Transform code.
Any language.

// Surgically replace one function in one file
patch "src/auth/hash.ts" in TypeScript {
  find fn hashPassword() {}
  replace with {
    return await bcrypt.hash(password, 12);
  }
  why: "upgrade to async bcrypt"
}

// Migrate lodash to native array methods
migrate "lodash to native" in TypeScript {
  rename: _.map    -> Array.prototype.map
  rename: _.filter -> Array.prototype.filter
  rename: _.find   -> Array.prototype.find
  remove: deprecated _.each
  scope:  "src/**/*.ts"
}
apply migrate "lodash to native" to project

// Assert invariants before transforms run
guard "no raw SQL" {
  scope:   "src/**"
  assert:  no file contains raw SQL interpolation
  on_fail: block_apply, show_diff
}

guard "api contract" {
  scope:   "src/**"
  assert:  fn verifyToken() exists
  assert:  fn hashPassword() exists
  on_fail: block_apply
}

// Track where user input flows through the codebase
trace userInput in "src/" {
  language: TypeScript
  origin:   req.body.email
  follow:   assignments, function_calls, returns
  report:   full_chain
  flag:     "any path reaching db.query without sanitize"
  flag:     "any path reaching console.log"
}