@reddoorla/maintenance 0.1.0

package/dist/cli/commands/audit.js

@@ -0,0 +1,666 @@
+// src/cli/commands/audit.ts
+import { resolve as resolve2 } from "path";
+
+// src/audits/util/spawn.ts
+import { spawn } from "child_process";
+var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve3, reject) => {
+  const child = spawn(cmd, [...args], {
+    cwd: opts.cwd,
+    env: opts.env ?? process.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += String(chunk));
+  child.stderr.on("data", (chunk) => stderr += String(chunk));
+  const timer = opts.timeoutMs ? setTimeout(() => {
+    child.kill("SIGTERM");
+    reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
+  }, opts.timeoutMs) : void 0;
+  child.on("error", (err) => {
+    if (timer) clearTimeout(timer);
+    reject(err);
+  });
+  child.on("close", (code) => {
+    if (timer) clearTimeout(timer);
+    resolve3({ code: code ?? -1, stdout, stderr });
+  });
+});
+
+// src/audits/deps.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+
+// src/configs/baseline-versions.ts
+var baselineVersions = {
+  // SvelteKit core
+  svelte: "^5.55.5",
+  "@sveltejs/kit": "^2.59.0",
+  "@sveltejs/adapter-netlify": "^6.0.4",
+  "@sveltejs/adapter-auto": "^7.0.0",
+  "@sveltejs/vite-plugin-svelte": "^7.0.0",
+  "svelte-check": "^4.4.7",
+  // Build tooling
+  vite: "^8.0.10",
+  vitest: "^4.1.1",
+  typescript: "^6.0.3",
+  // Tailwind 4
+  tailwindcss: "^4.0.14",
+  "@tailwindcss/vite": "^4.3.0",
+  // Prismic
+  "@prismicio/client": "^7.3.1",
+  "@prismicio/svelte": "^2.0.0",
+  "@slicemachine/adapter-sveltekit": "^0.3.36",
+  "slice-machine-ui": "^2.11.1",
+  // Test tooling
+  "@playwright/test": "^1.59.1",
+  "@axe-core/playwright": "^4.11.3",
+  "@lhci/cli": "^0.15.1",
+  // Lint
+  eslint: "^10.3.0",
+  "eslint-plugin-svelte": "^3.1.0",
+  "eslint-config-prettier": "^10.1.1",
+  prettier: "^3.1.1",
+  "prettier-plugin-svelte": "^3.2.6",
+  "typescript-eslint": "^8.59.1",
+  "@eslint/js": "^10.0.1",
+  globals: "^17.6.0",
+  // Misc
+  "@lucide/svelte": "^1.14.0",
+  "@zerodevx/svelte-img": "^2.1.2"
+};
+
+// src/audits/deps.ts
+function siteLabel(site) {
+  return site.name ?? site.path;
+}
+function stripCaret(range) {
+  return range.replace(/^[\^~]/, "");
+}
+function parseSemver(v) {
+  const cleaned = stripCaret(v).split("-")[0] ?? "0.0.0";
+  const parts = cleaned.split(".").map((n) => Number.parseInt(n, 10));
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function compareSemver(actual, baseline) {
+  const [aMajor, aMinor, aPatch] = parseSemver(actual);
+  const [bMajor, bMinor, bPatch] = parseSemver(baseline);
+  if (aMajor > bMajor) return "newer";
+  if (aMajor < bMajor) return "major";
+  if (aMinor > bMinor) return "newer";
+  if (aMinor < bMinor) return "minor";
+  if (aPatch > bPatch) return "newer";
+  if (aPatch < bPatch) return "patch";
+  return "same";
+}
+async function depsAudit(ctx) {
+  const pkgPath = join(ctx.site.path, "package.json");
+  let pkgRaw;
+  try {
+    pkgRaw = await readFile(pkgPath, "utf-8");
+  } catch (err) {
+    return {
+      audit: "deps",
+      site: siteLabel(ctx.site),
+      status: "skip",
+      summary: `no package.json at ${pkgPath}`,
+      details: { error: String(err) }
+    };
+  }
+  const pkg = JSON.parse(pkgRaw);
+  const installed = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {}
+  };
+  const details = [];
+  for (const [name, baseline] of Object.entries(baselineVersions)) {
+    const actual = installed[name];
+    if (!actual) continue;
+    details.push({
+      pkg: name,
+      baseline,
+      actual,
+      drift: compareSemver(actual, baseline)
+    });
+  }
+  const anyMajor = details.some((d) => d.drift === "major");
+  const anyMinor = details.some((d) => d.drift === "minor");
+  const anyNewer = details.some((d) => d.drift === "newer");
+  const status = anyMajor ? "fail" : anyMinor || anyNewer ? "warn" : "pass";
+  const summary = status === "pass" ? `all ${details.length} tracked deps in line with baseline` : status === "warn" ? `${details.filter((d) => d.drift !== "same").length} of ${details.length} tracked deps drifted` : `${details.filter((d) => d.drift === "major").length} deps lagging by a major version`;
+  return {
+    audit: "deps",
+    site: siteLabel(ctx.site),
+    status,
+    summary,
+    details
+  };
+}
+
+// src/audits/lint.ts
+import { existsSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join2, relative } from "path";
+import { ESLint } from "eslint";
+import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
+import { glob } from "tinyglobby";
+var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
+var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
+function siteLabel2(site) {
+  return site.name ?? site.path;
+}
+async function listFiles(cwd) {
+  return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
+}
+async function lintAudit(ctx) {
+  const { site } = ctx;
+  const configPath = join2(site.path, "eslint.config.js");
+  if (!existsSync(configPath)) {
+    return {
+      audit: "lint",
+      site: siteLabel2(site),
+      status: "skip",
+      summary: "no eslint config at site root"
+    };
+  }
+  const eslint = new ESLint({
+    cwd: site.path,
+    overrideConfigFile: configPath,
+    errorOnUnmatchedPattern: false
+  });
+  const relFiles = await listFiles(site.path);
+  const filesToLint = relFiles.map((f) => join2(site.path, f));
+  const eslintResults = await eslint.lintFiles(filesToLint);
+  const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
+  const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
+  const prettierUnformatted = [];
+  for (const file of filesToLint) {
+    const source = await readFile2(file, "utf-8");
+    const options = await prettierResolveConfig(file) ?? {};
+    const ok = await prettierCheck(source, { ...options, filepath: file });
+    if (!ok) prettierUnformatted.push(relative(site.path, file));
+  }
+  const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
+  const summary = status === "pass" ? `lint clean across ${filesToLint.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
+  return {
+    audit: "lint",
+    site: siteLabel2(site),
+    status,
+    summary,
+    details: {
+      eslintErrors,
+      eslintWarnings,
+      prettierUnformatted,
+      files: filesToLint.length
+    }
+  };
+}
+
+// src/audits/security.ts
+function siteLabel3(site) {
+  return site.name ?? site.path;
+}
+function classify(v) {
+  if (v.critical > 0 || v.high > 0) return "fail";
+  if (v.moderate > 0 || v.low > 0) return "warn";
+  return "pass";
+}
+async function tryRun(spawn2, cmd, args, cwd) {
+  try {
+    return await spawn2(cmd, args, { cwd });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { missing: true };
+    throw err;
+  }
+}
+async function securityAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel3(site);
+  let used = "pnpm audit";
+  let raw = await tryRun(
+    spawn2,
+    "pnpm",
+    ["audit", "--json", "--prod"],
+    site.path
+  );
+  if ("missing" in raw) {
+    used = "npm audit";
+    raw = await tryRun(spawn2, "npm", ["audit", "--json", "--omit=dev"], site.path);
+  }
+  if ("missing" in raw) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: "neither pnpm nor npm is available on PATH"
+    };
+  }
+  if (raw.code !== 0 && raw.code !== 1) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: `${used} exited with code ${raw.code}`,
+      details: { stderr: raw.stderr }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.stdout);
+  } catch (err) {
+    return {
+      audit: "security",
+      site: label,
+      status: "skip",
+      summary: `${used} produced unparseable JSON`,
+      details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
+    };
+  }
+  const vuln = {
+    low: parsed.metadata?.vulnerabilities?.low ?? 0,
+    moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
+    high: parsed.metadata?.vulnerabilities?.high ?? 0,
+    critical: parsed.metadata?.vulnerabilities?.critical ?? 0
+  };
+  const status = classify(vuln);
+  const total = vuln.low + vuln.moderate + vuln.high + vuln.critical;
+  const summary = status === "pass" ? `${used}: 0 vulnerabilities` : `${used}: ${total} vulnerabilities (${vuln.critical}C/${vuln.high}H/${vuln.moderate}M/${vuln.low}L)`;
+  return {
+    audit: "security",
+    site: label,
+    status,
+    summary,
+    details: vuln
+  };
+}
+
+// src/audits/lighthouse.ts
+import { writeFile, mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+
+// src/configs/lighthouse.ts
+var lighthouseConfig = {
+  ci: {
+    collect: {
+      url: ["http://localhost:5173/dev/a11y-fixtures"],
+      startServerCommand: "pnpm vite:dev",
+      startServerReadyPattern: "ready in",
+      startServerReadyTimeout: 12e4,
+      numberOfRuns: 1,
+      settings: {
+        preset: "desktop",
+        skipAudits: ["uses-http2"]
+      }
+    },
+    assert: {
+      assertions: {
+        "categories:accessibility": ["error", { minScore: 0.95 }],
+        "categories:best-practices": ["error", { minScore: 0.9 }],
+        "categories:seo": ["error", { minScore: 0.9 }],
+        "categories:performance": ["warn", { minScore: 0.7 }]
+      }
+    },
+    upload: {
+      target: "temporary-public-storage"
+    }
+  }
+};
+
+// src/audits/lighthouse.ts
+function siteLabel4(site) {
+  return site.name ?? site.path;
+}
+function isFakeShape(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.assertionsFailed === "number" && parsed.summary) return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function lighthouseAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel4(site);
+  const dir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
+  const configPath = join3(dir, "lighthouserc.json");
+  await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
+  let raw;
+  try {
+    raw = await spawn2("npx", ["--yes", "@lhci/cli", "autorun", `--config=${configPath}`], {
+      cwd: site.path
+    });
+  } catch (err) {
+    await rm(dir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "lighthouse",
+        site: label,
+        status: "skip",
+        summary: "npx/@lhci/cli not available"
+      };
+    }
+    throw err;
+  }
+  await rm(dir, { recursive: true, force: true });
+  const fake = isFakeShape(raw.stdout);
+  const normalized = fake ?? {
+    summary: {},
+    assertionsFailed: raw.code === 0 ? 0 : 1,
+    assertions: raw.code === 0 ? [] : [{ category: "unknown", level: "error", message: raw.stderr.slice(0, 200) }]
+  };
+  const anyError = (normalized.assertions ?? []).some((a) => a.level === "error");
+  const anyWarn = (normalized.assertions ?? []).some((a) => a.level === "warn");
+  const status = anyError ? "fail" : anyWarn ? "warn" : "pass";
+  const summary = status === "pass" ? "lighthouse: all categories passing" : `lighthouse: ${normalized.assertionsFailed} assertion(s) failed`;
+  return {
+    audit: "lighthouse",
+    site: label,
+    status,
+    summary,
+    details: normalized
+  };
+}
+
+// src/audits/a11y.ts
+import { writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+
+// src/configs/playwright-a11y.ts
+import { defineConfig, devices } from "@playwright/test";
+var a11yRoutes = [
+  { path: "/dev/a11y-fixtures", name: "a11y fixtures" },
+  { path: "/dev/animate-in", name: "animate-in demo" }
+];
+var playwrightA11yConfig = defineConfig({
+  testDir: "tests",
+  testMatch: /.*\.spec\.ts$/,
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  reporter: process.env.CI ? "github" : "list",
+  use: {
+    baseURL: "http://localhost:5173",
+    trace: "on-first-retry"
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] }
+    }
+  ],
+  webServer: {
+    command: "pnpm vite:dev",
+    url: "http://localhost:5173/dev/a11y-fixtures",
+    reuseExistingServer: !process.env.CI,
+    timeout: 12e4
+  }
+});
+
+// src/audits/a11y.ts
+function siteLabel5(site) {
+  return site.name ?? site.path;
+}
+function isFakeShape2(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.totalViolations === "number" && parsed.byImpact) return parsed;
+  } catch {
+    return null;
+  }
+  return null;
+}
+function buildSpec() {
+  return `
+import { test, expect } from "@playwright/test";
+import AxeBuilder from "@axe-core/playwright";
+const pages = ${JSON.stringify(a11yRoutes)};
+for (const { path, name } of pages) {
+  test(\`\${name} has no axe violations\`, async ({ page }) => {
+    await page.goto(path);
+    const results = await new AxeBuilder({ page })
+      .withTags(["wcag2a","wcag2aa","wcag21a","wcag21aa","wcag22aa"])
+      .analyze();
+    expect(results.violations).toEqual([]);
+  });
+}
+`;
+}
+async function a11yAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel5(site);
+  const dir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-"));
+  const specPath = join4(dir, "a11y.spec.ts");
+  await writeFile2(specPath, buildSpec(), "utf-8");
+  let raw;
+  try {
+    raw = await spawn2("npx", ["--yes", "playwright", "test", "--reporter=json", specPath], {
+      cwd: site.path
+    });
+  } catch (err) {
+    await rm2(dir, { recursive: true, force: true });
+    const e = err;
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {
+      return {
+        audit: "a11y",
+        site: label,
+        status: "skip",
+        summary: "npx/playwright not available"
+      };
+    }
+    throw err;
+  }
+  await rm2(dir, { recursive: true, force: true });
+  const fake = isFakeShape2(raw.stdout);
+  const normalized = fake ?? {
+    totalViolations: raw.code === 0 ? 0 : 1,
+    byImpact: raw.code === 0 ? {} : { moderate: 1 }
+  };
+  const hasSerious = (normalized.byImpact.serious ?? 0) > 0 || (normalized.byImpact.critical ?? 0) > 0;
+  const hasAny = normalized.totalViolations > 0;
+  const status = hasSerious ? "fail" : hasAny ? "warn" : "pass";
+  const summary = status === "pass" ? `a11y: 0 violations across ${a11yRoutes.length} routes` : `a11y: ${normalized.totalViolations} violations`;
+  return {
+    audit: "a11y",
+    site: label,
+    status,
+    summary,
+    details: normalized
+  };
+}
+
+// src/audits/index.ts
+var REGISTRY = {
+  deps: depsAudit,
+  lint: lintAudit,
+  security: securityAudit,
+  lighthouse: lighthouseAudit,
+  a11y: a11yAudit
+};
+var ALL_AUDIT_NAMES = Object.keys(REGISTRY);
+var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
+function timedSpawn(timeoutMs) {
+  return (cmd, args, opts = {}) => defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });
+}
+async function runAudits(site, which) {
+  const names = which ?? ALL_AUDIT_NAMES;
+  for (const n of names) {
+    if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);
+  }
+  const spawn2 = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
+  const label = site.name ?? site.path;
+  return Promise.all(
+    names.map(
+      (n) => REGISTRY[n]({ site, spawn: spawn2 }).catch(
+        (err) => ({
+          audit: n,
+          site: label,
+          status: "fail",
+          summary: `${n}: unexpected error \u2014 ${String(err)}`
+        })
+      )
+    )
+  );
+}
+
+// src/cli/fleet/resolve-sites.ts
+import { pathToFileURL } from "url";
+import { resolve, extname } from "path";
+
+// src/inventory/local.ts
+import { basename } from "path";
+function localPath(path, opts = {}) {
+  const site = { path, name: opts.name ?? basename(path) };
+  return async () => [site];
+}
+
+// src/inventory/json.ts
+import { readFile as readFile3 } from "fs/promises";
+function validate(raw) {
+  if (!Array.isArray(raw)) {
+    throw new Error("inventory JSON must be an array of sites");
+  }
+  return raw.map((entry, i) => {
+    if (!entry || typeof entry !== "object") {
+      throw new Error(`inventory entry ${i} is not an object`);
+    }
+    const e = entry;
+    if (typeof e.path !== "string" || e.path.length === 0) {
+      throw new Error(`inventory entry ${i} is missing required field: path`);
+    }
+    const site = { path: e.path };
+    if (typeof e.name === "string") site.name = e.name;
+    if (typeof e.repoUrl === "string") site.repoUrl = e.repoUrl;
+    if (typeof e.meta === "object" && e.meta !== null) {
+      site.meta = e.meta;
+    }
+    return site;
+  });
+}
+function fromJsonFile(path) {
+  return async () => {
+    const raw = JSON.parse(await readFile3(path, "utf-8"));
+    return validate(raw);
+  };
+}
+
+// src/cli/fleet/resolve-sites.ts
+async function resolveSites(input) {
+  if (input.site && input.fleet) {
+    throw Object.assign(new Error("cannot combine a positional [site] with --fleet"), {
+      exitCode: 2
+    });
+  }
+  if (input.fleet) {
+    const fleetPath = resolve(input.cwd, input.fleet);
+    const ext = extname(fleetPath).toLowerCase();
+    let provider;
+    if (ext === ".json") {
+      provider = fromJsonFile(fleetPath);
+    } else if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
+      const mod = await import(pathToFileURL(fleetPath).href);
+      if (!mod.default || typeof mod.default !== "function") {
+        throw Object.assign(new Error(`--fleet ${input.fleet}: default export is not a function`), {
+          exitCode: 2
+        });
+      }
+      provider = mod.default;
+    } else {
+      throw Object.assign(
+        new Error(`--fleet ${input.fleet}: unsupported extension ${ext || "(none)"}`),
+        { exitCode: 2 }
+      );
+    }
+    return provider();
+  }
+  return localPath(resolve(input.cwd, input.site ?? input.cwd))();
+}
+
+// src/cli/fleet/clone-if-needed.ts
+import { stat, readdir, mkdir } from "fs/promises";
+import { join as join5 } from "path";
+function deriveNameFromRepoUrl(repoUrl) {
+  const slash = repoUrl.split("/").pop() ?? repoUrl;
+  return slash.replace(/\.git$/, "");
+}
+async function isNonEmptyDir(path) {
+  try {
+    const s = await stat(path);
+    if (!s.isDirectory()) return false;
+    const entries = await readdir(path);
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function cloneIfNeeded(site, opts) {
+  if (await isNonEmptyDir(site.path)) return site;
+  if (!site.repoUrl) {
+    throw new Error(`site path does not exist (${site.path}) and no repoUrl is set \u2014 cannot clone`);
+  }
+  const name = site.name ?? deriveNameFromRepoUrl(site.repoUrl);
+  const target = join5(opts.workdir, name);
+  await mkdir(opts.workdir, { recursive: true });
+  if (await isNonEmptyDir(target)) {
+    return { ...site, name, path: target };
+  }
+  const spawn2 = opts.spawn ?? defaultSpawn;
+  const result = await spawn2("git", ["clone", site.repoUrl, target], {
+    cwd: opts.workdir,
+    timeoutMs: 5 * 6e4
+  });
+  if (result.code !== 0) {
+    throw new Error(`git clone failed (code ${result.code}): ${result.stderr}`);
+  }
+  return { ...site, name, path: target };
+}
+
+// src/cli/commands/audit.ts
+function parseOnly(value) {
+  if (!value) return void 0;
+  const names = value.split(",").map((s) => s.trim());
+  for (const n of names) {
+    if (!ALL_AUDIT_NAMES.includes(n)) {
+      throw Object.assign(new Error(`unknown audit in --only: ${n}`), { exitCode: 2 });
+    }
+  }
+  return names;
+}
+function formatTable(results) {
+  return results.map((r) => `${r.audit.padEnd(12)} ${r.status.padEnd(5)} ${r.site}
+  ${r.summary}`).join("\n");
+}
+function exitCode(results) {
+  return results.some((r) => r.status === "fail") ? 1 : 0;
+}
+async function runAuditCommand(site, opts) {
+  const which = parseOnly(opts.only);
+  const cwd = opts.cwd ? resolve2(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    cwd
+  });
+  if (opts.fleet) {
+    const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
+    sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
+  }
+  const results = [];
+  for (const s of sites) {
+    const r = await runAudits(s, which);
+    results.push(...r);
+  }
+  const output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);
+  return { output, code: exitCode(results) };
+}
+export {
+  runAuditCommand
+};
+//# sourceMappingURL=audit.js.map