@reddoorla/maintenance 0.1.0

package/dist/cli/bin.js

@@ -0,0 +1,1408 @@
+#!/usr/bin/env node
+
+// src/cli/bin.ts
+import { readFileSync } from "fs";
+import { dirname, join as join14 } from "path";
+import { fileURLToPath } from "url";
+import { cac } from "cac";
+
+// src/cli/commands/audit.ts
+import { resolve as resolve2 } from "path";
+
+// src/audits/util/spawn.ts
+import { spawn } from "child_process";
+var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve6, reject) => {
+  const child = spawn(cmd, [...args], {
+    cwd: opts.cwd,
+    env: opts.env ?? process.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += String(chunk));
+  child.stderr.on("data", (chunk) => stderr += String(chunk));
+  const timer = opts.timeoutMs ? setTimeout(() => {
+    child.kill("SIGTERM");
+    reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
+  }, opts.timeoutMs) : void 0;
+  child.on("error", (err) => {
+    if (timer) clearTimeout(timer);
+    reject(err);
+  });
+  child.on("close", (code) => {
+    if (timer) clearTimeout(timer);
+    resolve6({ code: code ?? -1, stdout, stderr });
+  });
+});
+
+// src/audits/deps.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+
+// src/configs/baseline-versions.ts
+var baselineVersions = {
+  // SvelteKit core
+  svelte: "^5.55.5",
+  "@sveltejs/kit": "^2.59.0",
+  "@sveltejs/adapter-netlify": "^6.0.4",
+  "@sveltejs/adapter-auto": "^7.0.0",
+  "@sveltejs/vite-plugin-svelte": "^7.0.0",
+  "svelte-check": "^4.4.7",
+  // Build tooling
+  vite: "^8.0.10",
+  vitest: "^4.1.1",
+  typescript: "^6.0.3",
+  // Tailwind 4
+  tailwindcss: "^4.0.14",
+  "@tailwindcss/vite": "^4.3.0",
+  // Prismic
+  "@prismicio/client": "^7.3.1",
+  "@prismicio/svelte": "^2.0.0",
+  "@slicemachine/adapter-sveltekit": "^0.3.36",
+  "slice-machine-ui": "^2.11.1",
+  // Test tooling
+  "@playwright/test": "^1.59.1",
+  "@axe-core/playwright": "^4.11.3",
+  "@lhci/cli": "^0.15.1",
+  // Lint
+  eslint: "^10.3.0",
+  "eslint-plugin-svelte": "^3.1.0",
+  "eslint-config-prettier": "^10.1.1",
+  prettier: "^3.1.1",
+  "prettier-plugin-svelte": "^3.2.6",
+  "typescript-eslint": "^8.59.1",
+  "@eslint/js": "^10.0.1",
+  globals: "^17.6.0",
+  // Misc
+  "@lucide/svelte": "^1.14.0",
+  "@zerodevx/svelte-img": "^2.1.2"
+};
+
+// src/audits/deps.ts
+function siteLabel(site) {
+  return site.name ?? site.path;
+}
+function stripCaret(range) {
+  return range.replace(/^[\^~]/, "");
+}
+function parseSemver(v) {
+  const cleaned = stripCaret(v).split("-")[0] ?? "0.0.0";
+  const parts = cleaned.split(".").map((n) => Number.parseInt(n, 10));
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function compareSemver(actual, baseline) {
+  const [aMajor, aMinor, aPatch] = parseSemver(actual);
+  const [bMajor, bMinor, bPatch] = parseSemver(baseline);
+  if (aMajor > bMajor) return "newer";
+  if (aMajor < bMajor) return "major";
+  if (aMinor > bMinor) return "newer";
+  if (aMinor < bMinor) return "minor";
+  if (aPatch > bPatch) return "newer";
+  if (aPatch < bPatch) return "patch";
+  return "same";
+}
+async function depsAudit(ctx) {
+  const pkgPath = join(ctx.site.path, "package.json");
+  let pkgRaw;
+  try {
+    pkgRaw = await readFile(pkgPath, "utf-8");
+  } catch (err) {
+    return {
+      audit: "deps",
+      site: siteLabel(ctx.site),
+      status: "skip",
+      summary: `no package.json at ${pkgPath}`,
+      details: { error: String(err) }
+    };
+  }
+  const pkg2 = JSON.parse(pkgRaw);
+  const installed = {
+    ...pkg2.dependencies ?? {},
+    ...pkg2.devDependencies ?? {}
+  };
+  const details = [];
+  for (const [name, baseline] of Object.entries(baselineVersions)) {
+    const actual = installed[name];
+    if (!actual) continue;
+    details.push({
+      pkg: name,
+      baseline,
+      actual,
+      drift: compareSemver(actual, baseline)
+    });
+  }
+  const anyMajor = details.some((d) => d.drift === "major");
+  const anyMinor = details.some((d) => d.drift === "minor");
+  const anyNewer = details.some((d) => d.drift === "newer");
+  const status = anyMajor ? "fail" : anyMinor || anyNewer ? "warn" : "pass";
+  const summary = status === "pass" ? `all ${details.length} tracked deps in line with baseline` : status === "warn" ? `${details.filter((d) => d.drift !== "same").length} of ${details.length} tracked deps drifted` : `${details.filter((d) => d.drift === "major").length} deps lagging by a major version`;
+  return {
+    audit: "deps",
+    site: siteLabel(ctx.site),
+    status,
+    summary,
+    details
+  };
+}
+
+// src/audits/lint.ts
+import { existsSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join2, relative } from "path";
+import { ESLint } from "eslint";
+import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
+import { glob } from "tinyglobby";
+var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
+var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
+function siteLabel2(site) {
+  return site.name ?? site.path;
+}
+async function listFiles(cwd) {
+  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
+}
+async function lintAudit(ctx) {
+  const { site } = ctx;
+  const configPath = join2(site.path, "eslint.config.js");
+  if (!existsSync(configPath)) {
+    return {
+      audit: "lint",
+      site: siteLabel2(site),
+      status: "skip",
+      summary: "no eslint config at site root"
+    };
+  }
+  const eslint2 = new ESLint({
+    cwd: site.path,
+    overrideConfigFile: configPath,
+    errorOnUnmatchedPattern: false
+  });
+  const relFiles = await listFiles(site.path);
+  const filesToLint = relFiles.map((f) => join2(site.path, f));
+  const eslintResults = await eslint2.lintFiles(filesToLint);
+  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
+  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
+  const prettierUnformatted = [];
+  for (const file of filesToLint) {
+    const source = await readFile2(file, "utf-8");
+    const options = await prettierResolveConfig(file) ?? {};
+    const ok = await prettierCheck(source, { ...options, filepath: file });
+    if (!ok) prettierUnformatted.push(relative(site.path, file));
+  }
+  const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
+  const summary = status === "pass" ? `lint clean across ${filesToLint.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
+  return {
+    audit: "lint",
+    site: siteLabel2(site),
+    status,
+    summary,
+    details: {
+      eslintErrors,
+      eslintWarnings,
+      prettierUnformatted,
+      files: filesToLint.length
+    }
+  };
+}
+
+// src/audits/security.ts
+function siteLabel3(site) {
+  return site.name ?? site.path;
+}
+function classify(v) {
+  if (v.critical > 0 || v.high > 0) return "fail";
+  if (v.moderate > 0 || v.low > 0) return "warn";
+  return "pass";
+}
+async function tryRun(spawn2, cmd, args, cwd) {
+  try {
+    return await spawn2(cmd, args, { cwd });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { missing: true };
+    throw err;
+  }
+}
+async function securityAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel3(site);
+  let used = "pnpm audit";
+  let raw = await tryRun(
+    spawn2,
+    "pnpm",
+    ["audit", "--json", "--prod"],
+    site.path
+  );
+  if ("missing" in raw) {
+    used = "npm audit";
+    raw = await tryRun(spawn2, "npm", ["audit", "--json", "--omit=dev"], site.path);
+  }
+  if ("missing" in raw) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: "neither pnpm nor npm is available on PATH"
+    };
+  }
+  if (raw.code !== 0 && raw.code !== 1) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: `${used} exited with code ${raw.code}`,
+      details: { stderr: raw.stderr }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.stdout);
+  } catch (err) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: `${used} produced unparseable JSON`,
+      details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
+    };
+  }
+  const vuln = {
+    low: parsed.metadata?.vulnerabilities?.low ?? 0,
+    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
+    high: parsed.metadata?.vulnerabilities?.high ?? 0,
+    critical: parsed.metadata?.vulnerabilities?.critical ?? 0
+  };
+  const status = classify(vuln);
+  const total = vuln.low + vuln.moderate + vuln.high + vuln.critical;
+  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${vuln.critical}C/${vuln.high}H/${vuln.moderate}M/${vuln.low}L)`;
+  return {
+    audit: "security",
+    site: label,
+    status,
+    summary,
+    details: vuln
+  };
+}
+
+// src/audits/lighthouse.ts
+import { writeFile, mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+
+// src/configs/lighthouse.ts
+var lighthouseConfig = {
+  ci: {
+    collect: {
+      url: ["http://localhost:5173/dev/a11y-fixtures"],
+      startServerCommand: "pnpm vite:dev",
+      startServerReadyPattern: "ready in",
+      startServerReadyTimeout: 12e4,
+      numberOfRuns: 1,
+      settings: {
+        preset: "desktop",
+        skipAudits: ["uses-http2"]
+      }
+    },
+    assert: {
+      assertions: {
+        "categories:accessibility": ["error", { minScore: 0.95 }],
+        "categories:best-practices": ["error", { minScore: 0.9 }],
+        "categories:seo": ["error", { minScore: 0.9 }],
+        "categories:performance": ["warn", { minScore: 0.7 }]
+      }
+    },
+    upload: {
+      target: "temporary-public-storage"
+    }
+  }
+};
+
+// src/audits/lighthouse.ts
+function siteLabel4(site) {
+  return site.name ?? site.path;
+}
+function isFakeShape(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.assertionsFailed === "number" && parsed.summary) return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function lighthouseAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel4(site);
+  const dir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
+  const configPath = join3(dir, "lighthouserc.json");
+  await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
+  let raw;
+  try {
+    raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
+      cwd: site.path
+    });
+  } catch (err) {
+    await rm(dir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "lighthouse",
+        site: label,
+        status: "skip",
+        summary: "npx/@lhci/cli not available"
+      };
+    }
+    throw err;
+  }
+  await rm(dir, { recursive: true, force: true });
+  const fake = isFakeShape(raw.stdout);
+  const normalized = fake ?? {
+    summary: {},
+    assertionsFailed: raw.code === 0 ? 0 : 1,
+    assertions: raw.code === 0 ? [] : [{ category: "unknown", level: "error", message: raw.stderr.slice(0, 200) }]
+  };
+  const anyError = (normalized.assertions ?? []).some((a) => a.level === "error");
+  const anyWarn = (normalized.assertions ?? []).some((a) => a.level === "warn");
+  const status = anyError ? "fail" : anyWarn ? "warn" : "pass";
+  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${normalized.assertionsFailed} assertion(s) failed`;
+  return {
+    audit: "lighthouse",
+    site: label,
+    status,
+    summary,
+    details: normalized
+  };
+}
+
+// src/audits/a11y.ts
+import { writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+
+// src/configs/playwright-a11y.ts
+import { defineConfig, devices } from "@playwright/test";
+var a11yRoutes = [
+  { path: "/dev/a11y-fixtures", name: "a11y fixtures" },
+  { path: "/dev/animate-in", name: "animate-in demo" }
+];
+var playwrightA11yConfig = defineConfig({
+  testDir: "tests",
+  testMatch: /.*\.spec\.ts$/,
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  reporter: process.env.CI ? "github" : "list",
+  use: {
+    baseURL: "http://localhost:5173",
+    trace: "on-first-retry"
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] }
+    }
+  ],
+  webServer: {
+    command: "pnpm vite:dev",
+    url: "http://localhost:5173/dev/a11y-fixtures",
+    reuseExistingServer: !process.env.CI,
+    timeout: 12e4
+  }
+});
+
+// src/audits/a11y.ts
+function siteLabel5(site) {
+  return site.name ?? site.path;
+}
+function isFakeShape2(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.totalViolations === "number" && parsed.byImpact) return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+function buildSpec() {
+  return `
+import { test, expect } from "@playwright/test";
+import AxeBuilder from "@axe-core/playwright";
+const pages = ${JSON.stringify(a11yRoutes)};
+for (const { path, name } of pages) {
+  test(\`\${name} has no axe violations\`, async ({ page }) => {
+    await page.goto(path);
+    const results = await new AxeBuilder({ page })
+      .withTags(["wcag2a","wcag2aa","wcag21a","wcag21aa","wcag22aa"])
+      .analyze();
+    expect(results.violations).toEqual([]);
+  });
+}
+`;
+}
+async function a11yAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel5(site);
+  const dir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-"));
+  const specPath = join4(dir, "a11y.spec.ts");
+  await writeFile2(specPath, buildSpec(), "utf-8");
+  let raw;
+  try {
+    raw = await spawn2("npx", ["--yes", "playwright", "test", "--reporter=json", specPath], {
+      cwd: site.path
+    });
+  } catch (err) {
+    await rm2(dir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "a11y",
+        site: label,
+        status: "skip",
+        summary: "npx/playwright not available"
+      };
+    }
+    throw err;
+  }
+  await rm2(dir, { recursive: true, force: true });
+  const fake = isFakeShape2(raw.stdout);
+  const normalized = fake ?? {
+    totalViolations: raw.code === 0 ? 0 : 1,
+    byImpact: raw.code === 0 ? {} : { moderate: 1 }
+  };
+  const hasSerious = (normalized.byImpact.serious ?? 0) > 0 || (normalized.byImpact.critical ?? 0) > 0;
+  const hasAny = normalized.totalViolations > 0;
+  const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
+  const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes` : `a11y: ${normalized.totalViolations} violations`;
+  return {
+    audit: "a11y",
+    site: label,
+    status,
+    summary,
+    details: normalized
+  };
+}
+
+// src/audits/index.ts
+var REGISTRY = {
+  deps: depsAudit,
+  lint: lintAudit,
+  security: securityAudit,
+  lighthouse: lighthouseAudit,
+  a11y: a11yAudit
+};
+var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
+var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
+function timedSpawn(timeoutMs) {
+  return (cmd, args, opts = {}) => defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });
+}
+async function runAudits(site, which) {
+  const names = which ?? ALL_AUDIT_NAMES;
+  for (const n of names) {
+    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);
+  }
+  const spawn2 = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
+  const label = site.name ?? site.path;
+  return Promise.all(
+    names.map(
+      (n) => REGISTRY[n]({ site, spawn: spawn2 }).catch(
+        (err) => ({
+          audit: n,
+          site: label,
+          status: "fail",
+          summary: `${n}: unexpected error \u2014 ${String(err)}`
+        })
+      )
+    )
+  );
+}
+
+// src/cli/fleet/resolve-sites.ts
+import { pathToFileURL } from "url";
+import { resolve, extname } from "path";
+
+// src/inventory/local.ts
+import { basename } from "path";
+function localPath(path, opts = {}) {
+  const site = { path, name: opts.name ?? basename(path) };
+  return async () => [site];
+}
+
+// src/inventory/json.ts
+import { readFile as readFile3 } from "fs/promises";
+function validate(raw) {
+  if (!Array.isArray(raw)) {
+    throw new Error("inventory JSON must be an array of sites");
+  }
+  return raw.map((entry, i) => {
+    if (!entry || typeof entry !== "object") {
+      throw new Error(`inventory entry ${i} is not an object`);
+    }
+    const e = entry;
+    if (typeof e.path !== "string" || e.path.length === 0) {
+      throw new Error(`inventory entry ${i} is missing required field: path`);
+    }
+    const site = { path: e.path };
+    if (typeof e.name === "string") site.name = e.name;
+    if (typeof e.repoUrl === "string") site.repoUrl = e.repoUrl;
+    if (typeof e.meta === "object" && e.meta !== null) {
+      site.meta = e.meta;
+    }
+    return site;
+  });
+}
+function fromJsonFile(path) {
+  return async () => {
+    const raw = JSON.parse(await readFile3(path, "utf-8"));
+    return validate(raw);
+  };
+}
+
+// src/cli/fleet/resolve-sites.ts
+async function resolveSites(input) {
+  if (input.site && input.fleet) {
+    throw Object.assign(new Error("cannot combine a positional [site] with --fleet"), {
+      exitCode: 2
+    });
+  }
+  if (input.fleet) {
+    const fleetPath = resolve(input.cwd, input.fleet);
+    const ext = extname(fleetPath).toLowerCase();
+    let provider;
+    if (ext === ".json") {
+      provider = fromJsonFile(fleetPath);
+    } else if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
+      const mod = await import(pathToFileURL(fleetPath).href);
+      if (!mod.default || typeof mod.default !== "function") {
+        throw Object.assign(new Error(`--fleet ${input.fleet}: default export is not a function`), {
+          exitCode: 2
+        });
+      }
+      provider = mod.default;
+    } else {
+      throw Object.assign(
+        new Error(`--fleet ${input.fleet}: unsupported extension ${ext || "(none)"}`),
+        { exitCode: 2 }
+      );
+    }
+    return provider();
+  }
+  return localPath(resolve(input.cwd, input.site ?? input.cwd))();
+}
+
+// src/cli/fleet/clone-if-needed.ts
+import { stat, readdir, mkdir } from "fs/promises";
+import { join as join5 } from "path";
+function deriveNameFromRepoUrl(repoUrl) {
+  const slash = repoUrl.split("/").pop() ?? repoUrl;
+  return slash.replace(/\.git$/, "");
+}
+async function isNonEmptyDir(path) {
+  try {
+    const s = await stat(path);
+    if (!s.isDirectory()) return false;
+    const entries = await readdir(path);
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function cloneIfNeeded(site, opts) {
+  if (await isNonEmptyDir(site.path)) return site;
+  if (!site.repoUrl) {
+    throw new Error(`site path does not exist (${site.path}) and no repoUrl is set \u2014 cannot clone`);
+  }
+  const name = site.name ?? deriveNameFromRepoUrl(site.repoUrl);
+  const target = join5(opts.workdir, name);
+  await mkdir(opts.workdir, { recursive: true });
+  if (await isNonEmptyDir(target)) {
+    return { ...site, name, path: target };
+  }
+  const spawn2 = opts.spawn ?? defaultSpawn;
+  const result = await spawn2("git", ["clone", site.repoUrl, target], {
+    cwd: opts.workdir,
+    timeoutMs: 5 * 6e4
+  });
+  if (result.code !== 0) {
+    throw new Error(`git clone failed (code ${result.code}): ${result.stderr}`);
+  }
+  return { ...site, name, path: target };
+}
+
+// src/cli/commands/audit.ts
+function parseOnly(value) {
+  if (!value) return void 0;
+  const names = value.split(",").map((s) => s.trim());
+  for (const n of names) {
+    if (!ALL_AUDIT_NAMES.includes(n)) {
+      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });
+    }
+  }
+  return names;
+}
+function formatTable(results) {
+  return results.map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}
+  ${r.summary}`).join("\n");
+}
+function exitCode(results) {
+  return results.some((r) => r.status === "fail") ? 1 : 0;
+}
+async function runAuditCommand(site, opts) {
+  const which = parseOnly(opts.only);
+  const cwd = opts.cwd ? resolve2(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  const results = [];
+  for (const s of sites) {
+    const r = await runAudits(s, which);
+    results.push(...r);
+  }
+  const output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);
+  return { output, code: exitCode(results) };
+}
+
+// src/cli/commands/sync-configs.ts
+import { readFile as readFile5 } from "fs/promises";
+import { join as join7, resolve as resolve3 } from "path";
+
+// src/recipes/sync-configs.ts
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { join as join6 } from "path";
+
+// src/recipes/sync-configs/templates.ts
+var eslint = {
+  config: "eslint",
+  path: "eslint.config.js",
+  contents: `import { createEslintConfig } from "@reddoorla/maintenance/configs/eslint";
+import svelteConfig from "./svelte.config.js";
+
+export default createEslintConfig({ svelteConfig });
+`
+};
+var prettier = {
+  config: "prettier",
+  path: ".prettierrc.json",
+  contents: `{
+  "trailingComma": "all",
+  "singleQuote": false,
+  "printWidth": 100,
+  "plugins": ["prettier-plugin-svelte"]
+}
+`
+};
+var lighthouse = {
+  config: "lighthouse",
+  path: "lighthouserc.json",
+  contents: `${JSON.stringify(
+    {
+      $note: "Generated by @reddoorla/maintenance sync-configs; edit src/configs/lighthouse.ts in the package instead.",
+      extends: "@reddoorla/maintenance/configs/lighthouse"
+    },
+    null,
+    2
+  )}
+`
+};
+var playwrightA11y = {
+  config: "playwright-a11y",
+  path: "playwright.config.ts",
+  contents: `export { default } from "@reddoorla/maintenance/configs/playwright-a11y";
+`
+};
+var ALL_TEMPLATES = [eslint, prettier, lighthouse, playwrightA11y];
+function templatesByName(which) {
+  return ALL_TEMPLATES.filter((t) => which.includes(t.config));
+}
+
+// src/util/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var exec = promisify(execFile);
+async function git(cwd, args) {
+  return exec("git", args, { cwd, env: process.env });
+}
+function branchName(recipe, when = /* @__PURE__ */ new Date()) {
+  const iso = when.toISOString().replace(/[-:.]/g, "").replace(/Z$/, "Z");
+  const trimmed = iso.replace(/(\d{8}T\d{6})\d+(Z)$/, "$1$2");
+  return `maint/${recipe}-${trimmed}`;
+}
+async function isWorkingTreeClean(cwd) {
+  const { stdout } = await git(cwd, ["status", "--porcelain"]);
+  return stdout.trim().length === 0;
+}
+async function createBranch(cwd, name) {
+  await git(cwd, ["checkout", "-b", name]);
+}
+async function stageAll(cwd) {
+  await git(cwd, ["add", "-A"]);
+}
+async function commit(cwd, message) {
+  await stageAll(cwd);
+  const { stdout: status } = await git(cwd, ["status", "--porcelain"]);
+  if (status.trim().length === 0) return null;
+  await git(cwd, ["commit", "-m", message]);
+  const { stdout: sha } = await git(cwd, ["rev-parse", "HEAD"]);
+  return sha.trim();
+}
+
+// src/recipes/sync-configs.ts
+function siteLabel6(site) {
+  return site.name ?? site.path;
+}
+async function readMaybe(path) {
+  try {
+    return await readFile4(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function planDiffs(cwd, templates) {
+  const diffs = [];
+  for (const t of templates) {
+    const existing = await readMaybe(join6(cwd, t.path));
+    if (existing !== t.contents) diffs.push(t);
+  }
+  return diffs;
+}
+async function syncConfigs(site, opts = {}) {
+  const label = siteLabel6(site);
+  const targets = opts.which ? templatesByName(opts.which) : ALL_TEMPLATES;
+  const diffs = await planDiffs(site.path, targets);
+  if (diffs.length === 0) {
+    return {
+      recipe: "sync-configs",
+      site: label,
+      status: "noop",
+      commits: [],
+      notes: "all targeted configs already match"
+    };
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
+  const branch = branchName("sync-configs");
+  await createBranch(site.path, branch);
+  const shas = [];
+  for (const t of diffs) {
+    await writeFile3(join6(site.path, t.path), t.contents, "utf-8");
+    const sha = await commit(
+      site.path,
+      `chore: sync ${t.config} config from @reddoorla/maintenance`
+    );
+    if (sha) shas.push(sha);
+  }
+  return {
+    recipe: "sync-configs",
+    site: label,
+    status: "applied",
+    commits: shas,
+    notes: `branch: ${branch}`
+  };
+}
+
+// src/cli/commands/sync-configs.ts
+function parseOnly2(value) {
+  return value ? value.split(",").map((s) => s.trim()) : void 0;
+}
+async function dryPlan(cwd, which) {
+  const targets = which ? templatesByName(which) : ALL_TEMPLATES;
+  const lines = [];
+  for (const t of targets) {
+    let existing = "";
+    try {
+      existing = await readFile5(join7(cwd, t.path), "utf-8");
+    } catch {
+    }
+    if (existing !== t.contents) lines.push(`would update ${t.path} (config: ${t.config})`);
+  }
+  return lines.length === 0 ? "no changes needed" : lines.join("\n");
+}
+function formatResult(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? "all configs in sync"}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runSyncConfigsCommand(site, opts) {
+  const which = parseOnly2(opts.only);
+  const cwd = opts.cwd ? resolve3(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  if (opts.dry) {
+    const blocks = [];
+    for (const s of sites) {
+      blocks.push(`[${s.name ?? s.path}]
+` + await dryPlan(s.path, which));
+    }
+    return { output: blocks.join("\n\n"), code: 0 };
+  }
+  const results = [];
+  for (const s of sites) results.push(await syncConfigs(s, which ? { which } : {}));
+  const output = results.map(formatResult).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output, code };
+}
+
+// src/cli/commands/bump-deps.ts
+import { resolve as resolve4 } from "path";
+
+// src/recipes/bump-deps.ts
+function siteLabel7(site) {
+  return site.name ?? site.path;
+}
+function outdatedFlagsForGroup(group) {
+  if (group === "major") return ["--latest"];
+  if (group === "minor") return [];
+  return ["--depth", "0"];
+}
+function upFlagsForGroup(group) {
+  if (group === "major") return ["--latest"];
+  return [];
+}
+async function bumpDeps(site, opts = {}) {
+  const label = siteLabel7(site);
+  const group = opts.group ?? "minor";
+  const spawn2 = opts.spawn ?? defaultSpawn;
+  const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
+    cwd: site.path
+  });
+  let parsed;
+  try {
+    parsed = JSON.parse(outdated.stdout || "{}");
+  } catch {
+    parsed = {};
+  }
+  const nothingToDo = Object.keys(parsed).length === 0;
+  if (nothingToDo) {
+    return {
+      recipe: "bump-deps",
+      site: label,
+      status: "noop",
+      commits: [],
+      notes: `pnpm outdated reported nothing for group=${group}`
+    };
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
+  const branch = branchName("bump-deps");
+  await createBranch(site.path, branch);
+  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], { cwd: site.path });
+  const sha = await commit(site.path, `chore(deps): bump dependencies (${group})`);
+  const shas = sha ? [sha] : [];
+  return {
+    recipe: "bump-deps",
+    site: label,
+    status: shas.length > 0 ? "applied" : "noop",
+    commits: shas,
+    notes: `branch: ${branch}`
+  };
+}
+
+// src/cli/commands/bump-deps.ts
+var GROUPS = ["patch", "minor", "major"];
+function formatResult2(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runBumpDepsCommand(site, opts) {
+  const group = opts.group ?? "minor";
+  if (!GROUPS.includes(group)) {
+    throw Object.assign(
+      new Error(`unknown --group: ${group}. expected one of ${GROUPS.join(", ")}`),
+      { exitCode: 2 }
+    );
+  }
+  const cwd = opts.cwd ? resolve4(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  const results = [];
+  for (const s of sites) results.push(await bumpDeps(s, { group }));
+  const output = results.map(formatResult2).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output, code };
+}
+
+// src/cli/commands/upgrade.ts
+import { resolve as resolve5 } from "path";
+
+// src/recipes/svelte-5/index.ts
+import { join as join13 } from "path";
+
+// src/util/pkg.ts
+import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+async function readPackageJson(path) {
+  const raw = await readFile6(path, "utf-8");
+  return JSON.parse(raw);
+}
+async function writePackageJson(path, pkg2) {
+  const content = JSON.stringify(pkg2, null, 2) + "\n";
+  await writeFile4(path, content, "utf-8");
+}
+function bumpDep(pkg2, name, version) {
+  const next = {
+    ...pkg2
+  };
+  if (pkg2.dependencies) {
+    next.dependencies = { ...pkg2.dependencies };
+  }
+  if (pkg2.devDependencies) {
+    next.devDependencies = { ...pkg2.devDependencies };
+  }
+  if (next.dependencies && name in next.dependencies) {
+    if (next.dependencies[name] === version) return pkg2;
+    next.dependencies[name] = version;
+    return next;
+  }
+  if (next.devDependencies && name in next.devDependencies) {
+    if (next.devDependencies[name] === version) return pkg2;
+    next.devDependencies[name] = version;
+    return next;
+  }
+  next.devDependencies = { ...next.devDependencies ?? {}, [name]: version };
+  return next;
+}
+
+// src/recipes/svelte-5/step-bump-versions.ts
+import { join as join8 } from "path";
+var SVELTE_5_VERSIONS = {
+  svelte: "^5.55.5",
+  "@sveltejs/kit": "^2.59.0",
+  "@sveltejs/vite-plugin-svelte": "^7.0.0",
+  "@sveltejs/adapter-netlify": "^6.0.4",
+  "@sveltejs/adapter-auto": "^7.0.0",
+  vite: "^8.0.10",
+  "svelte-check": "^4.4.7",
+  typescript: "^6.0.3",
+  "typescript-svelte-plugin": "^0.3.52"
+};
+async function bumpToSvelte5Versions(cwd) {
+  const pkgPath = join8(cwd, "package.json");
+  const pkg2 = await readPackageJson(pkgPath);
+  let next = pkg2;
+  for (const [name, version] of Object.entries(SVELTE_5_VERSIONS)) {
+    next = bumpDep(next, name, version);
+  }
+  if (next === pkg2) return false;
+  await writePackageJson(pkgPath, next);
+  return true;
+}
+
+// src/recipes/svelte-5/step-svelte-config.ts
+import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { join as join9 } from "path";
+async function migrateSvelteConfig(cwd) {
+  const path = join9(cwd, "svelte.config.js");
+  let src;
+  try {
+    src = await readFile7(path, "utf-8");
+  } catch {
+    return false;
+  }
+  let next = src;
+  next = next.replace(
+    /^import\s+\{\s*vitePreprocess\s*\}\s+from\s+["']@sveltejs\/vite-plugin-svelte["'];\n/m,
+    ""
+  );
+  next = next.replace(/^\s*preprocess:\s*vitePreprocess\(\)\s*,?\s*\n/m, "");
+  if (next === src) return false;
+  await writeFile5(path, next, "utf-8");
+  return true;
+}
+
+// src/recipes/svelte-5/step-svelte-migrate.ts
+async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
+  try {
+    const { code, stderr } = await spawn2(
+      "npx",
+      ["--yes", "svelte-migrate", "svelte-5", "--no-install"],
+      { cwd, timeoutMs: 5 * 6e4 }
+    );
+    if (code !== 0) {
+      return { ran: false, stderr };
+    }
+    return { ran: true, stderr };
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return { ran: false, stderr: "npx unavailable" };
+    }
+    throw err;
+  }
+}
+
+// src/recipes/svelte-5/step-tailwind-upgrade.ts
+import { join as join10 } from "path";
+async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
+  const pkg2 = await readPackageJson(join10(cwd, "package.json"));
+  const tailwindVersion = pkg2.devDependencies?.tailwindcss ?? pkg2.dependencies?.tailwindcss;
+  if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
+  if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
+  try {
+    const { code, stderr } = await spawn2("npx", ["--yes", "@tailwindcss/upgrade", "--force"], {
+      cwd,
+      timeoutMs: 5 * 6e4
+    });
+    if (code !== 0) return { ran: false, reason: stderr.slice(0, 200) };
+    return { ran: true };
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return { ran: false, reason: "npx unavailable" };
+    }
+    throw err;
+  }
+}
+
+// src/recipes/svelte-5/step-gotchas.ts
+import { readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
+import { join as join11 } from "path";
+import { glob as glob2 } from "tinyglobby";
+
+// src/recipes/svelte-5/codemods/on-event-to-handler.ts
+var SCRIPT_BLOCK = /<script\b[^>]*>[\s\S]*?<\/script>/g;
+var SIMPLE_ON_EVENT = /\bon:([a-z]+)(?=\s*=)/g;
+function onEventToHandler(source) {
+  const masked = [];
+  const placeholder = (i) => ` SCRIPT_${i} `;
+  const intermediate = source.replace(SCRIPT_BLOCK, (match) => {
+    masked.push(match);
+    return placeholder(masked.length - 1);
+  });
+  const rewritten = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
+  let out = rewritten;
+  masked.forEach((blk, i) => {
+    out = out.replace(placeholder(i), blk);
+  });
+  return out;
+}
+
+// src/recipes/svelte-5/codemods/dollar-props.ts
+var SCRIPT_TS = /<script\b[^>]*lang=["']ts["'][^>]*>([\s\S]*?)<\/script>/;
+var EXPORT_LET = /^\s*export\s+let\s+(\w+)\s*(?::\s*([^=;\n]+))?\s*(?:=\s*([^;\n]+))?;?\s*$/gm;
+function transformScript(scriptBody) {
+  const props = [];
+  const cleaned = scriptBody.replace(
+    EXPORT_LET,
+    (_full, name, type, defaultExpr) => {
+      props.push({
+        name,
+        type: type?.trim(),
+        defaultExpr: defaultExpr?.trim()
+      });
+      return "";
+    }
+  );
+  if (props.length === 0) return { body: scriptBody, changed: false };
+  const typeSig = props.map((p) => {
+    const optional = p.defaultExpr ? "?" : "";
+    return `${p.name}${optional}: ${p.type ?? "unknown"}`;
+  }).join("; ");
+  const destructured = props.map((p) => p.defaultExpr ? `${p.name} = ${p.defaultExpr}` : p.name).join(", ");
+  const decl = `  let { ${destructured} }: { ${typeSig} } = $props();`;
+  const next = cleaned.replace(/^(\s*)/, (m) => `${m}${decl}
+`);
+  return { body: next, changed: true };
+}
+function exportLetToProps(source) {
+  const match = source.match(SCRIPT_TS);
+  if (!match) return source;
+  const inner = match[1] ?? "";
+  const { body, changed } = transformScript(inner);
+  if (!changed) return source;
+  return source.replace(SCRIPT_TS, (full) => full.replace(inner, body));
+}
+
+// src/recipes/svelte-5/codemods/dollar-restprops.ts
+function removeDollarRestProps(source) {
+  let next = source;
+  next = next.replace(/\$\$restProps/g, "rest");
+  next = next.replace(/^\s*interface\s+\$\$Props\s*\{[^}]*\}\s*\n/gm, "");
+  return next;
+}
+
+// src/recipes/svelte-5/step-gotchas.ts
+var SVELTE_GLOBS = ["src/**/*.svelte"];
+var IGNORE2 = ["node_modules/**", ".svelte-kit/**", "build/**"];
+var CODEMODS = [onEventToHandler, exportLetToProps, removeDollarRestProps];
+async function applyGotchaCodemods(cwd) {
+  let filesChanged = 0;
+  const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
+  for (const rel of relPaths) {
+    const path = join11(cwd, rel);
+    const before = await readFile8(path, "utf-8");
+    const after = CODEMODS.reduce((s, fn) => fn(s), before);
+    if (after !== before) {
+      await writeFile6(path, after, "utf-8");
+      filesChanged += 1;
+    }
+  }
+  return { filesChanged };
+}
+
+// src/recipes/svelte-5/step-verify.ts
+async function verifyMigration(cwd, spawn2 = defaultSpawn) {
+  let install;
+  try {
+    install = await spawn2("pnpm", ["install"], { cwd, timeoutMs: 10 * 6e4 });
+  } catch {
+    install = { skipped: true };
+  }
+  let check;
+  try {
+    check = await spawn2("pnpm", ["run", "check"], { cwd, timeoutMs: 5 * 6e4 });
+  } catch {
+    check = { skipped: true };
+  }
+  return { install, check };
+}
+
+// src/recipes/svelte-5/step-summary.ts
+import { writeFile as writeFile7 } from "fs/promises";
+import { join as join12 } from "path";
+async function writeMigrationSummary(input) {
+  const lines = [
+    `# Svelte 4 \u2192 5 migration summary`,
+    ``,
+    `Generated by @reddoorla/maintenance.`,
+    ``,
+    `- svelte-migrate run: ${input.svelteMigrateRan ? "yes" : "no"}`,
+    `- @tailwindcss/upgrade run: ${input.tailwindUpgraded ? "yes" : "no"}`,
+    `- .svelte files touched by gotcha codemods: ${input.filesChangedByCodemods}`,
+    ``,
+    `Next steps:`,
+    `- Run \`pnpm run check\` and resolve any remaining warnings.`,
+    `- Spot-check rune migrations in components that use \`reactive\` statements.`,
+    `- Verify Playwright a11y tests still pass.`
+  ];
+  const content = lines.join("\n") + "\n";
+  const path = join12(input.cwd, "MIGRATION_SVELTE_5.md");
+  await writeFile7(path, content, "utf-8");
+  return path;
+}
+
+// src/recipes/svelte-5/index.ts
+function siteLabel8(site) {
+  return site.name ?? site.path;
+}
+async function alreadyOnSvelte5(cwd) {
+  try {
+    const pkg2 = await readPackageJson(join13(cwd, "package.json"));
+    const v = pkg2.devDependencies?.svelte ?? pkg2.dependencies?.svelte;
+    return !!v && /^\^?5\./.test(v);
+  } catch {
+    return false;
+  }
+}
+async function upgradeSvelte4to5(site, opts = {}) {
+  const label = siteLabel8(site);
+  const spawn2 = opts.spawn ?? defaultSpawn;
+  if (await alreadyOnSvelte5(site.path)) {
+    return {
+      recipe: "svelte-4-to-5",
+      site: label,
+      status: "noop",
+      commits: [],
+      notes: "site already declares svelte ^5.x"
+    };
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
+  const branch = branchName("svelte-4-to-5");
+  await createBranch(site.path, branch);
+  const shas = [];
+  const bumped = await bumpToSvelte5Versions(site.path);
+  if (bumped) {
+    const sha = await commit(site.path, "chore(svelte5): bump svelte/kit/vite/vite-plugin-svelte");
+    if (sha) shas.push(sha);
+  }
+  const configChanged = await migrateSvelteConfig(site.path);
+  if (configChanged) {
+    const sha = await commit(
+      site.path,
+      "refactor(svelte5): migrate svelte.config.js (drop vitePreprocess)"
+    );
+    if (sha) shas.push(sha);
+  }
+  const migrate = await runSvelteMigrate(site.path, spawn2);
+  if (migrate.ran) {
+    const sha = await commit(site.path, "refactor(svelte5): run official svelte-migrate codemod");
+    if (sha) shas.push(sha);
+  }
+  const tw = await upgradeTailwind(site.path, spawn2);
+  if (tw.ran) {
+    const sha = await commit(site.path, "chore(svelte5): tailwindcss 3 \u2192 4 upgrade");
+    if (sha) shas.push(sha);
+  }
+  const codemods = await applyGotchaCodemods(site.path);
+  if (codemods.filesChanged > 0) {
+    const sha = await commit(
+      site.path,
+      `refactor(svelte5): apply gotcha codemods (${codemods.filesChanged} files)`
+    );
+    if (sha) shas.push(sha);
+  }
+  await verifyMigration(site.path, spawn2);
+  const verifySha = await commit(site.path, "chore(svelte5): pnpm install + check");
+  if (verifySha) shas.push(verifySha);
+  await writeMigrationSummary({
+    cwd: site.path,
+    filesChangedByCodemods: codemods.filesChanged,
+    svelteMigrateRan: migrate.ran,
+    tailwindUpgraded: tw.ran
+  });
+  const summarySha = await commit(site.path, "docs(svelte5): add MIGRATION_SVELTE_5.md summary");
+  if (summarySha) shas.push(summarySha);
+  return {
+    recipe: "svelte-4-to-5",
+    site: label,
+    status: shas.length > 0 ? "applied" : "noop",
+    commits: shas,
+    notes: `branch: ${branch}`
+  };
+}
+
+// src/cli/commands/upgrade.ts
+var KNOWN_UPGRADES = /* @__PURE__ */ new Set(["svelte-4-to-5"]);
+function formatResult3(r) {
+  if (r.status === "noop") return `[${r.site}] noop: ${r.notes ?? ""}`;
+  return `[${r.site}] applied: ${r.commits.length} commit(s)
+${r.notes ?? ""}`;
+}
+async function runUpgradeCommand(upgradeName, site, opts = {}) {
+  if (!upgradeName || !KNOWN_UPGRADES.has(upgradeName)) {
+    throw Object.assign(
+      new Error(
+        `unknown upgrade: ${upgradeName ?? "(none)"}. expected one of ${[...KNOWN_UPGRADES].join(", ")}`
+      ),
+      { exitCode: 2 }
+    );
+  }
+  const cwd = opts.cwd ? resolve5(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  const results = [];
+  for (const s of sites) {
+    if (upgradeName === "svelte-4-to-5") {
+      results.push(await upgradeSvelte4to5(s));
+    }
+  }
+  const output = results.map(formatResult3).join("\n");
+  const code = results.some((r) => r.status === "failed") ? 1 : 0;
+  return { output, code };
+}
+
+// src/cli/bin.ts
+var here = dirname(fileURLToPath(import.meta.url));
+var pkg = JSON.parse(readFileSync(join14(here, "../../package.json"), "utf-8"));
+var AUDIT_DESCRIPTIONS = {
+  deps: "Diff site package.json against the bundled baseline version map.",
+  lighthouse: "Run @lhci/cli autorun using the canonical lighthouserc.",
+  a11y: "Playwright + axe against the canonical a11y routes.",
+  security: "pnpm audit (falls back to npm audit), prod-deps by default.",
+  lint: "ESLint + Prettier using the canonical configs."
+};
+var RECIPE_DESCRIPTIONS = {
+  "sync-configs": "Overwrite a site's canonical configs to match @reddoorla/maintenance.",
+  "bump-deps": "Bump dependencies and commit the lockfile change.",
+  "svelte-4-to-5": "Run the 7-commit Svelte 4 \u2192 5 upgrade recipe."
+};
+var cli = cac("reddoor-maint");
+cli.option("--cwd <path>", "Override working directory (default: process.cwd())");
+cli.option("--verbose", "Verbose output (full stack on errors)");
+cli.command("list-audits", "Print the available audits.").action(() => {
+  for (const [name, desc] of Object.entries(AUDIT_DESCRIPTIONS)) {
+    console.log(`${name.padEnd(12)} ${desc}`);
+  }
+});
+cli.command("list-recipes", "Print the available recipes.").action(() => {
+  for (const [name, desc] of Object.entries(RECIPE_DESCRIPTIONS)) {
+    console.log(`${name.padEnd(16)} ${desc}`);
+  }
+});
+cli.command("audit [site]", "Run audits against a site (default: cwd).").option("--only <names>", "Comma-separated audit names (e.g. deps,lighthouse)").option("--json", "Machine-readable JSON output").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js); aggregates across sites").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (site, opts) => {
+    try {
+      const { output, code } = await runAuditCommand(site, opts);
+      console.log(output);
+      process.exit(code);
+    } catch (err) {
+      const e = err;
+      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+      process.exit(e.exitCode ?? 1);
+    }
+  }
+);
+cli.command("sync-configs [site]", "Sync canonical configs into a site.").option("--only <names>", "Comma-separated config names (e.g. eslint,prettier)").option("--dry", "Print diff without writing").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (site, opts) => {
+    try {
+      const { output, code } = await runSyncConfigsCommand(site, opts);
+      console.log(output);
+      process.exit(code);
+    } catch (err) {
+      const e = err;
+      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+      process.exit(e.exitCode ?? 1);
+    }
+  }
+);
+cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>", "patch | minor | major", { default: "minor" }).option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (site, opts) => {
+    try {
+      const { output, code } = await runBumpDepsCommand(site, opts);
+      console.log(output);
+      process.exit(code);
+    } catch (err) {
+      const e = err;
+      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+      process.exit(e.exitCode ?? 1);
+    }
+  }
+);
+cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to-5).").example("reddoor-maint upgrade svelte-4-to-5 ./my-site").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
+  async (upgrade, site, opts) => {
+    try {
+      const { output, code } = await runUpgradeCommand(upgrade, site, opts);
+      console.log(output);
+      process.exit(code);
+    } catch (err) {
+      const e = err;
+      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+      process.exit(e.exitCode ?? 1);
+    }
+  }
+);
+cli.help();
+cli.version(pkg.version);
+cli.parse();
+//# sourceMappingURL=bin.js.map