAC7B,aAAa,CAsHf;AAgCD,yCAAyC;AACzC,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAGZ"}
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/sources/bulma-classes/html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAEV,UAAU,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAexB,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,+BAA+B,CAAC;AAiEvC;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAYjE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,SAoB3B,CAAC;AAsBF;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAgBnE;AAYD,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAQR;AAsBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU3E;AA4KD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,wCAAsC,CAAC;AAwyBhE;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA4BjD;AAID,+EAA+E;AAC/E,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAWD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,GAAE,gBAAqB,GAC7B,aAAa,CAsHf;AAgCD,yCAAyC;AACzC,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAGZ"}

package/dist/sources/bulma-classes/html.js

@@ -278,7 +278,7 @@ const SCRIPT_PATTERNS = [
     [
         'carousel',
         /carousel/i,
-        "drives a carousel: bestax's `Carousel` takes its slides as `CarouselItem` children and renders its own arrows and indicators (`autoplay` for a timed one); its styles ship in bestax's `extras.css` and `bestax.css`, not in Bulma's stylesheet",
+        "drives a carousel: bestax's `Carousel` takes its slides as `CarouselItem` children and renders its own arrows and indicators (`autoplay` for a timed one); for several slides in view it takes `itemsToShow`, with a variant per viewport such as `itemsToShowMobile`, and `itemsToScroll`, bulma-carousel's `slidesToShow` and `slidesToScroll`; it loops unless `repeat={false}`, where bulma-carousel stops at the ends unless `loop` or `infinite` is set; its styles ship in bestax's `extras.css` and `bestax.css`, not in Bulma's stylesheet",
     ],
     [
         'theme',
@@ -952,9 +952,24 @@ function relativeUrlNotes(root, dir, notes) {
         relativeUrlNotes(child, dir, notes);
     }
 }
+/**
+ * The parse errors, once per code with how many more there are, except a
+ * duplicate attribute whose name is known: each of those is its own note,
+ * naming the attribute and the copy the element keeps, since no two are
+ * about the same thing and reading the DOM is the only other way to tell.
+ */
 function parseNotes(parsed, notes) {
     const byCode = new Map();
     for (const error of parsed.errors) {
+        const duplicate = error.attribute;
+        if (duplicate) {
+            notes.push({
+                rule: htmlRuleId('html-parse', error.code),
+                message: `the HTML writes \`${duplicate.name}\` more than once on one element, and a browser keeps the first, \`${quote(duplicate.kept)}\`, and drops this one, \`${quote(duplicate.dropped)}\`: the component keeps the first too, so if the page meant the other, change it there`,
+                line: error.line,
+            });
+            continue;
+        }
         const seen = byCode.get(error.code);
         if (seen)
             seen.count++;

package/dist/types.d.ts

@@ -96,6 +96,8 @@ export interface FileResult {
     file: string;
     changed: boolean;
     todos: TodoEntry[];
+    /** Why the file could not be parsed or transformed, when it couldn't. */
+    error?: string;
 }
 /** Collects TODO entries for the file currently being transformed. */
 export interface TodoCollector {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1D,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACzC;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,mDAAmD;AACnD,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,gBAAgB,KACtB,MAAM,GAAG,SAAS,CAAC;AAExB,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GAAG,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,gBAAgB,KACtB,MAAM,GAAG,IAAI,CAAC;AAEnB,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,gBAAgB,KACtB,UAAU,CAAC;AAEhB,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,WAAW,KACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAEpC,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IAC/C,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC3D;;;OAGG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC;IACrB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IACtE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1D,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACzC;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,mDAAmD;AACnD,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,gBAAgB,KACtB,MAAM,GAAG,SAAS,CAAC;AAExB,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GAAG,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,gBAAgB,KACtB,MAAM,GAAG,IAAI,CAAC;AAEnB,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,gBAAgB,KACtB,UAAU,CAAC;AAEhB,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,OAAO,EAAE,WAAW,KACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAEpC,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IAC/C,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC3D;;;OAGG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC;IACrB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2DAA2D;IAC3D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IACtE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bestax-migrate",
-  "version": "2.31.1",
+  "version": "2.31.3",
   "description": "Codemods for migrating existing React apps from other Bulma libraries to @allxsmith/bestax-bulma",
   "type": "module",
   "bin": {
@@ -34,27 +34,27 @@
     "url": "https://github.com/allxsmith/bestax/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.29.8",
-    "chalk": "^6.0.0",
+    "@babel/parser": "^7.29.9",
+    "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "jscodeshift": "^17.3.0",
     "parse5": "^7.3.0",
     "property-information": "^7.2.0",
-    "@allxsmith/bestax-bulma": "^5.41.0"
+    "@allxsmith/bestax-bulma": "^5.44.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/jscodeshift": "^17.3.0",
-    "@types/node": "^26.6.4",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.5",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "classnames": "^2.5.1",
     "clsx": "^2.1.1",
     "jest": "^30.2.0",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "ts-jest": "^29.4.14",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "ts-jest": "^29.4.15",
     "typescript": "^6.0.3"
   },
   "publishConfig": {
@@ -78,5 +78,5 @@
     "clean": "rimraf dist",
     "release": "npx semantic-release"
   },
-  "readme": "# bestax-migrate\n\n[![npm version](https://img.shields.io/npm/v/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)\n[![npm downloads](https://img.shields.io/npm/dm/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Socket Badge](https://badge.socket.dev/npm/package/bestax-migrate/latest)](https://socket.dev/npm/package/bestax-migrate/overview)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14361/badge)](https://www.bestpractices.dev/projects/14361)\n[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/bestax-migrate#provenance)\n[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nCodemods that migrate existing React apps to [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — the actively maintained React component library for **Bulma v1**.\n\nCurrently supported sources:\n\n| Source                                                                           | Status                                                                               |\n| -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |\n| [`react-bulma-components`](https://github.com/couds/react-bulma-components) (v4) | ✅ All 32 components mapped (a few patterns are flagged as TODOs)                    |\n| [`rbx`](https://github.com/dfee/rbx) (v2)                                        | ✅ Full export surface mapped (a few patterns are flagged as TODOs)                  |\n| [`bloomer`](https://github.com/AlgusDark/bloomer) (0.6)                          | ✅ All 108 exports mapped (Font Awesome 4 icons and Bulma 0.4's `Nav` are flagged)   |\n| `bulma-classes`: Bulma's classes on plain JSX, no library                        | ✅ Converts an element only when bestax renders the same markup; the rest is flagged |\n| `bulma-classes` on HTML: static pages and templates styled with Bulma            | ✅ Writes a React component beside each page; its head and scripts are flagged       |\n\nPass the source as the first argument: `bestax-migrate <source> <paths…>`.\n\n## Requirements\n\n**Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the CLI\nexits immediately with an explicit upgrade message.\n\nThis applies only to the Node version the codemod itself runs on. It places no requirement on\nthe app being migrated — the source is read as text and is never executed.\n\n## Usage\n\n```bash\n# Preview what would change (no writes)\npnpm dlx bestax-migrate react-bulma-components src/ --dry\n# …or, for an rbx or bloomer app\npnpm dlx bestax-migrate rbx src/ --dry\npnpm dlx bestax-migrate bloomer src/ --dry\n# …or, for an app that writes Bulma's classes on plain JSX\npnpm dlx bestax-migrate bulma-classes src/ --dry\n# …or, for static HTML pages styled with Bulma: name a page, or walk a folder with -e html\n# (-e html,htm takes .htm pages too)\npnpm dlx bestax-migrate bulma-classes src/pages/login/index.html --dry\npnpm dlx bestax-migrate bulma-classes -e html src/pages/ --dry\n\n# Apply the migration\npnpm dlx bestax-migrate react-bulma-components src/\n```\n\nnpm and yarn work too: `npx bestax-migrate …` / `yarn dlx bestax-migrate …`.\n\nThe codemod uses [jscodeshift](https://github.com/facebook/jscodeshift) to:\n\n- rewrite the source library's imports to `@allxsmith/bestax-bulma` (including destructuring and namespace imports)\n- rename components and compound sub-components (`Form.Textarea` → `TextArea`, `Card.Footer.Item` → `Card.FooterItem`, `Hero.Footer` → `Hero.Foot`, …) — and, for bloomer, its flat names onto bestax's compounds (`CardHeaderTitle` → `Card.Header.Title`)\n- convert props (`renderAs` → `as`, `loading` → `isLoading`, numeric spacing/text sizes → string unions, `textAlign=\"center\"` → `textAlign=\"centered\"`, …)\n- flatten responsive breakpoint objects (`mobile={{ size: 4 }}` → `sizeMobile={4}`) and bloomer's `isDisplay`/`isHidden` strings, arrays and objects (`isHidden=\"touch\"` → `visibilityTouch=\"hidden\"`)\n- for `bulma-classes`, turn raw Bulma markup into components and props (`<a className=\"button is-primary\">` → `<Button as=\"a\" color=\"primary\">`, `<p className=\"has-text-centered mt-4\">` → `<Paragraph textAlign=\"centered\" mt=\"4\">`), converting an element only when bestax renders exactly the same markup\n- for `bulma-classes` on an HTML page, write a React module beside it (`index.html` → `index.tsx`, or `.jsx` when the package isn't TypeScript) whose default export is the page's body as a component (`LoginPage`), converted as the same markup written as JSX would be. The page is never changed and an existing module is never overwritten; the head, the `<html>` and `<body>` attributes, the stylesheets and scripts it loads, and inline handlers are left as `html-*` TODOs, except that under `--css bestax` or `--css bulma` the module imports the stylesheet in place of the page's Bulma `<link>`\n- restructure patterns bestax models differently (`Table.Container`, Navbar dropdowns, `Form.Help`, icon-font children → `<Icon name=…>`)\n- migrate stylesheets: CSS imports converge on `@allxsmith/bestax-bulma/bestax.css`, and SCSS files move from Bulma 0.9's `@import` + `$var !default` overrides to `@use 'bulma/sass' with (…)` plus `@use '@allxsmith/bestax-bulma/scss/extras'`\n- update `package.json`: remove the source library, add `@allxsmith/bestax-bulma`, raise a declared pre-1.0 `bulma` to `^1` (adding it only when your sources import `bulma/…` directly — otherwise it arrives transitively), and swap the dead `node-sass` for dart `sass` (no install is ever run). Migrating **rbx** is what frees an app from Bulma 0.7.5: rbx pinned it as a _direct_ dependency, so the app could not choose its own Bulma version at all. The four Bulma extensions rbx also pulled in (`bulma-badge`, `bulma-divider`, `bulma-pageloader`, `bulma-tooltip`) are **reported rather than removed** — bestax replaces all four, but a manifest entry is a deliberate declaration and your own Sass may import them. A **bloomer** app declared its own Bulma 0.6, which is what gets bumped. For **bulma-classes** there is no library to remove, and by default (`--css keep`) the app's Bulma version, Sass and stylesheet imports all stay: its own Bulma already styles every class a converted element renders. `--css bestax` or `--css bulma` moves it to Bulma v1 like the other sources\n\nAnything without a safe automatic conversion is left in place with a `// TODO(bestax-migrate): …` comment, and the run ends with a report of every TODO by file and line. TODOs are expected output, not errors — resolve them with the migration guide ([react-bulma-components](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components), [rbx](https://bestax.io/docs/guides/getting-started/migration/rbx), [bloomer](https://bestax.io/docs/guides/getting-started/migration/bloomer), [Bulma classes](https://bestax.io/docs/guides/getting-started/migration/bulma-classes)), or let the [`bestax-migrate` Agent Skill](https://bestax.io/docs/skills/intro) walk them for you:\n\n```bash\nnpx skills add https://github.com/allxsmith/bestax --skill bestax-migrate\n```\n\n### Through the Codemod Registry\n\nbestax-migrate is also in the [Codemod Registry](https://app.codemod.com/registry) as `bestax-migrate`, for teams that run their migrations through Codemod. That package runs this CLI from npm at a pinned release, which can trail the newest one:\n\n```bash\n# Preview (no writes)\nnpx codemod bestax-migrate --workflow preview --param source=react-bulma-components\n# Apply\nnpx codemod bestax-migrate --param source=react-bulma-components\n```\n\nRun it from your app root. `--param paths=\"src lib\"` (default `src`) and `--param options=\"--css keep\"` pass through to the CLI. Codemod's own `--dry-run` skips the shell step this package runs, so use the `preview` workflow for a dry run.\n\n## Options\n\n| Flag                 | Description                                                                                    |\n| -------------------- | ---------------------------------------------------------------------------------------------- |\n| `--dry`, `-d`        | Report what would change without writing files                                                 |\n| `--print`, `-p`      | Print transformed sources to stdout, still writing them unless `--dry` is set                  |\n| `--extensions`, `-e` | File extensions to include in a folder (default `js,jsx,ts,tsx,scss,sass`; `html` for pages)   |\n| `--css <mode>`       | Stylesheet target: `bestax`, `bulma`, or `keep` (default `bestax`; `keep` for `bulma-classes`) |\n| `--no-deps`          | Skip updating package.json dependencies                                                        |\n\n## After the codemod\n\n1. Run your package manager's install (the codemod rewrote `package.json` but never installs)\n2. Search for `TODO(bestax-migrate)` and resolve each comment\n3. Typecheck/build and review the rendered app\n\nFull walkthrough: [react-bulma-components migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components) · [rbx migration guide](https://bestax.io/docs/guides/getting-started/migration/rbx) · [bloomer migration guide](https://bestax.io/docs/guides/getting-started/migration/bloomer) · [Bulma classes migration guide](https://bestax.io/docs/guides/getting-started/migration/bulma-classes).\n\n## Hardened by default\n\nA codemod rewrites your source in place, so how it is built and published matters:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/bestax-migrate#provenance), or run `npm audit signatures`.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **The libraries this tool migrates away from are never installed here** — source fixtures are read as text only, so no unmaintained third-party package enters the dependency tree.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, and CodeQL, Dependency Review, and Dependabot run continuously alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n## Telemetry\n\n`bestax-migrate` can send one **anonymous** usage event after a successful\nrun — only if you opt in when asked (once, on an interactive terminal). The\nevent is just the run's shape — source library, CSS mode, the dry/deps flags, a\ncapped changed-file count, and per-rule TODO counts — plus the CLI version,\nNode major version, and OS platform name. Never file paths, file contents,\ncode, names, IPs, or machine IDs, and no identifier exists that could link two\nevents together. Opt out any time with `--no-telemetry`,\n`BESTAX_TELEMETRY=0`, or `DO_NOT_TRACK=1`.\n\nFull disclosure of every field and control: [Telemetry guide](https://bestax.io/docs/guides/telemetry)\n\n## License\n\nSource code licensed MIT\n"
+  "readme": "# bestax-migrate\n\n[![npm version](https://img.shields.io/npm/v/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)\n[![npm downloads](https://img.shields.io/npm/dm/bestax-migrate.svg)](https://www.npmjs.com/package/bestax-migrate)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Socket Badge](https://badge.socket.dev/npm/package/bestax-migrate/latest)](https://socket.dev/npm/package/bestax-migrate/overview)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14361/badge)](https://www.bestpractices.dev/projects/14361)\n[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/bestax-migrate#provenance)\n[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)\n\nCodemods that migrate existing React apps to [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — the actively maintained React component library for **Bulma v1**.\n\nCurrently supported sources:\n\n| Source                                                                           | Status                                                                               |\n| -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |\n| [`react-bulma-components`](https://github.com/couds/react-bulma-components) (v4) | ✅ All 32 components mapped (a few patterns are flagged as TODOs)                    |\n| [`rbx`](https://github.com/dfee/rbx) (v2)                                        | ✅ Full export surface mapped (a few patterns are flagged as TODOs)                  |\n| [`bloomer`](https://github.com/AlgusDark/bloomer) (0.6)                          | ✅ All 108 exports mapped (Font Awesome 4 icons and Bulma 0.4's `Nav` are flagged)   |\n| `bulma-classes`: Bulma's classes on plain JSX, no library                        | ✅ Converts an element only when bestax renders the same markup; the rest is flagged |\n| `bulma-classes` on HTML: static pages and templates styled with Bulma            | ✅ Writes a React component beside each page; its head and scripts are flagged       |\n\nPass the source as the first argument: `bestax-migrate <source> <paths…>`.\n\n## Requirements\n\n**Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the CLI\nexits immediately with an explicit upgrade message.\n\nThis applies only to the Node version the codemod itself runs on. It places no requirement on\nthe app being migrated — the source is read as text and is never executed.\n\n## Usage\n\n```bash\n# Preview what would change (no writes)\npnpm dlx bestax-migrate react-bulma-components src/ --dry\n# …or, for an rbx or bloomer app\npnpm dlx bestax-migrate rbx src/ --dry\npnpm dlx bestax-migrate bloomer src/ --dry\n# …or, for an app that writes Bulma's classes on plain JSX\npnpm dlx bestax-migrate bulma-classes src/ --dry\n# …or, for static HTML pages styled with Bulma: name a page, or walk a folder with -e html\n# (-e html,htm takes .htm pages too)\npnpm dlx bestax-migrate bulma-classes src/pages/login/index.html --dry\npnpm dlx bestax-migrate bulma-classes -e html src/pages/ --dry\n\n# Apply the migration\npnpm dlx bestax-migrate react-bulma-components src/\n```\n\nnpm and yarn work too: `npx bestax-migrate …` / `yarn dlx bestax-migrate …`.\n\nThe codemod uses [jscodeshift](https://github.com/facebook/jscodeshift) to:\n\n- rewrite the source library's imports to `@allxsmith/bestax-bulma` (including destructuring and namespace imports)\n- rename components and compound sub-components (`Form.Textarea` → `TextArea`, `Card.Footer.Item` → `Card.FooterItem`, `Hero.Footer` → `Hero.Foot`, …) — and, for bloomer, its flat names onto bestax's compounds (`CardHeaderTitle` → `Card.Header.Title`)\n- convert props (`renderAs` → `as`, `loading` → `isLoading`, numeric spacing/text sizes → string unions, `textAlign=\"center\"` → `textAlign=\"centered\"`, …)\n- flatten responsive breakpoint objects (`mobile={{ size: 4 }}` → `sizeMobile={4}`) and bloomer's `isDisplay`/`isHidden` strings, arrays and objects (`isHidden=\"touch\"` → `visibilityTouch=\"hidden\"`)\n- for `bulma-classes`, turn raw Bulma markup into components and props (`<a className=\"button is-primary\">` → `<Button as=\"a\" color=\"primary\">`, `<p className=\"has-text-centered mt-4\">` → `<Paragraph textAlign=\"centered\" mt=\"4\">`), converting an element only when bestax renders exactly the same markup\n- for `bulma-classes` on an HTML page, write a React module beside it (`index.html` → `index.tsx`, or `.jsx` when the package isn't TypeScript) whose default export is the page's body as a component (`LoginPage`), converted as the same markup written as JSX would be. The page is never changed and an existing module is never overwritten; the head, the `<html>` and `<body>` attributes, the stylesheets and scripts it loads, and inline handlers are left as `html-*` TODOs, except that under `--css bestax` or `--css bulma` the module imports the stylesheet in place of the page's Bulma `<link>`\n- restructure patterns bestax models differently (`Table.Container`, Navbar dropdowns, `Form.Help`, icon-font children → `<Icon name=…>`)\n- migrate stylesheets: CSS imports converge on `@allxsmith/bestax-bulma/bestax.css`, and SCSS files move from Bulma 0.9's `@import` + `$var !default` overrides to `@use 'bulma/sass' with (…)` plus `@use '@allxsmith/bestax-bulma/scss/extras'`\n- update `package.json`: remove the source library, add `@allxsmith/bestax-bulma`, raise a declared pre-1.0 `bulma` to `^1` (adding it only when your sources import `bulma/…` directly — otherwise it arrives transitively), and swap the dead `node-sass` for dart `sass` (no install is ever run). Migrating **rbx** is what frees an app from Bulma 0.7.5: rbx pinned it as a _direct_ dependency, so the app could not choose its own Bulma version at all. The four Bulma extensions rbx also pulled in (`bulma-badge`, `bulma-divider`, `bulma-pageloader`, `bulma-tooltip`) are **reported rather than removed** — bestax replaces all four, but a manifest entry is a deliberate declaration and your own Sass may import them. A **bloomer** app declared its own Bulma 0.6, which is what gets bumped. For **bulma-classes** there is no library to remove, and by default (`--css keep`) the app's Bulma version, Sass and stylesheet imports all stay: its own Bulma already styles every class a converted element renders. `--css bestax` or `--css bulma` moves it to Bulma v1 like the other sources\n\nAnything without a safe automatic conversion is left in place with a `// TODO(bestax-migrate): …` comment, and the run ends with a report of every TODO by file and line. TODOs are expected output, not errors — resolve them with the migration guide ([react-bulma-components](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components), [rbx](https://bestax.io/docs/guides/getting-started/migration/rbx), [bloomer](https://bestax.io/docs/guides/getting-started/migration/bloomer), [Bulma classes](https://bestax.io/docs/guides/getting-started/migration/bulma-classes)), or let the [`bestax-migrate` Agent Skill](https://bestax.io/docs/skills/intro) walk them for you:\n\n```bash\nnpx skills add https://github.com/allxsmith/bestax --skill bestax-migrate\n```\n\n### Through the Codemod Registry\n\nbestax-migrate is also in the [Codemod Registry](https://app.codemod.com/registry) as `bestax-migrate`, for teams that run their migrations through Codemod. That package runs this CLI from npm at a pinned release, which can trail the newest one:\n\n```bash\n# Preview (no writes)\nnpx codemod bestax-migrate --workflow preview --param source=react-bulma-components\n# Apply\nnpx codemod bestax-migrate --param source=react-bulma-components\n```\n\nRun it from your app root. `--param paths=\"src lib\"` (default `src`) and `--param options=\"--css keep\"` pass through to the CLI. Codemod's own `--dry-run` skips the shell step this package runs, so use the `preview` workflow for a dry run.\n\n## Options\n\n| Flag                 | Description                                                                                    |\n| -------------------- | ---------------------------------------------------------------------------------------------- |\n| `--dry`, `-d`        | Report what would change without writing files                                                 |\n| `--print`, `-p`      | Print transformed sources to stdout, still writing them unless `--dry` is set                  |\n| `--extensions`, `-e` | File extensions to include in a folder (default `js,jsx,ts,tsx,scss,sass`; `html` for pages)   |\n| `--css <mode>`       | Stylesheet target: `bestax`, `bulma`, or `keep` (default `bestax`; `keep` for `bulma-classes`) |\n| `--no-deps`          | Skip updating package.json dependencies                                                        |\n\n## Exit codes\n\n| Code  | Meaning                                                                                                                                                                                                                  |\n| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| `0`   | The run finished. TODOs are expected output and leave it at 0                                                                                                                                                            |\n| `1`   | A file could not be parsed or transformed. It is marked `✖`, listed in the report and left as it was, and every other file is still migrated. Fix it and run the codemod on it again. A run like that sends no telemetry |\n| `1`   | The command was refused before the run: an unknown source, flag or `--css` mode, a path that isn't there, an HTML page for a source that reads none, or Node older than 22                                               |\n| `130` | Ctrl-C at the telemetry question, which comes after the run                                                                                                                                                              |\n\n`--help` lists them too. With `--dry`, a file that fails to parse still makes the exit code 1, so a preview in CI catches it. A file the run can't read at all stops it there instead, with Node's error and exit code 1, before `package.json` is updated.\n\n## After the codemod\n\n1. Run your package manager's install (the codemod rewrote `package.json` but never installs)\n2. Search for `TODO(bestax-migrate)` and resolve each comment\n3. Typecheck/build and review the rendered app\n\nFull walkthrough: [react-bulma-components migration guide](https://bestax.io/docs/guides/getting-started/migration/react-bulma-components) · [rbx migration guide](https://bestax.io/docs/guides/getting-started/migration/rbx) · [bloomer migration guide](https://bestax.io/docs/guides/getting-started/migration/bloomer) · [Bulma classes migration guide](https://bestax.io/docs/guides/getting-started/migration/bulma-classes).\n\n## Hardened by default\n\nA codemod rewrites your source in place, so how it is built and published matters:\n\n- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/bestax-migrate#provenance), or run `npm audit signatures`.\n- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.\n- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.\n- **The libraries this tool migrates away from are never installed here** — source fixtures are read as text only, so no unmaintained third-party package enters the dependency tree.\n- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.\n- **Every GitHub Action is pinned to a full commit SHA**, and CodeQL, Dependency Review, and Dependabot run continuously alongside a high-severity `pnpm audit` gate.\n- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.\n\nFull detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)\n\n## Telemetry\n\n`bestax-migrate` can send one **anonymous** usage event after a successful\nrun — only if you opt in when asked (once, on an interactive terminal). The\nevent is just the run's shape — source library, CSS mode, the dry/deps flags, a\ncapped changed-file count, and per-rule TODO counts — plus the CLI version,\nNode major version, and OS platform name. Never file paths, file contents,\ncode, names, IPs, or machine IDs, and no identifier exists that could link two\nevents together. Opt out any time with `--no-telemetry`,\n`BESTAX_TELEMETRY=0`, or `DO_NOT_TRACK=1`.\n\nFull disclosure of every field and control: [Telemetry guide](https://bestax.io/docs/guides/telemetry)\n\n## License\n\nSource code licensed MIT\n"
 }