@reddoorla/maintenance 0.14.0 → 0.16.0

package/dist/cli/bin.js

@@ -9,6 +9,54 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/util/credentials.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function defaultCredentialsPath() {
+  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+  return join(base, "reddoor-maint", "credentials.env");
+}
+function parseEnvFile(contents) {
+  const out = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function loadCredentialsIntoEnv(path = defaultCredentialsPath()) {
+  let contents;
+  try {
+    contents = readFileSync(path, "utf-8");
+  } catch {
+    return [];
+  }
+  const parsed = parseEnvFile(contents);
+  const applied = [];
+  for (const [k, v] of Object.entries(parsed)) {
+    if (process.env[k] === void 0) {
+      process.env[k] = v;
+      applied.push(k);
+    }
+  }
+  return applied;
+}
+var init_credentials = __esm({
+  "src/util/credentials.ts"() {
+    "use strict";
+  }
+});
+
 // src/reports/airtable/client.ts
 var client_exports = {};
 __export(client_exports, {
@@ -16,11 +64,19 @@ __export(client_exports, {
   readAirtableConfig: () => readAirtableConfig
 });
 import Airtable from "airtable";
+function missing(name) {
+  return Object.assign(
+    new Error(
+      `${name} not set. Export it in your shell or put it in ${defaultCredentialsPath()} as ${name}=...`
+    ),
+    { exitCode: 2 }
+  );
+}
 function readAirtableConfig() {
   const apiKey = process.env.AIRTABLE_PAT;
   const baseId = process.env.AIRTABLE_BASE_ID;
-  if (!apiKey) throw Object.assign(new Error("AIRTABLE_PAT not set"), { exitCode: 2 });
-  if (!baseId) throw Object.assign(new Error("AIRTABLE_BASE_ID not set"), { exitCode: 2 });
+  if (!apiKey) throw missing("AIRTABLE_PAT");
+  if (!baseId) throw missing("AIRTABLE_BASE_ID");
   return { apiKey, baseId };
 }
 function openBase(cfg) {
@@ -29,6 +85,7 @@ function openBase(cfg) {
 var init_client = __esm({
   "src/reports/airtable/client.ts"() {
     "use strict";
+    init_credentials();
   }
 });
 
@@ -179,7 +236,7 @@ __export(lighthouse_airtable_exports, {
   resolveSlugFromCwd: () => resolveSlugFromCwd
 });
 import { readFile as readFile7 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function hasRealScores(result) {
   if (result.audit !== "lighthouse") return false;
   const details = result.details ?? {};
@@ -204,7 +261,7 @@ function lighthouseScoresFromResult(result) {
 }
 async function resolveSlugFromCwd(cwd) {
   try {
-    const pkgPath = join7(cwd, "package.json");
+    const pkgPath = join8(cwd, "package.json");
     const raw = await readFile7(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (!pkg.name) throw new Error("package.json has no 'name' field");
@@ -457,18 +514,18 @@ var init_reports = __esm({
 // src/reports/maintenance-email/assets/index.ts
 import { readFile as readFile13 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname2, join as join21 } from "path";
+import { dirname as dirname2, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveAssetsDir() {
   if (cachedAssetsDir) return cachedAssetsDir;
   let dir = dirname2(fileURLToPath2(import.meta.url));
   while (true) {
-    const srcCandidate = join21(dir, "src", "reports", "maintenance-email", "assets", "check.png");
+    const srcCandidate = join22(dir, "src", "reports", "maintenance-email", "assets", "check.png");
     if (existsSync3(srcCandidate)) {
       cachedAssetsDir = dirname2(srcCandidate);
       return cachedAssetsDir;
     }
-    const distCandidate = join21(dir, "dist", "reports", "maintenance-email", "assets", "check.png");
+    const distCandidate = join22(dir, "dist", "reports", "maintenance-email", "assets", "check.png");
     if (existsSync3(distCandidate)) {
       cachedAssetsDir = dirname2(distCandidate);
       return cachedAssetsDir;
@@ -485,8 +542,8 @@ function resolveAssetsDir() {
 async function loadBundledImages() {
   const assetsDir = resolveAssetsDir();
   const [check, blurred] = await Promise.all([
-    readFile13(join21(assetsDir, "check.png")),
-    readFile13(join21(assetsDir, "blurredTests.jpg"))
+    readFile13(join22(assetsDir, "check.png")),
+    readFile13(join22(assetsDir, "blurredTests.jpg"))
   ]);
   return {
     check: {
@@ -932,12 +989,14 @@ var init_orchestrate = __esm({
 });
 
 // src/cli/bin.ts
+init_credentials();
 import { dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { cac } from "cac";
 
 // src/cli/commands/audit.ts
 import { resolve as resolve2 } from "path";
+import { Listr } from "listr2";
 
 // src/audits/util/spawn.ts
 import { spawn } from "child_process";
@@ -970,7 +1029,7 @@ var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve10, reject) =>
 
 // src/audits/deps.ts
 import { readFile } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/util/site.ts
 function siteLabel(site) {
@@ -1037,7 +1096,7 @@ function compareSemver(actual, baseline) {
   return "same";
 }
 async function depsAudit(ctx) {
-  const pkgPath = join(ctx.site.path, "package.json");
+  const pkgPath = join2(ctx.site.path, "package.json");
   let pkgRaw;
   try {
     pkgRaw = await readFile(pkgPath, "utf-8");
@@ -1083,7 +1142,7 @@ async function depsAudit(ctx) {
 // src/audits/lint.ts
 import { existsSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { ESLint } from "eslint";
 import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "prettier";
 import { glob } from "tinyglobby";
@@ -1094,7 +1153,7 @@ async function listFiles(cwd) {
 }
 async function lintAudit(ctx) {
   const { site } = ctx;
-  const configPath = join2(site.path, "eslint.config.js");
+  const configPath = join3(site.path, "eslint.config.js");
   if (!existsSync(configPath)) {
     return {
       audit: "lint",
@@ -1114,7 +1173,7 @@ async function lintAudit(ctx) {
   const eslintWarnings = eslintResults.reduce((n, r) => n + r.warningCount, 0);
   const prettierUnformatted = [];
   for (const rel of relFiles) {
-    const absForResolve = join2(site.path, rel);
+    const absForResolve = join3(site.path, rel);
     const source = await readFile2(absForResolve, "utf-8");
     const options = await prettierResolveConfig(absForResolve) ?? {};
     const ok = await prettierCheck(source, { ...options, filepath: absForResolve });
@@ -1278,7 +1337,7 @@ async function securityAudit(ctx) {
 // src/audits/lighthouse.ts
 import { readFile as readFile4, writeFile, mkdtemp, rm, readdir } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/configs/lighthouse.ts
 var lighthouseConfig = {
@@ -1313,11 +1372,11 @@ var lighthouseConfig = {
 
 // src/audits/util/site-config.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 async function readSiteConfig(sitePath) {
   let raw;
   try {
-    raw = await readFile3(join3(sitePath, "package.json"), "utf-8");
+    raw = await readFile3(join4(sitePath, "package.json"), "utf-8");
   } catch {
     return {};
   }
@@ -1378,7 +1437,7 @@ async function readLhrEntries(resultsDir) {
   const entries = [];
   for (const f of files) {
     if (!f.startsWith("lhr-") || !f.endsWith(".json")) continue;
-    const lhr = await readJsonMaybe(join4(resultsDir, f));
+    const lhr = await readJsonMaybe(join5(resultsDir, f));
     if (!lhr || !lhr.categories) continue;
     const summary = {};
     for (const [k, v] of Object.entries(lhr.categories)) {
@@ -1432,10 +1491,10 @@ async function lighthouseAudit(ctx) {
       }
     }
   };
-  const configDir = await mkdtemp(join4(tmpdir(), "reddoor-lhci-"));
-  const configPath = join4(configDir, "lighthouserc.json");
+  const configDir = await mkdtemp(join5(tmpdir(), "reddoor-lhci-"));
+  const configPath = join5(configDir, "lighthouserc.json");
   await writeFile(configPath, JSON.stringify(resolvedConfig), "utf-8");
-  const resultsDir = join4(site.path, ".lighthouseci");
+  const resultsDir = join5(site.path, ".lighthouseci");
   await rm(resultsDir, { recursive: true, force: true });
   let raw;
   try {
@@ -1470,7 +1529,7 @@ async function lighthouseAudit(ctx) {
       summary: `lighthouse: no lhr-*.json written (exit ${raw.code})${raw.stderr ? ` \u2014 ${raw.stderr.slice(0, 200)}` : ""}`
     };
   }
-  const assertionResults = await readJsonMaybe(join4(resultsDir, "assertion-results.json")) ?? [];
+  const assertionResults = await readJsonMaybe(join5(resultsDir, "assertion-results.json")) ?? [];
   const failed = assertionResults.filter((a) => !a.passed);
   const assertions = failed.map((a) => ({
     category: categoryFromAssertion(a),
@@ -1497,7 +1556,7 @@ async function lighthouseAudit(ctx) {
 
 // src/audits/a11y.ts
 import { readFile as readFile5, writeFile as writeFile2, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/configs/playwright-a11y.ts
 import { defineConfig, devices } from "@playwright/test";
@@ -1622,14 +1681,14 @@ async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
   const label = siteLabel(site);
-  const specDir = await mkdtemp2(join5(site.path, ".reddoor-a11y-spec-"));
-  const specPath = join5(specDir, "a11y.spec.ts");
+  const specDir = await mkdtemp2(join6(site.path, ".reddoor-a11y-spec-"));
+  const specPath = join6(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
   const port = await findFreePort();
-  const configPath = join5(specDir, "playwright.config.ts");
+  const configPath = join6(specDir, "playwright.config.ts");
   await writeFile2(configPath, buildPlaywrightConfig(port, site.path), "utf-8");
-  const resultsPath = join5(site.path, RESULTS_REL);
-  await rm2(join5(site.path, ".reddoor-a11y"), { recursive: true, force: true });
+  const resultsPath = join6(site.path, RESULTS_REL);
+  await rm2(join6(site.path, ".reddoor-a11y"), { recursive: true, force: true });
   let raw;
   try {
     raw = await spawn2(
@@ -1694,29 +1753,27 @@ var DEFAULT_AUDIT_TIMEOUT_MS = 3e4;
 function timedSpawn(timeoutMs) {
   return (cmd, args, opts = {}) => defaultSpawn(cmd, args, { ...opts, timeoutMs: opts.timeoutMs ?? timeoutMs });
 }
+async function runOneAudit(site, name) {
+  if (!(name in REGISTRY)) throw new Error(`unknown audit: ${name}`);
+  const spawn2 = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
+  const label = site.name ?? site.path;
+  try {
+    return await REGISTRY[name]({ site, spawn: spawn2 });
+  } catch (err) {
+    return {
+      audit: name,
+      site: label,
+      status: "fail",
+      summary: `${name}: unexpected error \u2014 ${String(err)}`
+    };
+  }
+}
 async function runAudits(site, which) {
   const names = which ?? ALL_AUDIT_NAMES;
   for (const n of names) {
     if (!(n in REGISTRY)) throw new Error(`unknown audit: ${n}`);
   }
-  const spawn2 = timedSpawn(DEFAULT_AUDIT_TIMEOUT_MS);
-  const label = site.name ?? site.path;
-  return Promise.all(
-    names.map(
-      (n) => REGISTRY[n]({ site, spawn: spawn2 }).catch(
-        (err) => ({
-          audit: n,
-          site: label,
-          status: "fail",
-          summary: `${n}: unexpected error \u2014 ${String(err)}`
-        })
-      )
-    )
-  );
-}
-async function runAuditsAcross(sites, which) {
-  const all = await Promise.all(sites.map((s) => runAudits(s, which)));
-  return all.flat();
+  return Promise.all(names.map((n) => runOneAudit(site, n)));
 }
 
 // src/cli/fleet/resolve-sites.ts
@@ -1807,7 +1864,7 @@ async function resolveSites(input) {
 
 // src/cli/fleet/clone-if-needed.ts
 import { stat, readdir as readdir2, mkdir } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join6 } from "path";
+import { isAbsolute as isAbsolute2, join as join7 } from "path";
 function deriveNameFromRepoUrl(repoUrl) {
   const slash = repoUrl.split("/").pop() ?? repoUrl;
   return slash.replace(/\.git$/, "");
@@ -1848,7 +1905,7 @@ async function cloneIfNeeded(site, opts) {
   const name = site.name ?? deriveNameFromRepoUrl(site.repoUrl);
   assertSafeName(name);
   assertSafeRepoUrl(site.repoUrl);
-  const target = join6(opts.workdir, name);
+  const target = join7(opts.workdir, name);
   await mkdir(opts.workdir, { recursive: true });
   if (await isNonEmptyDir(target)) {
     return { ...site, name, path: target };
@@ -1882,8 +1939,87 @@ function formatTable(results) {
 function exitCode(results) {
   return results.some((r) => r.status === "fail") ? 1 : 0;
 }
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const totalSeconds = Math.round(ms / 1e3);
+  if (totalSeconds < 60) return `${totalSeconds}s`;
+  const m = Math.floor(totalSeconds / 60);
+  const s = totalSeconds % 60;
+  return `${m}m${s.toString().padStart(2, "0")}s`;
+}
+function buildAuditTasks(sites, which, results, renderer) {
+  const singleSite = sites.length === 1;
+  if (singleSite) {
+    const site = sites[0];
+    return new Listr(
+      which.map((name) => ({
+        title: name,
+        task: async (_ctx, task) => {
+          const start = Date.now();
+          const result = await runOneAudit(site, name);
+          results.push(result);
+          const elapsed = formatDuration(Date.now() - start);
+          task.title = `${name}: ${result.summary} (${elapsed})`;
+          if (result.status === "fail") throw new Error(result.summary);
+        }
+      })),
+      { concurrent: true, exitOnError: false, renderer }
+    );
+  }
+  return new Listr(
+    sites.map((site) => {
+      const label = site.name ?? site.path;
+      return {
+        title: label,
+        task: async (_ctx, task) => {
+          const start = Date.now();
+          let done = 0;
+          task.output = `0/${which.length} audits`;
+          const settled = await Promise.all(
+            which.map(async (name) => {
+              const r = await runOneAudit(site, name);
+              results.push(r);
+              done += 1;
+              task.output = `${done}/${which.length} audits`;
+              return r;
+            })
+          );
+          const elapsed = formatDuration(Date.now() - start);
+          const failed = settled.filter((r) => r.status === "fail").length;
+          const warned = settled.filter((r) => r.status === "warn").length;
+          const note = failed > 0 ? `${failed} failed` : warned > 0 ? `${warned} warning${warned === 1 ? "" : "s"}` : "all green";
+          task.title = `${label}: ${note} (${elapsed})`;
+          if (failed > 0) throw new Error(`${label}: ${failed} audit(s) failed`);
+        }
+      };
+    }),
+    { concurrent: true, exitOnError: false, renderer }
+  );
+}
+function formatWriteSummary(summary) {
+  const lines = summary.writes.map((w) => {
+    if (w.audit === "lighthouse") {
+      const s = w.counts;
+      return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;
+    }
+    if (w.audit === "a11y") {
+      return `  a11y: ${w.counts.violations} violations`;
+    }
+    if (w.audit === "deps") {
+      const c2 = w.counts;
+      return `  deps: ${c2.drifted} drifted (${c2.majorBehind} major)`;
+    }
+    const c = w.counts;
+    return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;
+  });
+  return `\u2192 wrote to Websites[${summary.siteName}]:
+${lines.join("\n")}`;
+}
+function rendererFor(json) {
+  return json ? "silent" : "default";
+}
 async function runAuditCommand(site, opts) {
-  const which = parseOnly(opts.only);
+  const which = parseOnly(opts.only) ?? ALL_AUDIT_NAMES;
   const cwd = opts.cwd ? resolve2(opts.cwd) : process.cwd();
   let sites = await resolveSites({
     ...site !== void 0 ? { site } : {},
@@ -1895,7 +2031,9 @@ async function runAuditCommand(site, opts) {
     const workdir = opts.workdir ?? `${process.env.HOME ?? ""}/.reddoor-maint/sites`;
     sites = await Promise.all(sites.map((s) => cloneIfNeeded(s, { workdir })));
   }
-  const results = await runAuditsAcross(sites, which);
+  const results = [];
+  const renderer = rendererFor(opts.json);
+  await buildAuditTasks(sites, which, results, renderer).run();
   let output = opts.json ? JSON.stringify(results, null, 2) : formatTable(results);
   if (opts.writeAirtable !== void 0) {
     const { openBase: openBase2, readAirtableConfig: readAirtableConfig2 } = await Promise.resolve().then(() => (init_client(), client_exports));
@@ -1903,39 +2041,37 @@ async function runAuditCommand(site, opts) {
     const { resolveSlugFromCwd: resolveSlugFromCwd2 } = await Promise.resolve().then(() => (init_lighthouse_airtable(), lighthouse_airtable_exports));
     const { writeAuditsToAirtable: writeAuditsToAirtable2 } = await Promise.resolve().then(() => (init_write_audits_to_airtable(), write_audits_to_airtable_exports));
     const slug = typeof opts.writeAirtable === "string" && opts.writeAirtable.length > 0 ? opts.writeAirtable : await resolveSlugFromCwd2(cwd);
-    const base = openBase2(readAirtableConfig2());
-    const websites = await listWebsites2(base);
-    const summary = await writeAuditsToAirtable2({ base, websites, slug, results });
-    const lines = summary.writes.map((w) => {
-      if (w.audit === "lighthouse") {
-        const s = w.counts;
-        return `  lighthouse: P=${s.performance} A=${s.accessibility} BP=${s.bestPractices} SEO=${s.seo}`;
-      }
-      if (w.audit === "a11y") {
-        return `  a11y: ${w.counts.violations} violations`;
-      }
-      if (w.audit === "deps") {
-        const c2 = w.counts;
-        return `  deps: ${c2.drifted} drifted (${c2.majorBehind} major)`;
-      }
-      const c = w.counts;
-      return `  security: ${c.critical}C/${c.high}H/${c.moderate}M/${c.low}L`;
-    });
-    output += `
+    let writeSummary = null;
+    await new Listr(
+      [
+        {
+          title: `Write to Airtable[${slug}]`,
+          task: async (_ctx, task) => {
+            const base = openBase2(readAirtableConfig2());
+            task.output = "loading Websites\u2026";
+            const websites = await listWebsites2(base);
+            task.output = "writing scores\u2026";
+            writeSummary = await writeAuditsToAirtable2({ base, websites, slug, results });
+            task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? "" : "s"})`;
+          }
+        }
+      ],
+      { renderer }
+    ).run();
+    if (writeSummary) output += `
 
-\u2192 wrote to Websites[${summary.siteName}]:
-${lines.join("\n")}`;
+${formatWriteSummary(writeSummary)}`;
   }
   return { output, code: exitCode(results) };
 }
 
 // src/cli/commands/sync-configs.ts
 import { readFile as readFile9 } from "fs/promises";
-import { join as join9, resolve as resolve3 } from "path";
+import { join as join10, resolve as resolve3 } from "path";
 
 // src/recipes/sync-configs.ts
 import { readFile as readFile8, writeFile as writeFile3 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/recipes/sync-configs/templates.ts
 var eslint = {
@@ -2208,13 +2344,13 @@ async function readMaybe(path) {
 async function planTemplateDiffs(cwd, templates) {
   const diffs = [];
   for (const t of templates) {
-    const existing = await readMaybe(join8(cwd, t.path));
+    const existing = await readMaybe(join9(cwd, t.path));
     if (existing !== t.contents) diffs.push(t);
   }
   return diffs;
 }
 async function planGitignore(cwd) {
-  const existing = await readMaybe(join8(cwd, ".gitignore"));
+  const existing = await readMaybe(join9(cwd, ".gitignore"));
   const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);
   const tracked = await listTrackedFiles(cwd);
   const toUntrack = findTrackedArtifacts(tracked, CANONICAL_GITIGNORE_ENTRIES);
@@ -2222,7 +2358,7 @@ async function planGitignore(cwd) {
   return { kind: "apply", content: merge.content, toUntrack, added: merge.added };
 }
 async function applyGitignore(cwd, plan) {
-  await writeFile3(join8(cwd, ".gitignore"), plan.content, "utf-8");
+  await writeFile3(join9(cwd, ".gitignore"), plan.content, "utf-8");
   if (plan.toUntrack.length > 0) {
     await removeFromIndex(cwd, plan.toUntrack);
   }
@@ -2245,7 +2381,7 @@ async function syncConfigs(site, opts = {}) {
     },
     apply: async ({ templateDiffs, gitignorePlan }, { commit: commit2 }) => {
       for (const t of templateDiffs) {
-        await writeFile3(join8(site.path, t.path), t.contents, "utf-8");
+        await writeFile3(join9(site.path, t.path), t.contents, "utf-8");
         await commit2(`chore: sync ${t.config} config from @reddoorla/maintenance`);
       }
       if (gitignorePlan.kind === "apply") {
@@ -2274,7 +2410,7 @@ function parseOnly2(value) {
 async function dryPlanGitignore(cwd) {
   let existing;
   try {
-    existing = await readFile9(join9(cwd, ".gitignore"), "utf-8");
+    existing = await readFile9(join10(cwd, ".gitignore"), "utf-8");
   } catch {
     return "would create .gitignore";
   }
@@ -2289,7 +2425,7 @@ async function dryPlan(cwd, which) {
   for (const t of templateTargets) {
     let existing = "";
     try {
-      existing = await readFile9(join9(cwd, t.path), "utf-8");
+      existing = await readFile9(join10(cwd, t.path), "utf-8");
     } catch {
     }
     if (existing !== t.contents) lines.push(`would update ${t.path} (config: ${t.config})`);
@@ -2337,7 +2473,7 @@ import { resolve as resolve4 } from "path";
 
 // src/recipes/bump-deps.ts
 import { stat as stat2 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function exists(path) {
   try {
     await stat2(path);
@@ -2366,10 +2502,10 @@ async function bumpDeps(site, opts = {}) {
     // land on top of whatever else was in the tree.
     checkTreeFirst: true,
     plan: async () => {
-      const hasPnpmLock = await exists(join10(site.path, "pnpm-lock.yaml"));
+      const hasPnpmLock = await exists(join11(site.path, "pnpm-lock.yaml"));
       if (!hasPnpmLock) {
-        const hasNpmLock = await exists(join10(site.path, "package-lock.json"));
-        const hasYarnLock = await exists(join10(site.path, "yarn.lock"));
+        const hasNpmLock = await exists(join11(site.path, "package-lock.json"));
+        const hasYarnLock = await exists(join11(site.path, "yarn.lock"));
         if (hasNpmLock || hasYarnLock) {
           const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
           return {
@@ -2439,7 +2575,7 @@ async function runBumpDepsCommand(site, opts) {
 import { resolve as resolve5 } from "path";
 
 // src/recipes/svelte-5/index.ts
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // src/util/pkg.ts
 import { readFile as readFile10, writeFile as writeFile4 } from "fs/promises";
@@ -2488,7 +2624,7 @@ function bumpDep(pkg, name, version2, opts = {}) {
 }
 
 // src/recipes/svelte-5/step-bump-versions.ts
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var SVELTE_5_VERSIONS = {
   svelte: "^5.55.5",
   "@sveltejs/kit": "^2.59.0",
@@ -2501,7 +2637,7 @@ var SVELTE_5_VERSIONS = {
   "typescript-svelte-plugin": "^0.3.52"
 };
 async function bumpToSvelte5Versions(cwd) {
-  const pkgPath = join11(cwd, "package.json");
+  const pkgPath = join12(cwd, "package.json");
   const pkg = await readPackageJson(pkgPath);
   let next = pkg;
   for (const [name, version2] of Object.entries(SVELTE_5_VERSIONS)) {
@@ -2514,7 +2650,7 @@ async function bumpToSvelte5Versions(cwd) {
 
 // src/recipes/svelte-5/step-svelte-config.ts
 import { readFile as readFile11, writeFile as writeFile5 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
 var IMPORT_FROM_VITE_PLUGIN = new RegExp(
   String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
@@ -2555,7 +2691,7 @@ function dropPreprocessKey(source) {
   return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
 }
 async function migrateSvelteConfig(cwd) {
-  const path = join12(cwd, "svelte.config.js");
+  const path = join13(cwd, "svelte.config.js");
   let src;
   try {
     src = await readFile11(path, "utf-8");
@@ -2592,9 +2728,9 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
-  const pkg = await readPackageJson(join13(cwd, "package.json"));
+  const pkg = await readPackageJson(join14(cwd, "package.json"));
   const tailwindVersion = pkg.devDependencies?.tailwindcss ?? pkg.dependencies?.tailwindcss;
   if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
   if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
@@ -2616,7 +2752,7 @@ async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-gotchas.ts
 import { readFile as readFile12, writeFile as writeFile6 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { glob as glob2 } from "tinyglobby";
 
 // src/recipes/svelte-5/codemods/on-event-to-handler.ts
@@ -2962,7 +3098,7 @@ async function planGotchaCodemods(cwd) {
   const changes = [];
   const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
   for (const rel of relPaths) {
-    const path = join14(cwd, rel);
+    const path = join15(cwd, rel);
     const before = await readFile12(path, "utf-8");
     const after = CODEMODS.reduce((s, fn) => fn(s), before);
     if (after !== before) changes.push({ rel, after });
@@ -2972,7 +3108,7 @@ async function planGotchaCodemods(cwd) {
 async function applyGotchaCodemods(cwd) {
   const changes = await planGotchaCodemods(cwd);
   for (const c of changes) {
-    await writeFile6(join14(cwd, c.rel), c.after, "utf-8");
+    await writeFile6(join15(cwd, c.rel), c.after, "utf-8");
   }
   return { filesChanged: changes.length };
 }
@@ -2996,7 +3132,7 @@ async function verifyMigration(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-summary.ts
 import { writeFile as writeFile7 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function writeMigrationSummary(input) {
   const lines = [
     `# Svelte 4 \u2192 5 migration summary`,
@@ -3013,7 +3149,7 @@ async function writeMigrationSummary(input) {
     `- Verify Playwright a11y tests still pass.`
   ];
   const content = lines.join("\n") + "\n";
-  const path = join15(input.cwd, "MIGRATION_SVELTE_5.md");
+  const path = join16(input.cwd, "MIGRATION_SVELTE_5.md");
   await writeFile7(path, content, "utf-8");
   return path;
 }
@@ -3021,7 +3157,7 @@ async function writeMigrationSummary(input) {
 // src/recipes/svelte-5/index.ts
 async function alreadyOnSvelte5(cwd) {
   try {
-    const pkg = await readPackageJson(join16(cwd, "package.json"));
+    const pkg = await readPackageJson(join17(cwd, "package.json"));
     const v = pkg.devDependencies?.svelte ?? pkg.dependencies?.svelte;
     return !!v && /^\^?5\./.test(v);
   } catch {
@@ -3116,7 +3252,7 @@ import { resolve as resolve6 } from "path";
 
 // src/recipes/convert-to-pnpm.ts
 import { rm as rm3, stat as stat3 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -3149,9 +3285,9 @@ async function exists2(path) {
 async function convertToPnpm(site, opts = {}) {
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
-  const pnpmLockPath = join17(site.path, "pnpm-lock.yaml");
-  const npmLockPath = join17(site.path, "package-lock.json");
-  const yarnLockPath = join17(site.path, "yarn.lock");
+  const pnpmLockPath = join18(site.path, "pnpm-lock.yaml");
+  const npmLockPath = join18(site.path, "package-lock.json");
+  const yarnLockPath = join18(site.path, "yarn.lock");
   return withRecipe({
     name: "convert-to-pnpm",
     site,
@@ -3174,7 +3310,7 @@ async function convertToPnpm(site, opts = {}) {
       if (hasYarnLock) await rm3(yarnLockPath, { force: true });
       const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
       await commit2(`chore(pnpm): remove ${sourceLock}`);
-      const pkgPath = join17(cwd, "package.json");
+      const pkgPath = join18(cwd, "package.json");
       const pkg = await readPackageJson(pkgPath);
       const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
       if (pkg.scripts && typeof pkg.scripts === "object") {
@@ -3187,7 +3323,7 @@ async function convertToPnpm(site, opts = {}) {
       }
       await writePackageJson(pkgPath, next);
       await commit2("chore(pnpm): pin packageManager + rewrite npm scripts");
-      await rm3(join17(cwd, "node_modules"), { recursive: true, force: true });
+      await rm3(join18(cwd, "node_modules"), { recursive: true, force: true });
       const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
       if (installResult.code !== 0) {
         return { kind: "failed", notes: `pnpm install failed (exit ${installResult.code})` };
@@ -3228,19 +3364,19 @@ import { resolve as resolve7 } from "path";
 
 // src/recipes/onboard.ts
 import { stat as stat4 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/util/self-version.ts
-import { readFileSync, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join as join18 } from "path";
+import { dirname, join as join19 } from "path";
 function selfPackageVersion(callerImportMetaUrl) {
   try {
     let dir = dirname(fileURLToPath(callerImportMetaUrl));
     while (true) {
-      const candidate = join18(dir, "package.json");
+      const candidate = join19(dir, "package.json");
       if (existsSync2(candidate)) {
-        const raw = readFileSync(candidate, "utf-8");
+        const raw = readFileSync2(candidate, "utf-8");
         const pkg = JSON.parse(raw);
         if (pkg.name === "@reddoorla/maintenance") {
           return pkg.version ?? "0.0.0";
@@ -3297,13 +3433,13 @@ async function onboard(site, opts = {}) {
     name: "onboard",
     site,
     plan: async () => {
-      if (!await exists3(join19(site.path, "pnpm-lock.yaml"))) {
+      if (!await exists3(join20(site.path, "pnpm-lock.yaml"))) {
         return {
           kind: "failed",
           notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
         };
       }
-      const pkgPath = join19(site.path, "package.json");
+      const pkgPath = join20(site.path, "package.json");
       const pkg = await readPackageJson(pkgPath);
       const toAdd = [];
       if (!isDeclared(pkg, PACKAGE_NAME)) {
@@ -3323,7 +3459,7 @@ async function onboard(site, opts = {}) {
       return { kind: "apply", plan: { pkg, toAdd } };
     },
     apply: async ({ pkg, toAdd }, { commit: commit2, cwd }) => {
-      const pkgPath = join19(cwd, "package.json");
+      const pkgPath = join20(cwd, "package.json");
       let next = pkg;
       for (const dep of toAdd) {
         next = bumpDep(next, dep.name, dep.version);
@@ -3392,7 +3528,7 @@ import { resolve as resolve8 } from "path";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 async function svelteCodemods(site) {
   return withRecipe({
     name: "svelte-codemods",
@@ -3406,7 +3542,7 @@ async function svelteCodemods(site) {
     },
     apply: async (changes, { commit: commit2, cwd }) => {
       for (const c of changes) {
-        await writeFile8(join20(cwd, c.rel), c.after, "utf-8");
+        await writeFile8(join21(cwd, c.rel), c.after, "utf-8");
       }
       await commit2(`refactor(svelte5): apply codemods (${changes.length} files)`);
       return { kind: "ok" };
@@ -3633,7 +3769,7 @@ import { resolve as resolve9 } from "path";
 
 // src/recipes/a11y-fixtures-page/index.ts
 import { access, mkdir as mkdir3, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname4, join as join22 } from "path";
+import { dirname as dirname4, join as join23 } from "path";
 
 // src/recipes/a11y-fixtures-page/template.ts
 var A11Y_FIXTURES_PAGE_RELATIVE = "src/routes/dev/a11y-fixtures/+page.svelte";
@@ -3684,7 +3820,7 @@ async function fileExists(path) {
   }
 }
 async function a11yFixturesPage(site) {
-  const target = join22(site.path, A11Y_FIXTURES_PAGE_RELATIVE);
+  const target = join23(site.path, A11Y_FIXTURES_PAGE_RELATIVE);
   return withRecipe({
     name: "a11y-fixtures-page",
     site,
@@ -3791,15 +3927,15 @@ async function runInitCommand(site, opts) {
 }
 
 // src/cli/version.ts
-import { readFileSync as readFileSync2, existsSync as existsSync4 } from "fs";
-import { dirname as dirname5, join as join23 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { dirname as dirname5, join as join24 } from "path";
 function resolvePackageVersion(fromDir) {
   try {
     let dir = fromDir;
     while (true) {
-      const candidate = join23(dir, "package.json");
+      const candidate = join24(dir, "package.json");
       if (existsSync4(candidate)) {
-        const raw = readFileSync2(candidate, "utf-8");
+        const raw = readFileSync3(candidate, "utf-8");
         const pkg = JSON.parse(raw);
         if (pkg.name === "@reddoorla/maintenance") {
           return pkg.version ?? "unknown";
@@ -3815,6 +3951,7 @@ function resolvePackageVersion(fromDir) {
 }
 
 // src/cli/bin.ts
+loadCredentialsIntoEnv();
 var here = dirname6(fileURLToPath3(import.meta.url));
 var version = resolvePackageVersion(here);
 var AUDIT_DESCRIPTIONS = {