openapi-typesafe-migrate 1.0.0-rc.0 → 1.0.0-rc.2

package/dist/cli/main.mjs

@@ -1,15 +1,96 @@
-import { mkdirSync, appendFileSync, readFileSync } from 'node:fs';
+import { mkdtempSync, writeFileSync, mkdirSync, appendFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { readFile, writeFile, readdir } from 'node:fs/promises';
+import { join, dirname, basename, isAbsolute, relative, sep, resolve } from 'node:path';
+import { spawn } from 'node:child_process';
+import { realpath, readFile, lstat, writeFile, chmod, rename, rm, readdir } from 'node:fs/promises';
 import ts from '@typescript/typescript6';
 import { parseArgs } from 'node:util';
 
+const LS_FILES_ARGUMENTS = [
+  "ls-files",
+  "--cached",
+  "--others",
+  "--exclude-standard",
+  "--deduplicate",
+  "-z"
+];
+const CHECK_IGNORE_ARGUMENTS = ["check-ignore", "--quiet", "."];
+const IGNORED_EXIT_CODE = 0;
+const NOT_IGNORED_EXIT_CODE = 1;
+const IGNORED_REASON = "the git repository around the folder ignores it";
+const GIT_COMMAND = "git";
+const HARDENED_CONFIG = [
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "safe.bareRepository=explicit"
+];
+const TRAILING_SLASH_RE = /\/$/;
+const SELF_PATHS = /* @__PURE__ */ new Set(["", "."]);
+function runGit(directory, gitArguments) {
+  return new Promise((resolve) => {
+    const child = spawn(GIT_COMMAND, [...HARDENED_CONFIG, ...gitArguments], { cwd: directory });
+    const output = [];
+    const errors = [];
+    child.stdout.on("data", (chunk) => output.push(chunk));
+    child.stderr.on("data", (chunk) => errors.push(chunk));
+    child.on("error", (error) => resolve({ kind: "failed", reason: error.message }));
+    child.on("close", (exitCode) => {
+      resolve({
+        kind: "exited",
+        exitCode,
+        output: Buffer.concat(output).toString("utf8"),
+        errors: Buffer.concat(errors).toString("utf8").trim()
+      });
+    });
+  });
+}
+function failureReason(run) {
+  if (run.kind === "failed") {
+    return run.reason;
+  }
+  return run.errors || `exit code ${run.exitCode}`;
+}
+function listedPaths$1(output) {
+  return output.split("\0").map((path) => path.replace(TRAILING_SLASH_RE, "")).filter((path) => !SELF_PATHS.has(path));
+}
+async function listDirectory(directory) {
+  const ignored = await runGit(directory, CHECK_IGNORE_ARGUMENTS);
+  if (ignored.kind === "exited" && ignored.exitCode === IGNORED_EXIT_CODE) {
+    return { kind: "unavailable", reason: IGNORED_REASON };
+  }
+  if (ignored.kind === "failed" || ignored.exitCode !== NOT_IGNORED_EXIT_CODE) {
+    return { kind: "unavailable", reason: failureReason(ignored) };
+  }
+  const listed = await runGit(directory, LS_FILES_ARGUMENTS);
+  if (listed.kind === "failed" || listed.exitCode !== 0) {
+    return { kind: "unavailable", reason: failureReason(listed) };
+  }
+  return { kind: "listed", paths: listedPaths$1(listed.output) };
+}
+class SpawnedGitFileList {
+  list(directory) {
+    return listDirectory(directory);
+  }
+}
+function createGitFileList() {
+  return new SpawnedGitFileList();
+}
+
+const LOG_FILE_MODE = 384;
+const TEMPORARY_FOLDER_PREFIX = "openapi-typesafe-migrate-";
+const LOG_EXTENSION = ".jsonl";
+const TIME_SEPARATOR = ":";
+const FILE_NAME_TIME_SEPARATOR = "-";
 class JsonLinesLogger {
   #options;
   constructor(options) {
     this.#options = options;
-    mkdirSync(dirname(options.path), { recursive: true });
+    if (options.isExclusive) {
+      writeFileSync(options.path, "", { flag: "wx", mode: LOG_FILE_MODE });
+    } else {
+      mkdirSync(dirname(options.path), { recursive: true });
+    }
   }
   info(event, fields = {}) {
     this.#append("info", event, fields);
@@ -19,13 +100,19 @@ class JsonLinesLogger {
   }
   #append(level, event, fields) {
     const time = this.#options.now().toISOString();
-    appendFileSync(this.#options.path, `${JSON.stringify({ time, level, event, ...fields })}
-`);
+    const line = `${JSON.stringify({ time, level, event, ...fields })}
+`;
+    appendFileSync(this.#options.path, line, { mode: LOG_FILE_MODE });
   }
 }
 function createJsonLinesLogger(options) {
   return new JsonLinesLogger(options);
 }
+function createTemporaryLogPath(parent, startTime) {
+  const folder = mkdtempSync(join(parent, TEMPORARY_FOLDER_PREFIX));
+  const name = startTime.toISOString().replaceAll(TIME_SEPARATOR, FILE_NAME_TIME_SEPARATOR);
+  return join(folder, `${name}${LOG_EXTENSION}`);
+}
 
 const SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
@@ -38,11 +125,19 @@ const SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".turbo",
   "coverage"
 ]);
-async function listTree(root, relative) {
-  const entries = await readdir(join(root, relative), { withFileTypes: true });
+const CURRENT_DIRECTORY = ".";
+const TEMPORARY_SUFFIX = ".openapi-typesafe-migrate.tmp";
+const PERMISSION_BITS = 4095;
+const TEMPORARY_MODE = 384;
+const PARENT_DIRECTORY = "..";
+function isInSkippedDirectory(path) {
+  return path.split("/").slice(0, -1).some((directory) => SKIPPED_DIRECTORIES.has(directory));
+}
+async function listTree(root, relative2) {
+  const entries = await readdir(join(root, relative2), { withFileTypes: true });
   const nested = await Promise.all(
     entries.map((entry) => {
-      const path = relative === "" ? entry.name : `${relative}/${entry.name}`;
+      const path = relative2 === "" ? entry.name : `${relative2}/${entry.name}`;
       if (entry.isDirectory()) {
         return SKIPPED_DIRECTORIES.has(entry.name) ? [] : listTree(root, path);
       }
@@ -51,23 +146,134 @@ async function listTree(root, relative) {
   );
   return nested.flat();
 }
+function isRelativeDownward(path) {
+  return !isAbsolute(path) && !path.split("/").includes(PARENT_DIRECTORY);
+}
+function isInFolder(folder, target) {
+  const path = relative(folder, target);
+  return path !== "" && path !== PARENT_DIRECTORY && !path.startsWith(`${PARENT_DIRECTORY}${sep}`) && !isAbsolute(path);
+}
+async function entryAt(root, realRoot, path) {
+  if (!isRelativeDownward(path)) {
+    return "outside";
+  }
+  try {
+    const stats = await lstat(join(root, path));
+    if (!stats.isFile() && !stats.isDirectory()) {
+      return "other";
+    }
+    if (!isInFolder(realRoot, await realpath(join(root, path)))) {
+      return "outside";
+    }
+    return stats.isFile() ? "file" : "directory";
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return "other";
+    }
+    throw error;
+  }
+}
+async function listedPaths(root, realRoot, paths) {
+  const candidates = paths.filter((path) => !isInSkippedDirectory(path));
+  const entries = await Promise.all(candidates.map((path) => entryAt(root, realRoot, path)));
+  const withEntry = (entry) => candidates.filter((_path, index) => entries[index] === entry);
+  return {
+    files: withEntry("file"),
+    directories: withEntry("directory").filter((path) => !SKIPPED_DIRECTORIES.has(baseName$1(path))),
+    skipped: withEntry("outside").map((path) => ({ path, reason: "outside-root" }))
+  };
+}
+function baseName$1(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function joinRelative(directory, path) {
+  return directory === "" ? path : `${directory}/${path}`;
+}
+const NO_FILES = { files: [], skipped: [] };
+function joinLists(lists) {
+  return lists.reduce(
+    (joined, list) => ({
+      files: [...joined.files, ...list.files],
+      skipped: [...joined.skipped, ...list.skipped]
+    }),
+    NO_FILES
+  );
+}
 class NodeProjectFiles {
   #root;
-  constructor(root) {
+  #options;
+  constructor(root, options) {
     this.#root = root;
+    this.#options = options;
   }
-  listFiles() {
-    return listTree(this.#root, "");
-  }
-  read(path) {
-    return readFile(join(this.#root, path), "utf8");
+  /** Git's view of the project when it is in a git repository, so ignored files stay out. */
+  async listFiles() {
+    return this.#listDirectory(await realpath(this.#root), "");
+  }
+  /**
+   * One directory, by the git repository it is in. Git lists a submodule or a nested repository
+   * as one entry, so each of those is listed the same way, by its own repository and ignore rules.
+   */
+  async #listDirectory(realRoot, directory) {
+    const { git, logger } = this.#options;
+    const listing = await git.list(join(this.#root, directory));
+    const logged = { directory: directory === "" ? CURRENT_DIRECTORY : directory };
+    if (listing.kind === "unavailable") {
+      const files2 = await listTree(this.#root, directory);
+      logger.info("files_listed", {
+        ...logged,
+        source: "tree",
+        fileCount: files2.length,
+        reason: listing.reason
+      });
+      return { files: files2, skipped: [] };
+    }
+    const paths = listing.paths.map((path) => joinRelative(directory, path));
+    const { files, directories, skipped } = await listedPaths(this.#root, realRoot, paths);
+    logger.info("files_listed", { ...logged, source: "git", fileCount: files.length });
+    for (const file of skipped) {
+      logger.warn("file_skipped", { ...file });
+    }
+    const nested = await Promise.all(
+      directories.map((path) => this.#listDirectory(realRoot, path))
+    );
+    return joinLists([{ files, skipped }, ...nested]);
+  }
+  async read(path) {
+    return readFile(await this.#pathInRoot(path), "utf8");
+  }
+  /**
+   * Writes a new file and renames it over the old one, so the write never goes through a link: a
+   * hard link to a file outside the root keeps its old text, and is reported in the log. The new
+   * file keeps the mode of the old one.
+   */
+  async write(path, text) {
+    const target = await this.#pathInRoot(path);
+    const { mode, nlink } = await lstat(target);
+    const temporary = join(dirname(target), `.${basename(target)}${TEMPORARY_SUFFIX}`);
+    await writeFile(temporary, text, { encoding: "utf8", flag: "wx", mode: TEMPORARY_MODE });
+    try {
+      await chmod(temporary, mode & PERMISSION_BITS);
+      await rename(temporary, target);
+    } catch (error) {
+      await rm(temporary, { force: true });
+      throw error;
+    }
+    if (nlink > 1) {
+      this.#options.logger.warn("hard_link_separated", { path, linkCount: nlink });
+    }
   }
-  write(path, text) {
-    return writeFile(join(this.#root, path), text, "utf8");
+  /** The real path of a project file; refuses one that resolves outside the root. */
+  async #pathInRoot(path) {
+    const realPath = isRelativeDownward(path) ? await realpath(join(this.#root, path)) : void 0;
+    if (realPath === void 0 || !isInFolder(await realpath(this.#root), realPath)) {
+      throw new Error(`${path} is outside the project folder ${this.#root}`);
+    }
+    return realPath;
   }
 }
-function createNodeProjectFiles(root) {
-  return new NodeProjectFiles(root);
+function createNodeProjectFiles(root, options) {
+  return new NodeProjectFiles(root, options);
 }
 
 function unchanged(text) {
@@ -157,6 +363,85 @@ function collectFileNames(file) {
   return names;
 }
 
+const SCRIPT_KINDS = /* @__PURE__ */ new Map([
+  [".ts", ts.ScriptKind.TS],
+  [".mts", ts.ScriptKind.TS],
+  [".cts", ts.ScriptKind.TS],
+  [".tsx", ts.ScriptKind.TSX],
+  [".js", ts.ScriptKind.JS],
+  [".mjs", ts.ScriptKind.JS],
+  [".cjs", ts.ScriptKind.JS],
+  [".jsx", ts.ScriptKind.JSX]
+]);
+const ASTRO_EXTENSION = ".astro";
+const SCRIPT_OPEN_TAG = "<script";
+const TAG_END = ">";
+const ASTRO_FRONTMATTER_RE = /^(\s*---\r?\n)([\s\S]*?)\r?\n---/;
+const LANG_RE = /\blang\s*=\s*["']?([a-z]+)/i;
+const LANG_KINDS = /* @__PURE__ */ new Map([
+  ["ts", ts.ScriptKind.TS],
+  ["typescript", ts.ScriptKind.TS],
+  ["tsx", ts.ScriptKind.TSX],
+  ["jsx", ts.ScriptKind.JSX]
+]);
+function extensionOf$1(path) {
+  return path.slice(path.lastIndexOf("."));
+}
+function plainScriptKind(path) {
+  return SCRIPT_KINDS.get(extensionOf$1(path));
+}
+function blockKind(attributes, isAstro) {
+  const lang = LANG_RE.exec(attributes)?.[1]?.toLowerCase();
+  const fallback = isAstro ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+  return (lang === void 0 ? void 0 : LANG_KINDS.get(lang)) ?? fallback;
+}
+function astroFrontmatter(text) {
+  const frontmatter = ASTRO_FRONTMATTER_RE.exec(text);
+  if (frontmatter === null) {
+    return { markupStart: 0 };
+  }
+  const [whole, fence, content] = frontmatter;
+  const region = { offset: fence.length, text: content, kind: ts.ScriptKind.TS };
+  return { region, markupStart: whole.length };
+}
+function scriptBlocks(markup) {
+  const openTag = /<script\b/gi;
+  const closeTag = /<\/script\s*>/gi;
+  const blocks = [];
+  for (let opening = openTag.exec(markup); opening !== null; opening = openTag.exec(markup)) {
+    const tagEnd = markup.indexOf(TAG_END, opening.index);
+    closeTag.lastIndex = tagEnd + 1;
+    const closing = tagEnd === -1 ? null : closeTag.exec(markup);
+    if (closing === null) {
+      break;
+    }
+    const attributes = markup.slice(opening.index + SCRIPT_OPEN_TAG.length, tagEnd);
+    blocks.push({
+      attributes,
+      contentStart: tagEnd + 1,
+      content: markup.slice(tagEnd + 1, closing.index)
+    });
+    openTag.lastIndex = closeTag.lastIndex;
+  }
+  return blocks;
+}
+function componentRegions(text, isAstro) {
+  const { region, markupStart } = isAstro ? astroFrontmatter(text) : { markupStart: 0 };
+  const regions = region === void 0 ? [] : [region];
+  for (const block of scriptBlocks(text.slice(markupStart))) {
+    const offset = markupStart + block.contentStart;
+    regions.push({ offset, text: block.content, kind: blockKind(block.attributes, isAstro) });
+  }
+  return regions;
+}
+function scriptRegions(text, path) {
+  const kind = plainScriptKind(path);
+  if (kind !== void 0) {
+    return [{ offset: 0, text, kind }];
+  }
+  return componentRegions(text, extensionOf$1(path) === ASTRO_EXTENSION);
+}
+
 const KEYWORDS = /* @__PURE__ */ new Map([
   ["AnyKeyword", "any"],
   ["BigIntKeyword", "bigint"],
@@ -362,19 +647,6 @@ function returnEdits(expression, names) {
 const TRANSFORM = "transform";
 const LEGACY_ONLY_CALLBACKS = ["postTransform", "transformProperty"];
 const IR_CALLBACKS_OPTION = "irCallbacks";
-const SCRIPT_KINDS = /* @__PURE__ */ new Map([
-  [".ts", ts.ScriptKind.TS],
-  [".mts", ts.ScriptKind.TS],
-  [".cts", ts.ScriptKind.TS],
-  [".tsx", ts.ScriptKind.TSX],
-  [".js", ts.ScriptKind.JS],
-  [".mjs", ts.ScriptKind.JS],
-  [".cjs", ts.ScriptKind.JS],
-  [".jsx", ts.ScriptKind.JSX]
-]);
-function scriptKindOf(path) {
-  return SCRIPT_KINDS.get(path.slice(path.lastIndexOf(".")));
-}
 function propertyNamed(options, name) {
   return options.properties.find((property) => {
     const key = property.name;
@@ -500,7 +772,7 @@ function findCallFindings(file, text, names) {
 }
 class TypescriptCallbackRewriter {
   rewrite(text, path) {
-    const scriptKind = scriptKindOf(path);
+    const scriptKind = plainScriptKind(path);
     if (scriptKind === void 0) {
       return unchanged(text);
     }
@@ -517,6 +789,149 @@ function createTypescriptCallbackRewriter() {
   return new TypescriptCallbackRewriter();
 }
 
+const REQUIRE = "require";
+const RESOLVE = "resolve";
+const VITEST_METHODS = /* @__PURE__ */ new Set([
+  "mock",
+  "doMock",
+  "unmock",
+  "doUnmock",
+  "importActual",
+  "importMock"
+]);
+const JEST_METHODS = /* @__PURE__ */ new Set([
+  "mock",
+  "doMock",
+  "unmock",
+  "dontMock",
+  "deepUnmock",
+  "setMock",
+  "requireActual",
+  "requireMock",
+  "createMockFromModule",
+  "genMockFromModule",
+  "unstable_mockModule",
+  "unstable_unmockModule"
+]);
+const MODULE_METHODS = /* @__PURE__ */ new Map([
+  ["vi", VITEST_METHODS],
+  ["jest", JEST_METHODS],
+  ["mock", /* @__PURE__ */ new Set(["module"])],
+  [REQUIRE, /* @__PURE__ */ new Set([RESOLVE])]
+]);
+function isIdentifierNamed(node, name) {
+  return ts.isIdentifier(node) && node.text === name;
+}
+function isModuleMethod(callee) {
+  const object = callee.expression;
+  const method = callee.name.text;
+  if (ts.isIdentifier(object)) {
+    return MODULE_METHODS.get(object.text)?.has(method) ?? false;
+  }
+  return method === RESOLVE && ts.isMetaProperty(object);
+}
+function isModuleCall(call) {
+  const callee = call.expression;
+  if (callee.kind === ts.SyntaxKind.ImportKeyword || isIdentifierNamed(callee, REQUIRE)) {
+    return true;
+  }
+  return ts.isPropertyAccessExpression(callee) && isModuleMethod(callee);
+}
+function isModuleSpecifier(literal) {
+  const parent = literal.parent;
+  if (ts.isImportDeclaration(parent) || ts.isExportDeclaration(parent) || ts.isJSDocImportTag(parent)) {
+    return parent.moduleSpecifier === literal;
+  }
+  if (ts.isCallExpression(parent)) {
+    return parent.arguments[0] === literal && isModuleCall(parent);
+  }
+  if (ts.isModuleDeclaration(parent)) {
+    return parent.name === literal;
+  }
+  if (ts.isLiteralTypeNode(parent)) {
+    return ts.isImportTypeNode(parent.parent);
+  }
+  return ts.isExternalModuleReference(parent);
+}
+function collectStrings(root, file, offset, found) {
+  const visit = (node) => {
+    if (ts.isStringLiteralLike(node)) {
+      const start = offset + node.getStart(file) + 1;
+      const end = offset + node.getEnd() - 1;
+      found.set(start, {
+        start,
+        end,
+        value: node.text,
+        isModuleSpecifier: isModuleSpecifier(node)
+      });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(root);
+}
+function commentRanges(file) {
+  const ranges = /* @__PURE__ */ new Map();
+  const add = (found) => {
+    for (const range of found ?? []) {
+      ranges.set(range.pos, range);
+    }
+  };
+  const visit = (node) => {
+    if (node.kind === ts.SyntaxKind.JsxText) {
+      return;
+    }
+    const children = node.getChildren(file).filter((child) => !ts.isJSDoc(child));
+    if (children.length === 0) {
+      add(ts.getTrailingCommentRanges(file.text, node.pos));
+      add(ts.getLeadingCommentRanges(file.text, node.pos));
+    }
+    children.forEach(visit);
+  };
+  visit(file);
+  return [...ranges.values()];
+}
+const JSDOC_START = "/**";
+const EMPTY_BLOCK_COMMENT = "/**/";
+const JSDOC_HOST = "\nvar host;";
+const JSDOC_FILE_NAME = "jsdoc.js";
+function collectJsDocStrings(comment, offset, found) {
+  const text = `${comment}${JSDOC_HOST}`;
+  const file = ts.createSourceFile(JSDOC_FILE_NAME, text, ts.ScriptTarget.Latest, true);
+  const host = file.statements[0];
+  for (const doc of ts.getJSDocCommentsAndTags(host)) {
+    collectStrings(doc, file, offset, found);
+  }
+}
+function literalStrings(file, offset) {
+  const found = /* @__PURE__ */ new Map();
+  collectStrings(file, file, offset, found);
+  for (const range of commentRanges(file)) {
+    const comment = file.text.slice(range.pos, range.end);
+    if (comment.startsWith(JSDOC_START) && comment !== EMPTY_BLOCK_COMMENT) {
+      collectJsDocStrings(comment, offset + range.pos, found);
+    }
+  }
+  return found;
+}
+function regionStrings(region, path) {
+  const file = ts.createSourceFile(path, region.text, ts.ScriptTarget.Latest, true, region.kind);
+  const found = literalStrings(file, region.offset);
+  for (const reference of file.typeReferenceDirectives) {
+    const start = region.offset + reference.pos;
+    const end = region.offset + reference.end;
+    found.set(start, { start, end, value: reference.fileName, isModuleSpecifier: true });
+  }
+  return [...found.values()];
+}
+class TypescriptSourceStringScanner {
+  scan(text, path) {
+    return scriptRegions(text, path).flatMap((region) => regionStrings(region, path)).sort((left, right) => left.start - right.start);
+  }
+}
+function createTypescriptStringScanner() {
+  return new TypescriptSourceStringScanner();
+}
+
 const PACKAGE_RENAMES = /* @__PURE__ */ new Map([
   ["openapi-typescript", "openapi-typesafe"],
   ["openapi-fetch", "openapi-typesafe-fetch"],
@@ -539,6 +954,9 @@ const DEPENDENCY_FIELDS = [
   "optionalDependencies"
 ];
 const OVERRIDE_FIELDS = ["overrides", "resolutions", "pnpm"];
+const OLD_PEER_DEPENDENTS = /* @__PURE__ */ new Map([
+  ["swr-openapi", { peer: "openapi-fetch", range: ">=0.15" }]
+]);
 
 const COMMAND_RE = new RegExp(`(?<=^|[\\s"'\`;&|(])${GENERATOR_COMMAND}(?=$|[\\s"'\`;&|)])`, "g");
 const VERSIONED_COMMAND_RE = new RegExp(`(?<=^|[\\s"'\`;&|(])${GENERATOR_COMMAND}@`);
@@ -602,6 +1020,35 @@ function overriddenPackages(value) {
   return [...new Set(targets.filter((target) => PACKAGE_RENAMES.has(target)))];
 }
 
+const SCHEME_SEPARATOR = "://";
+const HIDDEN_USERINFO = "***";
+const USERINFO_END = "@";
+const AUTHORITY_END_RE = /[/?#"'`\s]/;
+function scanAuthority(text, start) {
+  let userinfoEnd = -1;
+  let end = start;
+  for (; end < text.length && !AUTHORITY_END_RE.test(text.charAt(end)); end++) {
+    if (text.charAt(end) === USERINFO_END) {
+      userinfoEnd = end;
+    }
+  }
+  return { end, userinfoEnd };
+}
+function hideUrlCredentials(text) {
+  let hidden = "";
+  let copiedUpTo = 0;
+  for (let found = text.indexOf(SCHEME_SEPARATOR); found !== -1; ) {
+    const start = found + SCHEME_SEPARATOR.length;
+    const { end, userinfoEnd } = scanAuthority(text, start);
+    if (userinfoEnd !== -1) {
+      hidden += `${text.slice(copiedUpTo, start)}${HIDDEN_USERINFO}`;
+      copiedUpTo = userinfoEnd;
+    }
+    found = text.indexOf(SCHEME_SEPARATOR, end);
+  }
+  return `${hidden}${text.slice(copiedUpTo)}`;
+}
+
 const VERSION_STYLE_RE = /^([\^~]|>=)?\d/;
 const KEPT_PROTOCOLS = ["catalog:", "workspace:"];
 function migrateVersionSpec(spec, version) {
@@ -618,13 +1065,16 @@ function migrateVersionSpec(spec, version) {
 
 const INDENT_RE = /^[ \t]+(?=")/m;
 const DEFAULT_INDENT = "  ";
+const LF = "\n";
+const CRLF = "\r\n";
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function formatLike(original, manifest) {
   const indent = INDENT_RE.exec(original)?.[0] ?? DEFAULT_INDENT;
-  const ending = original.endsWith("\n") ? "\n" : "";
-  return `${JSON.stringify(manifest, null, indent)}${ending}`;
+  const lineEnding = original.includes(CRLF) ? CRLF : LF;
+  const finalNewline = original.endsWith(LF) ? lineEnding : "";
+  return `${JSON.stringify(manifest, null, indent).replaceAll(LF, lineEnding)}${finalNewline}`;
 }
 function renameDependencies(field, dependencies, version, findings) {
   return Object.fromEntries(
@@ -639,10 +1089,14 @@ function renameDependencies(field, dependencies, version, findings) {
         field,
         from: name,
         to: renamed,
-        spec: decision.spec
+        spec: hideUrlCredentials(decision.spec)
       });
       if (decision.kind === "kept" && decision.isReported) {
-        findings.manualSteps.push({ kind: "spec-kept", name: renamed, spec });
+        findings.manualSteps.push({
+          kind: "spec-kept",
+          name: renamed,
+          spec: hideUrlCredentials(spec)
+        });
       }
       if (field === "peerDependencies") {
         findings.manualSteps.push({ kind: "peer-dependency-renamed", name: renamed });
@@ -671,6 +1125,17 @@ function reportOverrides(manifest, findings) {
     }
   }
 }
+function reportOldPeers(manifest, findings) {
+  for (const [dependent, { peer, range }] of OLD_PEER_DEPENDENTS) {
+    const isDependency = DEPENDENCY_FIELDS.some((field) => {
+      const dependencies = manifest[field];
+      return isObject(dependencies) && Object.hasOwn(dependencies, dependent);
+    });
+    if (isDependency) {
+      findings.manualSteps.push({ kind: "old-peer-needed", dependent, peer, range });
+    }
+  }
+}
 function migrateFields(manifest, version, findings) {
   const migrated = { ...manifest };
   for (const field of DEPENDENCY_FIELDS) {
@@ -683,6 +1148,7 @@ function migrateFields(manifest, version, findings) {
     migrated.scripts = migrateScripts(manifest.scripts, findings);
   }
   reportOverrides(manifest, findings);
+  reportOldPeers(manifest, findings);
   return migrated;
 }
 function migratePackageManifest(text, version) {
@@ -690,7 +1156,7 @@ function migratePackageManifest(text, version) {
   try {
     manifest = JSON.parse(text);
   } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
+    const reason = hideUrlCredentials(error instanceof Error ? error.message : String(error));
     return { ...unchanged(text), manualSteps: [{ kind: "manifest-unreadable", reason }] };
   }
   if (!isObject(manifest)) {
@@ -702,10 +1168,6 @@ function migratePackageManifest(text, version) {
   return { text: isChanged ? formatLike(text, migrated) : text, ...findings };
 }
 
-const SPECIFIER_RE = new RegExp(
-  `(["'\`])(${[...PACKAGE_RENAMES.keys()].join("|")})(/[^"'\`\\s]*)?\\1`,
-  "g"
-);
 const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -719,28 +1181,60 @@ const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".svelte",
   ".astro"
 ]);
-function migrateModuleSpecifiers(text) {
+function renamedValue(value) {
+  const slash = value.indexOf("/");
+  const name = slash === -1 ? value : value.slice(0, slash);
+  const renamed = PACKAGE_RENAMES.get(name);
+  if (renamed === void 0) {
+    return void 0;
+  }
+  return { to: `${renamed}${value.slice(name.length)}`, isDeep: slash !== -1 };
+}
+function distinctStrings(strings) {
+  const distinct = [];
+  for (const found of [...strings].sort((left, right) => left.start - right.start)) {
+    const previous = distinct.at(-1);
+    if (previous === void 0 || found.start >= previous.end) {
+      distinct.push(found);
+    } else if (found.start === previous.start && found.end === previous.end) {
+      const isModuleSpecifier = previous.isModuleSpecifier || found.isModuleSpecifier;
+      distinct[distinct.length - 1] = { ...previous, isModuleSpecifier };
+    } else {
+      throw new Error(
+        `Source strings overlap at offsets ${previous.start}-${previous.end} and ${found.start}-${found.end}; the file was not changed.`
+      );
+    }
+  }
+  return distinct;
+}
+function migrateModuleSpecifiers(text, strings) {
   const changes = [];
   const manualSteps = [];
   let migrated = "";
   let copiedUpTo = 0;
-  for (const match of text.matchAll(SPECIFIER_RE)) {
-    const [whole, quote, name, subpath] = match;
-    const line = lineAt(text, match.index);
-    const to = `${PACKAGE_RENAMES.get(name)}${subpath ?? ""}`;
-    changes.push({ kind: "specifier-renamed", line, from: whole.slice(1, -1), to });
-    if (subpath !== void 0) {
-      manualSteps.push({ kind: "deep-import", line, specifier: to });
+  for (const found of distinctStrings(strings)) {
+    const renamed = renamedValue(found.value);
+    if (renamed === void 0) {
+      continue;
+    }
+    const line = lineAt(text, found.start);
+    if (!found.isModuleSpecifier) {
+      manualSteps.push({ kind: "string-names-package", line, value: found.value, to: renamed.to });
+      continue;
+    }
+    changes.push({ kind: "specifier-renamed", line, from: found.value, to: renamed.to });
+    if (renamed.isDeep) {
+      manualSteps.push({ kind: "deep-import", line, specifier: renamed.to });
     }
-    migrated += `${text.slice(copiedUpTo, match.index)}${quote}${to}${quote}`;
-    copiedUpTo = match.index + whole.length;
+    migrated += `${text.slice(copiedUpTo, found.start)}${renamed.to}`;
+    copiedUpTo = found.end;
   }
   return { text: migrated + text.slice(copiedUpTo), changes, manualSteps };
 }
 
-const ENTRY_RE = /^(\s+)(["']?)([\w@./-]+)\2:\s*(["']?)([^"'#\s]+)\4(.*)$/;
+const ENTRY_RE = /^(\s+)(["']?)([\w@./-]+)\2:\s*(["']?)([^"'#\s]+)\4/;
 const TOP_LEVEL_KEY_RE = /^([\w-]+):/;
-const KEY_RE = /^\s+(["']?)(.+?)\1:(?:\s|$)/;
+const KEY_RE = /^\s+(["']?)(\S.*?)\1:(?:\s|$)/;
 const CATALOG_SECTIONS = /* @__PURE__ */ new Set(["catalog", "catalogs"]);
 const REPORTED_SECTIONS = /* @__PURE__ */ new Set(["overrides", "patchedDependencies"]);
 function migrateEntry(line, version) {
@@ -749,7 +1243,8 @@ function migrateEntry(line, version) {
   if (entry === null || renamed === void 0) {
     return { line };
   }
-  const [, indent, keyQuote, name, specQuote, spec, rest] = entry;
+  const [whole, indent, keyQuote, name, specQuote, spec] = entry;
+  const rest = line.slice(whole.length);
   const decision = migrateVersionSpec(spec, version);
   const key = `${keyQuote}${renamed}${keyQuote}`;
   const migrated = `${indent}${key}: ${specQuote}${decision.spec}${specQuote}${rest}`;
@@ -758,7 +1253,7 @@ function migrateEntry(line, version) {
     return {
       line: migrated,
       change,
-      manualStep: { kind: "spec-kept", name: renamed, spec }
+      manualStep: { kind: "spec-kept", name: renamed, spec: hideUrlCredentials(spec) }
     };
   }
   return { line: migrated, change };
@@ -771,29 +1266,41 @@ function reportEntry(line, field) {
     name
   }));
 }
+const LINE_FEED = "\n";
+const CARRIAGE_RETURN = "\r";
+function withoutCarriageReturn(line) {
+  if (!line.endsWith(CARRIAGE_RETURN)) {
+    return { body: line, restore: (body) => body };
+  }
+  return {
+    body: line.slice(0, -CARRIAGE_RETURN.length),
+    restore: (body) => `${body}${CARRIAGE_RETURN}`
+  };
+}
 function migrateWorkspaceCatalogs(text, version) {
   const changes = [];
   const manualSteps = [];
   let section;
-  const lines = text.split("\n").map((line) => {
+  const lines = text.split(LINE_FEED).map((rawLine) => {
+    const { body: line, restore } = withoutCarriageReturn(rawLine);
     const topLevelKey = TOP_LEVEL_KEY_RE.exec(line)?.[1];
     if (topLevelKey !== void 0) {
       section = topLevelKey;
-      return line;
+      return rawLine;
     }
     if (section !== void 0 && REPORTED_SECTIONS.has(section)) {
       manualSteps.push(...reportEntry(line, section));
-      return line;
+      return rawLine;
     }
     if (section === void 0 || !CATALOG_SECTIONS.has(section)) {
-      return line;
+      return rawLine;
     }
     const result = migrateEntry(line, version);
     changes.push(...result.change ? [result.change] : []);
     manualSteps.push(...result.manualStep ? [result.manualStep] : []);
-    return result.line;
+    return restore(result.line);
   });
-  return changes.length === 0 ? { ...unchanged(text), manualSteps } : { text: lines.join("\n"), changes, manualSteps };
+  return changes.length === 0 ? { ...unchanged(text), manualSteps } : { text: lines.join(LINE_FEED), changes, manualSteps };
 }
 
 const SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([".sh", ".bash", ".zsh", ".yml", ".yaml"]);
@@ -826,7 +1333,10 @@ const FILE_KINDS = [
   },
   {
     matches: (path) => SOURCE_EXTENSIONS.has(extensionOf(path)),
-    migrate: (text, path, context) => chain(migrateModuleSpecifiers(text), (renamed) => context.rewriter.rewrite(renamed, path))
+    migrate: (text, path, context) => chain(
+      migrateModuleSpecifiers(text, context.scanner.scan(text, path)),
+      (renamed) => context.rewriter.rewrite(renamed, path)
+    )
   },
   {
     matches: (path) => SCRIPT_EXTENSIONS.has(extensionOf(path)) || SCRIPT_NAMES.has(baseName(path)),
@@ -846,7 +1356,8 @@ async function migrateFile(path, dependencies, input) {
     return void 0;
   }
   const text = await dependencies.files.read(path);
-  const context = { version: input.version, rewriter: dependencies.rewriter };
+  const { rewriter, scanner } = dependencies;
+  const context = { version: input.version, rewriter, scanner };
   const migration = migrate(text, path, context);
   const isChanged = migration.text !== text;
   if (isChanged && input.isWrite) {
@@ -859,7 +1370,8 @@ async function migrateFile(path, dependencies, input) {
   return { path, isChanged, changes, manualSteps };
 }
 async function migrateProject(dependencies, input) {
-  const paths = (await dependencies.files.listFiles()).sort();
+  const { files, skipped } = await dependencies.files.listFiles();
+  const paths = [...files].sort();
   dependencies.logger.info("migration_started", { fileCount: paths.length, ...input });
   const reports = [];
   for (const path of paths) {
@@ -868,8 +1380,11 @@ async function migrateProject(dependencies, input) {
       reports.push(report);
     }
   }
-  dependencies.logger.info("migration_finished", { changedFiles: reports.length });
-  return reports;
+  dependencies.logger.info("migration_finished", {
+    changedFiles: reports.length,
+    skippedFiles: skipped.length
+  });
+  return { files: reports, skipped };
 }
 
 function assertNever(value) {
@@ -877,6 +1392,7 @@ function assertNever(value) {
 }
 
 const IR_CALLBACKS_GUIDE = "https://github.com/openapi-typesafe/openapi-typesafe/blob/main/docs/node.md#ir-callbacks";
+const OPENAPI_FETCH_ALIAS_GUIDE = "https://github.com/openapi-typesafe/openapi-typesafe/blob/main/docs/fetch/index.md#libraries-built-on-openapi-fetch";
 function changeMessage(change) {
   switch (change.kind) {
     case "dependency-renamed":
@@ -904,8 +1420,15 @@ const KEEP_REASONS = {
 const PEER_NOTE = "users of this package must switch too (a breaking change for them)";
 const PINNED_NOTE = "change it to openapi-typesafe@<version>";
 const DEEP_IMPORT_NOTE = "imports a file inside the package; check that it exists";
+const STRING_NOTE = "is a string, not a module specifier, so it was kept";
+const STRING_FIX_NOTE = "if it names the package, change it to";
 const KEPT_NOTE = `it works, with a deprecation warning. See ${IR_CALLBACKS_GUIDE}`;
 const LEGACY_CALLBACK_NOTE = `receives TypeScript nodes (deprecated). See ${IR_CALLBACKS_GUIDE}`;
+function oldPeerMessage(step) {
+  const { dependent, peer, range } = step;
+  const successor = PACKAGE_RENAMES.get(peer) ?? peer;
+  return `${dependent} takes its client type from ${peer}@${range}, its peer dependency: alias ${peer} to ${successor} with overrides or resolutions, or passing it the ${successor} client fails to type-check. See ${OPENAPI_FETCH_ALIAS_GUIDE}`;
+}
 function manualStepMessage(step) {
   switch (step.kind) {
     case "manifest-unreadable":
@@ -920,6 +1443,10 @@ function manualStepMessage(step) {
       return `${step.location} runs a pinned openapi-typescript@<version>: ${PINNED_NOTE}`;
     case "deep-import":
       return `line ${step.line}: "${step.specifier}" ${DEEP_IMPORT_NOTE}`;
+    case "string-names-package":
+      return `line ${step.line}: "${step.value}" ${STRING_NOTE}; ${STRING_FIX_NOTE} "${step.to}"`;
+    case "old-peer-needed":
+      return oldPeerMessage(step);
     case "transform-not-rewritten":
       return `line ${step.line}: transform kept (${KEEP_REASONS[step.reason]}); ${KEPT_NOTE}`;
     case "legacy-callback":
@@ -928,6 +1455,13 @@ function manualStepMessage(step) {
       return assertNever(step);
   }
 }
+const SKIPPED_HEADING = "Skipped (not read, not written):";
+const SKIP_REASONS = {
+  "outside-root": "git listed it, but it is outside the project folder; check where this git index came from"
+};
+function skipReasonMessage(reason) {
+  return SKIP_REASONS[reason];
+}
 const NEXT_STEPS = [
   "Install: run your package manager's install, so the lockfile has the new packages.",
   "Regenerate your types and commit them once: the file header names openapi-typesafe now, so `--check` fails until you do.",
@@ -957,14 +1491,24 @@ function manualStepsSection(reports) {
   );
   return steps.length === 0 ? [] : ["Manual steps:", ...steps, ""];
 }
-function renderReport(reports, isWrite) {
+function skippedSection(skipped) {
+  if (skipped.length === 0) {
+    return [];
+  }
+  const lines = skipped.map((file) => `  ${file.path}: ${skipReasonMessage(file.reason)}`);
+  return [SKIPPED_HEADING, ...lines, ""];
+}
+function renderReport(migration, isWrite) {
+  const reports = migration.files;
+  const skipped = skippedSection(migration.skipped);
   if (reports.length === 0) {
-    return `${NOTHING_FOUND}
+    return `${[...skipped, NOTHING_FOUND].join("\n")}
 `;
   }
   const lines = [
     ...changesSection(reports),
     ...manualStepsSection(reports),
+    ...skipped,
     "Next steps:",
     ...NEXT_STEPS.map((step, index) => `  ${index + 1}. ${step}`),
     "",
@@ -1012,7 +1556,7 @@ Options
 
 Exit codes
   0  Done
-  1  The migration failed (the message and the log say why)
+  1  The migration failed (the message and the log say why), or the log could not be created
   2  Unknown option or argument
 `;
 const usageError = (message) => `${message}
@@ -1020,6 +1564,8 @@ Run openapi-typesafe-migrate --help for the options.
 `;
 const logNote = (path) => `Log: ${path}
 `;
+const logError = (path, message) => `Cannot create the log ${path ?? "in the temporary directory"}: ${message}
+`;
 
 const EXIT_CODES = { success: 0, failure: 1, usage: 2 };
 function parseRequest(argv, dependencies) {
@@ -1033,17 +1579,31 @@ function parseRequest(argv, dependencies) {
     throw error;
   }
 }
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+function openLog(request, dependencies) {
+  try {
+    return dependencies.createLogger(request.logPath);
+  } catch (error) {
+    dependencies.writeStderr(logError(request.logPath, errorMessage(error)));
+    return void 0;
+  }
+}
 async function runMigration(request, dependencies) {
+  const log = openLog(request, dependencies);
+  if (log === void 0) {
+    return EXIT_CODES.failure;
+  }
+  const { logger, path } = log;
   const root = dependencies.resolvePath(dependencies.cwd, request.root ?? ".");
-  const { logger, path } = dependencies.createLogger(request.logPath);
   try {
-    const files = dependencies.createFiles(root);
+    const files = dependencies.createFiles(root, logger);
+    const { rewriter, scanner } = dependencies;
     const input = { version: dependencies.version, isWrite: request.isWrite };
-    const reports = await migrateProject({ files, rewriter: dependencies.rewriter, logger }, input);
-    dependencies.writeStdout(renderReport(reports, request.isWrite));
+    const migration = await migrateProject({ files, rewriter, scanner, logger }, input);
+    dependencies.writeStdout(renderReport(migration, request.isWrite));
     return EXIT_CODES.success;
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    const message = errorMessage(error);
     logger.warn("migration_failed", { root, message });
     dependencies.writeStderr(`${message}
 `);
@@ -1070,24 +1630,25 @@ async function runCli(argv, dependencies) {
 }
 
 const PACKAGE_JSON = new URL("../../package.json", import.meta.url);
-const LOG_DIRECTORY = "openapi-typesafe-migrate";
 function readVersion() {
   const packageJson = JSON.parse(readFileSync(PACKAGE_JSON, "utf8"));
   return packageJson.version;
 }
 const now = () => /* @__PURE__ */ new Date();
 function createLogger(path) {
-  const logPath = path === void 0 ? join(tmpdir(), LOG_DIRECTORY, `${now().toISOString().replaceAll(":", "-")}.jsonl`) : resolve(path);
-  return { logger: createJsonLinesLogger({ path: logPath, now }), path: logPath };
+  const isExclusive = path === void 0;
+  const logPath = isExclusive ? createTemporaryLogPath(tmpdir(), now()) : resolve(path);
+  return { logger: createJsonLinesLogger({ path: logPath, now, isExclusive }), path: logPath };
 }
 const dependencies = {
   version: readVersion(),
   cwd: process.cwd(),
   writeStdout: (text) => process.stdout.write(text),
   writeStderr: (text) => process.stderr.write(text),
-  createFiles: createNodeProjectFiles,
+  createFiles: (root, logger) => createNodeProjectFiles(root, { git: createGitFileList(), logger }),
   createLogger,
   rewriter: createTypescriptCallbackRewriter(),
+  scanner: createTypescriptStringScanner(),
   resolvePath: resolve
 };
 runCli(process.argv.slice(2), dependencies).then((exitCode) => {