permdock 0.7.0 → 0.8.0

package/dist/{codemod-BP6n8N9L.js → codemod-DWSN2erG.js}

@@ -1,19 +1,22 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { a as rel } from "./files-D_JIzUrP.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-Dv6q4i5s.js";
+import { n as ROOT } from "./manifest-Cgiq5oqc.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
-import { r as refuseDirty, t as applyFiles } from "./files-acUbNwWt.js";
+import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import { extname, join, resolve } from "node:path";
+import { basename, extname, join, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
 //#region src/cli/codemod/cli-calls.ts
-/** `permdock`, `npx permdock@0.4`, `pnpm exec permdock`: the bin name followed by a space. */
+/**
+* `permdock`, `npx permdock@0.4`, `pnpm exec permdock`: the bin name followed
+* by a space.
+*/
 const INVOCATION = /(?<![\w./@-])permdock(?:@[\w.^~-]+)?(?=[ \t])/gu;
 /**
-* Where a shell command ends: an operator, a pipe, a redirect, a comment or
-* a closing backtick. A JSON string also ends at its closing quote. `<id>`
-* is a placeholder, not a redirect, so a redirect needs a space on both sides.
+* Where a shell command ends: an operator, a pipe, a redirect, a comment or a
+* closing backtick. A JSON string also ends at its closing quote. `<id>` is a
+* placeholder, not a redirect, so a redirect needs a space on both sides.
 */
 function commandEnd(text, from, json) {
 	const match = (json ? /&&|\|\||[;|`)\n"]|(?<=\s)\d?[<>]{1,2}(?:&\d|\s)|\s#/u : /&&|\|\||[;|`)\n]|(?<=\s)\d?[<>]{1,2}(?:&\d|\s)|\s#/u).exec(text.slice(from));
@@ -33,7 +36,10 @@ function lineColumn(text, offset) {
 		column: offset - before.lastIndexOf("\n")
 	};
 }
-/** The leaf path the positional tokens name, with the token after which a moved subcommand goes. */
+/**
+* The leaf path the positional tokens name, with the token after which a moved
+* subcommand goes.
+*/
 function commandOf(tokens) {
 	let node = ROOT;
 	const path = [];
@@ -116,8 +122,8 @@ function mappedValue(values, value) {
 	return Object.hasOwn(values, value) ? values[value] : void 0;
 }
 /**
-* Rewrites the 0.5.0 CLI renames in shell commands: package.json scripts,
-* CI workflows, shell scripts. A rename that needs a person, such as an
+* Rewrites the 0.5.0 CLI renames in shell commands: package.json scripts, CI
+* workflows, shell scripts. A rename that needs a person, such as an
 * environment name that must become a project id, is a follow-up instead.
 */
 function rewriteCliCalls(text, options) {
@@ -179,6 +185,380 @@ function dropWithSpace(text, edit) {
 	} : edit;
 }
 //#endregion
+//#region src/cli/codemod/ast.ts
+function nameOf(node) {
+	if (node?.type === "Literal") return typeof node.value === "string" ? node.value : void 0;
+	return node?.name;
+}
+const NOT_REFERENCES = /* @__PURE__ */ new Set([
+	"ImportSpecifier",
+	"ImportDefaultSpecifier",
+	"ImportNamespaceSpecifier",
+	"LabeledStatement",
+	"BreakStatement",
+	"ContinueStatement",
+	"TSEnumMember",
+	"TSModuleDeclaration",
+	"TSTypeParameter"
+]);
+const KEYED_MEMBERS = /* @__PURE__ */ new Set([
+	"MethodDefinition",
+	"PropertyDefinition",
+	"AccessorProperty",
+	"TSPropertySignature",
+	"TSMethodSignature",
+	"TSAbstractMethodDefinition",
+	"TSAbstractPropertyDefinition"
+]);
+/**
+* How an identifier is read: a plain reference, a shorthand property value, the
+* local of an `export { }`, or not a reference.
+*/
+function referencePlace(node, parent, ancestors) {
+	const type = parent.type;
+	if (node.type === "JSXIdentifier") return type === "JSXOpeningElement" || type === "JSXClosingElement" || type === "JSXMemberExpression" && parent.object === node ? "reference" : "none";
+	if (type === "Property") {
+		if (ancestors.at(-2)?.type === "ObjectPattern") return "none";
+		if (parent.shorthand === true) return parent.value === node ? "shorthand" : "none";
+		return parent.key === node && parent.computed !== true ? "none" : "reference";
+	}
+	if (type === "MemberExpression" || KEYED_MEMBERS.has(type)) return (type === "MemberExpression" ? parent.property : parent.key) === node && parent.computed !== true ? "none" : "reference";
+	if (type === "ExportSpecifier") {
+		const reexport = ancestors.at(-2)?.source !== null;
+		return parent.local === node && !reexport ? "export" : "none";
+	}
+	if (type === "TSQualifiedName") return parent.right === node ? "none" : "reference";
+	return NOT_REFERENCES.has(type) ? "none" : "reference";
+}
+function nodes(value) {
+	return Array.isArray(value) ? value.filter(isNode) : [];
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A child node under a field `Estree` types as something else (`value`, a type
+* parameter's `name`).
+*/
+function child(node, field) {
+	const value = Reflect.get(node, field);
+	return isNode(value) ? value : void 0;
+}
+function patternNames(pattern, into) {
+	if (pattern === null || pattern === void 0) return;
+	switch (pattern.type) {
+		case "Identifier":
+			into.add(pattern.name ?? "");
+			return;
+		case "ObjectPattern":
+			for (const property of nodes(pattern.properties)) patternNames(property.type === "RestElement" ? property.argument : child(property, "value"), into);
+			return;
+		case "ArrayPattern":
+			for (const element of nodes(pattern.elements)) patternNames(element, into);
+			return;
+		default: patternNames(pattern.left ?? pattern.argument ?? pattern.parameter, into);
+	}
+}
+const DECLARATIONS_WITH_ID = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"ClassDeclaration",
+	"TSEnumDeclaration",
+	"TSTypeAliasDeclaration",
+	"TSInterfaceDeclaration",
+	"TSModuleDeclaration",
+	"TSImportEqualsDeclaration",
+	"TSDeclareFunction"
+]);
+function declareStatement(statement, into) {
+	const type = statement.type;
+	if (type === "VariableDeclaration") for (const declarator of nodes(statement.declarations)) patternNames(declarator.id, into);
+	else if (DECLARATIONS_WITH_ID.has(type)) patternNames(statement.id, into);
+	else if (statement.declaration !== null && statement.declaration !== void 0) declareStatement(statement.declaration, into);
+	else if (type === "ImportDeclaration") for (const spec of nodes(statement.specifiers)) patternNames(spec.local, into);
+}
+const BLOCK_SCOPES = /* @__PURE__ */ new Set([
+	"Program",
+	"BlockStatement",
+	"StaticBlock",
+	"TSModuleBlock"
+]);
+const FUNCTION_SCOPES = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression",
+	"TSDeclareFunction"
+]);
+/**
+* The names a node declares for the code inside it; `undefined` for a node that
+* opens no scope.
+*/
+function scopeBindings(node) {
+	const names = /* @__PURE__ */ new Set();
+	const declare = (statements) => {
+		for (const statement of statements) if (statement !== null && statement !== void 0) declareStatement(statement, names);
+	};
+	const type = node.type;
+	let opens = true;
+	if (BLOCK_SCOPES.has(type)) declare(nodes(node.body));
+	else if (FUNCTION_SCOPES.has(type)) {
+		for (const param of nodes(node.params)) patternNames(param, names);
+		patternNames(type === "FunctionExpression" ? node.id : void 0, names);
+	} else if (type === "ClassExpression") patternNames(node.id, names);
+	else if (type === "ForStatement") declare([node.init]);
+	else if (type === "ForInStatement" || type === "ForOfStatement") declare([node.left]);
+	else if (type === "CatchClause") patternNames(node.param, names);
+	else if (type === "SwitchStatement") declare(nodes(node.cases).flatMap((branch) => nodes(branch.consequent)));
+	else if (type === "TSMappedType") patternNames(node.key, names);
+	else opens = false;
+	for (const param of nodes(node.typeParameters?.params)) {
+		opens = true;
+		patternNames(child(param, "name"), names);
+	}
+	return opens ? names : void 0;
+}
+function bindingsCached(node, cache) {
+	let found = cache.get(node);
+	if (found === void 0) {
+		found = scopeBindings(node) ?? null;
+		cache.set(node, found);
+	}
+	return found;
+}
+function applyEdits(source, edits) {
+	let out = source;
+	for (const item of edits.toSorted((a, b) => b.start - a.start || b.end - a.end)) out = out.slice(0, item.start) + item.text + out.slice(item.end);
+	return out;
+}
+function position(lineAt, index) {
+	const { line, lineStart } = lineAt(index);
+	return {
+		line,
+		column: index - lineStart + 1
+	};
+}
+function lineIndex(source) {
+	const starts = [0];
+	for (let i = 0; i < source.length; i += 1) if (source.charCodeAt(i) === 10) starts.push(i + 1);
+	return (index) => {
+		let low = 0;
+		let high = starts.length - 1;
+		while (low < high) {
+			const mid = low + high + 1 >> 1;
+			if ((starts[mid] ?? 0) <= index) low = mid;
+			else high = mid - 1;
+		}
+		return {
+			line: low + 1,
+			lineStart: starts[low] ?? 0
+		};
+	};
+}
+/**
+* Every node in source order with its parent and ancestors: Oxc nodes carry no
+* parent, so enter and exit keep a stack.
+*/
+function walk(program, visit) {
+	const stack = [];
+	const handlers = {};
+	for (const type of Object.keys(visitorKeys)) {
+		handlers[type] = (node) => {
+			visit(node, stack.at(-1), stack);
+			stack.push(node);
+		};
+		handlers[`${type}:exit`] = () => {
+			stack.pop();
+		};
+	}
+	new Visitor(handlers).visit(program);
+}
+//#endregion
+//#region src/cli/codemod/config-moves.ts
+/** Passes over one file before the codemod stops; each pass moves one key. */
+const MAX_PASSES = 500;
+function unwrap(node) {
+	if (node?.type === "TSSatisfiesExpression" || node?.type === "TSAsExpression" || node?.type === "ParenthesizedExpression") return unwrap(child(node, "expression"));
+	if (node?.type === "CallExpression" && nameOf(node.callee) === "defineConfig") return unwrap(node.arguments?.[0]);
+	return node;
+}
+function configRoots(program, file) {
+	const roots = [];
+	const isConfigFile = basename(file).startsWith("permdock.config.");
+	walk(program, (node) => {
+		const root = node.type === "CallExpression" && nameOf(node.callee) === "defineConfig" ? unwrap(node) : node.type === "ExportDefaultDeclaration" && isConfigFile ? unwrap(node.declaration) : void 0;
+		if (root?.type === "ObjectExpression" && !roots.includes(root)) roots.push(root);
+	});
+	return roots;
+}
+function keyOf(property) {
+	return property.type === "Property" && property.computed !== true ? nameOf(property.key) : void 0;
+}
+function propertyOf(object, key) {
+	return nodes(object.properties).find((property) => keyOf(property) === key);
+}
+function objectValue(property) {
+	const value = child(property, "value");
+	return value?.type === "ObjectExpression" ? value : void 0;
+}
+/** The first property at `move.from` under `object`, with the concrete paths. */
+function find(object, move, depth, path, skipped) {
+	const segment = move.from[depth];
+	if (segment === void 0) return;
+	const keys = segment === "*" ? nodes(object.properties).flatMap((property) => {
+		const key = keyOf(property);
+		return key === void 0 ? [] : [key];
+	}) : [segment];
+	for (const key of keys) {
+		const property = propertyOf(object, key);
+		if (property === void 0) continue;
+		const at = [...path, key];
+		if (depth === move.from.length - 1) {
+			if (skipped.has(property.start)) continue;
+			return {
+				parent: object,
+				property,
+				path: at
+			};
+		}
+		const next = objectValue(property);
+		const found = next === void 0 ? void 0 : find(next, move, depth + 1, at, skipped);
+		if (found !== void 0) return found;
+	}
+}
+/** `move.to` with each `*` replaced by the key `from` matched there. */
+function concreteTarget(move, path) {
+	return move.to.map((segment, index) => segment === "*" ? path[index] ?? segment : segment);
+}
+function removal(source, parent, property) {
+	const siblings = nodes(parent.properties);
+	const index = siblings.indexOf(property);
+	const next = siblings[index + 1];
+	if (next !== void 0) return {
+		start: property.start,
+		end: next.start,
+		text: ""
+	};
+	const previous = siblings[index - 1];
+	const end = /^\s*,/u.exec(source.slice(property.end))?.[0].length ?? 0;
+	return previous === void 0 ? {
+		start: property.start,
+		end: property.end + end,
+		text: ""
+	} : {
+		start: previous.end,
+		end: property.end,
+		text: ""
+	};
+}
+/** Adds `text` as the last property of `object`, so moved keys keep their order. */
+function append(source, object, text) {
+	const last = nodes(object.properties).at(-1);
+	if (last === void 0) return {
+		start: object.start + 1,
+		end: object.start + 1,
+		text: ` ${text} `
+	};
+	const comma = /^\s*,/u.exec(source.slice(last.end))?.[0].length;
+	return comma === void 0 ? {
+		start: last.end,
+		end: last.end,
+		text: `, ${text}`
+	} : {
+		start: last.end + comma,
+		end: last.end + comma,
+		text: ` ${text},`
+	};
+}
+function nested(keys, value) {
+	const [first, ...rest] = keys;
+	return rest.length === 0 ? `${first}: ${value}` : `${first}: { ${nested(rest, value)} }`;
+}
+function step(source, found, to) {
+	const relative = to.slice(found.path.length - 1);
+	const value = child(found.property, "value");
+	const text = value === void 0 ? "" : source.slice(value.start, value.end);
+	const from = found.path.join(".");
+	const target = to.join(".");
+	let object = found.parent;
+	for (const [index, key] of relative.entries()) {
+		const existing = propertyOf(object, key);
+		const last = index === relative.length - 1;
+		if (existing === void 0) {
+			const insert = nested(relative.slice(index), text);
+			return {
+				kind: "edits",
+				at: found.property.start,
+				from,
+				to: target,
+				edits: object === found.parent ? [{
+					start: found.property.start,
+					end: found.property.end,
+					text: insert
+				}] : [removal(source, found.parent, found.property), append(source, object, insert)]
+			};
+		}
+		const next = objectValue(existing);
+		if (last || next === void 0) return {
+			kind: "conflict",
+			at: found.property.start,
+			message: `${from} moved to ${target}, which ${last ? "is already set" : "is not an object literal"}; merge it by hand`
+		};
+		object = next;
+	}
+	return {
+		kind: "conflict",
+		at: found.property.start,
+		message: `${from} moved to ${target}; move it by hand`
+	};
+}
+/**
+* The first move that applies under any config root. A move that conflicts is
+* skipped from then on and reported once in `followUps`.
+*/
+function nextEdits(program, file, source, moves, skipped, followUps) {
+	for (const root of configRoots(program, file)) for (const move of moves) {
+		const found = find(root, move, 0, [], skipped);
+		if (found === void 0) continue;
+		const result = step(source, found, concreteTarget(move, found.path));
+		if (result.kind === "edits") return result;
+		skipped.add(found.property.start);
+		if (!followUps.some((item) => item.message === result.message)) followUps.push({
+			...position(lineIndex(source), result.at),
+			name: found.path.join("."),
+			message: result.message
+		});
+	}
+}
+/**
+* Moves each key `moves` names to its new path, one key per pass, until no move
+* applies. A key whose target is already set, or sits under a value that is not
+* an object literal, is reported instead.
+*/
+function moveConfigKeys(file, original, moves) {
+	let source = original;
+	const lineAt = lineIndex(original);
+	const changes = [];
+	const followUps = [];
+	const skipped = /* @__PURE__ */ new Set();
+	for (let pass = 0; pass < MAX_PASSES; pass += 1) {
+		const parsed = parseSync(file, source, { sourceType: "module" });
+		if (parsed.errors.length > 0) break;
+		const program = parsed.program;
+		const applied = nextEdits(program, file, source, moves, skipped, followUps);
+		if (applied === void 0) break;
+		changes.push({
+			...position(lineAt, Math.min(applied.at, original.length)),
+			from: applied.from,
+			to: applied.to
+		});
+		source = applyEdits(source, applied.edits);
+	}
+	return {
+		source,
+		changes,
+		followUps
+	};
+}
+//#endregion
 //#region src/cli/codemod/renames-0.5.ts
 const SERVER_ADAPTERS = [
 	"permdock/server",
@@ -797,6 +1177,94 @@ const SIGNATURE_CHANGES_0_5 = Object.freeze([
 		after: "PermissionRequirementOptions"
 	}
 ]);
+/**
+* 0.8 folds the `tenant` / `team` config shorthands into the named-scope forms,
+* under the `tenant` / `team` aliases a policy's first and second scope answer
+* to.
+*/
+const CONFIG_MOVES_0_8 = Object.freeze([
+	{
+		from: ["rls", "tenantType"],
+		to: [
+			"rls",
+			"scopeTypes",
+			"tenant"
+		]
+	},
+	{
+		from: ["rls", "teamType"],
+		to: [
+			"rls",
+			"scopeTypes",
+			"team"
+		]
+	},
+	{
+		from: [
+			"rls",
+			"memberships",
+			"tenant"
+		],
+		to: [
+			"rls",
+			"memberships",
+			"scopes",
+			"tenant"
+		]
+	},
+	{
+		from: [
+			"rls",
+			"memberships",
+			"team"
+		],
+		to: [
+			"rls",
+			"memberships",
+			"scopes",
+			"team"
+		]
+	},
+	...[[
+		"rls",
+		"memberships",
+		"scopes",
+		"*"
+	], [
+		"rls",
+		"memberships",
+		"resource",
+		"*"
+	]].flatMap((table) => ["tenant", "team"].map((scope) => ({
+		from: [...table, scope],
+		to: [
+			...table,
+			"columns",
+			scope
+		]
+	})))
+]);
+/**
+* 0.8 drops `team` from the client `RolesOptions`; `{ scope, id }` names any
+* scope. Reported, since only the reader knows the scope a `team` id belongs
+* to.
+*/
+const SIGNATURE_CHANGES_0_8 = Object.freeze([{
+	name: "useRoles",
+	entries: [
+		"permdock/react",
+		"permdock/react-native",
+		"permdock/vue",
+		"permdock/solid"
+	],
+	before: "useRoles({ team: id })",
+	after: "useRoles({ scope: \"team\", id })"
+}, ...["roles", "rolesFor"].map((name) => ({
+	name,
+	entries: ["permdock/svelte"],
+	before: `${name}(() => ({ team: id }))`,
+	after: `${name}(() => ({ scope: "team", id }))`
+}))]);
 //#endregion
 //#region src/cli/codemod/shapes-0.5.ts
 const JSX_KITS = [
@@ -912,181 +1380,6 @@ const DURATION_KEYS_0_5 = Object.freeze({
 	lists: ["durations"]
 });
 //#endregion
-//#region src/cli/codemod/ast.ts
-function nameOf(node) {
-	if (node?.type === "Literal") return typeof node.value === "string" ? node.value : void 0;
-	return node?.name;
-}
-const NOT_REFERENCES = /* @__PURE__ */ new Set([
-	"ImportSpecifier",
-	"ImportDefaultSpecifier",
-	"ImportNamespaceSpecifier",
-	"LabeledStatement",
-	"BreakStatement",
-	"ContinueStatement",
-	"TSEnumMember",
-	"TSModuleDeclaration",
-	"TSTypeParameter"
-]);
-const KEYED_MEMBERS = /* @__PURE__ */ new Set([
-	"MethodDefinition",
-	"PropertyDefinition",
-	"AccessorProperty",
-	"TSPropertySignature",
-	"TSMethodSignature",
-	"TSAbstractMethodDefinition",
-	"TSAbstractPropertyDefinition"
-]);
-/** How an identifier is read: a plain reference, a shorthand property value, the local of an `export { }`, or not a reference. */
-function referencePlace(node, parent, ancestors) {
-	const type = parent.type;
-	if (node.type === "JSXIdentifier") return type === "JSXOpeningElement" || type === "JSXClosingElement" || type === "JSXMemberExpression" && parent.object === node ? "reference" : "none";
-	if (type === "Property") {
-		if (ancestors.at(-2)?.type === "ObjectPattern") return "none";
-		if (parent.shorthand === true) return parent.value === node ? "shorthand" : "none";
-		return parent.key === node && parent.computed !== true ? "none" : "reference";
-	}
-	if (type === "MemberExpression" || KEYED_MEMBERS.has(type)) return (type === "MemberExpression" ? parent.property : parent.key) === node && parent.computed !== true ? "none" : "reference";
-	if (type === "ExportSpecifier") {
-		const reexport = ancestors.at(-2)?.source !== null;
-		return parent.local === node && !reexport ? "export" : "none";
-	}
-	if (type === "TSQualifiedName") return parent.right === node ? "none" : "reference";
-	return NOT_REFERENCES.has(type) ? "none" : "reference";
-}
-function nodes(value) {
-	return Array.isArray(value) ? value.filter(isNode) : [];
-}
-function isNode(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** A child node under a field `Estree` types as something else (`value`, a type parameter's `name`). */
-function child(node, field) {
-	const value = Reflect.get(node, field);
-	return isNode(value) ? value : void 0;
-}
-function patternNames(pattern, into) {
-	if (pattern === null || pattern === void 0) return;
-	switch (pattern.type) {
-		case "Identifier":
-			into.add(pattern.name ?? "");
-			return;
-		case "ObjectPattern":
-			for (const property of nodes(pattern.properties)) patternNames(property.type === "RestElement" ? property.argument : child(property, "value"), into);
-			return;
-		case "ArrayPattern":
-			for (const element of nodes(pattern.elements)) patternNames(element, into);
-			return;
-		default: patternNames(pattern.left ?? pattern.argument ?? pattern.parameter, into);
-	}
-}
-const DECLARATIONS_WITH_ID = /* @__PURE__ */ new Set([
-	"FunctionDeclaration",
-	"ClassDeclaration",
-	"TSEnumDeclaration",
-	"TSTypeAliasDeclaration",
-	"TSInterfaceDeclaration",
-	"TSModuleDeclaration",
-	"TSImportEqualsDeclaration",
-	"TSDeclareFunction"
-]);
-function declareStatement(statement, into) {
-	const type = statement.type;
-	if (type === "VariableDeclaration") for (const declarator of nodes(statement.declarations)) patternNames(declarator.id, into);
-	else if (DECLARATIONS_WITH_ID.has(type)) patternNames(statement.id, into);
-	else if (statement.declaration !== null && statement.declaration !== void 0) declareStatement(statement.declaration, into);
-	else if (type === "ImportDeclaration") for (const spec of nodes(statement.specifiers)) patternNames(spec.local, into);
-}
-const BLOCK_SCOPES = /* @__PURE__ */ new Set([
-	"Program",
-	"BlockStatement",
-	"StaticBlock",
-	"TSModuleBlock"
-]);
-const FUNCTION_SCOPES = /* @__PURE__ */ new Set([
-	"FunctionDeclaration",
-	"FunctionExpression",
-	"ArrowFunctionExpression",
-	"TSDeclareFunction"
-]);
-/** The names a node declares for the code inside it; `undefined` for a node that opens no scope. */
-function scopeBindings(node) {
-	const names = /* @__PURE__ */ new Set();
-	const declare = (statements) => {
-		for (const statement of statements) if (statement !== null && statement !== void 0) declareStatement(statement, names);
-	};
-	const type = node.type;
-	let opens = true;
-	if (BLOCK_SCOPES.has(type)) declare(nodes(node.body));
-	else if (FUNCTION_SCOPES.has(type)) {
-		for (const param of nodes(node.params)) patternNames(param, names);
-		patternNames(type === "FunctionExpression" ? node.id : void 0, names);
-	} else if (type === "ClassExpression") patternNames(node.id, names);
-	else if (type === "ForStatement") declare([node.init]);
-	else if (type === "ForInStatement" || type === "ForOfStatement") declare([node.left]);
-	else if (type === "CatchClause") patternNames(node.param, names);
-	else if (type === "SwitchStatement") declare(nodes(node.cases).flatMap((branch) => nodes(branch.consequent)));
-	else if (type === "TSMappedType") patternNames(node.key, names);
-	else opens = false;
-	for (const param of nodes(node.typeParameters?.params)) {
-		opens = true;
-		patternNames(child(param, "name"), names);
-	}
-	return opens ? names : void 0;
-}
-function bindingsCached(node, cache) {
-	let found = cache.get(node);
-	if (found === void 0) {
-		found = scopeBindings(node) ?? null;
-		cache.set(node, found);
-	}
-	return found;
-}
-function applyEdits(source, edits) {
-	let out = source;
-	for (const item of edits.toSorted((a, b) => b.start - a.start || b.end - a.end)) out = out.slice(0, item.start) + item.text + out.slice(item.end);
-	return out;
-}
-function position(lineAt, index) {
-	const { line, lineStart } = lineAt(index);
-	return {
-		line,
-		column: index - lineStart + 1
-	};
-}
-function lineIndex(source) {
-	const starts = [0];
-	for (let i = 0; i < source.length; i += 1) if (source.charCodeAt(i) === 10) starts.push(i + 1);
-	return (index) => {
-		let low = 0;
-		let high = starts.length - 1;
-		while (low < high) {
-			const mid = low + high + 1 >> 1;
-			if ((starts[mid] ?? 0) <= index) low = mid;
-			else high = mid - 1;
-		}
-		return {
-			line: low + 1,
-			lineStart: starts[low] ?? 0
-		};
-	};
-}
-/** Every node in source order with its parent and ancestors: Oxc nodes carry no parent, so enter and exit keep a stack. */
-function walk(program, visit) {
-	const stack = [];
-	const handlers = {};
-	for (const type of Object.keys(visitorKeys)) {
-		handlers[type] = (node) => {
-			visit(node, stack.at(-1), stack);
-			stack.push(node);
-		};
-		handlers[`${type}:exit`] = () => {
-			stack.pop();
-		};
-	}
-	new Visitor(handlers).visit(program);
-}
-//#endregion
 //#region src/cli/codemod/context.ts
 /** One version's rename map: what the codemod rewrites and what it only reports. */
 const SCRIPT_BLOCK = /<script\b([^>]*)>([\s\S]*?)<\/script>/gu;
@@ -1121,7 +1414,10 @@ function renameOf(set, name, entry) {
 function listOf(items) {
 	return new Intl.ListFormat("en-GB", { type: "disjunction" }).format(items);
 }
-/** The import a call's callee is bound to: a named import, or a member of a namespace import. */
+/**
+* The import a call's callee is bound to: a named import, or a member of a
+* namespace import.
+*/
 function importedCallee(ctx, callee, ancestors) {
 	if (callee?.type === "Identifier") {
 		const name = callee.name ?? "";
@@ -1744,7 +2040,10 @@ function visitMember(ctx, node, ancestors) {
 		else if (origin === void 0) reportMethods(ctx, [property], "member", "is on a value from");
 	}
 }
-/** `const x = f(…)` or `const x = await f(…)` at module level, where `f` is imported from a permdock entry. */
+/**
+* `const x = f(…)` or `const x = await f(…)` at module level, where `f` is
+* imported from a permdock entry.
+*/
 function factoryValues(program, bindings) {
 	const out = /* @__PURE__ */ new Map();
 	for (const statement of nodes(program.body)) {
@@ -1808,8 +2107,8 @@ function renameOptions(ctx, object, rows) {
 	}
 }
 /**
-* Rows with `calls` are renamed at those calls and nowhere else: their old
-* key (`store`) is still a valid option on every other factory. Rows without
+* Rows with `calls` are renamed at those calls and nowhere else: their old key
+* (`store`) is still a valid option on every other factory. Rows without
 * `calls` are reported only on an object that reaches a permdock call.
 */
 function reportOptions(ctx, node, ancestors) {
@@ -1831,9 +2130,9 @@ const PASS_THROUGH = /* @__PURE__ */ new Set([
 	"TSNonNullExpression"
 ]);
 /**
-* The permdock call an object literal is an argument of, directly or nested
-* in another argument's object, array or property value. `entry` is unset
-* for a method on a receiver named after PermDock, whose entry is unknown.
+* The permdock call an object literal is an argument of, directly or nested in
+* another argument's object, array or property value. `entry` is unset for a
+* method on a receiver named after PermDock, whose entry is unknown.
 */
 function optionTarget(ctx, node, ancestors) {
 	let child = node;
@@ -1858,8 +2157,8 @@ function rewriteImports(ctx, removed) {
 		const { rename, spec } = binding;
 		const imported = spec.imported;
 		if (rename === void 0 || imported === void 0 || removed.has(local)) continue;
-		if (local !== binding.imported) replace(ctx, imported, imported.type === "Literal" ? JSON.stringify(rename.to) : rename.to, rename.from);
-		else replace(ctx, imported, ctx.kept.has(local) ? `${rename.to} as ${local}` : rename.to, rename.from);
+		if (local === binding.imported) replace(ctx, imported, ctx.kept.has(local) ? `${rename.to} as ${local}` : rename.to, rename.from);
+		else replace(ctx, imported, imported.type === "Literal" ? JSON.stringify(rename.to) : rename.to, rename.from);
 	}
 }
 function rewriteReferences(ctx) {
@@ -1873,7 +2172,10 @@ function rewriteReferences(ctx) {
 		else replace(ctx, node, rename.to, name);
 	}
 }
-/** `export { a } from 'permdock'` keeps exporting `a`: the module's own export name is not the codemod's to change. */
+/**
+* `export { a } from 'permdock'` keeps exporting `a`: the module's own export
+* name is not the codemod's to change.
+*/
 function rewriteReexports(ctx) {
 	for (const statement of nodes(ctx.program.body)) {
 		const entry = statement.source?.value;
@@ -1909,8 +2211,16 @@ const CODEMOD_0_5 = Object.freeze({
 	wraps: OPTION_WRAPS_0_5,
 	durations: DURATION_KEYS_0_5
 });
+const CODEMOD_0_8 = Object.freeze({
+	renames: [],
+	signatures: SIGNATURE_CHANGES_0_8,
+	configMoves: CONFIG_MOVES_0_8
+});
 /** Each codemod version and the rename map it applies. */
-const CODEMODS = Object.freeze({ "0.5": CODEMOD_0_5 });
+const CODEMODS = Object.freeze({
+	"0.5": CODEMOD_0_5,
+	"0.8": CODEMOD_0_8
+});
 function codemodVersions() {
 	return Object.keys(CODEMODS);
 }
@@ -1926,7 +2236,10 @@ const EXTENSIONS = /* @__PURE__ */ new Set([
 	".vue",
 	".svelte"
 ]);
-/** Files whose shell commands the codemod rewrites when the version renames CLI names. */
+/**
+* Files whose shell commands the codemod rewrites when the version renames CLI
+* names.
+*/
 const CLI_FILE_NAMES = /* @__PURE__ */ new Set([
 	"package.json",
 	"Makefile",
@@ -1968,9 +2281,9 @@ function codemod(options) {
 	const writes = [];
 	for (const file of files) {
 		const source = readFileSync(file, "utf8");
-		if (!source.includes("permdock")) continue;
+		if (!source.includes("permdock") && !basename(file).startsWith("permdock.config.")) continue;
 		const name = rel(options.cwd, file);
-		const result = isCodeFile(file) ? transformSource(file, source, set) : cliResult(file, source);
+		const result = isCodeFile(file) ? withConfigMoves(file, transformSource(file, source, set), set) : cliResult(file, source);
 		if (result.error !== void 0) {
 			followUps.push({
 				file: name,
@@ -2018,6 +2331,15 @@ function codemod(options) {
 		followUps
 	};
 }
+function withConfigMoves(file, result, set) {
+	if (result.error !== void 0 || set.configMoves === void 0) return result;
+	const moved = moveConfigKeys(file, result.source, set.configMoves);
+	return {
+		source: moved.source,
+		changes: [...result.changes, ...moved.changes],
+		followUps: [...result.followUps, ...moved.followUps]
+	};
+}
 function normaliseVersion(version) {
 	if (version === void 0) throw new CliError("usage", `codemod needs a version: permdock codemod <version>. Supported: ${Object.keys(CODEMODS).join(", ")}.`);
 	return /^v?(\d+\.\d+)(?:\.\d+)?$/u.exec(version)?.[1] ?? version;