@reddoorla/maintenance 0.1.0 → 0.1.2

package/dist/cli/bin.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli/bin.ts
-import { readFileSync } from "fs";
-import { dirname, join as join14 } from "path";
+import { dirname } from "path";
 import { fileURLToPath } from "url";
 import { cac } from "cac";
 
@@ -12,15 +11,18 @@ import { resolve as resolve2 } from "path";
 // src/audits/util/spawn.ts
 import { spawn } from "child_process";
 var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve6, reject) => {
+  const streaming = opts.streaming === true;
   const child = spawn(cmd, [...args], {
     cwd: opts.cwd,
     env: opts.env ?? process.env,
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
   });
   let stdout = "";
   let stderr = "";
-  child.stdout.on("data", (chunk) => stdout += String(chunk));
-  child.stderr.on("data", (chunk) => stderr += String(chunk));
+  if (!streaming) {
+    child.stdout?.on("data", (chunk) => stdout += String(chunk));
+    child.stderr?.on("data", (chunk) => stderr += String(chunk));
+  }
   const timer = opts.timeoutMs ? setTimeout(() => {
     child.kill("SIGTERM");
     reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
@@ -115,10 +117,10 @@ async function depsAudit(ctx) {
       details: { error: String(err) }
     };
   }
-  const pkg2 = JSON.parse(pkgRaw);
+  const pkg = JSON.parse(pkgRaw);
   const installed = {
-    ...pkg2.dependencies ?? {},
-    ...pkg2.devDependencies ?? {}
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {}
   };
   const details = [];
   for (const [name, baseline] of Object.entries(baselineVersions)) {
@@ -148,7 +150,7 @@ async function depsAudit(ctx) {
 // src/audits/lint.ts
 import { existsSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { join as join2, relative } from "path";
+import { join as join2 } from "path";
 import { ESLint } from "eslint";
 import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
 import { glob } from "tinyglobby";
@@ -177,19 +179,19 @@ async function lintAudit(ctx) {
     errorOnUnmatchedPattern: false
   });
   const relFiles = await listFiles(site.path);
-  const filesToLint = relFiles.map((f) => join2(site.path, f));
-  const eslintResults = await eslint2.lintFiles(filesToLint);
+  const eslintResults = await eslint2.lintFiles(relFiles);
   const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
   const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
   const prettierUnformatted = [];
-  for (const file of filesToLint) {
-    const source = await readFile2(file, "utf-8");
-    const options = await prettierResolveConfig(file) ?? {};
-    const ok = await prettierCheck(source, { ...options, filepath: file });
-    if (!ok) prettierUnformatted.push(relative(site.path, file));
+  for (const rel of relFiles) {
+    const absForResolve = join2(site.path, rel);
+    const source = await readFile2(absForResolve, "utf-8");
+    const options = await prettierResolveConfig(absForResolve) ?? {};
+    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });
+    if (!ok) prettierUnformatted.push(rel);
   }
   const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
-  const summary = status === "pass" ? `lint clean across ${filesToLint.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
+  const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
   return {
     audit: "lint",
     site: siteLabel2(site),
@@ -199,7 +201,7 @@ async function lintAudit(ctx) {
       eslintErrors,
       eslintWarnings,
       prettierUnformatted,
-      files: filesToLint.length
+      files: relFiles.length
     }
   };
 }
@@ -213,6 +215,61 @@ function classify(v) {
   if (v.moderate > 0 || v.low > 0) return "warn";
   return "pass";
 }
+function normalizeSeverity(s) {
+  if (s === "low" || s === "moderate" || s === "high" || s === "critical") return s;
+  return "low";
+}
+function extractAdvisoriesFromPnpm(parsed) {
+  const out = [];
+  for (const a of Object.values(parsed.advisories ?? {})) {
+    if (!a) continue;
+    out.push({
+      module: a.module_name ?? "unknown",
+      severity: normalizeSeverity(a.severity),
+      title: a.title ?? "(no title)",
+      ...a.cves ? { cves: a.cves } : {},
+      ...a.url ? { url: a.url } : {}
+    });
+  }
+  return out;
+}
+function resolveNpmAdvisoryRoot(startName, vulnerabilities) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = startName;
+  while (!seen.has(current)) {
+    seen.add(current);
+    const entry = vulnerabilities[current];
+    if (!entry || !Array.isArray(entry.via)) return { rootName: current };
+    const detailed = entry.via.find(
+      (e) => typeof e === "object" && e !== null
+    );
+    if (detailed) return { rootName: current, detail: detailed };
+    const next = entry.via.find((e) => typeof e === "string");
+    if (!next || next === current) return { rootName: current };
+    current = next;
+  }
+  return { rootName: current };
+}
+function extractAdvisoriesFromNpm(parsed) {
+  const vulnerabilities = parsed.vulnerabilities ?? {};
+  const roots = /* @__PURE__ */ new Map();
+  for (const [name, v] of Object.entries(vulnerabilities)) {
+    if (!v) continue;
+    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);
+    if (roots.has(rootName)) continue;
+    const rootEntry = vulnerabilities[rootName];
+    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);
+    const title = detail?.title ?? rootName;
+    const url = detail?.url;
+    roots.set(rootName, {
+      module: rootEntry?.name ?? rootName,
+      severity,
+      title,
+      ...url ? { url } : {}
+    });
+  }
+  return [...roots.values()];
+}
 async function tryRun(spawn2, cmd, args, cwd) {
   try {
     return await spawn2(cmd, args, { cwd });
@@ -266,26 +323,27 @@ async function securityAudit(ctx) {
       details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
     };
   }
-  const vuln = {
+  const counts = {
     low: parsed.metadata?.vulnerabilities?.low ?? 0,
     moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
     high: parsed.metadata?.vulnerabilities?.high ?? 0,
     critical: parsed.metadata?.vulnerabilities?.critical ?? 0
   };
-  const status = classify(vuln);
-  const total = vuln.low + vuln.moderate + vuln.high + vuln.critical;
-  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${vuln.critical}C/${vuln.high}H/${vuln.moderate}M/${vuln.low}L)`;
+  const advisories = used === "pnpm audit" ? extractAdvisoriesFromPnpm(parsed) : extractAdvisoriesFromNpm(parsed);
+  const status = classify(counts);
+  const total = counts.low + counts.moderate + counts.high + counts.critical;
+  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${counts.critical}C/${counts.high}H/${counts.moderate}M/${counts.low}L)`;
   return {
     audit: "security",
     site: label,
     status,
     summary,
-    details: vuln
+    details: { counts, advisories }
   };
 }
 
 // src/audits/lighthouse.ts
-import { writeFile, mkdtemp, rm } from "fs/promises";
+import { readFile as readFile3, writeFile, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join3 } from "path";
 
@@ -321,29 +379,56 @@ var lighthouseConfig = {
 function siteLabel4(site) {
   return site.name ?? site.path;
 }
-function isFakeShape(stdout) {
+async function readJsonMaybe(path) {
   try {
-    const parsed = JSON.parse(stdout);
-    if (typeof parsed.assertionsFailed === "number" && parsed.summary) return parsed;
+    const raw = await readFile3(path, "utf-8");
+    return JSON.parse(raw);
   } catch {
     return null;
   }
-  return null;
+}
+function averageSummaries(entries) {
+  if (entries.length === 0) return {};
+  const sums = {};
+  const counts = {};
+  for (const e of entries) {
+    for (const [k, v] of Object.entries(e.summary ?? {})) {
+      if (typeof v !== "number") continue;
+      sums[k] = (sums[k] ?? 0) + v;
+      counts[k] = (counts[k] ?? 0) + 1;
+    }
+  }
+  const out = {};
+  for (const k of Object.keys(sums)) {
+    const total = sums[k] ?? 0;
+    const count = counts[k] ?? 1;
+    out[k] = total / count;
+  }
+  return out;
+}
+function categoryFromAssertion(a) {
+  const colonIdx = a.name.indexOf(":");
+  return colonIdx >= 0 ? a.name.slice(colonIdx + 1) : a.name;
+}
+function messageForAssertion(a) {
+  return `${a.name} ${a.operator} ${a.expected} (actual: ${a.actual.toFixed(2)})`;
 }
 async function lighthouseAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel4(site);
-  const dir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
-  const configPath = join3(dir, "lighthouserc.json");
+  const configDir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
+  const configPath = join3(configDir, "lighthouserc.json");
   await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
+  const resultsDir = join3(site.path, ".lighthouseci");
+  await rm(resultsDir, { recursive: true, force: true });
   let raw;
   try {
     raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
       cwd: site.path
     });
   } catch (err) {
-    await rm(dir, { recursive: true, force: true });
+    await rm(configDir, { recursive: true, force: true });
     const e = err;
     if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
       return {
@@ -355,17 +440,32 @@ async function lighthouseAudit(ctx) {
     }
     throw err;
   }
-  await rm(dir, { recursive: true, force: true });
-  const fake = isFakeShape(raw.stdout);
-  const normalized = fake ?? {
-    summary: {},
-    assertionsFailed: raw.code === 0 ? 0 : 1,
-    assertions: raw.code === 0 ? [] : [{ category: "unknown", level: "error", message: raw.stderr.slice(0, 200) }]
-  };
-  const anyError = (normalized.assertions ?? []).some((a) => a.level === "error");
-  const anyWarn = (normalized.assertions ?? []).some((a) => a.level === "warn");
+  await rm(configDir, { recursive: true, force: true });
+  const manifest = await readJsonMaybe(join3(resultsDir, "manifest.json"));
+  if (!manifest || manifest.length === 0) {
+    return {
+      audit: "lighthouse",
+      site: label,
+      status: "fail",
+      summary: `lighthouse: no manifest written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
+    };
+  }
+  const assertionResults = await readJsonMaybe(join3(resultsDir, "assertion-results.json")) ?? [];
+  const failed = assertionResults.filter((a) => !a.passed);
+  const assertions = failed.map((a) => ({
+    category: categoryFromAssertion(a),
+    level: a.level,
+    message: messageForAssertion(a)
+  }));
+  const anyError = assertions.some((a) => a.level === "error");
+  const anyWarn = assertions.some((a) => a.level === "warn");
   const status = anyError ? "fail" : anyWarn ? "warn" : "pass";
-  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${normalized.assertionsFailed} assertion(s) failed`;
+  const normalized = {
+    summary: averageSummaries(manifest),
+    assertionsFailed: failed.length,
+    assertions
+  };
+  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${failed.length} assertion(s) failed`;
   return {
     audit: "lighthouse",
     site: label,
@@ -376,7 +476,7 @@ async function lighthouseAudit(ctx) {
 }
 
 // src/audits/a11y.ts
-import { writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
 
@@ -412,48 +512,81 @@ var playwrightA11yConfig = defineConfig({
 });
 
 // src/audits/a11y.ts
+var RESULTS_REL = ".reddoor-a11y/results.json";
 function siteLabel5(site) {
   return site.name ?? site.path;
 }
-function isFakeShape2(stdout) {
+async function readJsonMaybe2(path) {
   try {
-    const parsed = JSON.parse(stdout);
-    if (typeof parsed.totalViolations === "number" && parsed.byImpact) return parsed;
+    const raw = await readFile4(path, "utf-8");
+    return JSON.parse(raw);
   } catch {
     return null;
   }
-  return null;
 }
 function buildSpec() {
-  return `
-import { test, expect } from "@playwright/test";
+  return `import { test, expect } from "@playwright/test";
 import AxeBuilder from "@axe-core/playwright";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+
 const pages = ${JSON.stringify(a11yRoutes)};
-for (const { path, name } of pages) {
-  test(\`\${name} has no axe violations\`, async ({ page }) => {
+const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
+
+// Playwright's default per-test timeout is 30s. We loop through every
+// configured route in a single test, so the budget needs to scale.
+test.setTimeout(5 * 60_000);
+
+test("a11y across configured routes", async ({ page }) => {
+  const violations = [];
+  for (const { path, name } of pages) {
     await page.goto(path);
     const results = await new AxeBuilder({ page })
       .withTags(["wcag2a","wcag2aa","wcag21a","wcag21aa","wcag22aa"])
       .analyze();
-    expect(results.violations).toEqual([]);
-  });
-}
+    for (const v of results.violations) {
+      violations.push({
+        id: v.id,
+        impact: v.impact ?? "moderate",
+        route: name,
+        help: v.help,
+        helpUrl: v.helpUrl,
+        nodes: v.nodes.map((n) => ({ html: n.html, target: n.target })),
+      });
+    }
+  }
+  const byImpact = {};
+  for (const v of violations) {
+    byImpact[v.impact] = (byImpact[v.impact] ?? 0) + 1;
+  }
+  if (OUTPUT) {
+    await mkdir(dirname(OUTPUT), { recursive: true });
+    await writeFile(
+      OUTPUT,
+      JSON.stringify({ totalViolations: violations.length, byImpact, violations }, null, 2),
+    );
+  }
+  expect(violations).toEqual([]);
+});
 `;
 }
 async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel5(site);
-  const dir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-"));
-  const specPath = join4(dir, "a11y.spec.ts");
+  const specDir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-spec-"));
+  const specPath = join4(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
+  const resultsPath = join4(site.path, RESULTS_REL);
+  await rm2(join4(site.path, ".reddoor-a11y"), { recursive: true, force: true });
   let raw;
   try {
-    raw = await spawn2("npx", ["--yes", "playwright", "test", "--reporter=json", specPath], {
-      cwd: site.path
+    raw = await spawn2("npx", ["--yes", "playwright", "test", "--reporter=line", specPath], {
+      cwd: site.path,
+      env: { ...process.env, REDDOOR_A11Y_OUTPUT: resultsPath }
     });
   } catch (err) {
-    await rm2(dir, { recursive: true, force: true });
+    await rm2(specDir, { recursive: true, force: true });
     const e = err;
     if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
       return {
@@ -465,22 +598,26 @@ async function a11yAudit(ctx) {
     }
     throw err;
   }
-  await rm2(dir, { recursive: true, force: true });
-  const fake = isFakeShape2(raw.stdout);
-  const normalized = fake ?? {
-    totalViolations: raw.code === 0 ? 0 : 1,
-    byImpact: raw.code === 0 ? {} : { moderate: 1 }
-  };
-  const hasSerious = (normalized.byImpact.serious ?? 0) > 0 || (normalized.byImpact.critical ?? 0) > 0;
-  const hasAny = normalized.totalViolations > 0;
+  await rm2(specDir, { recursive: true, force: true });
+  const artifact = await readJsonMaybe2(resultsPath);
+  if (!artifact) {
+    return {
+      audit: "a11y",
+      site: label,
+      status: "fail",
+      summary: `a11y: no results written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
+    };
+  }
+  const hasSerious = (artifact.byImpact.serious ?? 0) > 0 || (artifact.byImpact.critical ?? 0) > 0;
+  const hasAny = artifact.totalViolations > 0;
   const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
-  const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes` : `a11y: ${normalized.totalViolations} violations`;
+  const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes` : `a11y: ${artifact.totalViolations} violations`;
   return {
     audit: "a11y",
     site: label,
     status,
     summary,
-    details: normalized
+    details: artifact
   };
 }
 
@@ -530,7 +667,8 @@ function localPath(path, opts = {}) {
 }
 
 // src/inventory/json.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
+import { isAbsolute } from "path";
 function validate(raw) {
   if (!Array.isArray(raw)) {
     throw new Error("inventory JSON must be an array of sites");
@@ -543,6 +681,11 @@ function validate(raw) {
     if (typeof e.path !== "string" || e.path.length === 0) {
       throw new Error(`inventory entry ${i} is missing required field: path`);
     }
+    if (!isAbsolute(e.path)) {
+      throw new Error(
+        `inventory entry ${i}: path must be absolute (got "${e.path}"). Relative paths are rejected so cwd at invocation can't change which site is targeted.`
+      );
+    }
     const site = { path: e.path };
     if (typeof e.name === "string") site.name = e.name;
     if (typeof e.repoUrl === "string") site.repoUrl = e.repoUrl;
@@ -554,7 +697,7 @@ function validate(raw) {
 }
 function fromJsonFile(path) {
   return async () => {
-    const raw = JSON.parse(await readFile3(path, "utf-8"));
+    const raw = JSON.parse(await readFile5(path, "utf-8"));
     return validate(raw);
   };
 }
@@ -593,11 +736,22 @@ async function resolveSites(input) {
 
 // src/cli/fleet/clone-if-needed.ts
 import { stat, readdir, mkdir } from "fs/promises";
-import { join as join5 } from "path";
+import { isAbsolute as isAbsolute2, join as join5 } from "path";
 function deriveNameFromRepoUrl(repoUrl) {
   const slash = repoUrl.split("/").pop() ?? repoUrl;
   return slash.replace(/\.git$/, "");
 }
+function assertSafeName(name) {
+  if (isAbsolute2(name)) {
+    throw new Error(`unsafe site name (absolute path not allowed): ${name}`);
+  }
+  if (name.includes("/") || name.includes("\\")) {
+    throw new Error(`unsafe site name (path separator not allowed): ${name}`);
+  }
+  if (name.split(/[\\/]/).some((seg) => seg === "..")) {
+    throw new Error(`unsafe site name (traversal segment not allowed): ${name}`);
+  }
+}
 async function isNonEmptyDir(path) {
   try {
     const s = await stat(path);
@@ -614,6 +768,7 @@ async function cloneIfNeeded(site, opts) {
     throw new Error(`site path does not exist (${site.path}) and no repoUrl is set \u2014 cannot clone`);
   }
   const name = site.name ?? deriveNameFromRepoUrl(site.repoUrl);
+  assertSafeName(name);
   const target = join5(opts.workdir, name);
   await mkdir(opts.workdir, { recursive: true });
   if (await isNonEmptyDir(target)) {
@@ -670,11 +825,11 @@ async function runAuditCommand(site, opts) {
 }
 
 // src/cli/commands/sync-configs.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { join as join7, resolve as resolve3 } from "path";
 
 // src/recipes/sync-configs.ts
-import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
 import { join as join6 } from "path";
 
 // src/recipes/sync-configs/templates.ts
@@ -759,7 +914,7 @@ function siteLabel6(site) {
 }
 async function readMaybe(path) {
   try {
-    return await readFile4(path, "utf-8");
+    return await readFile6(path, "utf-8");
   } catch {
     return null;
   }
@@ -818,7 +973,7 @@ async function dryPlan(cwd, which) {
   for (const t of targets) {
     let existing = "";
     try {
-      existing = await readFile5(join7(cwd, t.path), "utf-8");
+      existing = await readFile7(join7(cwd, t.path), "utf-8");
     } catch {
     }
     if (existing !== t.contents) lines.push(`would update ${t.path} (config: ${t.config})`);
@@ -877,6 +1032,7 @@ async function bumpDeps(site, opts = {}) {
   const label = siteLabel7(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
+  await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
   const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
     cwd: site.path
   });
@@ -901,7 +1057,10 @@ async function bumpDeps(site, opts = {}) {
   }
   const branch = branchName("bump-deps");
   await createBranch(site.path, branch);
-  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], { cwd: site.path });
+  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
+    cwd: site.path,
+    streaming: true
+  });
   const sha = await commit(site.path, `chore(deps): bump dependencies (${group})`);
   const shas = sha ? [sha] : [];
   return {
@@ -952,36 +1111,38 @@ import { resolve as resolve5 } from "path";
 import { join as join13 } from "path";
 
 // src/util/pkg.ts
-import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { readFile as readFile8, writeFile as writeFile4 } from "fs/promises";
 async function readPackageJson(path) {
-  const raw = await readFile6(path, "utf-8");
+  const raw = await readFile8(path, "utf-8");
   return JSON.parse(raw);
 }
-async function writePackageJson(path, pkg2) {
-  const content = JSON.stringify(pkg2, null, 2) + "\n";
+async function writePackageJson(path, pkg) {
+  const content = JSON.stringify(pkg, null, 2) + "\n";
   await writeFile4(path, content, "utf-8");
 }
-function bumpDep(pkg2, name, version) {
+function bumpDep(pkg, name, version2, opts = {}) {
+  const mode = opts.mode ?? "ensure";
   const next = {
-    ...pkg2
+    ...pkg
   };
-  if (pkg2.dependencies) {
-    next.dependencies = { ...pkg2.dependencies };
+  if (pkg.dependencies) {
+    next.dependencies = { ...pkg.dependencies };
   }
-  if (pkg2.devDependencies) {
-    next.devDependencies = { ...pkg2.devDependencies };
+  if (pkg.devDependencies) {
+    next.devDependencies = { ...pkg.devDependencies };
   }
   if (next.dependencies && name in next.dependencies) {
-    if (next.dependencies[name] === version) return pkg2;
-    next.dependencies[name] = version;
+    if (next.dependencies[name] === version2) return pkg;
+    next.dependencies[name] = version2;
     return next;
   }
   if (next.devDependencies && name in next.devDependencies) {
-    if (next.devDependencies[name] === version) return pkg2;
-    next.devDependencies[name] = version;
+    if (next.devDependencies[name] === version2) return pkg;
+    next.devDependencies[name] = version2;
     return next;
   }
-  next.devDependencies = { ...next.devDependencies ?? {}, [name]: version };
+  if (mode === "bump-only") return pkg;
+  next.devDependencies = { ...next.devDependencies ?? {}, [name]: version2 };
   return next;
 }
 
@@ -1000,33 +1161,69 @@ var SVELTE_5_VERSIONS = {
 };
 async function bumpToSvelte5Versions(cwd) {
   const pkgPath = join8(cwd, "package.json");
-  const pkg2 = await readPackageJson(pkgPath);
-  let next = pkg2;
-  for (const [name, version] of Object.entries(SVELTE_5_VERSIONS)) {
-    next = bumpDep(next, name, version);
+  const pkg = await readPackageJson(pkgPath);
+  let next = pkg;
+  for (const [name, version2] of Object.entries(SVELTE_5_VERSIONS)) {
+    next = bumpDep(next, name, version2, { mode: "bump-only" });
   }
-  if (next === pkg2) return false;
+  if (next === pkg) return false;
   await writePackageJson(pkgPath, next);
   return true;
 }
 
 // src/recipes/svelte-5/step-svelte-config.ts
-import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
 import { join as join9 } from "path";
+var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
+var IMPORT_FROM_VITE_PLUGIN = new RegExp(
+  String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
+  "m"
+);
+function dropVitePreprocessImport(source) {
+  return source.replace(IMPORT_FROM_VITE_PLUGIN, (full, names) => {
+    const remaining = names.split(",").map((n) => n.trim()).filter((n) => n.length > 0 && n !== "vitePreprocess");
+    if (remaining.length === 0) return "";
+    return `import { ${remaining.join(", ")} } from "${VITE_PLUGIN_PKG}";
+`;
+  });
+}
+function findMatchingParen(source, openIdx) {
+  if (source[openIdx] !== "(") return -1;
+  let depth = 0;
+  for (let i = openIdx; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === "(") depth++;
+    else if (ch === ")") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+function dropPreprocessKey(source) {
+  const startRe = /^(\s*)preprocess:\s*vitePreprocess\(/m;
+  const m = startRe.exec(source);
+  if (!m) return source;
+  const indent = m[1] ?? "";
+  const parenOpenAbs = m.index + m[0].length - 1;
+  const parenCloseAbs = findMatchingParen(source, parenOpenAbs);
+  if (parenCloseAbs < 0) return source;
+  let tailIdx = parenCloseAbs + 1;
+  while (tailIdx < source.length && /[ \t,]/.test(source[tailIdx] ?? "")) tailIdx++;
+  if (source[tailIdx] === "\n") tailIdx++;
+  return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
+}
 async function migrateSvelteConfig(cwd) {
   const path = join9(cwd, "svelte.config.js");
   let src;
   try {
-    src = await readFile7(path, "utf-8");
+    src = await readFile9(path, "utf-8");
   } catch {
     return false;
   }
   let next = src;
-  next = next.replace(
-    /^import\s+\{\s*vitePreprocess\s*\}\s+from\s+["']@sveltejs\/vite-plugin-svelte["'];\n/m,
-    ""
-  );
-  next = next.replace(/^\s*preprocess:\s*vitePreprocess\(\)\s*,?\s*\n/m, "");
+  next = dropPreprocessKey(next);
+  next = dropVitePreprocessImport(next);
   if (next === src) return false;
   await writeFile5(path, next, "utf-8");
   return true;
@@ -1056,8 +1253,8 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
 import { join as join10 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
-  const pkg2 = await readPackageJson(join10(cwd, "package.json"));
-  const tailwindVersion = pkg2.devDependencies?.tailwindcss ?? pkg2.dependencies?.tailwindcss;
+  const pkg = await readPackageJson(join10(cwd, "package.json"));
+  const tailwindVersion = pkg.devDependencies?.tailwindcss ?? pkg.dependencies?.tailwindcss;
   if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
   if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
   try {
@@ -1077,7 +1274,7 @@ async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-gotchas.ts
-import { readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
 import { join as join11 } from "path";
 import { glob as glob2 } from "tinyglobby";
 
@@ -1136,10 +1333,32 @@ function exportLetToProps(source) {
 }
 
 // src/recipes/svelte-5/codemods/dollar-restprops.ts
+function removeInterfaceBlock(source) {
+  const re = /^\s*interface\s+\$\$Props\s*\{/m;
+  let out = source;
+  while (true) {
+    const match = re.exec(out);
+    if (!match) return out;
+    const openBraceIdx = match.index + match[0].length - 1;
+    let depth = 1;
+    let i = openBraceIdx + 1;
+    while (i < out.length && depth > 0) {
+      const ch = out[i];
+      if (ch === "{") depth++;
+      else if (ch === "}") depth--;
+      i++;
+    }
+    if (depth !== 0) return out;
+    let endIdx = i;
+    while (endIdx < out.length && /[ \t]/.test(out[endIdx] ?? "")) endIdx++;
+    if (out[endIdx] === "\n") endIdx++;
+    out = out.slice(0, match.index) + out.slice(endIdx);
+  }
+}
 function removeDollarRestProps(source) {
   let next = source;
   next = next.replace(/\$\$restProps/g, "rest");
-  next = next.replace(/^\s*interface\s+\$\$Props\s*\{[^}]*\}\s*\n/gm, "");
+  next = removeInterfaceBlock(next);
   return next;
 }
 
@@ -1152,7 +1371,7 @@ async function applyGotchaCodemods(cwd) {
   const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
   for (const rel of relPaths) {
     const path = join11(cwd, rel);
-    const before = await readFile8(path, "utf-8");
+    const before = await readFile10(path, "utf-8");
     const after = CODEMODS.reduce((s, fn) => fn(s), before);
     if (after !== before) {
       await writeFile6(path, after, "utf-8");
@@ -1209,8 +1428,8 @@ function siteLabel8(site) {
 }
 async function alreadyOnSvelte5(cwd) {
   try {
-    const pkg2 = await readPackageJson(join13(cwd, "package.json"));
-    const v = pkg2.devDependencies?.svelte ?? pkg2.dependencies?.svelte;
+    const pkg = await readPackageJson(join13(cwd, "package.json"));
+    const v = pkg.devDependencies?.svelte ?? pkg.dependencies?.svelte;
     return !!v && /^\^?5\./.test(v);
   } catch {
     return false;
@@ -1322,9 +1541,22 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
   return { output, code };
 }
 
+// src/cli/version.ts
+import { readFileSync } from "fs";
+import { join as join14 } from "path";
+function resolvePackageVersion(fromDir) {
+  try {
+    const raw = readFileSync(join14(fromDir, "..", "..", "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/cli/bin.ts
 var here = dirname(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync(join14(here, "../../package.json"), "utf-8"));
+var version = resolvePackageVersion(here);
 var AUDIT_DESCRIPTIONS = {
   deps: "Diff site package.json against the bundled baseline version map.",
   lighthouse: "Run @lhci/cli autorun using the canonical lighthouserc.",
@@ -1403,6 +1635,6 @@ cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to
   }
 );
 cli.help();
-cli.version(pkg.version);
+cli.version(version);
 cli.parse();
 //# sourceMappingURL=bin.js.map