@reddoorla/maintenance 0.1.2 → 0.2.0

package/dist/index.js

@@ -260,59 +260,64 @@ function extractAdvisoriesFromNpm(parsed) {
   }
   return [...roots.values()];
 }
-async function tryRun(spawn2, cmd, args, cwd) {
+async function runAuditTool(spawn2, cmd, args, cwd) {
+  let raw;
   try {
-    return await spawn2(cmd, args, { cwd });
+    raw = await spawn2(cmd, args, { cwd });
   } catch (err) {
     const e = err;
-    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { missing: true };
-    throw err;
-  }
-}
-async function securityAudit(ctx) {
-  const spawn2 = ctx.spawn ?? defaultSpawn;
-  const site = ctx.site;
-  const label = siteLabel3(site);
-  let used = "pnpm audit";
-  let raw = await tryRun(
-    spawn2,
-    "pnpm",
-    ["audit", "--json", "--prod"],
-    site.path
-  );
-  if ("missing" in raw) {
-    used = "npm audit";
-    raw = await tryRun(spawn2, "npm", ["audit", "--json", "--omit=dev"], site.path);
-  }
-  if ("missing" in raw) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: "neither pnpm nor npm is available on PATH"
-    };
+    if (e.code === "ENOENT" || /ENOENT/.test(String(err))) return { kind: "missing" };
+    return { kind: "error", reason: `spawn failed: ${String(err).slice(0, 200)}` };
   }
   if (raw.code !== 0 && raw.code !== 1) {
     return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} exited with code ${raw.code}`,
-      details: { stderr: raw.stderr }
+      kind: "error",
+      reason: `exit ${raw.code}${raw.stderr ? `: ${raw.stderr.slice(0, 150)}` : ""}`
     };
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw.stdout);
+    parsed = JSON.parse(raw.stdout || "{}");
   } catch (err) {
-    return {
-      audit: "security",
-      site: label,
-      status: "skip",
-      summary: `${used} produced unparseable JSON`,
-      details: { error: String(err), stdout: raw.stdout.slice(0, 500) }
-    };
+    return { kind: "error", reason: `unparseable JSON: ${String(err).slice(0, 100)}` };
+  }
+  const errEnvelope = parsed.error;
+  if (errEnvelope && typeof errEnvelope === "object") {
+    return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
   }
+  if (!parsed.metadata?.vulnerabilities) {
+    return { kind: "error", reason: "no metadata.vulnerabilities in output" };
+  }
+  return { kind: "ok", parsed };
+}
+async function securityAudit(ctx) {
+  const spawn2 = ctx.spawn ?? defaultSpawn;
+  const site = ctx.site;
+  const label = siteLabel3(site);
+  let used = "pnpm audit";
+  let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
+  if (result.kind !== "ok") {
+    const pnpmReason = result.kind === "missing" ? "not installed" : result.reason;
+    const npmResult = await runAuditTool(
+      spawn2,
+      "npm",
+      ["audit", "--json", "--omit=dev"],
+      site.path
+    );
+    if (npmResult.kind === "ok") {
+      result = npmResult;
+      used = "npm audit";
+    } else {
+      const npmReason = npmResult.kind === "missing" ? "not installed" : npmResult.reason;
+      return {
+        audit: "security",
+        site: label,
+        status: "skip",
+        summary: `cannot run audit \u2014 pnpm: ${pnpmReason}; npm: ${npmReason}`
+      };
+    }
+  }
+  const parsed = result.parsed;
   const counts = {
     low: parsed.metadata?.vulnerabilities?.low ?? 0,
     moderate: parsed.metadata?.vulnerabilities?.moderate ?? 0,
@@ -342,7 +347,10 @@ var lighthouseConfig = {
   ci: {
     collect: {
       url: ["http://localhost:5173/dev/a11y-fixtures"],
-      startServerCommand: "pnpm vite:dev",
+      // `npm run vite:dev` works on both pnpm and npm sites — pnpm respects
+      // the `run` form too. Keeps this config portable across the fleet
+      // while sites transition to pnpm.
+      startServerCommand: "npm run vite:dev",
       startServerReadyPattern: "ready in",
       startServerReadyTimeout: 12e4,
       numberOfRuns: 1,
@@ -494,7 +502,8 @@ var playwrightA11yConfig = defineConfig({
     }
   ],
   webServer: {
-    command: "pnpm vite:dev",
+    // Portable across pnpm and npm sites — pnpm respects `npm run` too.
+    command: "npm run vite:dev",
     url: "http://localhost:5173/dev/a11y-fixtures",
     reuseExistingServer: !process.env.CI,
     timeout: 12e4
@@ -1238,8 +1247,124 @@ async function upgradeSvelte4to5(site, opts = {}) {
   };
 }
 
+// src/recipes/convert-to-pnpm.ts
+import { rm as rm3, stat } from "fs/promises";
+import { join as join12 } from "path";
+
+// src/recipes/convert-to-pnpm/script-rewrites.ts
+function rewriteScriptForPnpm(script) {
+  let out = script;
+  out = out.replace(/\bnpm run(?=\s)/g, "pnpm run");
+  out = out.replace(/\bnpx(?=\s)/g, "pnpm dlx");
+  return out;
+}
+function rewriteScriptsForPnpm(scripts) {
+  const next = {};
+  let changedCount = 0;
+  for (const [name, value] of Object.entries(scripts)) {
+    const rewritten = rewriteScriptForPnpm(value);
+    next[name] = rewritten;
+    if (rewritten !== value) changedCount++;
+  }
+  return { scripts: next, changedCount };
+}
+
+// src/recipes/convert-to-pnpm.ts
+var DEFAULT_PNPM_VERSION = "10.33.1";
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function siteLabel9(site) {
+  return site.name ?? site.path;
+}
+async function convertToPnpm(site, opts = {}) {
+  const label = siteLabel9(site);
+  const spawn2 = opts.spawn ?? defaultSpawn;
+  const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
+  const pnpmLockPath = join12(site.path, "pnpm-lock.yaml");
+  const npmLockPath = join12(site.path, "package-lock.json");
+  const yarnLockPath = join12(site.path, "yarn.lock");
+  if (await exists(pnpmLockPath)) {
+    return {
+      recipe: "convert-to-pnpm",
+      site: label,
+      status: "noop",
+      commits: [],
+      notes: "site already has pnpm-lock.yaml"
+    };
+  }
+  const hasNpmLock = await exists(npmLockPath);
+  const hasYarnLock = await exists(yarnLockPath);
+  if (!hasNpmLock && !hasYarnLock) {
+    return {
+      recipe: "convert-to-pnpm",
+      site: label,
+      status: "noop",
+      commits: [],
+      notes: "no convertible lockfile (package-lock.json or yarn.lock) at site root"
+    };
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
+  const branch = branchName("convert-to-pnpm");
+  await createBranch(site.path, branch);
+  const shas = [];
+  if (hasNpmLock) await rm3(npmLockPath, { force: true });
+  if (hasYarnLock) await rm3(yarnLockPath, { force: true });
+  const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
+  const lockSha = await commit(site.path, `chore(pnpm): remove ${sourceLock}`);
+  if (lockSha) shas.push(lockSha);
+  const pkgPath = join12(site.path, "package.json");
+  const pkg = await readPackageJson(pkgPath);
+  const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
+  if (pkg.scripts && typeof pkg.scripts === "object") {
+    const { scripts: rewritten, changedCount } = rewriteScriptsForPnpm(
+      pkg.scripts
+    );
+    if (changedCount > 0) {
+      next.scripts = rewritten;
+    }
+  }
+  await writePackageJson(pkgPath, next);
+  const pkgSha = await commit(site.path, "chore(pnpm): pin packageManager + rewrite npm scripts");
+  if (pkgSha) shas.push(pkgSha);
+  const installResult = await spawn2("pnpm", ["install"], {
+    cwd: site.path,
+    streaming: true
+  });
+  if (installResult.code !== 0) {
+    return {
+      recipe: "convert-to-pnpm",
+      site: label,
+      status: "failed",
+      commits: shas,
+      notes: `pnpm install failed (exit ${installResult.code}). branch ${branch} left for inspection.`
+    };
+  }
+  const installSha = await commit(site.path, "chore(pnpm): add pnpm-lock.yaml");
+  if (installSha) shas.push(installSha);
+  return {
+    recipe: "convert-to-pnpm",
+    site: label,
+    status: "applied",
+    commits: shas,
+    notes: `branch: ${branch}`
+  };
+}
+
 // src/recipes/index.ts
-var ALL_RECIPE_NAMES = ["sync-configs", "bump-deps", "svelte-4-to-5"];
+var ALL_RECIPE_NAMES = [
+  "sync-configs",
+  "bump-deps",
+  "svelte-4-to-5",
+  "convert-to-pnpm"
+];
 function isRecipeName(value) {
   return ALL_RECIPE_NAMES.includes(value);
 }
@@ -1291,6 +1416,7 @@ export {
   ALL_RECIPE_NAMES,
   a11yAudit,
   bumpDeps,
+  convertToPnpm,
   depsAudit,
   fromJsonFile,
   isRecipeName,