permdock 0.3.1 → 0.5.0

package/dist/codemod-Cxvvc70T.js

@@ -0,0 +1,2084 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { a as rel } from "./files-D_JIzUrP.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { n as ROOT } from "./manifest-CtKR3GXL.js";
+import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
+import { r as refuseDirty, t as applyFiles } from "./files-C5ZI27eV.js";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { extname, join, resolve } from "node:path";
+import { Visitor, parseSync, visitorKeys } from "oxc-parser";
+//#region src/cli/codemod/cli-calls.ts
+/** `permdock`, `npx permdock@0.4`, `pnpm exec permdock`: the bin name followed by a space. */
+const INVOCATION = /(?<![\w./@-])permdock(?:@[\w.^~-]+)?(?=[ \t])/gu;
+/**
+* Where a shell command ends: an operator, a pipe, a redirect, a comment or
+* a closing backtick. A JSON string also ends at its closing quote. `<id>`
+* is a placeholder, not a redirect, so a redirect needs a space on both sides.
+*/
+function commandEnd(text, from, json) {
+	const match = (json ? /&&|\|\||[;|`)\n"]|(?<=\s)\d?[<>]{1,2}(?:&\d|\s)|\s#/u : /&&|\|\||[;|`)\n]|(?<=\s)\d?[<>]{1,2}(?:&\d|\s)|\s#/u).exec(text.slice(from));
+	return match === null ? text.length : from + match.index;
+}
+function tokensOf(text, start, end) {
+	return [...text.slice(start, end).matchAll(/\S+/gu)].map((match) => ({
+		start: start + match.index,
+		end: start + match.index + match[0].length,
+		text: match[0]
+	}));
+}
+function lineColumn(text, offset) {
+	const before = text.slice(0, offset);
+	return {
+		line: before.split("\n").length,
+		column: offset - before.lastIndexOf("\n")
+	};
+}
+/** The leaf path the positional tokens name, with the token after which a moved subcommand goes. */
+function commandOf(tokens) {
+	let node = ROOT;
+	const path = [];
+	let last;
+	for (const token of tokens) {
+		if (token.text.startsWith("-")) continue;
+		const child = node.children.find((item) => item.name === token.text);
+		if (child === void 0) break;
+		path.push(child.name);
+		last = token;
+		if (child.kind === "leaf") return { command: path.join(" ") };
+		node = child;
+	}
+	const move = COMMAND_MOVES.find((item) => item.from === path.join(" "));
+	if (move === void 0 || last === void 0) return { command: void 0 };
+	return {
+		command: move.to,
+		insertAfter: last,
+		insert: move.to.slice(move.from.length + 1)
+	};
+}
+function flagEdits(command, tokens, notes) {
+	const edits = [];
+	for (const [index, token] of tokens.entries()) {
+		if (!token.text.startsWith("--")) continue;
+		const eq = token.text.indexOf("=");
+		const name = eq === -1 ? token.text : token.text.slice(0, eq);
+		const rename = flagRename(command, name);
+		if (rename === void 0) continue;
+		const edit = flagEdit(rename, token, eq, tokens[index + 1]);
+		if (edit === void 0) notes.push({
+			at: token.start,
+			message: renameMessage(command, rename)
+		});
+		else edits.push(...edit);
+	}
+	return edits;
+}
+function flagEdit(rename, token, eq, next) {
+	if (rename.rewrite !== void 0) return eq === -1 ? [{
+		start: token.start,
+		end: token.end,
+		text: rename.rewrite,
+		from: token.text
+	}] : void 0;
+	if (rename.to === void 0 || rename.hint !== void 0) return;
+	if (rename.values === void 0) {
+		const value = eq === -1 ? "" : token.text.slice(eq);
+		return [{
+			start: token.start,
+			end: token.end,
+			text: `${rename.to}${value}`,
+			from: token.text
+		}];
+	}
+	if (eq !== -1) {
+		const mapped = mappedValue(rename.values, token.text.slice(eq + 1));
+		return mapped === void 0 ? void 0 : [{
+			start: token.start,
+			end: token.end,
+			text: `${rename.to}=${mapped}`,
+			from: token.text
+		}];
+	}
+	const mapped = next === void 0 ? void 0 : mappedValue(rename.values, next.text);
+	if (next === void 0 || mapped === void 0) return;
+	return [{
+		start: token.start,
+		end: token.end,
+		text: rename.to,
+		from: token.text
+	}, {
+		start: next.start,
+		end: next.end,
+		text: mapped,
+		from: next.text
+	}];
+}
+function mappedValue(values, value) {
+	return Object.hasOwn(values, value) ? values[value] : void 0;
+}
+/**
+* Rewrites the 0.5.0 CLI renames in shell commands: package.json scripts,
+* CI workflows, shell scripts. A rename that needs a person, such as an
+* environment name that must become a project id, is a follow-up instead.
+*/
+function rewriteCliCalls(text, options) {
+	const edits = [];
+	const notes = [];
+	for (const match of text.matchAll(INVOCATION)) {
+		const start = match.index + match[0].length;
+		const tokens = tokensOf(text, start, commandEnd(text, start, options.json));
+		const { command, insertAfter, insert } = commandOf(tokens);
+		if (command === void 0) continue;
+		if (insertAfter !== void 0 && insert !== void 0) edits.push({
+			start: insertAfter.end,
+			end: insertAfter.end,
+			text: ` ${insert}`,
+			from: insertAfter.text
+		});
+		edits.push(...flagEdits(command, tokens, notes));
+		for (const change of DEFAULT_CHANGES) {
+			const given = new Set(tokens.map((token) => token.text));
+			const last = tokens.at(-1);
+			if (change.command === command && last !== void 0 && !change.unless.some((flag) => given.has(flag)) && !given.has(change.add)) edits.push({
+				start: last.end,
+				end: last.end,
+				text: ` ${change.add}`,
+				from: last.text
+			});
+		}
+	}
+	const changes = [];
+	let out = text;
+	for (const edit of edits.toSorted((a, b) => b.start - a.start)) {
+		const { start, end } = edit.text === "" ? dropWithSpace(out, edit) : edit;
+		out = `${out.slice(0, start)}${edit.text}${out.slice(end)}`;
+		changes.push({
+			...lineColumn(text, edit.start),
+			from: edit.from,
+			to: edit.start === edit.end ? `${edit.from}${edit.text}` : edit.text === "" ? "(removed)" : edit.text
+		});
+	}
+	return {
+		text: out,
+		changes: changes.toReversed(),
+		followUps: notes.map((note) => {
+			const { line, column } = lineColumn(text, note.at);
+			return {
+				line,
+				column,
+				name: "cli",
+				message: note.message
+			};
+		})
+	};
+}
+/** A dropped flag takes the space before it, so `a --legacy b` becomes `a b`. */
+function dropWithSpace(text, edit) {
+	return text[edit.start - 1] === " " ? {
+		start: edit.start - 1,
+		end: edit.end
+	} : edit;
+}
+//#endregion
+//#region src/cli/codemod/renames-0.5.ts
+const SERVER_ADAPTERS = [
+	"permdock/server",
+	"permdock/hono",
+	"permdock/express",
+	"permdock/fastify",
+	"permdock/elysia",
+	"permdock/nest",
+	"permdock/node"
+];
+const rows = [
+	{
+		from: "createServerKernel",
+		to: "createPermDock",
+		entries: ["permdock/server"]
+	},
+	{
+		from: "ServerKernel",
+		to: "ServerPermDock",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "ServerKernelOptions",
+		to: "ServerPermDockOptions",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "createEvaluationsHandler",
+		to: "evaluationsHandler",
+		entries: ["permdock/server"]
+	},
+	{
+		from: "createNativeStore",
+		to: "nativeStore",
+		entries: ["permdock/react-native"]
+	},
+	{
+		from: "permdock",
+		to: "getPermDock",
+		entries: [
+			"permdock/server",
+			"permdock/node",
+			"permdock/terminal",
+			"permdock/openai",
+			"permdock/claude-agent",
+			"permdock/eve"
+		],
+		kind: "method"
+	},
+	{
+		from: "permdock",
+		to: "middleware",
+		entries: [
+			"permdock/hono",
+			"permdock/express",
+			"permdock/elysia",
+			"permdock/trpc",
+			"permdock/orpc"
+		],
+		kind: "method"
+	},
+	{
+		from: "load",
+		to: "data",
+		entries: ["permdock/authzen"],
+		kind: "option"
+	},
+	{
+		from: "loadData",
+		to: "data",
+		entries: ["permdock/nest"],
+		kind: "option"
+	},
+	{
+		from: "onDenied",
+		to: "deniedResponse",
+		entries: [
+			...SERVER_ADAPTERS,
+			"permdock/trpc",
+			"permdock/orpc",
+			"permdock/supabase/middleware"
+		],
+		kind: "option",
+		calls: ["createPermDock"]
+	},
+	{
+		from: "onDenied",
+		to: "deniedText",
+		entries: ["permdock/ai-sdk", "permdock/mcp"],
+		kind: "option",
+		calls: ["createPermDock"]
+	},
+	{
+		from: "tools",
+		to: "operations",
+		entries: [
+			"permdock/ai-sdk",
+			"permdock/openai",
+			"permdock/claude-agent",
+			"permdock/eve"
+		],
+		kind: "option",
+		calls: ["createPermDock"]
+	},
+	{
+		from: "OnDenied",
+		to: "DeniedResponse",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "OnDeniedEvent",
+		to: "DeniedResponseEvent",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "OnDeniedText",
+		to: "DeniedText",
+		entries: ["permdock/ai-sdk", "permdock/mcp"],
+		kind: "type"
+	},
+	{
+		from: "PermDockRequest",
+		to: "ExpressPermDockRequest",
+		entries: ["permdock/express"],
+		kind: "type"
+	},
+	{
+		from: "PermDockRequest",
+		to: "FastifyPermDockRequest",
+		entries: ["permdock/fastify"],
+		kind: "type"
+	},
+	{
+		from: "PermDockEnv",
+		to: "HonoPermDockEnv",
+		entries: ["permdock/hono"],
+		kind: "type"
+	},
+	{
+		from: "ElysiaContext",
+		to: "ElysiaPermDockContext",
+		entries: ["permdock/elysia"],
+		kind: "type"
+	},
+	{
+		from: "ElysiaCtx",
+		to: "ElysiaRequestContext",
+		entries: ["permdock/elysia"],
+		kind: "type"
+	},
+	{
+		from: "ConvexPermDockCtx",
+		to: "ConvexPermDockContext",
+		entries: ["permdock/convex"],
+		kind: "type"
+	},
+	{
+		from: "ServerPermDockProviderProps",
+		to: "NextPermDockProviderProps",
+		entries: ["permdock/next"],
+		kind: "type"
+	},
+	{
+		from: "NativePermDockProviderProps",
+		to: "ReactNativePermDockProviderProps",
+		entries: ["permdock/react-native"],
+		kind: "type"
+	},
+	{
+		from: "PermDockSvelteOptions",
+		to: "SveltePermDockOptions",
+		entries: ["permdock/svelte"],
+		kind: "type"
+	},
+	{
+		from: "subjectFromSession",
+		to: "subjectFromEve",
+		entries: ["permdock/eve"]
+	},
+	{
+		from: "actorFromSession",
+		to: "actorFromEve",
+		entries: ["permdock/eve"]
+	},
+	{
+		from: "CredentialPrincipal",
+		to: "ApiKeyPrincipal",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "LinkPrincipal",
+		to: "CapabilityPrincipal",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "SsfSubjectMapper",
+		to: "SsfSubjectResolver",
+		entries: ["permdock/ssf"],
+		kind: "type"
+	},
+	{
+		from: "memorySettings",
+		to: "memorySettingsSource",
+		entries: ["permdock"]
+	},
+	{
+		from: "memoryRelations",
+		to: "memoryRelationSource",
+		entries: ["permdock"]
+	},
+	{
+		from: "memorySink",
+		to: "memoryDecisionSink",
+		entries: ["permdock"]
+	},
+	{
+		from: "memoryApprovalPolicies",
+		to: "memoryApprovalPolicySource",
+		entries: ["permdock"]
+	},
+	{
+		from: "memoryApprovalDelegations",
+		to: "memoryApprovalDelegationSource",
+		entries: ["permdock/approvals"]
+	},
+	{
+		from: "memoryAccessReviews",
+		to: "memoryAccessReviewStore",
+		entries: ["permdock/approvals"]
+	},
+	{
+		from: "MemoryAccessReviews",
+		to: "MemoryAccessReviewStore",
+		entries: ["permdock/approvals"],
+		kind: "type"
+	},
+	{
+		from: "MemoryRelationsData",
+		to: "MemoryRelationSourceData",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "MemorySink",
+		to: "MemoryDecisionSink",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "MemorySinkOptions",
+		to: "MemoryDecisionSinkOptions",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "memoryCredentials",
+		to: "memoryCredentialStore",
+		entries: ["permdock/server"]
+	},
+	{
+		from: "MemoryCredentials",
+		to: "MemoryCredentialStore",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "memoryStorage",
+		to: "memorySnapshotStorage",
+		entries: ["permdock/react-native"]
+	},
+	{
+		from: "rlsParity",
+		to: "testRlsParity",
+		entries: ["permdock/testing"]
+	},
+	{
+		from: "ormParity",
+		to: "testOrmParity",
+		entries: ["permdock/testing"]
+	},
+	{
+		from: "fromStripeEntitlements",
+		to: "stripeEntitlementSource",
+		entries: ["permdock"]
+	},
+	{
+		from: "fromTable",
+		to: "tableMembershipSource",
+		entries: ["permdock/supabase"]
+	},
+	{
+		from: "fromJunction",
+		to: "junctionMembershipSource",
+		entries: ["permdock/supabase"]
+	},
+	{
+		from: "fromSupabasePostgres",
+		to: "supabasePostgresQuery",
+		entries: ["permdock/supabase"]
+	},
+	{
+		from: "verifyWebBotAuth",
+		to: "webBotAuthVerifier",
+		entries: SERVER_ADAPTERS
+	},
+	{
+		from: "RoleSource",
+		to: "CustomRoleSource",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "RoleSourceFactory",
+		to: "CustomRoleSourceFactory",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "memoryRoleSource",
+		to: "memoryCustomRoleSource",
+		entries: ["permdock"]
+	},
+	{
+		from: "testRoleSource",
+		to: "testCustomRoleSource",
+		entries: ["permdock/testing"]
+	},
+	{
+		from: "betterAuthRoleSource",
+		to: "betterAuthCustomRoleSource",
+		entries: ["permdock/better-auth"]
+	},
+	{
+		from: "BetterAuthRoleSourceOptions",
+		to: "BetterAuthCustomRoleSourceOptions",
+		entries: ["permdock/better-auth"],
+		kind: "type"
+	},
+	{
+		from: "PermDockStorage",
+		to: "SnapshotStorage",
+		entries: ["permdock/react-native"],
+		kind: "type"
+	},
+	{
+		from: "store",
+		to: "directory",
+		entries: ["permdock/scim"],
+		kind: "option",
+		calls: ["scimHandler"]
+	},
+	{
+		from: "store",
+		to: "reviews",
+		entries: ["permdock/approvals"],
+		kind: "option",
+		calls: ["startAccessReview"]
+	},
+	{
+		from: "delegations",
+		to: "approvalDelegations",
+		entries: ["permdock/approvals"],
+		kind: "option",
+		calls: ["approvalsHandler", "matchDelegation"]
+	},
+	{
+		from: "source",
+		to: "call",
+		entries: ["permdock"],
+		kind: "option"
+	},
+	{
+		from: "testAuthZen",
+		to: "testAuthzen",
+		entries: ["permdock/testing"]
+	},
+	{
+		from: "AuthZenVectors",
+		to: "AuthzenVectors",
+		entries: ["permdock/testing"],
+		kind: "type"
+	},
+	{
+		from: "AuthZenEvaluationVector",
+		to: "AuthzenEvaluationVector",
+		entries: ["permdock/testing"],
+		kind: "type"
+	},
+	{
+		from: "AuthZenEvaluationsVector",
+		to: "AuthzenEvaluationsVector",
+		entries: ["permdock/testing"],
+		kind: "type"
+	},
+	{
+		from: "AuthZenSearchVector",
+		to: "AuthzenSearchVector",
+		entries: ["permdock/testing"],
+		kind: "type"
+	},
+	{
+		from: "TestAuthZenOptions",
+		to: "TestAuthzenOptions",
+		entries: ["permdock/testing"],
+		kind: "type"
+	},
+	{
+		from: "powersyncSource",
+		to: "powerSyncSource",
+		entries: ["permdock/react-native"]
+	},
+	{
+		from: "summariseSubject",
+		to: "summarizeSubject",
+		entries: ["permdock/approvals"]
+	},
+	{
+		from: "WebhookFailureReason",
+		to: "WebhookFailureCause",
+		entries: ["permdock/cloud"],
+		kind: "type"
+	},
+	{
+		from: "ApprovalResumeFailure",
+		to: "ApprovalResumeFailureCause",
+		entries: ["permdock/approvals"],
+		kind: "type"
+	},
+	{
+		from: "window",
+		to: "per",
+		entries: ["permdock", ...SERVER_ADAPTERS],
+		kind: "method"
+	},
+	{
+		from: "DefinePermissionsOptions",
+		to: "PermissionsOptions",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "SignCapabilityOptions",
+		to: "CapabilityOptions",
+		entries: ["permdock"],
+		kind: "type"
+	},
+	{
+		from: "SignRunTicketOptions",
+		to: "RunTicketOptions",
+		entries: ["permdock/server"],
+		kind: "type"
+	},
+	{
+		from: "StartAccessReviewOptions",
+		to: "AccessReviewOptions",
+		entries: ["permdock/approvals"],
+		kind: "type"
+	},
+	{
+		from: "StartAutomationOptions",
+		to: "AutomationOptions",
+		entries: ["permdock/workflow", "permdock/workflow-sdk"],
+		kind: "type"
+	},
+	{
+		from: "VerifyWebhookOptions",
+		to: "WebhookOptions",
+		entries: ["permdock/cloud"],
+		kind: "type"
+	},
+	{
+		from: "UseRolesOptions",
+		to: "RolesOptions",
+		entries: [
+			"permdock/vue",
+			"permdock/svelte",
+			"permdock/solid"
+		],
+		kind: "type"
+	},
+	{
+		from: "ConvexCtxLike",
+		to: "ConvexContextLike",
+		entries: ["permdock/convex"],
+		kind: "type"
+	},
+	{
+		from: "createJwtSubjectResolver",
+		to: "jwtSubjectResolver",
+		entries: ["permdock/jwt"]
+	},
+	{
+		from: "createClerkSubjectResolver",
+		to: "clerkSubjectResolver",
+		entries: ["permdock/clerk"]
+	},
+	{
+		from: "fromResponse",
+		to: "sendResponse",
+		entries: ["permdock/node"]
+	},
+	{
+		from: "fromResponse",
+		to: "send",
+		entries: ["permdock/node"],
+		kind: "method"
+	},
+	{
+		from: "createPermDock",
+		to: "getPermDockSync",
+		entries: ["permdock"]
+	},
+	{
+		from: "createPermDock",
+		to: "getPermDock",
+		entries: ["permdock/pdp"]
+	},
+	{
+		from: "loadRelations",
+		to: "prefetchRelations",
+		entries: ["permdock", "permdock/pdp"],
+		kind: "method"
+	}
+];
+/** Every 0.5.0 rename, one row per `from` and target. */
+const RENAMES_0_5 = Object.freeze(rows.map((row) => Object.freeze({
+	...row,
+	entries: Object.freeze([...row.entries]),
+	...row.calls === void 0 ? {} : { calls: Object.freeze([...row.calls]) }
+})));
+/** 0.5.0 changes the codemod lists as manual follow-ups. */
+const SIGNATURE_CHANGES_0_5 = Object.freeze([
+	{
+		name: "permittedIds",
+		entries: ["permdock"],
+		before: "permittedIds(permdock, permission, scope)",
+		after: "permdock.permittedIds(permission, scope)"
+	},
+	{
+		name: "mayUse",
+		entries: ["permdock"],
+		before: "mayUse(permdock, permission)",
+		after: "permdock.mayUse(permission)"
+	},
+	{
+		name: "subjectFromApiKey",
+		entries: ["permdock/server"],
+		before: "subjectFromApiKey(options)(key)",
+		after: "subjectFromApiKey(key, options)",
+		shape: "curried"
+	},
+	{
+		name: "subjectFromBetterAuth",
+		entries: ["permdock/better-auth"],
+		before: "subjectFromBetterAuth(auth, session, options)",
+		after: "subjectFromBetterAuth(session, { auth, ...options })"
+	},
+	{
+		name: "capabilitySubject",
+		entries: ["permdock"],
+		before: "capabilitySubject(...)",
+		after: "subjectFromCapability(token, options)"
+	},
+	{
+		name: "credentialSubject",
+		entries: ["permdock"],
+		before: "credentialSubject(...)",
+		after: "subjectFromApiKey(key, options)"
+	},
+	{
+		name: "MappedSubject",
+		entries: ["permdock/jwt"],
+		before: "MappedSubject",
+		after: "Subject<JwtPrincipal>"
+	},
+	{
+		name: "verifyWebBotAuth",
+		entries: SERVER_ADAPTERS,
+		before: "verifyWebBotAuth(request, options)",
+		after: "webBotAuthVerifier(options)(request)"
+	},
+	{
+		name: "verifyWebhook",
+		entries: ["permdock/cloud"],
+		before: "verifyWebhook(request, options).reason",
+		after: "verifyWebhook(request, options).cause"
+	},
+	{
+		name: "inspectApproval",
+		entries: ["permdock/approvals"],
+		before: "inspectApproval(store, token).detail",
+		after: "inspectApproval(store, token).cause"
+	},
+	{
+		name: "consumeApproval",
+		entries: ["permdock/approvals"],
+		before: "consumeApproval(store, token).detail",
+		after: "consumeApproval(store, token).cause"
+	},
+	{
+		name: "requireAccess",
+		entries: ["permdock/next"],
+		before: "requireAccess({ permission, data, tenant, onDenied })",
+		after: "requirePermission(permission, data, { tenant, onDenied })"
+	},
+	{
+		name: "RequireAccessInput",
+		entries: ["permdock/next"],
+		before: "RequireAccessInput",
+		after: "PermissionRequirementOptions"
+	}
+]);
+//#endregion
+//#region src/cli/codemod/shapes-0.5.ts
+const JSX_KITS = [
+	"permdock/react",
+	"permdock/react-native",
+	"permdock/solid"
+];
+const PROP_RENAMES_0_5 = Object.freeze([{
+	component: "Protected",
+	entries: [...JSX_KITS, "permdock/vue"],
+	from: "fallback",
+	to: "denied"
+}, {
+	component: "PermDockProvider",
+	entries: JSX_KITS,
+	from: "fallback",
+	to: "denied",
+	within: "defaults"
+}]);
+const TEMPLATE_HINTS_0_5 = Object.freeze([{
+	component: "Protected",
+	entries: ["permdock/vue"],
+	pattern: /(?:#|v-slot:)fallback\b/gu,
+	name: "fallback",
+	message: "the `<Protected>` slot `fallback` is `denied`: `#denied`"
+}, {
+	component: "Protected",
+	entries: ["permdock/svelte"],
+	pattern: /\{#snippet\s+fallback\b|\bslot=["']fallback["']/gu,
+	name: "fallback",
+	message: "the `<Protected>` snippet `fallback` is `denied`: `{#snippet denied(decision)}`"
+}]);
+const AWAIT_RENAMES_0_5 = Object.freeze([{
+	name: "createPermDock",
+	entries: ["permdock"],
+	to: "getPermDock",
+	sync: "getPermDockSync"
+}]);
+const CALL_RENAMES_0_5 = Object.freeze([{
+	from: "rolesOf",
+	to: "rolesFor",
+	entries: ["permdock"],
+	kind: "option",
+	calls: ["customRoleSource"]
+}]);
+const METHOD_FUNCTIONS_0_5 = Object.freeze([
+	"decideRoleChange",
+	"decideCredential",
+	"decideAutomation",
+	"decideSupportSession",
+	"whoCan"
+].map((method) => ({
+	method,
+	to: method,
+	entry: "permdock",
+	anyReceiver: true
+})).concat([{
+	method: "simulate",
+	to: "simulateArazzo",
+	entry: "permdock",
+	anyReceiver: true,
+	argument: "arazzo"
+}, {
+	method: "activate",
+	to: "activate",
+	entry: "permdock",
+	anyReceiver: false
+}]));
+const FUNCTION_METHODS_0_5 = Object.freeze([{
+	name: "permittedIds",
+	entry: "permdock",
+	method: "permittedIds"
+}, {
+	name: "mayUse",
+	entry: "permdock",
+	method: "mayUse"
+}]);
+const INSTANCE_FACTORIES = [
+	"createPermDock",
+	"getPermDock",
+	"getPermDockSync"
+];
+const OPTION_WRAPS_0_5 = Object.freeze([{
+	key: "approvalPolicies",
+	wrapper: "approvalPolicies",
+	entry: "permdock",
+	calls: INSTANCE_FACTORIES,
+	entries: ["permdock", "permdock/pdp"],
+	already: [
+		"approvalPolicies",
+		"memoryApprovalPolicySource",
+		"memoryApprovalPolicies"
+	],
+	reportElsewhere: true
+}, {
+	key: "policies",
+	wrapper: "hostedPolicies",
+	entry: "permdock",
+	calls: INSTANCE_FACTORIES,
+	entries: ["permdock", "permdock/pdp"],
+	already: ["hostedPolicies"],
+	reportElsewhere: false
+}]);
+const DURATION_KEYS_0_5 = Object.freeze({
+	keys: [
+		"ttl",
+		"after",
+		"per",
+		"window",
+		"maxDuration",
+		"duration"
+	],
+	lists: ["durations"]
+});
+//#endregion
+//#region src/cli/codemod/ast.ts
+function nameOf(node) {
+	if (node?.type === "Literal") return typeof node.value === "string" ? node.value : void 0;
+	return node?.name;
+}
+const NOT_REFERENCES = /* @__PURE__ */ new Set([
+	"ImportSpecifier",
+	"ImportDefaultSpecifier",
+	"ImportNamespaceSpecifier",
+	"LabeledStatement",
+	"BreakStatement",
+	"ContinueStatement",
+	"TSEnumMember",
+	"TSModuleDeclaration",
+	"TSTypeParameter"
+]);
+const KEYED_MEMBERS = /* @__PURE__ */ new Set([
+	"MethodDefinition",
+	"PropertyDefinition",
+	"AccessorProperty",
+	"TSPropertySignature",
+	"TSMethodSignature",
+	"TSAbstractMethodDefinition",
+	"TSAbstractPropertyDefinition"
+]);
+/** How an identifier is read: a plain reference, a shorthand property value, the local of an `export { }`, or not a reference. */
+function referencePlace(node, parent, ancestors) {
+	const type = parent.type;
+	if (node.type === "JSXIdentifier") return type === "JSXOpeningElement" || type === "JSXClosingElement" || type === "JSXMemberExpression" && parent.object === node ? "reference" : "none";
+	if (type === "Property") {
+		if (ancestors.at(-2)?.type === "ObjectPattern") return "none";
+		if (parent.shorthand === true) return parent.value === node ? "shorthand" : "none";
+		return parent.key === node && parent.computed !== true ? "none" : "reference";
+	}
+	if (type === "MemberExpression" || KEYED_MEMBERS.has(type)) return (type === "MemberExpression" ? parent.property : parent.key) === node && parent.computed !== true ? "none" : "reference";
+	if (type === "ExportSpecifier") {
+		const reexport = ancestors.at(-2)?.source !== null;
+		return parent.local === node && !reexport ? "export" : "none";
+	}
+	if (type === "TSQualifiedName") return parent.right === node ? "none" : "reference";
+	return NOT_REFERENCES.has(type) ? "none" : "reference";
+}
+function nodes(value) {
+	return Array.isArray(value) ? value.filter(isNode) : [];
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A child node under a field `Estree` types as something else (`value`, a type parameter's `name`). */
+function child(node, field) {
+	const value = Reflect.get(node, field);
+	return isNode(value) ? value : void 0;
+}
+function patternNames(pattern, into) {
+	if (pattern === null || pattern === void 0) return;
+	switch (pattern.type) {
+		case "Identifier":
+			into.add(pattern.name ?? "");
+			return;
+		case "ObjectPattern":
+			for (const property of nodes(pattern.properties)) patternNames(property.type === "RestElement" ? property.argument : child(property, "value"), into);
+			return;
+		case "ArrayPattern":
+			for (const element of nodes(pattern.elements)) patternNames(element, into);
+			return;
+		default: patternNames(pattern.left ?? pattern.argument ?? pattern.parameter, into);
+	}
+}
+const DECLARATIONS_WITH_ID = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"ClassDeclaration",
+	"TSEnumDeclaration",
+	"TSTypeAliasDeclaration",
+	"TSInterfaceDeclaration",
+	"TSModuleDeclaration",
+	"TSImportEqualsDeclaration",
+	"TSDeclareFunction"
+]);
+function declareStatement(statement, into) {
+	const type = statement.type;
+	if (type === "VariableDeclaration") for (const declarator of nodes(statement.declarations)) patternNames(declarator.id, into);
+	else if (DECLARATIONS_WITH_ID.has(type)) patternNames(statement.id, into);
+	else if (statement.declaration !== null && statement.declaration !== void 0) declareStatement(statement.declaration, into);
+	else if (type === "ImportDeclaration") for (const spec of nodes(statement.specifiers)) patternNames(spec.local, into);
+}
+const BLOCK_SCOPES = /* @__PURE__ */ new Set([
+	"Program",
+	"BlockStatement",
+	"StaticBlock",
+	"TSModuleBlock"
+]);
+const FUNCTION_SCOPES = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression",
+	"TSDeclareFunction"
+]);
+/** The names a node declares for the code inside it; `undefined` for a node that opens no scope. */
+function scopeBindings(node) {
+	const names = /* @__PURE__ */ new Set();
+	const declare = (statements) => {
+		for (const statement of statements) if (statement !== null && statement !== void 0) declareStatement(statement, names);
+	};
+	const type = node.type;
+	let opens = true;
+	if (BLOCK_SCOPES.has(type)) declare(nodes(node.body));
+	else if (FUNCTION_SCOPES.has(type)) {
+		for (const param of nodes(node.params)) patternNames(param, names);
+		patternNames(type === "FunctionExpression" ? node.id : void 0, names);
+	} else if (type === "ClassExpression") patternNames(node.id, names);
+	else if (type === "ForStatement") declare([node.init]);
+	else if (type === "ForInStatement" || type === "ForOfStatement") declare([node.left]);
+	else if (type === "CatchClause") patternNames(node.param, names);
+	else if (type === "SwitchStatement") declare(nodes(node.cases).flatMap((branch) => nodes(branch.consequent)));
+	else if (type === "TSMappedType") patternNames(node.key, names);
+	else opens = false;
+	for (const param of nodes(node.typeParameters?.params)) {
+		opens = true;
+		patternNames(child(param, "name"), names);
+	}
+	return opens ? names : void 0;
+}
+function bindingsCached(node, cache) {
+	let found = cache.get(node);
+	if (found === void 0) {
+		found = scopeBindings(node) ?? null;
+		cache.set(node, found);
+	}
+	return found;
+}
+function applyEdits(source, edits) {
+	let out = source;
+	for (const item of edits.toSorted((a, b) => b.start - a.start || b.end - a.end)) out = out.slice(0, item.start) + item.text + out.slice(item.end);
+	return out;
+}
+function position(lineAt, index) {
+	const { line, lineStart } = lineAt(index);
+	return {
+		line,
+		column: index - lineStart + 1
+	};
+}
+function lineIndex(source) {
+	const starts = [0];
+	for (let i = 0; i < source.length; i += 1) if (source.charCodeAt(i) === 10) starts.push(i + 1);
+	return (index) => {
+		let low = 0;
+		let high = starts.length - 1;
+		while (low < high) {
+			const mid = low + high + 1 >> 1;
+			if ((starts[mid] ?? 0) <= index) low = mid;
+			else high = mid - 1;
+		}
+		return {
+			line: low + 1,
+			lineStart: starts[low] ?? 0
+		};
+	};
+}
+/** Every node in source order with its parent and ancestors: Oxc nodes carry no parent, so enter and exit keep a stack. */
+function walk(program, visit) {
+	const stack = [];
+	const handlers = {};
+	for (const type of Object.keys(visitorKeys)) {
+		handlers[type] = (node) => {
+			visit(node, stack.at(-1), stack);
+			stack.push(node);
+		};
+		handlers[`${type}:exit`] = () => {
+			stack.pop();
+		};
+	}
+	new Visitor(handlers).visit(program);
+}
+//#endregion
+//#region src/cli/codemod/context.ts
+/** One version's rename map: what the codemod rewrites and what it only reports. */
+const SCRIPT_BLOCK = /<script\b([^>]*)>([\s\S]*?)<\/script>/gu;
+function isPermDockSpecifier(value) {
+	return typeof value === "string" && (value === "permdock" || value.startsWith("permdock/"));
+}
+function declaredBetween(ctx, name, ancestors) {
+	return ancestors.some((scope) => scope !== ctx.program && bindingsCached(scope, ctx.scopes)?.has(name) === true);
+}
+function isModuleBinding(ctx, name, ancestors) {
+	return ctx.moduleNames.has(name) && !declaredBetween(ctx, name, ancestors);
+}
+function edit(ctx, node, text, from, to) {
+	if (ctx.edits.some((item) => item.start === node.start && item.end === node.end)) return;
+	ctx.edits.push({
+		start: node.start,
+		end: node.end,
+		text
+	});
+	ctx.changes.push({
+		at: node.start,
+		from,
+		to
+	});
+}
+function replace(ctx, node, text, from) {
+	edit(ctx, node, text, from, beforeFirst(text, " as "));
+}
+function renameOf(set, name, entry) {
+	return set.renames.find((row) => row.from === name && row.kind !== "option" && row.kind !== "method" && row.entries.includes(entry));
+}
+function listOf(items) {
+	return new Intl.ListFormat("en-GB", { type: "disjunction" }).format(items);
+}
+/** The import a call's callee is bound to: a named import, or a member of a namespace import. */
+function importedCallee(ctx, callee, ancestors) {
+	if (callee?.type === "Identifier") {
+		const name = callee.name ?? "";
+		return isModuleBinding(ctx, name, ancestors) ? ctx.bindings.get(name) : void 0;
+	}
+	const object = callee?.type === "MemberExpression" && callee.computed !== true ? callee.object : void 0;
+	const namespace = object?.type === "Identifier" && isModuleBinding(ctx, object.name ?? "", ancestors) ? ctx.namespaces.get(object.name ?? "") : void 0;
+	const imported = callee?.property?.name;
+	return namespace === void 0 || imported === void 0 ? void 0 : {
+		entry: namespace,
+		imported
+	};
+}
+function renameKey(ctx, property, from, to) {
+	const key = property.key;
+	if (property.type !== "Property" || key === void 0 || property.computed === true) return;
+	ctx.handledKeys.add(key);
+	if (property.shorthand === true) edit(ctx, {
+		...property,
+		end: property.start
+	}, `${to}: `, from, to);
+	else replace(ctx, key, key.type === "Literal" ? JSON.stringify(to) : to, from);
+}
+function renameKeys(ctx, object, from, to) {
+	for (const property of nodes(object.properties)) if (nameOf(property.key) === from) renameKey(ctx, property, from, to);
+}
+function boundImport(ctx, node, ancestors) {
+	const name = node?.name;
+	return (node?.type === "Identifier" || node?.type === "JSXIdentifier") && name !== void 0 && isModuleBinding(ctx, name, ancestors) ? ctx.bindings.get(name) : void 0;
+}
+//#endregion
+//#region src/cli/codemod/imports.ts
+function removableBindings(ctx) {
+	const out = /* @__PURE__ */ new Set();
+	if (ctx.keepLocals) return out;
+	for (const local of ctx.bindings.keys()) {
+		const references = ctx.references.filter((item) => item.node.name === local);
+		if (references.length > 0 && references.every((item) => ctx.consumed.has(item.node.start))) out.add(local);
+	}
+	return out;
+}
+function importedLocal(ctx, name, entry, ancestors) {
+	for (const [local, binding] of ctx.bindings) if (binding.entry === entry && binding.imported === name && !typeOnly(binding) && !declaredBetween(ctx, local, ancestors)) return local;
+	if (ctx.moduleNames.has(name) || declaredBetween(ctx, name, ancestors)) return;
+	const names = ctx.additions.get(entry) ?? /* @__PURE__ */ new Set();
+	names.add(name);
+	ctx.additions.set(entry, names);
+	return name;
+}
+function typeOnly(binding) {
+	return Reflect.get(binding.declaration, "importKind") === "type" || Reflect.get(binding.spec, "importKind") === "type";
+}
+function finishImports(ctx, removed) {
+	const gone = /* @__PURE__ */ new Set();
+	for (const local of removed) {
+		const spec = ctx.bindings.get(local)?.spec;
+		if (spec !== void 0) gone.add(spec);
+	}
+	const pending = new Map(ctx.additions);
+	for (const declaration of nodes(ctx.program.body)) {
+		const all = nodes(declaration.specifiers);
+		if (declaration.type !== "ImportDeclaration" || !all.some((spec) => gone.has(spec))) continue;
+		if (all.some((spec) => spec.type !== "ImportSpecifier")) {
+			for (const spec of all) gone.delete(spec);
+			continue;
+		}
+		if (all.some((spec) => !gone.has(spec))) {
+			removeSpecifiers(ctx, all, gone);
+			continue;
+		}
+		const entry = String(declaration.source?.value);
+		const names = Reflect.get(declaration, "importKind") === "type" ? void 0 : pending.get(entry);
+		if (names === void 0) ctx.edits.push({
+			start: declaration.start,
+			end: lineEnd(ctx.code, declaration.end),
+			text: ""
+		});
+		else {
+			pending.delete(entry);
+			ctx.edits.push({
+				start: declaration.start,
+				end: declaration.end,
+				text: importText(ctx, entry, names)
+			});
+		}
+	}
+	for (const [entry, names] of pending) addImport(ctx, entry, names, gone);
+}
+function lineEnd(code, end) {
+	return code[end] === "\n" ? end + 1 : end;
+}
+function importText(ctx, entry, names) {
+	const source = nodes(ctx.program.body).map((statement) => statement.source).find((node) => isPermDockSpecifier(node?.value));
+	const mark = ctx.code[source?.start ?? -1] ?? "\"";
+	return `import { ${[...names].join(", ")} } from ${mark}${entry}${mark};`;
+}
+function removeSpecifiers(ctx, all, gone) {
+	const last = all.findLastIndex((spec) => !gone.has(spec));
+	for (const [index, spec] of all.entries()) {
+		const next = all[index + 1];
+		if (gone.has(spec) && index < last && next !== void 0) ctx.edits.push({
+			start: spec.start,
+			end: next.start,
+			text: ""
+		});
+	}
+	const survivor = all[last];
+	const tail = all.at(-1);
+	if (survivor !== void 0 && tail !== void 0 && tail !== survivor) ctx.edits.push({
+		start: survivor.end,
+		end: tail.end,
+		text: ""
+	});
+}
+function addImport(ctx, entry, names, gone) {
+	const statements = nodes(ctx.program.body);
+	const anchor = statements.filter((statement) => statement.type === "ImportDeclaration" && statement.source?.value === entry && Reflect.get(statement, "importKind") !== "type").flatMap((statement) => nodes(statement.specifiers)).findLast((spec) => spec.type === "ImportSpecifier" && !gone.has(spec));
+	if (anchor !== void 0) {
+		ctx.edits.push({
+			start: anchor.end,
+			end: anchor.end,
+			text: `, ${[...names].join(", ")}`
+		});
+		return;
+	}
+	const lastImport = statements.findLast((statement) => statement.type === "ImportDeclaration");
+	const at = lastImport?.end ?? 0;
+	const text = importText(ctx, entry, names);
+	ctx.edits.push({
+		start: at,
+		end: at,
+		text: lastImport === void 0 ? `${text}\n` : `\n${text}`
+	});
+}
+//#endregion
+//#region src/cli/codemod/shapes.ts
+function templateHints(file, source, set, components, lineAt) {
+	const hints = (set.templates ?? []).filter((hint) => hint.entries.some((entry) => components.has(`${entry} ${hint.component}`)));
+	if (hints.length === 0 || !/\.(?:vue|svelte)$/iu.test(file)) return [];
+	const markup = source.replaceAll(SCRIPT_BLOCK, (block) => " ".repeat(block.length));
+	return hints.flatMap((hint) => [...markup.matchAll(hint.pattern)].map((match) => {
+		const { line, column } = position(lineAt, match.index);
+		return {
+			line,
+			column,
+			name: hint.name,
+			message: hint.message
+		};
+	}));
+}
+function awaitRow(ctx, callee) {
+	return (ctx.set.awaits ?? []).find((row) => callee !== void 0 && row.name === callee.imported && row.entries.includes(callee.entry));
+}
+function visitAwait(ctx, node, ancestors) {
+	const call = node.argument;
+	if (call?.type !== "CallExpression" || call.callee === void 0) return;
+	const callee = importedCallee(ctx, call.callee, ancestors);
+	const row = awaitRow(ctx, callee);
+	if (row === void 0 || callee === void 0) return;
+	swapCallee(ctx, call.callee, row.name, row.to, callee.entry, ancestors);
+}
+function swapCallee(ctx, callee, from, to, entry, ancestors) {
+	if (callee.type === "MemberExpression" && callee.property !== void 0) {
+		replace(ctx, callee.property, to, from);
+		return true;
+	}
+	const local = importedLocal(ctx, to, entry, ancestors);
+	if (local === void 0) {
+		ctx.followUps.push({
+			at: callee.start,
+			name: from,
+			message: `\`${from}\` is \`${to}\` from \`${entry}\` here; \`${to}\` is already bound in this scope`
+		});
+		return false;
+	}
+	ctx.consumed.add(callee.start);
+	edit(ctx, callee, local, from, to);
+	return true;
+}
+function reportUnawaited(ctx, node, ancestors, row) {
+	const parent = ancestors.at(-1);
+	if (parent?.type === "ReturnStatement" || parent?.type === "ArrowFunctionExpression" && parent.body === node || parent?.type === "MemberExpression" && parent.object === node && parent.property?.name === "then") ctx.followUps.push({
+		at: node.start,
+		name: row.name,
+		message: `\`${row.name}\` without \`await\` is \`${row.sync}\`, which returns the instance, never a Promise; call \`${row.to}\` when a source answers asynchronously`
+	});
+}
+function propRows(ctx, binding) {
+	return binding === void 0 ? [] : (ctx.set.props ?? []).filter((row) => row.component === binding.imported && row.entries.includes(binding.entry));
+}
+function visitElement(ctx, node, ancestors) {
+	const tag = child(node, "name");
+	const binding = boundImport(ctx, tag, ancestors);
+	const rows = propRows(ctx, binding);
+	const named = tag?.type === "JSXMemberExpression" ? child(tag, "property") : tag;
+	const unbound = (ctx.set.props ?? []).filter((row) => binding === void 0 && row.within !== void 0 && named?.type === "JSXIdentifier" && named.name === row.component);
+	for (const attribute of nodes(Reflect.get(node, "attributes"))) {
+		const name = child(attribute, "name");
+		if (attribute.type !== "JSXAttribute" || name?.type !== "JSXIdentifier") continue;
+		for (const row of rows) if (row.within === void 0 && name.name === row.from) replace(ctx, name, row.to, row.from);
+		else if (row.within !== void 0 && name.name === row.within) renameWithin(ctx, attribute, row);
+		for (const row of unbound) if (name.name === row.within && holdsKey(attribute, row.from)) ctx.followUps.push({
+			at: attribute.start,
+			name: row.from,
+			message: `\`${row.within}.${row.from}\` of \`<${row.component}>\` is \`${row.within}.${row.to}\``
+		});
+	}
+}
+function attributeObject(attribute) {
+	const value = child(attribute, "value");
+	const expression = value?.type === "JSXExpressionContainer" ? child(value, "expression") : void 0;
+	return expression?.type === "ObjectExpression" ? expression : void 0;
+}
+function holdsKey(attribute, key) {
+	const object = attributeObject(attribute);
+	return object === void 0 || nodes(object.properties).some((property) => nameOf(property.key) === key);
+}
+function renameWithin(ctx, attribute, row) {
+	const object = attributeObject(attribute);
+	if (object === void 0) {
+		ctx.followUps.push({
+			at: attribute.start,
+			name: row.from,
+			message: `\`${row.within}.${row.from}\` of \`<${row.component}>\` is \`${row.within}.${row.to}\``
+		});
+		return;
+	}
+	renameKeys(ctx, object, row.from, row.to);
+}
+function visitComponentArguments(ctx, node, ancestors) {
+	const args = nodes(node.arguments);
+	for (const [index, argument] of args.entries()) {
+		const rows = propRows(ctx, boundImport(ctx, argument, ancestors)).filter((row) => row.within === void 0);
+		for (const row of rows) for (const later of args.slice(index + 1)) if (later.type === "ObjectExpression") renameKeys(ctx, later, row.from, row.to);
+	}
+}
+function methodRow(ctx, node, ancestors) {
+	const callee = node.callee;
+	const receiver = callee?.object;
+	const method = callee?.property?.name;
+	const first = nodes(node.arguments)[0];
+	return (ctx.set.methodFunctions ?? []).find((row) => callee?.type === "MemberExpression" && callee.computed !== true && row.method === method && (row.argument === void 0 || first?.type === "ObjectExpression" && nodes(first.properties).some((property) => nameOf(property.key) === row.argument)) && (row.anyReceiver || holdsInstance(ctx, receiver, ancestors)));
+}
+function holdsInstance(ctx, receiver, ancestors) {
+	const name = receiver?.type === "Identifier" ? receiver.name : void 0;
+	if (name === void 0) return false;
+	return /permdock/iu.test(name) || isModuleBinding(ctx, name, ancestors) && ctx.factories.has(name);
+}
+function visitMethodCall(ctx, node, ancestors) {
+	const row = node.type === "CallExpression" ? methodRow(ctx, node, ancestors) : void 0;
+	const receiver = node.callee?.object;
+	if (row === void 0 || receiver === void 0) return;
+	const name = receiver.type === "Identifier" ? receiver.name : void 0;
+	if (name !== void 0 && ctx.namespaces.has(name)) return;
+	const open = ctx.code.indexOf("(", receiver.end);
+	const between = ctx.code.slice(receiver.end, open);
+	if (Reflect.get(node, "optional") === true || Reflect.get(node.callee ?? node, "optional") === true || receiver.type === "SequenceExpression" || !/^\s*\.\s*\w+\s*$/u.test(between)) {
+		ctx.followUps.push({
+			at: node.start,
+			name: row.method,
+			message: `\`permdock.${row.method}(…)\` is \`${row.to}(permdock, …)\` from \`${row.entry}\``
+		});
+		return;
+	}
+	const local = importedLocal(ctx, row.to, row.entry, ancestors);
+	if (local === void 0) {
+		ctx.followUps.push({
+			at: node.start,
+			name: row.method,
+			message: `\`permdock.${row.method}(…)\` is \`${row.to}(permdock, …)\` from \`${row.entry}\`; \`${row.to}\` is already bound in this scope`
+		});
+		return;
+	}
+	const separator = nodes(node.arguments).length === 0 ? "" : ",";
+	const space = /\s/u.test(ctx.code[open + 1] ?? "") ? "" : " ";
+	ctx.edits.push({
+		start: receiver.start,
+		end: receiver.start,
+		text: `${local}(`
+	}, {
+		start: receiver.end,
+		end: open + 1,
+		text: separator === "" ? "" : `${separator}${space}`
+	});
+	ctx.changes.push({
+		at: node.start,
+		from: row.method,
+		to: row.to
+	});
+}
+const PLAIN_RECEIVERS = /* @__PURE__ */ new Set([
+	"Identifier",
+	"MemberExpression",
+	"CallExpression",
+	"ThisExpression"
+]);
+function visitFunctionCall(ctx, node, callee) {
+	const row = (ctx.set.functionMethods ?? []).find((item) => item.name === callee.imported && item.entry === callee.entry);
+	const [receiver, next] = nodes(node.arguments);
+	if (row === void 0 || node.type !== "CallExpression" || node.callee === void 0 || receiver === void 0 || receiver.type === "SpreadElement" || Reflect.get(node, "optional") === true) return false;
+	const plain = PLAIN_RECEIVERS.has(receiver.type);
+	ctx.edits.push({
+		start: node.callee.start,
+		end: receiver.start,
+		text: plain ? "" : "("
+	}, {
+		start: receiver.end,
+		end: next?.start ?? node.end - 1,
+		text: `${plain ? "" : ")"}.${row.method}(`
+	});
+	if (node.callee.type === "Identifier") ctx.consumed.add(node.callee.start);
+	ctx.changes.push({
+		at: node.start,
+		from: row.name,
+		to: row.method
+	});
+	return true;
+}
+function isWrapped(ctx, row, value, ancestors) {
+	const callee = value?.type === "CallExpression" ? importedCallee(ctx, value.callee, ancestors) : void 0;
+	return callee !== void 0 && callee.entry === row.entry && row.already.includes(callee.imported);
+}
+function visitWraps(ctx, node, callee, ancestors) {
+	const rows = (ctx.set.wraps ?? []).filter((row) => row.entries.includes(callee.entry) && row.calls.includes(callee.imported));
+	for (const argument of nodes(node.arguments)) for (const property of argument.type === "ObjectExpression" ? nodes(argument.properties) : []) {
+		const row = rows.find((item) => item.key === nameOf(property.key));
+		if (row !== void 0 && property.computed !== true) wrapOption(ctx, row, property, ancestors);
+	}
+}
+function wrapOption(ctx, row, property, ancestors) {
+	const value = child(property, "value");
+	if (property.key !== void 0) ctx.handledKeys.add(property.key);
+	if (value === void 0 || isWrapped(ctx, row, value, ancestors)) return;
+	const local = importedLocal(ctx, row.wrapper, row.entry, ancestors);
+	if (local === void 0 || property.type !== "Property") {
+		ctx.followUps.push({
+			at: property.start,
+			name: row.key,
+			message: `option \`${row.key}\` takes \`${row.wrapper}(source)\` from \`${row.entry}\`; \`${row.wrapper}\` is already bound in this scope`
+		});
+		return;
+	}
+	ctx.edits.push(property.shorthand === true ? {
+		start: property.start,
+		end: property.start,
+		text: `${row.key}: ${local}(`
+	} : {
+		start: value.start,
+		end: value.start,
+		text: `${local}(`
+	}, {
+		start: value.end,
+		end: value.end,
+		text: ")"
+	});
+	ctx.changes.push({
+		at: value.start,
+		from: row.key,
+		to: row.wrapper
+	});
+}
+function reportWraps(ctx, node, ancestors) {
+	for (const property of nodes(node.properties)) {
+		const row = (ctx.set.wraps ?? []).find((item) => item.reportElsewhere && item.key === nameOf(property.key));
+		if (row !== void 0 && property.key !== void 0 && property.computed !== true && !ctx.handledKeys.has(property.key) && !isWrapped(ctx, row, child(property, "value"), ancestors)) ctx.followUps.push({
+			at: property.start,
+			name: row.key,
+			message: `option \`${row.key}\` takes \`${row.wrapper}(source)\` from \`${row.entry}\` when this object reaches \`getPermDock\` or \`getPermDockSync\``
+		});
+	}
+}
+const UNIT_SECONDS = Object.freeze({
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800
+});
+function seconds(value) {
+	if (value?.type !== "Literal" || typeof value.value !== "string") return;
+	const match = /^\s*(\d+)([smhdw])\s*$/u.exec(value.value);
+	const amount = Number(match?.[1]);
+	const unit = UNIT_SECONDS[match?.[2] ?? ""];
+	return unit === void 0 || !(amount > 0) ? void 0 : amount * unit;
+}
+function insidePermDockCall(ctx, object, ancestors) {
+	const chain = [...ancestors, object];
+	return ancestors.some((node, index) => (node.type === "CallExpression" || node.type === "NewExpression") && nodes(node.arguments).includes(chain[index + 1] ?? node) && importedCallee(ctx, node.callee, ancestors.slice(0, index)) !== void 0);
+}
+function visitDurations(ctx, node, ancestors) {
+	const keys = ctx.set.durations;
+	if (keys === void 0) return;
+	const rewrite = insidePermDockCall(ctx, node, ancestors);
+	const parent = ancestors.at(-1);
+	if (!rewrite && nodes(parent?.arguments).includes(node)) return;
+	for (const property of nodes(node.properties)) {
+		const key = nameOf(property.key);
+		const value = child(property, "value");
+		const literals = key !== void 0 && keys.keys.includes(key) ? [value] : key !== void 0 && keys.lists.includes(key) && value?.type === "ArrayExpression" ? nodes(value.elements) : [];
+		for (const literal of literals) {
+			const total = seconds(literal);
+			if (literal === void 0 || total === void 0) continue;
+			const text = String(literal.value);
+			if (rewrite) {
+				ctx.edits.push({
+					start: literal.start,
+					end: literal.end,
+					text: String(total)
+				});
+				ctx.changes.push({
+					at: literal.start,
+					from: text,
+					to: String(total)
+				});
+			} else ctx.followUps.push({
+				at: literal.start,
+				name: key ?? text,
+				message: `duration \`"${text}"\` is \`${total}\` (seconds) when this object reaches PermDock`
+			});
+		}
+	}
+}
+//#endregion
+//#region src/cli/codemod/transform.ts
+/** Applies `set` to one file's source; `file` picks the parser by extension. */
+function transformSource(file, source, set) {
+	const lineAt = lineIndex(source);
+	const edits = [];
+	const changes = [];
+	const followUps = [];
+	const components = /* @__PURE__ */ new Set();
+	for (const segment of segmentsOf(file, source)) {
+		const result = parseSync(`segment.${segment.lang}`, segment.code, {
+			lang: segment.lang,
+			sourceType: "module"
+		});
+		const error = result.errors.find((item) => {
+			return item.severity === "Error";
+		});
+		if (error !== void 0) return {
+			source,
+			changes: [],
+			followUps: [],
+			error: error.message
+		};
+		const ctx = contextFor(result.program, set, segment);
+		if (ctx === void 0) continue;
+		transformProgram(ctx, segment);
+		for (const binding of ctx.bindings.values()) components.add(`${binding.entry} ${binding.imported}`);
+		const at = (index) => position(lineAt, index + segment.offset);
+		for (const item of ctx.edits) edits.push({
+			start: item.start + segment.offset,
+			end: item.end + segment.offset,
+			text: item.text
+		});
+		for (const change of ctx.changes) changes.push({
+			...at(change.at),
+			from: change.from,
+			to: change.to
+		});
+		for (const note of ctx.followUps) followUps.push({
+			...at(note.at),
+			name: note.name,
+			message: note.message
+		});
+	}
+	followUps.push(...templateHints(file, source, set, components, lineAt));
+	return {
+		source: applyEdits(source, edits),
+		changes: changes.toSorted(byPosition),
+		followUps: followUps.toSorted(byPosition)
+	};
+}
+function byPosition(a, b) {
+	return a.line - b.line || a.column - b.column;
+}
+function segmentsOf(file, source) {
+	const extension = file.slice(file.lastIndexOf(".") + 1).toLowerCase();
+	if (extension === "vue" || extension === "svelte") return [...source.matchAll(SCRIPT_BLOCK)].map((match) => {
+		const [whole, attributes = "", code = ""] = match;
+		const typed = /\blang=["']?(?:ts|typescript)\b/u.test(attributes);
+		return {
+			code,
+			offset: match.index + whole.indexOf(">") + 1,
+			lang: typed ? "ts" : "jsx",
+			keepLocals: true
+		};
+	});
+	return [{
+		code: source,
+		offset: 0,
+		lang: extension === "tsx" ? "tsx" : [
+			"ts",
+			"mts",
+			"cts"
+		].includes(extension) ? "ts" : "jsx",
+		keepLocals: false
+	}];
+}
+/** The module's `permdock` imports, or `undefined` when it has none. */
+function contextFor(program, set, segment) {
+	const bindings = /* @__PURE__ */ new Map();
+	const namespaces = /* @__PURE__ */ new Map();
+	const entries = /* @__PURE__ */ new Set();
+	for (const statement of nodes(program.body)) {
+		const entry = statement.source?.value;
+		if (!isPermDockSpecifier(entry)) continue;
+		entries.add(entry);
+		if (statement.type !== "ImportDeclaration") continue;
+		for (const spec of nodes(statement.specifiers)) {
+			const local = spec.local?.name ?? "";
+			if (spec.type === "ImportNamespaceSpecifier") namespaces.set(local, entry);
+			const imported = nameOf(spec.imported);
+			if (spec.type === "ImportSpecifier" && imported !== void 0) {
+				const rename = renameOf(set, imported, entry);
+				bindings.set(local, {
+					entry,
+					imported,
+					spec,
+					declaration: statement,
+					rename
+				});
+			}
+		}
+	}
+	if (entries.size === 0) return;
+	const renamedLocals = /* @__PURE__ */ new Map();
+	for (const [local, binding] of bindings) if (binding.rename !== void 0 && local === binding.imported) renamedLocals.set(local, binding.rename);
+	const touches = (row) => row.entries.some((entry) => entries.has(entry));
+	return {
+		program,
+		code: segment.code,
+		keepLocals: segment.keepLocals,
+		consumed: /* @__PURE__ */ new Set(),
+		additions: /* @__PURE__ */ new Map(),
+		set,
+		edits: [],
+		changes: [],
+		followUps: [],
+		bindings,
+		namespaces,
+		moduleNames: scopeBindings(program) ?? /* @__PURE__ */ new Set(),
+		renamedLocals,
+		kept: /* @__PURE__ */ new Set(),
+		references: [],
+		optionRows: set.renames.filter((row) => row.kind === "option" && touches(row)),
+		methodRows: set.renames.filter((row) => row.kind === "method" && touches(row)),
+		factories: factoryValues(program, bindings),
+		handledKeys: /* @__PURE__ */ new Set(),
+		newShapes: /* @__PURE__ */ new Set(),
+		scopes: /* @__PURE__ */ new WeakMap()
+	};
+}
+function transformProgram(ctx, segment) {
+	for (const [local, rename] of ctx.renamedLocals) if (segment.keepLocals || ctx.moduleNames.has(rename.to)) ctx.kept.add(local);
+	walk(ctx.program, (node, parent, ancestors) => {
+		switch (node.type) {
+			case "Identifier":
+			case "JSXIdentifier":
+				visitIdentifier(ctx, node, parent, ancestors);
+				break;
+			case "MemberExpression":
+			case "TSQualifiedName":
+				visitMember(ctx, node, ancestors);
+				break;
+			case "ObjectPattern":
+				reportMethods(ctx, propertyKeys(node), "destructured", "comes from");
+				break;
+			case "CallExpression":
+			case "NewExpression":
+				visitCall(ctx, node, ancestors);
+				visitComponentArguments(ctx, node, ancestors);
+				visitMethodCall(ctx, node, ancestors);
+				break;
+			case "JSXOpeningElement":
+				visitElement(ctx, node, ancestors);
+				break;
+			case "AwaitExpression":
+				visitAwait(ctx, node, ancestors);
+				break;
+			case "ObjectExpression":
+				reportOptions(ctx, node, ancestors);
+				reportWraps(ctx, node, ancestors);
+				visitDurations(ctx, node, ancestors);
+		}
+	});
+	const removed = removableBindings(ctx);
+	rewriteImports(ctx, removed);
+	rewriteReferences(ctx);
+	rewriteReexports(ctx);
+	reportUncalledSignatures(ctx, removed);
+	finishImports(ctx, removed);
+}
+function visitIdentifier(ctx, node, parent, ancestors) {
+	const name = node.name ?? "";
+	if (parent === void 0 || !(ctx.bindings.has(name) || ctx.namespaces.has(name))) return;
+	const place = referencePlace(node, parent, ancestors);
+	if (place === "none" || !isModuleBinding(ctx, name, ancestors)) return;
+	const rename = ctx.renamedLocals.get(name);
+	if (rename !== void 0 && declaredBetween(ctx, rename.to, ancestors)) ctx.kept.add(name);
+	ctx.references.push({
+		node,
+		place,
+		parent
+	});
+}
+function visitMember(ctx, node, ancestors) {
+	const member = node.type === "MemberExpression";
+	const object = member ? node.object : node.left;
+	const property = member ? node.property : node.right;
+	if (node.computed === true || property?.name === void 0) return;
+	const namespace = object?.type === "Identifier" && isModuleBinding(ctx, object.name ?? "", ancestors) ? ctx.namespaces.get(object.name ?? "") : void 0;
+	const rename = namespace === void 0 ? void 0 : renameOf(ctx.set, property.name, namespace);
+	if (rename !== void 0) replace(ctx, property, rename.to, rename.from);
+	else if (member) {
+		const receiver = object?.type === "Identifier" ? object.name : void 0;
+		const origin = receiver !== void 0 && isModuleBinding(ctx, receiver, ancestors) ? ctx.factories.get(receiver) : void 0;
+		const method = origin === void 0 ? void 0 : ctx.methodRows.find((row) => row.from === property.name && row.entries.includes(origin));
+		if (method !== void 0) replace(ctx, property, method.to, method.from);
+		else if (origin === void 0) reportMethods(ctx, [property], "member", "is on a value from");
+	}
+}
+/** `const x = f(…)` or `const x = await f(…)` at module level, where `f` is imported from a permdock entry. */
+function factoryValues(program, bindings) {
+	const out = /* @__PURE__ */ new Map();
+	for (const statement of nodes(program.body)) {
+		const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+		if (declaration?.type !== "VariableDeclaration" || Reflect.get(declaration, "kind") !== "const") continue;
+		for (const declarator of nodes(declaration.declarations)) {
+			const init = declarator.init?.type === "AwaitExpression" ? declarator.init.argument : declarator.init;
+			const callee = init?.type === "CallExpression" ? init.callee : void 0;
+			const factory = callee?.type === "Identifier" ? callee.name : void 0;
+			const entry = factory === void 0 ? void 0 : bindings.get(factory)?.entry;
+			const name = declarator.id?.type === "Identifier" ? declarator.id.name : void 0;
+			if (entry !== void 0 && name !== void 0) out.set(name, entry);
+		}
+	}
+	return out;
+}
+function reportMethods(ctx, keys, what, where) {
+	for (const key of keys) for (const row of ctx.methodRows) if (nameOf(key) === row.from) ctx.followUps.push({
+		at: key.start,
+		name: row.from,
+		message: `${what} \`${row.from}\` is \`${row.to}\` when it ${where} ${listOf(row.entries)}`
+	});
+}
+/** The non-computed keys of an object literal or pattern. */
+function propertyKeys(node) {
+	return nodes(node.properties).flatMap((property) => property.type === "Property" && property.computed !== true && property.key !== void 0 ? [property.key] : []);
+}
+function visitCall(ctx, node, ancestors) {
+	const callee = importedCallee(ctx, node.callee, ancestors);
+	if (callee === void 0) return;
+	const pending = awaitRow(ctx, callee);
+	if (pending !== void 0 && ancestors.at(-1)?.type !== "AwaitExpression") reportUnawaited(ctx, node, ancestors, pending);
+	const renamed = renameOf(ctx.set, callee.imported, callee.entry)?.to;
+	const names = /* @__PURE__ */ new Set([callee.imported, renamed]);
+	const moved = visitFunctionCall(ctx, node, callee);
+	visitWraps(ctx, node, callee, ancestors);
+	for (const signature of ctx.set.signatures) if (!moved && signature.entries.includes(callee.entry) && names.has(signature.name)) {
+		if (signature.shape === "curried" && !isCurried(node, ancestors)) {
+			ctx.newShapes.add(signature.name);
+			continue;
+		}
+		ctx.followUps.push({
+			at: node.start,
+			name: signature.name,
+			message: `\`${signature.before}\` is now \`${signature.after}\``
+		});
+	}
+	const rows = ctx.optionRows.filter((row) => row.entries.includes(callee.entry) && (row.calls ?? []).some((call) => names.has(call)));
+	for (const argument of nodes(node.arguments)) if (argument.type === "ObjectExpression") renameOptions(ctx, argument, rows);
+}
+/** `f(options)(key)`, or `f({ … })` whose result is kept for a later call. */
+function isCurried(node, ancestors) {
+	const args = nodes(node.arguments);
+	const parent = ancestors.at(-1);
+	return args.length === 1 && (args[0]?.type === "ObjectExpression" || parent?.type === "CallExpression" && parent.callee === node);
+}
+function renameOptions(ctx, object, rows) {
+	for (const property of nodes(object.properties)) {
+		const row = rows.find((item) => item.from === nameOf(property.key));
+		if (row !== void 0) renameKey(ctx, property, row.from, row.to);
+	}
+}
+/**
+* Rows with `calls` are renamed at those calls and nowhere else: their old
+* key (`store`) is still a valid option on every other factory. Rows without
+* `calls` are reported only on an object that reaches a permdock call.
+*/
+function reportOptions(ctx, node, ancestors) {
+	const target = optionTarget(ctx, node, ancestors);
+	if (target === void 0) return;
+	const rows = ctx.optionRows.filter((row) => row.calls === void 0 && (target.entry === void 0 || row.entries.includes(target.entry)));
+	for (const key of propertyKeys(node)) for (const row of rows) if (nameOf(key) === row.from && !ctx.handledKeys.has(key)) ctx.followUps.push({
+		at: key.start,
+		name: row.from,
+		message: `option \`${row.from}\` is \`${row.to}\` when this object reaches ${listOf(row.entries)}`
+	});
+}
+const PASS_THROUGH = /* @__PURE__ */ new Set([
+	"ArrayExpression",
+	"ObjectExpression",
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSSatisfiesExpression",
+	"TSNonNullExpression"
+]);
+/**
+* The permdock call an object literal is an argument of, directly or nested
+* in another argument's object, array or property value. `entry` is unset
+* for a method on a receiver named after PermDock, whose entry is unknown.
+*/
+function optionTarget(ctx, node, ancestors) {
+	let child = node;
+	for (let index = ancestors.length - 1; index >= 0; index -= 1) {
+		const parent = ancestors[index];
+		if (parent === void 0) return;
+		if (parent.type === "CallExpression" || parent.type === "NewExpression") return nodes(parent.arguments).includes(child) ? calleeTarget(ctx, parent.callee, ancestors) : void 0;
+		if (!(parent.type === "Property" && parent.value === child || PASS_THROUGH.has(parent.type))) return;
+		child = parent;
+	}
+}
+function calleeTarget(ctx, callee, ancestors) {
+	const imported = importedCallee(ctx, callee, ancestors);
+	if (imported !== void 0) return { entry: imported.entry };
+	const receiver = callee?.type === "MemberExpression" && callee.computed !== true ? callee.object : void 0;
+	if (!holdsInstance(ctx, receiver, ancestors)) return;
+	const name = receiver?.name ?? "";
+	return { entry: isModuleBinding(ctx, name, ancestors) ? ctx.factories.get(name) : void 0 };
+}
+function rewriteImports(ctx, removed) {
+	for (const [local, binding] of ctx.bindings) {
+		const { rename, spec } = binding;
+		const imported = spec.imported;
+		if (rename === void 0 || imported === void 0 || removed.has(local)) continue;
+		if (local !== binding.imported) replace(ctx, imported, imported.type === "Literal" ? JSON.stringify(rename.to) : rename.to, rename.from);
+		else replace(ctx, imported, ctx.kept.has(local) ? `${rename.to} as ${local}` : rename.to, rename.from);
+	}
+}
+function rewriteReferences(ctx) {
+	for (const { node, place, parent } of ctx.references) {
+		const name = node.name ?? "";
+		const rename = ctx.renamedLocals.get(name);
+		if (rename === void 0 || ctx.kept.has(name) || ctx.consumed.has(node.start)) continue;
+		if (place === "shorthand" && parent.key !== void 0 && ctx.handledKeys.has(parent.key)) replace(ctx, node, rename.to, name);
+		else if (place === "shorthand") edit(ctx, parent, `${name}: ${rename.to}`, name, rename.to);
+		else if (place === "export" && parent.exported?.start === node.start) replace(ctx, node, `${rename.to} as ${name}`, name);
+		else replace(ctx, node, rename.to, name);
+	}
+}
+/** `export { a } from 'permdock'` keeps exporting `a`: the module's own export name is not the codemod's to change. */
+function rewriteReexports(ctx) {
+	for (const statement of nodes(ctx.program.body)) {
+		const entry = statement.source?.value;
+		if (statement.type !== "ExportNamedDeclaration" || !isPermDockSpecifier(entry)) continue;
+		for (const spec of nodes(statement.specifiers)) {
+			const local = spec.local;
+			const rename = renameOf(ctx.set, nameOf(local) ?? "", entry);
+			if (rename !== void 0 && local !== void 0) replace(ctx, local, spec.exported?.start === local.start ? `${rename.to} as ${rename.from}` : rename.to, rename.from);
+		}
+	}
+}
+function reportUncalledSignatures(ctx, removed) {
+	for (const [local, binding] of ctx.bindings) {
+		if (removed.has(local)) continue;
+		const names = /* @__PURE__ */ new Set([binding.imported, binding.rename?.to]);
+		for (const signature of ctx.set.signatures) if (signature.entries.includes(binding.entry) && names.has(signature.name) && !ctx.newShapes.has(signature.name) && !ctx.followUps.some((note) => note.name === signature.name)) ctx.followUps.push({
+			at: binding.spec.start,
+			name: signature.name,
+			message: `\`${local}\` is imported; \`${signature.before}\` is now \`${signature.after}\``
+		});
+	}
+}
+//#endregion
+//#region src/cli/codemod/codemod.ts
+const CODEMOD_0_5 = Object.freeze({
+	renames: Object.freeze([...RENAMES_0_5, ...CALL_RENAMES_0_5]),
+	signatures: SIGNATURE_CHANGES_0_5,
+	props: PROP_RENAMES_0_5,
+	templates: TEMPLATE_HINTS_0_5,
+	awaits: AWAIT_RENAMES_0_5,
+	methodFunctions: METHOD_FUNCTIONS_0_5,
+	functionMethods: FUNCTION_METHODS_0_5,
+	wraps: OPTION_WRAPS_0_5,
+	durations: DURATION_KEYS_0_5
+});
+/** Each codemod version and the rename map it applies. */
+const CODEMODS = Object.freeze({ "0.5": CODEMOD_0_5 });
+function codemodVersions() {
+	return Object.keys(CODEMODS);
+}
+const EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs",
+	".vue",
+	".svelte"
+]);
+/** Files whose shell commands the codemod rewrites when the version renames CLI names. */
+const CLI_FILE_NAMES = /* @__PURE__ */ new Set([
+	"package.json",
+	"Makefile",
+	"justfile",
+	"Dockerfile"
+]);
+const CLI_EXTENSIONS = /* @__PURE__ */ new Set([
+	".yml",
+	".yaml",
+	".sh"
+]);
+/** Prose: the codemod lists the old calls in it and rewrites none. */
+const CLI_REVIEW_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx"]);
+/** The versions whose renames include the CLI's own commands and flags. */
+const CLI_RENAME_VERSIONS = /* @__PURE__ */ new Set(["0.5"]);
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	".git",
+	".next",
+	".turbo",
+	".svelte-kit",
+	"coverage"
+]);
+function runCodemod(options) {
+	const report = codemod(options);
+	return {
+		code: 0,
+		output: options.json ? JSON.stringify(report, null, 2) : formatReport(report)
+	};
+}
+function codemod(options) {
+	const version = normaliseVersion(options.version);
+	const set = CODEMODS[version];
+	if (set === void 0) throw new CliError("usage", `unknown codemod version '${version}'. Supported: ${Object.keys(CODEMODS).join(", ")}.`);
+	const files = sourceFiles(options.cwd, options.paths.length === 0 ? ["."] : options.paths, CLI_RENAME_VERSIONS.has(version));
+	const changed = [];
+	const followUps = [];
+	const writes = [];
+	for (const file of files) {
+		const source = readFileSync(file, "utf8");
+		if (!source.includes("permdock")) continue;
+		const name = rel(options.cwd, file);
+		const result = isCodeFile(file) ? transformSource(file, source, set) : cliResult(file, source);
+		if (result.error !== void 0) {
+			followUps.push({
+				file: name,
+				line: 1,
+				column: 1,
+				name: "parse",
+				message: `not parsed, left as it is: ${result.error}`
+			});
+			continue;
+		}
+		if (result.changes.length > 0) {
+			changed.push({
+				file: name,
+				changes: result.changes
+			});
+			if (result.source !== source) writes.push({
+				path: file,
+				text: result.source
+			});
+		}
+		for (const followUp of result.followUps) followUps.push({
+			file: name,
+			...followUp
+		});
+	}
+	if (!options.dryRun && writes.length > 0) {
+		refuseDirty({
+			command: "codemod",
+			invocation: [
+				"codemod",
+				version,
+				...options.paths
+			].join(" "),
+			cwd: options.cwd,
+			paths: writes.map((write) => write.path),
+			force: options.force === true
+		});
+		applyFiles(options.cwd, writes);
+	}
+	return {
+		version,
+		dryRun: options.dryRun,
+		scanned: files.length,
+		files: changed,
+		followUps
+	};
+}
+function normaliseVersion(version) {
+	if (version === void 0) throw new CliError("usage", `codemod needs a version: permdock codemod <version>. Supported: ${Object.keys(CODEMODS).join(", ")}.`);
+	return /^v?(\d+\.\d+)(?:\.\d+)?$/u.exec(version)?.[1] ?? version;
+}
+function isCodeFile(file) {
+	return EXTENSIONS.has(extname(file));
+}
+function isCliFile(name) {
+	return CLI_FILE_NAMES.has(name) || CLI_EXTENSIONS.has(extname(name)) || CLI_REVIEW_EXTENSIONS.has(extname(name));
+}
+function cliResult(file, source) {
+	const result = rewriteCliCalls(source, { json: extname(file) === ".json" });
+	if (!CLI_REVIEW_EXTENSIONS.has(extname(file))) return {
+		source: result.text,
+		changes: result.changes,
+		followUps: result.followUps
+	};
+	return {
+		source,
+		changes: [],
+		followUps: [...result.changes.map((change) => ({
+			line: change.line,
+			column: change.column,
+			name: "cli",
+			message: `${change.from} → ${change.to} since 0.5.0`
+		})), ...result.followUps]
+	};
+}
+function sourceFiles(cwd, paths, cli) {
+	const out = /* @__PURE__ */ new Set();
+	for (const path of paths) {
+		const root = resolve(cwd, path);
+		const stats = statSync(root, { throwIfNoEntry: false });
+		if (stats === void 0) throw new CliError("usage", `not found: ${path}`);
+		if (stats.isFile()) out.add(root);
+		else walkDir(root, out, cli);
+	}
+	return [...out].toSorted();
+}
+function walkDir(dir, out, cli) {
+	for (const name of readdirSync(dir)) {
+		if (SKIP_DIRS.has(name)) continue;
+		const full = join(dir, name);
+		if (statSync(full).isDirectory()) walkDir(full, out, cli);
+		else if (EXTENSIONS.has(extname(name)) || cli && isCliFile(name)) out.add(full);
+	}
+}
+function formatReport(report) {
+	const lines = [];
+	const changes = report.files.reduce((sum, file) => sum + file.changes.length, 0);
+	const verb = report.dryRun ? "would change" : "changed";
+	lines.push(`permdock codemod ${report.version}: ${verb} ${changes} ${changes === 1 ? "name" : "names"} in ${report.files.length} of ${report.scanned} ${report.scanned === 1 ? "file" : "files"}; ${report.followUps.length} manual ${report.followUps.length === 1 ? "follow-up" : "follow-ups"}${report.dryRun ? " (dry run, nothing written)" : ""}`);
+	for (const file of report.files) {
+		lines.push("", file.file);
+		for (const change of file.changes) lines.push(`  ${change.line}:${change.column}  ${change.from} → ${change.to}`);
+	}
+	if (report.followUps.length > 0) {
+		lines.push("", "Manual follow-ups");
+		for (const item of report.followUps) lines.push(`  ${item.file}:${item.line}:${item.column}  ${item.message}`);
+	}
+	return lines.join("\n");
+}
+//#endregion
+export { codemodVersions, runCodemod };