@reddoorla/maintenance 0.1.1 → 0.1.3

package/dist/index.js

@@ -1,15 +1,18 @@
 // src/audits/util/spawn.ts
 import { spawn } from "child_process";
 var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve, reject) => {
+  const streaming = opts.streaming === true;
   const child = spawn(cmd, [...args], {
     cwd: opts.cwd,
     env: opts.env ?? process.env,
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: streaming ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
   });
   let stdout = "";
   let stderr = "";
-  child.stdout.on("data", (chunk) => stdout += String(chunk));
-  child.stderr.on("data", (chunk) => stderr += String(chunk));
+  if (!streaming) {
+    child.stdout?.on("data", (chunk) => stdout += String(chunk));
+    child.stderr?.on("data", (chunk) => stderr += String(chunk));
+  }
   const timer = opts.timeoutMs ? setTimeout(() => {
     child.kill("SIGTERM");
     reject(new Error(`spawn timeout after ${opts.timeoutMs}ms: ${cmd}`));
@@ -137,7 +140,7 @@ async function depsAudit(ctx) {
 // src/audits/lint.ts
 import { existsSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { join as join2, relative } from "path";
+import { join as join2 } from "path";
 import { ESLint } from "eslint";
 import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
 import { glob } from "tinyglobby";
@@ -166,19 +169,19 @@ async function lintAudit(ctx) {
     errorOnUnmatchedPattern: false
   });
   const relFiles = await listFiles(site.path);
-  const filesToLint = relFiles.map((f) => join2(site.path, f));
-  const eslintResults = await eslint2.lintFiles(filesToLint);
+  const eslintResults = await eslint2.lintFiles(relFiles);
   const eslintErrors = eslintResults.reduce((n, r) => n + r.errorCount, 0);
   const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
   const prettierUnformatted = [];
-  for (const file of filesToLint) {
-    const source = await readFile2(file, "utf-8");
-    const options = await prettierResolveConfig(file) ?? {};
-    const ok = await prettierCheck(source, { ...options, filepath: file });
-    if (!ok) prettierUnformatted.push(relative(site.path, file));
+  for (const rel of relFiles) {
+    const absForResolve = join2(site.path, rel);
+    const source = await readFile2(absForResolve, "utf-8");
+    const options = await prettierResolveConfig(absForResolve) ?? {};
+    const ok = await prettierCheck(source, { ...options, filepath: absForResolve });
+    if (!ok) prettierUnformatted.push(rel);
   }
   const status = eslintErrors > 0 || prettierUnformatted.length > 0 ? "fail" : eslintWarnings > 0 ? "warn" : "pass";
-  const summary = status === "pass" ? `lint clean across ${filesToLint.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
+  const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
   return {
     audit: "lint",
     site: siteLabel2(site),
@@ -188,7 +191,7 @@ async function lintAudit(ctx) {
       eslintErrors,
       eslintWarnings,
       prettierUnformatted,
-      files: filesToLint.length
+      files: relFiles.length
     }
   };
 }
@@ -204,7 +207,7 @@ function classify(v) {
 }
 function normalizeSeverity(s) {
   if (s === "low" || s === "moderate" || s === "high" || s === "critical") return s;
-  return "moderate";
+  return "low";
 }
 function extractAdvisoriesFromPnpm(parsed) {
   const out = [];
@@ -220,83 +223,101 @@ function extractAdvisoriesFromPnpm(parsed) {
   }
   return out;
 }
+function resolveNpmAdvisoryRoot(startName, vulnerabilities) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = startName;
+  while (!seen.has(current)) {
+    seen.add(current);
+    const entry = vulnerabilities[current];
+    if (!entry || !Array.isArray(entry.via)) return { rootName: current };
+    const detailed = entry.via.find(
+      (e) => typeof e === "object" && e !== null
+    );
+    if (detailed) return { rootName: current, detail: detailed };
+    const next = entry.via.find((e) => typeof e === "string");
+    if (!next || next === current) return { rootName: current };
+    current = next;
+  }
+  return { rootName: current };
+}
 function extractAdvisoriesFromNpm(parsed) {
-  const out = [];
-  for (const [name, v] of Object.entries(parsed.vulnerabilities ?? {})) {
+  const vulnerabilities = parsed.vulnerabilities ?? {};
+  const roots = /* @__PURE__ */ new Map();
+  for (const [name, v] of Object.entries(vulnerabilities)) {
     if (!v) continue;
-    let title = name;
-    let url;
-    if (Array.isArray(v.via)) {
-      const detailed = v.via.find(
-        (entry) => typeof entry === "object" && entry !== null
-      );
-      if (detailed) {
-        title = detailed.title ?? name;
-        url = detailed.url;
-      }
-    }
-    out.push({
-      module: v.name ?? name,
-      severity: normalizeSeverity(v.severity),
+    const { rootName, detail } = resolveNpmAdvisoryRoot(name, vulnerabilities);
+    if (roots.has(rootName)) continue;
+    const rootEntry = vulnerabilities[rootName];
+    const severity = normalizeSeverity(rootEntry?.severity ?? v.severity);
+    const title = detail?.title ?? rootName;
+    const url = detail?.url;
+    roots.set(rootName, {
+      module: rootEntry?.name ?? rootName,
+      severity,
       title,
       ...url ? { url } : {}
     });
   }
-  return out;
+  return [...roots.values()];
 }
-async function tryRun(spawn2, cmd, args, cwd) {
+async function runAuditTool(spawn2, cmd, args, cwd) {
+  let raw;
   try {
-    return await spawn2(cmd, args, { cwd });
+    raw = await spawn2(cmd, args, { cwd });
   } catch (err) {
     const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { missing: true };
-    throw err;
-  }
-}
-async function securityAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel3(site);
-  let used = "pnpm audit";
-  let raw = await tryRun(
-    spawn2,
-    "pnpm",
-    ["audit", "--json", "--prod"],
-    site.path
-  );
-  if ("missing" in raw) {
-    used = "npm audit";
-    raw = await tryRun(spawn2, "npm", ["audit", "--json", "--omit=dev"], site.path);
-  }
-  if ("missing" in raw) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: "neither pnpm nor npm is available on PATH"
-    };
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { kind: "missing" };
+    return { kind: "error", reason: `spawn failed: ${String(err).slice(0, 200)}` };
   }
   if (raw.code !== 0 && raw.code !== 1) {
     return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} exited with code ${raw.code}`,
-      details: { stderr: raw.stderr }
+      kind: "error",
+      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : ""}`
     };
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw.stdout);
+    parsed = JSON.parse(raw.stdout || "{}");
   } catch (err) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} produced unparseable JSON`,
-      details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
-    };
+    return { kind: "error", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };
   }
+  const errEnvelope = parsed.error;
+  if (errEnvelope && typeof errEnvelope === "object") {
+    return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
+  }
+  if (!parsed.metadata?.vulnerabilities) {
+    return { kind: "error", reason: "no metadata.vulnerabilities in output" };
+  }
+  return { kind: "ok", parsed };
+}
+async function securityAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel3(site);
+  let used = "pnpm audit";
+  let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
+  if (result.kind !== "ok") {
+    const pnpmReason = result.kind === "missing" ? "not installed" : result.reason;
+    const npmResult = await runAuditTool(
+      spawn2,
+      "npm",
+      ["audit", "--json", "--omit=dev"],
+      site.path
+    );
+    if (npmResult.kind === "ok") {
+      result = npmResult;
+      used = "npm audit";
+    } else {
+      const npmReason = npmResult.kind === "missing" ? "not installed" : npmResult.reason;
+      return {
+        audit: "security",
+        site: label,
+        status: "skip",
+        summary: `cannot run audit \u2014 pnpm: ${pnpmReason}; npm: ${npmReason}`
+      };
+    }
+  }
+  const parsed = result.parsed;
   const counts = {
     low: parsed.metadata?.vulnerabilities?.low ?? 0,
     moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
@@ -507,6 +528,10 @@ import { dirname } from "node:path";
 const pages = ${JSON.stringify(a11yRoutes)};
 const OUTPUT = process.env.REDDOOR_A11Y_OUTPUT;
 
+// Playwright's default per-test timeout is 30s. We loop through every
+// configured route in a single test, so the budget needs to scale.
+test.setTimeout(5 * 60_000);
+
 test("a11y across configured routes", async ({ page }) => {
   const violations = [];
   for (const { path, name } of pages) {
@@ -781,6 +806,7 @@ async function bumpDeps(site, opts = {}) {
   const label = siteLabel7(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
+  await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
   const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
     cwd: site.path
   });
@@ -805,7 +831,10 @@ async function bumpDeps(site, opts = {}) {
   }
   const branch = branchName("bump-deps");
   await createBranch(site.path, branch);
-  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], { cwd: site.path });
+  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
+    cwd: site.path,
+    streaming: true
+  });
   const sha = await commit(site.path, `chore(deps): bump dependencies (${group})`);
   const shas = sha ? [sha] : [];
   return {
@@ -830,7 +859,8 @@ async function writePackageJson(path, pkg) {
   const content = JSON.stringify(pkg, null, 2) + "\n";
   await writeFile4(path, content, "utf-8");
 }
-function bumpDep(pkg, name, version) {
+function bumpDep(pkg, name, version, opts = {}) {
+  const mode = opts.mode ?? "ensure";
   const next = {
     ...pkg
   };
@@ -850,6 +880,7 @@ function bumpDep(pkg, name, version) {
     next.devDependencies[name] = version;
     return next;
   }
+  if (mode === "bump-only") return pkg;
   next.devDependencies = { ...next.devDependencies ?? {}, [name]: version };
   return next;
 }
@@ -872,7 +903,7 @@ async function bumpToSvelte5Versions(cwd) {
   const pkg = await readPackageJson(pkgPath);
   let next = pkg;
   for (const [name, version] of Object.entries(SVELTE_5_VERSIONS)) {
-    next = bumpDep(next, name, version);
+    next = bumpDep(next, name, version, { mode: "bump-only" });
   }
   if (next === pkg) return false;
   await writePackageJson(pkgPath, next);
@@ -882,6 +913,45 @@ async function bumpToSvelte5Versions(cwd) {
 // src/recipes/svelte-5/step-svelte-config.ts
 import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
 import { join as join7 } from "path";
+var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
+var IMPORT_FROM_VITE_PLUGIN = new RegExp(
+  String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
+  "m"
+);
+function dropVitePreprocessImport(source) {
+  return source.replace(IMPORT_FROM_VITE_PLUGIN, (full, names) => {
+    const remaining = names.split(",").map((n) => n.trim()).filter((n) => n.length > 0 && n !== "vitePreprocess");
+    if (remaining.length === 0) return "";
+    return `import { ${remaining.join(", ")} } from "${VITE_PLUGIN_PKG}";
+`;
+  });
+}
+function findMatchingParen(source, openIdx) {
+  if (source[openIdx] !== "(") return -1;
+  let depth = 0;
+  for (let i = openIdx; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === "(") depth++;
+    else if (ch === ")") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+function dropPreprocessKey(source) {
+  const startRe = /^(\s*)preprocess:\s*vitePreprocess\(/m;
+  const m = startRe.exec(source);
+  if (!m) return source;
+  const indent = m[1] ?? "";
+  const parenOpenAbs = m.index + m[0].length - 1;
+  const parenCloseAbs = findMatchingParen(source, parenOpenAbs);
+  if (parenCloseAbs < 0) return source;
+  let tailIdx = parenCloseAbs + 1;
+  while (tailIdx < source.length && /[ \t,]/.test(source[tailIdx] ?? "")) tailIdx++;
+  if (source[tailIdx] === "\n") tailIdx++;
+  return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
+}
 async function migrateSvelteConfig(cwd) {
   const path = join7(cwd, "svelte.config.js");
   let src;
@@ -891,11 +961,8 @@ async function migrateSvelteConfig(cwd) {
     return false;
   }
   let next = src;
-  next = next.replace(
-    /^import\s+\{\s*vitePreprocess\s*\}\s+from\s+["']@sveltejs\/vite-plugin-svelte["'];\n/m,
-    ""
-  );
-  next = next.replace(/^\s*preprocess:\s*vitePreprocess\(\)\s*,?\s*\n/m, "");
+  next = dropPreprocessKey(next);
+  next = dropVitePreprocessImport(next);
   if (next === src) return false;
   await writeFile5(path, next, "utf-8");
   return true;
@@ -1005,10 +1072,32 @@ function exportLetToProps(source) {
 }
 
 // src/recipes/svelte-5/codemods/dollar-restprops.ts
+function removeInterfaceBlock(source) {
+  const re = /^\s*interface\s+\$\$Props\s*\{/m;
+  let out = source;
+  while (true) {
+    const match = re.exec(out);
+    if (!match) return out;
+    const openBraceIdx = match.index + match[0].length - 1;
+    let depth = 1;
+    let i = openBraceIdx + 1;
+    while (i < out.length && depth > 0) {
+      const ch = out[i];
+      if (ch === "{") depth++;
+      else if (ch === "}") depth--;
+      i++;
+    }
+    if (depth !== 0) return out;
+    let endIdx = i;
+    while (endIdx < out.length && /[ \t]/.test(out[endIdx] ?? "")) endIdx++;
+    if (out[endIdx] === "\n") endIdx++;
+    out = out.slice(0, match.index) + out.slice(endIdx);
+  }
+}
 function removeDollarRestProps(source) {
   let next = source;
   next = next.replace(/\$\$restProps/g, "rest");
-  next = next.replace(/^\s*interface\s+\$\$Props\s*\{[^}]*\}\s*\n/gm, "");
+  next = removeInterfaceBlock(next);
   return next;
 }
 
@@ -1169,6 +1258,7 @@ function localPath(path, opts = {}) {
 
 // src/inventory/json.ts
 import { readFile as readFile9 } from "fs/promises";
+import { isAbsolute } from "path";
 function validate(raw) {
   if (!Array.isArray(raw)) {
     throw new Error("inventory JSON must be an array of sites");
@@ -1181,6 +1271,11 @@ function validate(raw) {
     if (typeof e.path !== "string" || e.path.length === 0) {
       throw new Error(`inventory entry ${i} is missing required field: path`);
     }
+    if (!isAbsolute(e.path)) {
+      throw new Error(
+        `inventory entry ${i}: path must be absolute (got "${e.path}"). Relative paths are rejected so cwd at invocation can't change which site is targeted.`
+      );
+    }
     const site = { path: e.path };
     if (typeof e.name === "string") site.name = e.name;
     if (typeof e.repoUrl === "string") site.repoUrl = e.repoUrl;