parche-cli 0.0.0-stage → 0.5.1

package/data/known-sdks.json

@@ -0,0 +1,125 @@
+{
+  "schemaVersion": 1,
+  "about": "Lista curada de SDKs de APIs de terceros (paquete → proveedor y rubro), de clientes HTTP y de hosts de APIs conocidas. La usa el inventario de `parche scan`. Agregar entradas es la forma de subir la confianza de una detección de 'baja' a 'alta'.",
+  "npm": {
+    "stripe": { "provider": "Stripe", "category": "pagos" },
+    "@stripe/stripe-js": { "provider": "Stripe", "category": "pagos" },
+    "mercadopago": { "provider": "Mercado Pago", "category": "pagos" },
+    "@paypal/checkout-server-sdk": { "provider": "PayPal", "category": "pagos" },
+    "@paypal/paypal-server-sdk": { "provider": "PayPal", "category": "pagos" },
+    "braintree": { "provider": "Braintree", "category": "pagos" },
+    "plaid": { "provider": "Plaid", "category": "pagos" },
+    "@adyen/api-library": { "provider": "Adyen", "category": "pagos" },
+    "@afipsdk/afip.js": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "@arcasdk/core": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "afip.ts": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "ts-afip-ws": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "facturajs": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "openai": { "provider": "OpenAI", "category": "ia" },
+    "@anthropic-ai/sdk": { "provider": "Anthropic", "category": "ia" },
+    "@google/generative-ai": { "provider": "Google (Gemini)", "category": "ia" },
+    "@google/genai": { "provider": "Google (Gemini)", "category": "ia" },
+    "@mistralai/mistralai": { "provider": "Mistral", "category": "ia" },
+    "cohere-ai": { "provider": "Cohere", "category": "ia" },
+    "groq-sdk": { "provider": "Groq", "category": "ia" },
+    "replicate": { "provider": "Replicate", "category": "ia" },
+    "@huggingface/inference": { "provider": "Hugging Face", "category": "ia" },
+    "twilio": { "provider": "Twilio", "category": "mensajería" },
+    "@slack/web-api": { "provider": "Slack", "category": "mensajería" },
+    "@slack/bolt": { "provider": "Slack", "category": "mensajería" },
+    "discord.js": { "provider": "Discord", "category": "mensajería" },
+    "telegraf": { "provider": "Telegram", "category": "mensajería" },
+    "node-telegram-bot-api": { "provider": "Telegram", "category": "mensajería" },
+    "@sendgrid/mail": { "provider": "SendGrid", "category": "email" },
+    "resend": { "provider": "Resend", "category": "email" },
+    "postmark": { "provider": "Postmark", "category": "email" },
+    "mailgun.js": { "provider": "Mailgun", "category": "email" },
+    "@mailchimp/mailchimp_marketing": { "provider": "Mailchimp", "category": "email" },
+    "aws-sdk": { "provider": "AWS", "category": "nube" },
+    "firebase-admin": { "provider": "Firebase (Google)", "category": "nube" },
+    "firebase": { "provider": "Firebase (Google)", "category": "nube" },
+    "googleapis": { "provider": "Google APIs", "category": "nube" },
+    "@supabase/supabase-js": { "provider": "Supabase", "category": "datos" },
+    "algoliasearch": { "provider": "Algolia", "category": "datos" },
+    "@notionhq/client": { "provider": "Notion", "category": "productividad" },
+    "airtable": { "provider": "Airtable", "category": "productividad" },
+    "@octokit/rest": { "provider": "GitHub", "category": "devtools" },
+    "@octokit/core": { "provider": "GitHub", "category": "devtools" },
+    "@sentry/node": { "provider": "Sentry", "category": "observabilidad" },
+    "@shopify/shopify-api": { "provider": "Shopify", "category": "ecommerce" },
+    "@woocommerce/woocommerce-rest-api": { "provider": "WooCommerce", "category": "ecommerce" },
+    "@hubspot/api-client": { "provider": "HubSpot", "category": "crm" },
+    "contentful": { "provider": "Contentful", "category": "contenido" },
+    "@googlemaps/google-maps-services-js": { "provider": "Google Maps", "category": "mapas" },
+    "auth0": { "provider": "Auth0", "category": "auth" },
+    "@clerk/clerk-sdk-node": { "provider": "Clerk", "category": "auth" }
+  },
+  "npmPrefixes": {
+    "@aws-sdk/": { "provider": "AWS", "category": "nube" },
+    "@google-cloud/": { "provider": "Google Cloud", "category": "nube" },
+    "@azure/": { "provider": "Azure", "category": "nube" }
+  },
+  "composer": {
+    "afipsdk/afip.php": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "fertandil87/afip.php": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "ivanalemunioz/afip.php": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "eesnaola/afip.php": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "multinexo/php-afip-ws": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "mercadopago/dx-php": { "provider": "Mercado Pago", "category": "pagos" },
+    "stripe/stripe-php": { "provider": "Stripe", "category": "pagos" },
+    "twilio/sdk": { "provider": "Twilio", "category": "mensajería" },
+    "aws/aws-sdk-php": { "provider": "AWS", "category": "nube" },
+    "openai-php/client": { "provider": "OpenAI", "category": "ia" },
+    "sendgrid/sendgrid": { "provider": "SendGrid", "category": "email" },
+    "google/apiclient": { "provider": "Google APIs", "category": "nube" }
+  },
+  "pypi": {
+    "stripe": { "provider": "Stripe", "category": "pagos" },
+    "mercadopago": { "provider": "Mercado Pago", "category": "pagos" },
+    "openai": { "provider": "OpenAI", "category": "ia" },
+    "anthropic": { "provider": "Anthropic", "category": "ia" },
+    "google-generativeai": { "provider": "Google (Gemini)", "category": "ia" },
+    "twilio": { "provider": "Twilio", "category": "mensajería" },
+    "boto3": { "provider": "AWS", "category": "nube" },
+    "sendgrid": { "provider": "SendGrid", "category": "email" },
+    "slack-sdk": { "provider": "Slack", "category": "mensajería" },
+    "pyafipws": { "provider": "ARCA (ex AFIP)", "category": "facturación" }
+  },
+  "httpClients": {
+    "npm": ["axios", "got", "undici", "node-fetch", "ky", "superagent", "cross-fetch", "isomorphic-fetch"],
+    "composer": ["guzzlehttp/guzzle", "symfony/http-client"],
+    "pypi": ["requests", "httpx", "aiohttp", "urllib3"]
+  },
+  "notApis": {
+    "prefixes": ["@types/", "eslint", "@eslint/", "prettier", "jest", "@jest/", "vitest", "mocha", "typescript", "ts-node", "@babel/", "babel-", "webpack", "vite", "rollup", "esbuild", "@vitejs/", "nodemon", "husky", "lint-staged", "@testing-library/", "@apollo/", "graphql", "react", "vue", "svelte", "next", "nuxt", "express", "fastify", "koa", "@nestjs/", "@angular/", "socket.io", "@prisma/", "prisma", "@trpc/", "@tanstack/", "@redis/", "redis", "ioredis", "ws", "pg", "mysql", "mongodb", "mongoose", "sequelize", "typeorm", "knex", "drizzle-orm", "@aws-sdk/types", "@smithy/"],
+    "why": "Librerías de desarrollo, frameworks, bases de datos y transporte (socket.io, ws): no son la API de un tercero aunque el nombre diga 'client'."
+  },
+  "hosts": {
+    "api.stripe.com": { "provider": "Stripe", "category": "pagos" },
+    "api.mercadopago.com": { "provider": "Mercado Pago", "category": "pagos" },
+    "api.mercadolibre.com": { "provider": "Mercado Libre", "category": "ecommerce" },
+    "api.paypal.com": { "provider": "PayPal", "category": "pagos" },
+    "api-m.paypal.com": { "provider": "PayPal", "category": "pagos" },
+    "afip.gov.ar": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "arca.gob.ar": { "provider": "ARCA (ex AFIP)", "category": "facturación" },
+    "api.openai.com": { "provider": "OpenAI", "category": "ia" },
+    "api.anthropic.com": { "provider": "Anthropic", "category": "ia" },
+    "generativelanguage.googleapis.com": { "provider": "Google (Gemini)", "category": "ia" },
+    "api.mistral.ai": { "provider": "Mistral", "category": "ia" },
+    "api.twilio.com": { "provider": "Twilio", "category": "mensajería" },
+    "api.telegram.org": { "provider": "Telegram", "category": "mensajería" },
+    "graph.facebook.com": { "provider": "Meta (WhatsApp/Facebook)", "category": "mensajería" },
+    "slack.com": { "provider": "Slack", "category": "mensajería" },
+    "hooks.slack.com": { "provider": "Slack", "category": "mensajería" },
+    "discord.com": { "provider": "Discord", "category": "mensajería" },
+    "api.sendgrid.com": { "provider": "SendGrid", "category": "email" },
+    "api.resend.com": { "provider": "Resend", "category": "email" },
+    "api.github.com": { "provider": "GitHub", "category": "devtools" },
+    "googleapis.com": { "provider": "Google APIs", "category": "nube" },
+    "amazonaws.com": { "provider": "AWS", "category": "nube" },
+    "api.notion.com": { "provider": "Notion", "category": "productividad" },
+    "api.airtable.com": { "provider": "Airtable", "category": "productividad" },
+    "myshopify.com": { "provider": "Shopify", "category": "ecommerce" },
+    "api.hubapi.com": { "provider": "HubSpot", "category": "crm" }
+  }
+}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "parche-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.1",
+  "description": "Dependabot para APIs: detecta cambios de APIs de terceros en tu código y abre el PR con el arreglo.",
+  "keywords": [
+    "api",
+    "migration",
+    "codemod",
+    "dependabot",
+    "arca",
+    "afip",
+    "wsfe",
+    "mercadopago",
+    "github-action"
+  ],
+  "homepage": "https://github.com/Pepo08/parche#readme",
+  "bugs": "https://github.com/Pepo08/parche/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Pepo08/parche.git"
+  },
+  "author": "Joaquín González",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "parche": "bin/parche.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "packs",
+    "data",
+    "templates",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.js",
+    "demo": "bash demo.sh"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.28.0",
+    "jscodeshift": "^17.3.0",
+    "php-parser": "^3.7.0",
+    "typescript": "~6.0.3"
+  }
+}

package/packs/ai.model-retirements.json

@@ -0,0 +1,96 @@
+{
+  "id": "ai.model-retirements",
+  "version": "2026.10.16",
+  "provider": "Modelos de IA",
+  "title": "Modelos y endpoints de IA retirados o por retirarse",
+  "kind": "retirement",
+  "severity": "high",
+  "deadline": null,
+  "last_verified": "2026-10-16",
+  "summary_es": "Tu código usa modelos o APIs de IA que ya no responden o tienen fecha de retiro.",
+  "why_es": "Los proveedores de modelos retiran IDs de modelo y endpoints con algunas semanas o meses de aviso. Después de la fecha, las llamadas fallan. Parche no reemplaza el modelo automáticamente porque cambiar de modelo cambia el comportamiento: te avisa, te dice la fecha y el reemplazo que recomienda el proveedor.",
+  "sources": [
+    { "title": "Anthropic: Model deprecations", "url": "https://platform.claude.com/docs/en/about-claude/model-deprecations" },
+    { "title": "OpenAI: Deprecations", "url": "https://developers.openai.com/api/docs/deprecations" }
+  ],
+  "detect": {
+    "packages": ["@anthropic-ai/sdk", "openai"],
+    "retired_models": {
+      "claude-sonnet-4-5-20250929": { "date": "2026-11-30", "replacement": "claude-sonnet-5-5" },
+      "claude-opus-4-1-20250805": { "date": "2026-08-05", "replacement": "claude-opus-4-8" },
+      "claude-sonnet-4-20250514": { "date": "2026-06-15", "replacement": "claude-sonnet-5-5" },
+      "claude-opus-4-20250514": { "date": "2026-06-15", "replacement": "claude-opus-4-8" },
+      "claude-3-haiku-20240307": { "date": "2026-04-20", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-3-7-sonnet-20250219": { "date": "2026-02-19", "replacement": "claude-sonnet-5-5" },
+      "claude-3-5-haiku-20241022": { "date": "2026-02-19", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-3-opus-20240229": { "date": "2026-01-05", "replacement": "claude-opus-4-8" },
+      "claude-3-5-sonnet-20241022": { "date": "2025-10-28", "replacement": "claude-sonnet-5-5" },
+      "claude-3-5-sonnet-20240620": { "date": "2025-10-28", "replacement": "claude-sonnet-5-5" },
+      "claude-3-sonnet-20240229": { "date": "2025-07-21", "replacement": "claude-sonnet-5-5" },
+      "claude-2.1": { "date": "2025-07-21", "replacement": "claude-opus-4-8" },
+      "claude-2.0": { "date": "2025-07-21", "replacement": "claude-opus-4-8" },
+      "claude-instant-1.2": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-instant-1.1": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-instant-1.0": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-1.3": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-1.2": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-1.1": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+      "claude-1.0": { "date": "2024-11-06", "replacement": "claude-haiku-4-5-20251001" },
+
+      "gpt-5-2025-08-07": { "date": "2026-12-11", "replacement": "gpt-5.6-sol" },
+      "gpt-5-mini-2025-08-07": { "date": "2026-12-11", "replacement": "gpt-5.6-terra" },
+      "gpt-5-nano-2025-08-07": { "date": "2026-12-11", "replacement": "gpt-5.6-luna" },
+      "gpt-5-pro-2025-10-06": { "date": "2026-12-11", "replacement": "gpt-5.6-sol (reasoning.mode: pro)" },
+      "o3-2025-04-16": { "date": "2026-12-11", "replacement": "gpt-5.6-sol" },
+      "o3-pro-2025-06-10": { "date": "2026-12-11", "replacement": "gpt-5.6-sol (reasoning.mode: pro)" },
+      "gpt-3.5-turbo": { "date": "2026-10-23", "replacement": "gpt-5.6-terra" },
+      "gpt-3.5-turbo-0125": { "date": "2026-10-23", "replacement": "gpt-5.6-terra" },
+      "gpt-4": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-4-0613": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-4-1106-preview": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-4-turbo": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-4-turbo-2024-04-09": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-4.1-nano": { "date": "2026-10-23", "replacement": "gpt-5.6-luna" },
+      "gpt-4.1-nano-2025-04-14": { "date": "2026-10-23", "replacement": "gpt-5.6-luna" },
+      "gpt-4o-2024-05-13": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "gpt-image-1": { "date": "2026-10-23", "replacement": "gpt-image-2.5-sunburst o gpt-image-2.5-flare" },
+      "o1": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "o1-2024-12-17": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "o1-pro": { "date": "2026-10-23", "replacement": "gpt-5.6-sol (reasoning.mode: pro)" },
+      "o1-pro-2025-03-19": { "date": "2026-10-23", "replacement": "gpt-5.6-sol (reasoning.mode: pro)" },
+      "o3-mini": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "o3-mini-2025-01-31": { "date": "2026-10-23", "replacement": "gpt-5.6-sol" },
+      "o4-mini": { "date": "2026-10-23", "replacement": "gpt-5.6-terra" },
+      "o4-mini-2025-04-16": { "date": "2026-10-23", "replacement": "gpt-5.6-terra" },
+      "gpt-3.5-turbo-instruct": { "date": "2026-09-28", "replacement": "gpt-5.6-terra" },
+      "gpt-3.5-turbo-1106": { "date": "2026-09-28", "replacement": "gpt-5.6-terra" },
+      "babbage-002": { "date": "2026-09-28", "replacement": "gpt-5.6-terra" },
+      "davinci-002": { "date": "2026-09-28", "replacement": "gpt-5.6-terra" },
+      "dall-e-3": { "date": "2026-05-12", "replacement": "gpt-image-2, gpt-image-1 o gpt-image-1-mini" },
+      "dall-e-2": { "date": "2026-05-12", "replacement": "gpt-image-2, gpt-image-1 o gpt-image-1-mini" },
+      "gpt-4o-realtime-preview": { "date": "2026-05-07", "replacement": "gpt-realtime-1.5" },
+      "gpt-4o-realtime-preview-2025-06-03": { "date": "2026-05-07", "replacement": "gpt-realtime-1.5" },
+      "gpt-4o-realtime-preview-2024-12-17": { "date": "2026-05-07", "replacement": "gpt-realtime-1.5" },
+      "gpt-4-0314": { "date": "2026-03-26", "replacement": "gpt-5 o gpt-4.1" },
+      "gpt-4-0125-preview": { "date": "2026-03-26", "replacement": "gpt-5 o gpt-4.1" },
+      "gpt-4-turbo-preview": { "date": "2026-03-26", "replacement": "gpt-5 o gpt-4.1" },
+      "chatgpt-4o-latest": { "date": "2026-02-17", "replacement": "gpt-5.1-chat-latest" },
+      "codex-mini-latest": { "date": "2026-02-12", "replacement": "gpt-5-codex-mini" }
+    },
+    "retirement_floors": {
+      "claude-haiku-4-5-20251001": "2026-10-15",
+      "claude-opus-4-5-20251101": "2026-11-24"
+    },
+    "retired_endpoints": [
+      { "pattern": ".beta.assistants", "retired": "2026-08-26", "replacement_es": "Responses API + Conversations API", "provider": "openai" },
+      { "pattern": ".beta.threads", "retired": "2026-08-26", "replacement_es": "Responses API + Conversations API", "provider": "openai" },
+      { "pattern": "/v1/assistants", "retired": "2026-08-26", "replacement_es": "Responses API + Conversations API", "provider": "openai" }
+    ]
+  },
+  "codemod": null,
+  "review_checklist_es": [
+    "Elegir el modelo de reemplazo según la página de deprecaciones del proveedor.",
+    "Correr tus evals o pruebas de regresión de prompts antes de cambiar de modelo.",
+    "Revisar parámetros que cambian entre generaciones de modelos."
+  ]
+}

package/packs/arca.wsfe.condicion-iva-receptor.json

@@ -0,0 +1,51 @@
+{
+  "id": "arca.wsfe.condicion-iva-receptor",
+  "version": "2026.10.16",
+  "provider": "ARCA (ex AFIP)",
+  "title": "Condición frente al IVA del receptor obligatoria en WSFEv1",
+  "kind": "breaking",
+  "severity": "critical",
+  "deadline": "2026-12-01",
+  "last_verified": "2026-10-16",
+  "summary_es": "Desde el 1/12/2026 ARCA rechaza automáticamente las solicitudes de CAE que no informen CondicionIVAReceptorId.",
+  "why_es": "La RG 5616/2024 hizo obligatorio informar la condición frente al IVA del receptor en cada comprobante electrónico. El manual del desarrollador de WSFEv1 (v4.8) fija el 1 de diciembre de 2026 como fecha desde la cual el campo es obligatorio: si viaja vacío, nulo o no viaja, el pedido de CAE se rechaza y no se puede facturar.",
+  "sources": [
+    { "title": "VATupdate: Argentina makes recipient VAT status mandatory (WSFEv1 v4.8)", "url": "https://www.vatupdate.com/2026/09/09/argentina-makes-recipient-vat-status-mandatory-in-electronic-invoices/" },
+    { "title": "iProfesional: ARCA rechazará facturas sin la condición del cliente frente al IVA", "url": "https://www.iprofesional.com/impuestos/464104-nuevo-requisito-arca-puede-trabar-emision-facturas" },
+    { "title": "Tabla de códigos de FEParamGetCondicionIvaReceptor", "url": "https://app.spomsolutions.com/blog/condicion-iva-receptor-rg-5616" },
+    { "title": "Afip SDK: factura electrónica (Node y PHP, CreateVoucher / CreateNextVoucher)", "url": "https://docs.afipsdk.com/siguientes-pasos/web-services/factura-electronica" },
+    { "title": "afipsdk/afip.php en Packagist", "url": "https://packagist.org/packages/afipsdk/afip.php" }
+  ],
+  "detect": {
+    "packages": ["@afipsdk/afip.js", "@arcasdk/core", "afip.ts", "ts-afip-ws", "facturajs", "afipsdk/afip.php", "fertandil87/afip.php", "ivanalemunioz/afip.php", "eesnaola/afip.php"],
+    "calls": ["ElectronicBilling.createVoucher", "ElectronicBilling.createNextVoucher", "ElectronicBilling->CreateVoucher", "ElectronicBilling->CreateNextVoucher"],
+    "raw_markers": ["FECAESolicitar", "FECAEDetRequest"],
+    "field": "CondicionIVAReceptorId"
+  },
+  "codes": {
+    "1": "IVA Responsable Inscripto",
+    "4": "IVA Sujeto Exento",
+    "5": "Consumidor Final",
+    "6": "Responsable Monotributo",
+    "7": "Sujeto No Categorizado",
+    "8": "Proveedor del Exterior",
+    "9": "Cliente del Exterior",
+    "10": "IVA Liberado – Ley N° 19.640",
+    "13": "Monotributista Social",
+    "15": "IVA No Alcanzado",
+    "16": "Monotributo Trabajador Independiente Promovido"
+  },
+  "codes_by_class": {
+    "A": [1, 6, 13, 16],
+    "B": [4, 5, 7, 8, 9, 10, 15],
+    "C": [1, 4, 5, 6, 7, 8, 9, 10, 13, 15, 16]
+  },
+  "codes_note_es": "Validá los códigos contra FEParamGetCondicionIvaReceptor en homologación antes de pasar a producción.",
+  "codemod": "arca-wsfe-condicion-iva",
+  "review_checklist_es": [
+    "Probar la emisión en homologación (wsfehomo) con cada tipo de comprobante que emitís.",
+    "Confirmar que cada cliente con CUIT tiene guardada su condición frente al IVA y que se envía en cada CAE.",
+    "Pedir la condición frente al IVA en el alta de clientes nuevos.",
+    "Validar los códigos con FEParamGetCondicionIvaReceptor (la tabla puede cambiar)."
+  ]
+}

package/packs/mercadopago.payments-to-orders.json

@@ -0,0 +1,57 @@
+{
+  "id": "mercadopago.payments-to-orders",
+  "version": "2026.10.15",
+  "provider": "Mercado Pago",
+  "title": "Migración de creación de pagos: Payments API → Orders API",
+  "kind": "migration",
+  "severity": "medium",
+  "deadline": null,
+  "last_verified": "2026-10-15",
+  "summary_es": "Mercado Pago dejó de sumar features a Payments API; Orders API es la integración nueva para Checkout API.",
+  "why_es": "Payments API sigue funcionando pero solo recibe correcciones de seguridad y estabilidad. Orders API unifica el procesamiento online, trae varias transacciones por orden, captura dedicada, 3DS 2.0 nativo y errores consolidados. Los pagos ya creados se siguen consultando, capturando, cancelando y reembolsando por la API con la que se crearon, así que Parche migra solo la creación y deja el resto marcado para revisión.",
+  "sources": [
+    { "title": "Mercado Pago: Cómo migrar de Payments API a Orders API", "url": "https://www.mercadopago.com.ar/developers/es/docs/checkout-api-orders/resources/migrate-payments-to-orders" },
+    { "title": "SDK Node.js de Mercado Pago (clase Order)", "url": "https://www.npmjs.com/package/mercadopago" }
+  ],
+  "detect": {
+    "packages": ["mercadopago"],
+    "calls": ["Payment.create", "Payment.get", "Payment.search", "Payment.cancel", "Payment.capture", "PaymentRefund"],
+    "raw_markers": ["api.mercadopago.com/v1/payments"],
+    "legacy_v1": ["mercadopago.configure(", "mercadopago.payment.create(", "mercadopago.payment.save("]
+  },
+  "status_map": {
+    "approved": "processed",
+    "rejected": "failed",
+    "cancelled": "canceled",
+    "pending": "action_required",
+    "in_process": "processing",
+    "authorized": "action_required",
+    "in_mediation": "charged_back",
+    "refunded": "refunded",
+    "charged_back": "charged_back"
+  },
+  "status_detail_map": {
+    "cc_rejected_bad_filled_card_number": "bad_filled_card_data",
+    "cc_rejected_bad_filled_date": "bad_filled_card_data",
+    "cc_rejected_bad_filled_security_code": "bad_filled_card_data",
+    "cc_rejected_call_for_authorize": "required_call_for_authorize",
+    "cc_rejected_card_disabled": "card_disabled",
+    "cc_rejected_duplicated_payment": "processing_error",
+    "cc_rejected_high_risk": "high_risk",
+    "cc_rejected_insufficient_amount": "insufficient_amount",
+    "cc_rejected_invalid_installments": "invalid_installments",
+    "cc_rejected_max_attempts": "max_attempts_exceeded",
+    "cc_rejected_other_reason": "rejected_by_issuer",
+    "pending_waiting_transfer": "waiting_transfer"
+  },
+  "codemod": "mercadopago-payments-to-orders",
+  "review_checklist_es": [
+    "Configurar el webhook con el tópico `orders` en Tus integraciones y mantener `payment` en paralelo durante la transición.",
+    "Enviar `X-Idempotency-Key` en todas las escrituras (crear, capturar, cancelar, reembolsar).",
+    "Manejar `status` y `status_detail` a nivel orden y a nivel transacción.",
+    "Persistir también `transactions.payments[].id` (los reembolsos parciales lo necesitan).",
+    "En sandbox, el email del pagador tiene que ser test@testuser.com.",
+    "Si usás captura manual: la ventana de captura es de 5 días y Orders solo soporta captura total.",
+    "Pagos creados con Payments API se siguen consultando y reembolsando por Payments API."
+  ]
+}

package/src/ast.js

@@ -0,0 +1,204 @@
+// Utilidades de AST compartidas por todos los codemods.
+import jscodeshift from 'jscodeshift';
+import { parse as babelParse } from '@babel/parser';
+import { parsePhp, isPhp } from './php.js';
+
+export function jFor(file) {
+  const parser = /\.ts$/.test(file) ? 'ts' : 'tsx';
+  return jscodeshift.withParser(parser);
+}
+
+// Estilo de comillas predominante en el archivo, para que el código nuevo combine.
+export function detectQuote(source) {
+  const single = (source.match(/'[^'\n]*'/g) || []).length;
+  const double = (source.match(/"[^"\n]*"/g) || []).length;
+  return double > single ? 'double' : 'single';
+}
+
+// Fin de línea predominante en el archivo. recast imprime con os.EOL por defecto (\r\n en
+// Windows), así que hay que pasárselo siempre para no reescribir el archivo entero.
+export function eolOf(source) {
+  const crlf = (source.match(/\r\n/g) || []).length;
+  const lf = (source.match(/\n/g) || []).length - crlf;
+  return crlf > lf ? '\r\n' : '\n';
+}
+
+// Aplica inserciones de texto { offset, text } de atrás para adelante, así no se corren los offsets.
+export function applyEdits(source, edits) {
+  let out = source;
+  for (const e of [...edits].sort((a, b) => b.offset - a.offset)) {
+    out = out.slice(0, e.offset) + e.text + out.slice(e.offset);
+  }
+  return out;
+}
+
+// Offset en el texto original de una posición { line, column } de recast.
+// No usar node.start/node.end para editar texto: recast parsea una copia con las líneas unidas
+// por os.EOL y las tabs de la indentación expandidas, así que esos offsets no coinciden con el
+// archivo del cliente (en Windows quedan corridos un carácter por línea).
+export function offsetAt(source, { line, column }, tabWidth = 4) {
+  let k = 0;
+  for (let i = 1; i < line; i++) k = source.indexOf('\n', k) + 1;
+  // La indentación se mide como en recast: tab hasta el próximo múltiplo, \v \f y BOM no ocupan.
+  let width = 0;
+  while (width < column && /[^\S\r\n]/.test(source[k] ?? '')) {
+    if (source[k] === '\t') width = (Math.floor(width / tabWidth) + 1) * tabWidth;
+    else if (!'\v\f'.includes(source[k])) width += 1;
+    k++;
+  }
+  return k + (column - width);
+}
+
+export function keyName(prop) {
+  if (!prop || !prop.key) return null;
+  if (prop.computed) return null;
+  const k = prop.key;
+  if (k.type === 'Identifier') return k.name;
+  if (k.type === 'StringLiteral' || (k.type === 'Literal' && typeof k.value === 'string')) return k.value;
+  return null;
+}
+
+export function isPlainProp(prop) {
+  return prop && (prop.type === 'ObjectProperty' || prop.type === 'Property');
+}
+
+export function hasSpread(obj) {
+  return obj.properties.some((p) => p.type === 'SpreadElement' || p.type === 'SpreadProperty' || p.type === 'ObjectMethod');
+}
+
+export function getProp(obj, name) {
+  return obj.properties.find((p) => isPlainProp(p) && keyName(p) === name) || null;
+}
+
+export function isQuotedKey(prop) {
+  return prop.key && (prop.key.type === 'StringLiteral' || prop.key.type === 'Literal');
+}
+
+export function literalValue(node) {
+  if (!node) return undefined;
+  if (['StringLiteral', 'NumericLiteral', 'BooleanLiteral'].includes(node.type)) return node.value;
+  if (node.type === 'Literal') return node.value;
+  if (node.type === 'TemplateLiteral' && node.expressions.length === 0) return node.quasis[0].value.cooked;
+  return undefined;
+}
+
+export function isStringLit(node) {
+  return node && (node.type === 'StringLiteral' || (node.type === 'Literal' && typeof node.value === 'string'));
+}
+
+export function lineOf(node) {
+  return node && node.loc ? node.loc.start.line : null;
+}
+
+// Copia profunda de un nodo sin metadatos de posición, para poder usarlo dos veces.
+export function cloneNode(node) {
+  if (Array.isArray(node)) return node.map(cloneNode);
+  if (!node || typeof node !== 'object') return node;
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (['loc', 'start', 'end', 'range', 'comments', 'leadingComments', 'trailingComments', 'innerComments', 'original', 'tokens'].includes(k)) continue;
+    out[k] = cloneNode(v);
+  }
+  return out;
+}
+
+// Cadena de propiedades de un MemberExpression no computado: result.a.b → { root: 'result', path: ['a','b'] }
+export function memberChain(node) {
+  const path = [];
+  let cur = node;
+  while (cur && (cur.type === 'MemberExpression' || cur.type === 'OptionalMemberExpression')) {
+    if (cur.computed || cur.property.type !== 'Identifier') return null;
+    path.unshift(cur.property.name);
+    cur = cur.object;
+  }
+  if (!cur || cur.type !== 'Identifier') return null;
+  return { root: cur.name, path };
+}
+
+export function buildMember(j, rootName, parts) {
+  let expr = j.identifier(rootName);
+  for (const part of parts) {
+    if (typeof part === 'number') expr = j.memberExpression(expr, j.numericLiteral(part), true);
+    else expr = j.memberExpression(expr, j.identifier(part));
+  }
+  return expr;
+}
+
+// ¿Este Identifier es una referencia real (no una clave de objeto ni una propiedad de member)?
+export function isReference(path) {
+  const parent = path.parent && path.parent.node;
+  if (!parent) return true;
+  if ((parent.type === 'MemberExpression' || parent.type === 'OptionalMemberExpression') && parent.property === path.node && !parent.computed) return false;
+  if ((parent.type === 'ObjectProperty' || parent.type === 'Property') && parent.key === path.node && !parent.computed && !parent.shorthand) return false;
+  if (parent.type === 'ImportSpecifier' || parent.type === 'ImportDefaultSpecifier') return false;
+  if (parent.type === 'VariableDeclarator' && parent.id === path.node) return false;
+  if (parent.type === 'TSPropertySignature' || parent.type === 'TSQualifiedName') return false;
+  const grand = path.parent.parent && path.parent.parent.node;
+  if ((parent.type === 'ObjectProperty' || parent.type === 'Property') && grand && grand.type === 'ObjectPattern') return false;
+  return true;
+}
+
+// Nodo armado desde texto: recast lo imprime tal cual, sin reformatear.
+export function snippet(j, code, type) {
+  return j(code).find(j[type]).paths()[0].node;
+}
+
+// Resuelve un Identifier a la inicialización de su declaración (const x = {...}) usando el scope.
+export function resolveBinding(path, name) {
+  const scope = path.scope && path.scope.lookup(name);
+  if (!scope) return null;
+  const bindings = scope.getBindings()[name];
+  if (!bindings || !bindings.length) return null;
+  const declPath = bindings[0].parent;
+  if (declPath && declPath.node.type === 'VariableDeclarator' && declPath.node.id.type === 'Identifier') return declPath;
+  return null;
+}
+
+// Chequeo de sintaxis del resultado, usado por verify y por los tests.
+export function parseCheck(source, file) {
+  if (isPhp(file)) {
+    parsePhp(source, file);
+    return true;
+  }
+  // decorators-legacy: NestJS, Angular y TypeORM usan decoradores (@Injectable()); sin el plugin, el chequeo
+  // de sintaxis fallaba y --verify frenaba el PR en esos repos.
+  const plugins = ['jsx', 'decorators-legacy'];
+  if (/\.(ts|tsx)$/.test(file)) plugins.push('typescript');
+  if (/\.ts$/.test(file)) plugins.splice(plugins.indexOf('jsx'), 1);
+  babelParse(source, { sourceType: 'unambiguous', plugins, allowAwaitOutsideFunction: true });
+  return true;
+}
+
+export function finding(pack, file, node, status, message, extra = {}) {
+  return { pack, file, line: lineOf(node), status, message, ...extra };
+}
+
+// Recast agrega líneas en blanco alrededor de propiedades multilínea que reimprime.
+// Esto saca SOLO las líneas en blanco nuevas (las que no estaban en el original),
+// usando un diff de líneas, así el PR muestra el cambio y nada más.
+export function tidy(original, output) {
+  const a = original.split('\n');
+  const b = output.split('\n');
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+  for (let i = n - 1; i >= 0; i--) {
+    for (let k = m - 1; k >= 0; k--) {
+      dp[i][k] = a[i] === b[k] ? dp[i + 1][k + 1] + 1 : Math.max(dp[i + 1][k], dp[i][k + 1]);
+    }
+  }
+  const keep = [];
+  let i = 0;
+  let k = 0;
+  while (k < m) {
+    // Una línea en blanco que también puede emparejarse más adelante se toma como nueva: así lo
+    // insertado con insertAfter queda pegado a la línea anterior (el import nuevo junto a los otros
+    // imports) y la línea en blanco original queda después.
+    if (i < n && a[i] === b[k] && b[k].trim() === '' && dp[i][k + 1] === dp[i][k]) { k++; continue; }
+    if (i < n && a[i] === b[k]) { keep.push(b[k]); i++; k++; continue; }
+    if (i < n && dp[i + 1][k] >= dp[i][k + 1]) { i++; continue; }
+    if (b[k].trim() !== '') keep.push(b[k]); // línea nueva con contenido: se queda
+    k++;
+  }
+  return keep.join('\n');
+}