@reddoorla/maintenance 0.55.0 → 0.56.0

package/dist/chunk-WVRPOXKH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reports/due.ts"],"sourcesContent":["import type { WebsiteRow, Frequency, Status } from \"./airtable/websites.js\";\nimport type { ReportRow } from \"./airtable/reports.js\";\nimport type { ReportType } from \"./types.js\";\n\n/** Statuses where reports are appropriate. Drops \"deprecated\" and\n * \"probably not our problem\" — even if the operator left a freq set, we don't\n * want to surface those sites in --due output. Sites with status=null pass\n * through (existing data is partial; better to surface than silently skip). */\nconst ELIGIBLE_STATUSES: ReadonlySet<Status> = new Set<Status>([\n  \"in development\",\n  \"launch period\",\n  \"maintenance\",\n  \"hosting\",\n]);\n\nexport type DueItem = {\n  site: WebsiteRow;\n  reportType: ReportType;\n  /** Inclusive: the day the next report became due. */\n  dueDate: Date;\n  /** ISO date of the last `Sent at` for this (site, type), or null if there's never been one. */\n  lastSent: string | null;\n};\n\nconst MONTHS: Record<Exclude<Frequency, \"None\">, number> = {\n  Monthly: 1,\n  Quarterly: 3,\n  Yearly: 12,\n};\n\n/**\n * Add `n` calendar months in UTC, clamped to the last day of the target month.\n * Jan 31 + 1 month = Feb 28 (not Mar 3, which is what naive setMonth produces).\n * All-UTC accessors mean the result is timezone-independent.\n */\nfunction addMonths(d: Date, n: number): Date {\n  const out = new Date(d);\n  const day = out.getUTCDate();\n  out.setUTCDate(1);\n  out.setUTCMonth(out.getUTCMonth() + n);\n  const lastDayOfTargetMonth = new Date(\n    Date.UTC(out.getUTCFullYear(), out.getUTCMonth() + 1, 0),\n  ).getUTCDate();\n  out.setUTCDate(Math.min(day, lastDayOfTargetMonth));\n  return out;\n}\n\n/** Truncate to UTC midnight. Avoids local-TZ skew when comparing Airtable date-only fields. */\nfunction startOfDay(d: Date): Date {\n  const out = new Date(d);\n  out.setUTCHours(0, 0, 0, 0);\n  return out;\n}\n\nfunction lastSentForType(reports: ReportRow[], siteId: string, type: ReportType): string | null {\n  const candidates = reports\n    .filter((r) => r.siteId === siteId && r.reportType === type && r.sentAt !== null)\n    .map((r) => r.sentAt!)\n    .sort();\n  return candidates[candidates.length - 1] ?? null;\n}\n\n/**\n * Computes which (site, type) pairs are due as of `today`.\n *\n * Algorithm per (site, type):\n *  1. If freq === \"None\", skip.\n *  2. baseDate = max(last Sent at for this type, site's `maintenance/testing day` fallback).\n *  3. If no baseDate exists at all, the site is due now.\n *  4. dueDate = baseDate + frequency months.\n *  5. Due iff startOfDay(today) >= startOfDay(dueDate).\n */\nexport function findDueReports(\n  websites: WebsiteRow[],\n  reports: ReportRow[],\n  today: Date,\n): DueItem[] {\n  const out: DueItem[] = [];\n  const todayStart = startOfDay(today);\n\n  for (const site of websites) {\n    // Skip explicitly-non-active statuses (deprecated, \"probably not our problem\").\n    // Null status is treated as active for backwards compat with rows that pre-date\n    // the Status convention.\n    if (site.status !== null && !ELIGIBLE_STATUSES.has(site.status)) continue;\n\n    for (const type of [\"Maintenance\", \"Testing\"] as const) {\n      const rawFreq = type === \"Maintenance\" ? site.maintenanceFreq : site.testingFreq;\n      // Normalize obvious whitespace so a trailing-space typo (\"Quarterly \") still\n      // schedules. The LOUD warning below is the real safety net for genuine\n      // casing/spelling mistakes (\"monthly\", \"Quaterly\").\n      const freq = (typeof rawFreq === \"string\" ? rawFreq.trim() : rawFreq) as Frequency;\n      // Intentional silent skip — \"None\" (and the empty/blank default) means \"no\n      // schedule\", not a mistake.\n      if (freq === \"None\" || freq === (\"\" as Frequency)) continue;\n      // A non-empty, non-None value that doesn't match a known schedule used to\n      // silently produce no due date — the site just vanished from the loop. Warn\n      // LOUDLY so a casing/typo Airtable value is fixable instead of invisible.\n      if (!(freq in MONTHS)) {\n        console.warn(\n          `⚠ ${site.name}: unrecognized ${type === \"Maintenance\" ? \"maintenance\" : \"testing\"} frequency '${rawFreq}' — not scheduling; fix the Airtable value`,\n        );\n        continue;\n      }\n\n      const lastSent = lastSentForType(reports, site.id, type);\n      const fallback = type === \"Maintenance\" ? site.maintenanceDay : site.testingDay;\n      const baseIso = lastSent ?? fallback;\n\n      if (!baseIso) {\n        out.push({ site, reportType: type, dueDate: todayStart, lastSent });\n        continue;\n      }\n\n      const dueDate = addMonths(new Date(baseIso), MONTHS[freq]);\n      if (todayStart.getTime() >= startOfDay(dueDate).getTime()) {\n        out.push({ site, reportType: type, dueDate, lastSent });\n      }\n    }\n  }\n\n  return out;\n}\n\n/**\n * The UTC `YYYY-MM` of a `dueDate` from {@link findDueReports} — the per-recurrence\n * idempotency key for drafting. Monthly recurrences land in distinct months; quarterly\n * and yearly land in distinct due-months too, so this uniquely names one draft per cycle.\n * UTC accessors keep it timezone-independent, consistent with the rest of this module.\n */\nexport function reportPeriodKey(dueDate: Date): string {\n  if (Number.isNaN(dueDate.getTime())) throw new TypeError(\"reportPeriodKey: invalid Date\");\n  const year = dueDate.getUTCFullYear();\n  const month = String(dueDate.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}-${month}`;\n}\n"],"mappings":";AAQA,IAAM,oBAAyC,oBAAI,IAAY;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAWD,IAAM,SAAqD;AAAA,EACzD,SAAS;AAAA,EACT,WAAW;AAAA,EACX,QAAQ;AACV;AAOA,SAAS,UAAU,GAAS,GAAiB;AAC3C,QAAM,MAAM,IAAI,KAAK,CAAC;AACtB,QAAM,MAAM,IAAI,WAAW;AAC3B,MAAI,WAAW,CAAC;AAChB,MAAI,YAAY,IAAI,YAAY,IAAI,CAAC;AACrC,QAAM,uBAAuB,IAAI;AAAA,IAC/B,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC;AAAA,EACzD,EAAE,WAAW;AACb,MAAI,WAAW,KAAK,IAAI,KAAK,oBAAoB,CAAC;AAClD,SAAO;AACT;AAGA,SAAS,WAAW,GAAe;AACjC,QAAM,MAAM,IAAI,KAAK,CAAC;AACtB,MAAI,YAAY,GAAG,GAAG,GAAG,CAAC;AAC1B,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAsB,QAAgB,MAAiC;AAC9F,QAAM,aAAa,QAChB,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,eAAe,QAAQ,EAAE,WAAW,IAAI,EAC/E,IAAI,CAAC,MAAM,EAAE,MAAO,EACpB,KAAK;AACR,SAAO,WAAW,WAAW,SAAS,CAAC,KAAK;AAC9C;AAYO,SAAS,eACd,UACA,SACA,OACW;AACX,QAAM,MAAiB,CAAC;AACxB,QAAM,aAAa,WAAW,KAAK;AAEnC,aAAW,QAAQ,UAAU;AAI3B,QAAI,KAAK,WAAW,QAAQ,CAAC,kBAAkB,IAAI,KAAK,MAAM,EAAG;AAEjE,eAAW,QAAQ,CAAC,eAAe,SAAS,GAAY;AACtD,YAAM,UAAU,SAAS,gBAAgB,KAAK,kBAAkB,KAAK;AAIrE,YAAM,OAAQ,OAAO,YAAY,WAAW,QAAQ,KAAK,IAAI;AAG7D,UAAI,SAAS,UAAU,SAAU,GAAkB;AAInD,UAAI,EAAE,QAAQ,SAAS;AACrB,gBAAQ;AAAA,UACN,UAAK,KAAK,IAAI,kBAAkB,SAAS,gBAAgB,gBAAgB,SAAS,eAAe,OAAO;AAAA,QAC1G;AACA;AAAA,MACF;AAEA,YAAM,WAAW,gBAAgB,SAAS,KAAK,IAAI,IAAI;AACvD,YAAM,WAAW,SAAS,gBAAgB,KAAK,iBAAiB,KAAK;AACrE,YAAM,UAAU,YAAY;AAE5B,UAAI,CAAC,SAAS;AACZ,YAAI,KAAK,EAAE,MAAM,YAAY,MAAM,SAAS,YAAY,SAAS,CAAC;AAClE;AAAA,MACF;AAEA,YAAM,UAAU,UAAU,IAAI,KAAK,OAAO,GAAG,OAAO,IAAI,CAAC;AACzD,UAAI,WAAW,QAAQ,KAAK,WAAW,OAAO,EAAE,QAAQ,GAAG;AACzD,YAAI,KAAK,EAAE,MAAM,YAAY,MAAM,SAAS,SAAS,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,gBAAgB,SAAuB;AACrD,MAAI,OAAO,MAAM,QAAQ,QAAQ,CAAC,EAAG,OAAM,IAAI,UAAU,+BAA+B;AACxF,QAAM,OAAO,QAAQ,eAAe;AACpC,QAAM,QAAQ,OAAO,QAAQ,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAC/D,SAAO,GAAG,IAAI,IAAI,KAAK;AACzB;","names":[]}

package/dist/chunk-XKOZUVK2.js

@@ -0,0 +1,121 @@
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+import {
+  branchName,
+  checkoutBranch,
+  commit,
+  createBranch,
+  currentBranch,
+  deleteBranch,
+  forceCheckoutBranch,
+  isWorkingTreeClean
+} from "./chunk-XTK5VIQB.js";
+
+// src/recipes/_with-recipe.ts
+async function withRecipe(body) {
+  const label = siteLabel(body.site);
+  if (body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  const planned = await body.plan();
+  if (planned.kind === "noop") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "noop",
+      commits: [],
+      ...planned.notes ? { notes: planned.notes } : {}
+    };
+  }
+  if (planned.kind === "failed") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: [],
+      notes: planned.notes
+    };
+  }
+  if (!body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  let original = null;
+  try {
+    original = await currentBranch(body.site.path);
+  } catch {
+    original = null;
+  }
+  const branch = branchName(body.name);
+  await createBranch(body.site.path, branch);
+  const restoreOriginal = async () => {
+    if (original === null || original === branch) return;
+    try {
+      await checkoutBranch(body.site.path, original);
+    } catch (err) {
+      console.warn(
+        `warning: could not restore branch ${original} after ${body.name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
+  const restoreAfterFailure = async () => {
+    if (original === null || original === branch) return;
+    try {
+      await forceCheckoutBranch(body.site.path, original);
+    } catch (err) {
+      console.warn(
+        `warning: could not force-restore branch ${original} after failed ${body.name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return;
+    }
+    try {
+      await deleteBranch(body.site.path, branch);
+    } catch (err) {
+      console.warn(
+        `warning: could not delete recipe branch ${branch} after failed ${body.name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
+  const shas = [];
+  let result;
+  try {
+    result = await body.apply(planned.plan, {
+      cwd: body.site.path,
+      branch,
+      commit: async (msg) => {
+        const sha = await commit(body.site.path, msg);
+        if (sha) shas.push(sha);
+        return sha;
+      }
+    });
+  } catch (err) {
+    await restoreAfterFailure();
+    throw err;
+  }
+  if (result.kind === "failed") {
+    await restoreAfterFailure();
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: shas,
+      notes: result.notes
+    };
+  }
+  if (shas.length === 0) {
+    await restoreOriginal();
+  }
+  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;
+  return {
+    recipe: body.name,
+    site: label,
+    status: shas.length > 0 ? "applied" : "noop",
+    commits: shas,
+    notes
+  };
+}
+
+export {
+  withRecipe
+};
+//# sourceMappingURL=chunk-XKOZUVK2.js.map

package/dist/chunk-XKOZUVK2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/_with-recipe.ts"],"sourcesContent":["import type { RecipeName, RecipeResult, Site } from \"../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  forceCheckoutBranch,\n  isWorkingTreeClean,\n} from \"../util/git.js\";\nimport { siteLabel } from \"../util/site.js\";\n\n/** Outcome of the read-only planning phase. `noop` and `failed` short-circuit\n * without creating a branch; `apply` carries the recipe-specific plan data\n * forward to the apply phase. */\nexport type RecipePlan<P> =\n  | { kind: \"noop\"; notes?: string }\n  | { kind: \"failed\"; notes: string }\n  | { kind: \"apply\"; plan: P };\n\nexport type RecipeApplyCtx = {\n  /** Stage all current changes and commit. Returns the SHA, or null if\n   * nothing was staged. The wrapper accumulates SHAs into the final\n   * RecipeResult. */\n  commit: (message: string) => Promise<string | null>;\n  /** Branch name that was created for this run. */\n  branch: string;\n  /** Site path — same as `site.path`. */\n  cwd: string;\n};\n\nexport type RecipeApplyResult = { kind: \"ok\"; notes?: string } | { kind: \"failed\"; notes: string };\n\nexport type RecipeBody<P> = {\n  name: RecipeName;\n  site: Site;\n  /** Inspect the site and decide: noop, failed, or proceed (with plan data\n   * passed to apply). Runs before the working-tree clean check unless\n   * `checkTreeFirst: true` is set, so most recipes can noop on a dirty\n   * tree without throwing. */\n  plan: () => Promise<RecipePlan<P>>;\n  /** Make the actual changes. Use `ctx.commit(msg)` for each logical step;\n   * the wrapper collects SHAs into `RecipeResult.commits`. Return\n   * `{ kind: \"failed\", notes }` to abort partway and surface the failure. */\n  apply: (plan: P, ctx: RecipeApplyCtx) => Promise<RecipeApplyResult>;\n  /** Check working tree clean BEFORE `plan()` runs. Use only when plan\n   * itself mutates the tree (e.g. `bump-deps` runs `pnpm install` in plan\n   * for an accurate outdated probe). Default false — clean check happens\n   * after plan only if plan returns proceed, allowing noop-on-dirty for\n   * read-only plans (a tree with stray edits + no recipe work to do\n   * should not throw). */\n  checkTreeFirst?: boolean;\n};\n\n/** Wrap a recipe's plan/apply phases. Centralises the siteLabel /\n * clean-tree check / branch creation / commit accumulation / RecipeResult\n * construction boilerplate that every recipe used to re-implement. */\nexport async function withRecipe<P>(body: RecipeBody<P>): Promise<RecipeResult> {\n  const label = siteLabel(body.site);\n\n  if (body.checkTreeFirst && !(await isWorkingTreeClean(body.site.path))) {\n    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);\n  }\n\n  const planned = await body.plan();\n\n  if (planned.kind === \"noop\") {\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"noop\",\n      commits: [],\n      ...(planned.notes ? { notes: planned.notes } : {}),\n    };\n  }\n  if (planned.kind === \"failed\") {\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"failed\",\n      commits: [],\n      notes: planned.notes,\n    };\n  }\n\n  if (!body.checkTreeFirst && !(await isWorkingTreeClean(body.site.path))) {\n    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);\n  }\n\n  // Capture the operator's branch BEFORE we create the recipe branch, so we can\n  // return them to it afterwards (#2) and so the failure path (#3) knows which\n  // branch to force-restore to. Best-effort: if we can't read it (detached HEAD,\n  // git error) we proceed with `original = null` and skip any force operations\n  // rather than guess — we must NEVER force-discard/delete a branch we're unsure\n  // of.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(body.site.path);\n  } catch {\n    original = null;\n  }\n\n  const branch = branchName(body.name);\n  await createBranch(body.site.path, branch);\n\n  /**\n   * Best-effort restore to the operator's original branch. Never throws — a\n   * restore failure must not turn an otherwise-clean recipe result into a\n   * failure (#2). Skipped when we couldn't capture the original branch.\n   *\n   * IMPORTANT (composition): this is invoked only on the NOOP-from-apply path\n   * (the recipe created a branch but committed nothing — leaving the operator\n   * parked on an empty maint branch is pure downside). It is deliberately NOT\n   * invoked on the APPLIED path: the fleet onboarding pipeline composes recipes\n   * by running them in sequence against the SAME checkout, each building on the\n   * prior's committed files in the working tree (convert-to-pnpm's lockfile →\n   * onboard's deps → sync-configs → svelte-codemods). Restoring to the base\n   * branch after an applied recipe would strip those files from the working\n   * tree and break composition (verified live across the fleet). selfUpdating,\n   * which PUSHES its branch, does its own post-push restore since its local\n   * branch is disposable.\n   */\n  const restoreOriginal = async (): Promise<void> => {\n    if (original === null || original === branch) return;\n    try {\n      await checkoutBranch(body.site.path, original);\n    } catch (err) {\n      // Leave the operator on the recipe branch rather than fail the result.\n      console.warn(\n        `warning: could not restore branch ${original} after ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  };\n\n  /**\n   * Failure restore (#3): force the checkout back to the captured original\n   * branch (discarding the recipe branch's uncommitted changes) and delete the\n   * recipe branch, so a re-run starts clean. SAFETY: only ever force-checks-out\n   * the captured `original` and only ever deletes `branch` (the recipe-created\n   * branch); never deletes `original`, never runs `git clean`. If `original` is\n   * unavailable we do nothing (the safe subset) — better to leave the operator\n   * parked than to force anything we're unsure about. Best-effort: never throws.\n   */\n  const restoreAfterFailure = async (): Promise<void> => {\n    if (original === null || original === branch) return;\n    try {\n      await forceCheckoutBranch(body.site.path, original);\n    } catch (err) {\n      console.warn(\n        `warning: could not force-restore branch ${original} after failed ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n      // If we couldn't get off the recipe branch, deleting it would fail anyway;\n      // and we must never delete the branch we're still on.\n      return;\n    }\n    try {\n      await deleteBranch(body.site.path, branch);\n    } catch (err) {\n      console.warn(\n        `warning: could not delete recipe branch ${branch} after failed ${body.name}: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  };\n\n  const shas: string[] = [];\n  let result: RecipeApplyResult;\n  try {\n    result = await body.apply(planned.plan, {\n      cwd: body.site.path,\n      branch,\n      commit: async (msg) => {\n        const sha = await gitCommit(body.site.path, msg);\n        if (sha) shas.push(sha);\n        return sha;\n      },\n    });\n  } catch (err) {\n    // Body threw mid-mutation: force-restore + delete the recipe branch so the\n    // checkout is retriable, then re-throw (preserve the prior throw semantics —\n    // callers like init treat an uncaught throw as an `error` step).\n    await restoreAfterFailure();\n    throw err;\n  }\n\n  if (result.kind === \"failed\") {\n    await restoreAfterFailure();\n    return {\n      recipe: body.name,\n      site: label,\n      status: \"failed\",\n      commits: shas,\n      notes: result.notes,\n    };\n  }\n\n  // NOOP-from-apply only: no commits to compose, so don't leave the operator\n  // parked on an empty maint branch. The APPLIED path intentionally stays on the\n  // maint branch so the onboarding pipeline can compose (see restoreOriginal).\n  if (shas.length === 0) {\n    await restoreOriginal();\n  }\n\n  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;\n  return {\n    recipe: body.name,\n    site: label,\n    status: shas.length > 0 ? \"applied\" : \"noop\",\n    commits: shas,\n    notes,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0DA,eAAsB,WAAc,MAA4C;AAC9E,QAAM,QAAQ,UAAU,KAAK,IAAI;AAEjC,MAAI,KAAK,kBAAkB,CAAE,MAAM,mBAAmB,KAAK,KAAK,IAAI,GAAI;AACtE,UAAM,IAAI,MAAM,iDAAiD,KAAK,KAAK,IAAI,EAAE;AAAA,EACnF;AAEA,QAAM,UAAU,MAAM,KAAK,KAAK;AAEhC,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAClD;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,UAAU;AAC7B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,kBAAkB,CAAE,MAAM,mBAAmB,KAAK,KAAK,IAAI,GAAI;AACvE,UAAM,IAAI,MAAM,iDAAiD,KAAK,KAAK,IAAI,EAAE;AAAA,EACnF;AAQA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,KAAK,IAAI;AAAA,EAC/C,QAAQ;AACN,eAAW;AAAA,EACb;AAEA,QAAM,SAAS,WAAW,KAAK,IAAI;AACnC,QAAM,aAAa,KAAK,KAAK,MAAM,MAAM;AAmBzC,QAAM,kBAAkB,YAA2B;AACjD,QAAI,aAAa,QAAQ,aAAa,OAAQ;AAC9C,QAAI;AACF,YAAM,eAAe,KAAK,KAAK,MAAM,QAAQ;AAAA,IAC/C,SAAS,KAAK;AAEZ,cAAQ;AAAA,QACN,qCAAqC,QAAQ,UAAU,KAAK,IAAI,KAC9D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAWA,QAAM,sBAAsB,YAA2B;AACrD,QAAI,aAAa,QAAQ,aAAa,OAAQ;AAC9C,QAAI;AACF,YAAM,oBAAoB,KAAK,KAAK,MAAM,QAAQ;AAAA,IACpD,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,2CAA2C,QAAQ,iBAAiB,KAAK,IAAI,KAC3E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAGA;AAAA,IACF;AACA,QAAI;AACF,YAAM,aAAa,KAAK,KAAK,MAAM,MAAM;AAAA,IAC3C,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,2CAA2C,MAAM,iBAAiB,KAAK,IAAI,KACzE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAiB,CAAC;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,QAAQ,MAAM;AAAA,MACtC,KAAK,KAAK,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,OAAO,QAAQ;AACrB,cAAM,MAAM,MAAM,OAAU,KAAK,KAAK,MAAM,GAAG;AAC/C,YAAI,IAAK,MAAK,KAAK,GAAG;AACtB,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AAIZ,UAAM,oBAAoB;AAC1B,UAAM;AAAA,EACR;AAEA,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,oBAAoB;AAC1B,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,OAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAKA,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,gBAAgB;AAAA,EACxB;AAEA,QAAM,QAAQ,OAAO,QAAQ,GAAG,OAAO,KAAK,aAAa,MAAM,KAAK,WAAW,MAAM;AACrF,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,MAAM;AAAA,IACN,QAAQ,KAAK,SAAS,IAAI,YAAY;AAAA,IACtC,SAAS;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-XO2RUYVM.js

@@ -0,0 +1,138 @@
+import {
+  svelteCodemods
+} from "./chunk-FUD4I2ZW.js";
+import {
+  onboard
+} from "./chunk-ZYBOT5PM.js";
+import {
+  convertToPnpm
+} from "./chunk-2X322ZES.js";
+import {
+  syncConfigs
+} from "./chunk-JNXCDUYB.js";
+import {
+  withRecipe
+} from "./chunk-XKOZUVK2.js";
+import {
+  runAudits
+} from "./chunk-4PY4I5OR.js";
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+
+// src/recipes/a11y-fixtures-page/index.ts
+import { access, mkdir, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/recipes/a11y-fixtures-page/template.ts
+var A11Y_FIXTURES_PAGE_RELATIVE = "src/routes/dev/a11y-fixtures/+page.svelte";
+var A11Y_FIXTURES_PAGE_TEMPLATE = `<svelte:head>
+  <title>a11y fixtures \u2014 Reddoor</title>
+  <meta
+    name="description"
+    content="Reddoor accessibility fixtures \u2014 semantic landmarks, heading hierarchy, and a stable target for @lhci/cli and Playwright + axe-core coverage. Not linked from the public site."
+  />
+</svelte:head>
+
+<main>
+  <header>
+    <h1>Accessibility fixtures</h1>
+    <p>
+      This page exists so <code>@lhci/cli</code> and Playwright + axe-core have a
+      stable target with predictable a11y characteristics. It is not linked from
+      the public site.
+    </p>
+  </header>
+
+  <section aria-labelledby="landmarks-heading">
+    <h2 id="landmarks-heading">Landmarks</h2>
+    <p>
+      A single <code>main</code> wraps the page; sections each declare
+      <code>aria-labelledby</code> matched to their heading id so screen readers
+      and axe both see a clean outline.
+    </p>
+  </section>
+
+  <section aria-labelledby="links-heading">
+    <h2 id="links-heading">Links</h2>
+    <p>
+      <a href="/">Back to home</a> \u2014 relative link with descriptive visible text,
+      so no <code>aria-label</code> override is needed.
+    </p>
+  </section>
+</main>
+`;
+
+// src/recipes/a11y-fixtures-page/index.ts
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function a11yFixturesPage(site) {
+  const target = join(site.path, A11Y_FIXTURES_PAGE_RELATIVE);
+  return withRecipe({
+    name: "a11y-fixtures-page",
+    site,
+    plan: async () => {
+      if (await fileExists(target)) {
+        return { kind: "noop", notes: `${A11Y_FIXTURES_PAGE_RELATIVE} already exists` };
+      }
+      return { kind: "apply", plan: { target } };
+    },
+    apply: async (planned, { commit }) => {
+      await mkdir(dirname(planned.target), { recursive: true });
+      await writeFile(planned.target, A11Y_FIXTURES_PAGE_TEMPLATE, "utf-8");
+      await commit("feat: add /dev/a11y-fixtures starter route");
+      return { kind: "ok" };
+    }
+  });
+}
+
+// src/recipes/init.ts
+function recipeStep(name, fn) {
+  return {
+    name,
+    run: async (site) => ({ kind: "recipe", result: await fn(site) })
+  };
+}
+var DEFAULT_INIT_STEPS = [
+  recipeStep("convert-to-pnpm", convertToPnpm),
+  recipeStep("onboard", onboard),
+  recipeStep("sync-configs", syncConfigs),
+  recipeStep("svelte-codemods", svelteCodemods),
+  recipeStep("a11y-fixtures-page", a11yFixturesPage),
+  {
+    name: "audit",
+    run: async (site) => ({ kind: "audit", results: await runAudits(site) })
+  }
+];
+async function init(site, opts = {}) {
+  const steps = opts.steps ?? DEFAULT_INIT_STEPS;
+  const out = [];
+  for (const step of steps) {
+    let result;
+    try {
+      result = await step.run(site);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      out.push({ name: step.name, result: { kind: "error", message } });
+      return { site: siteLabel(site), steps: out, complete: false };
+    }
+    out.push({ name: step.name, result });
+    if (result.kind === "recipe" && result.result.status === "failed") {
+      return { site: siteLabel(site), steps: out, complete: false };
+    }
+  }
+  return { site: siteLabel(site), steps: out, complete: true };
+}
+
+export {
+  a11yFixturesPage,
+  DEFAULT_INIT_STEPS,
+  init
+};
+//# sourceMappingURL=chunk-XO2RUYVM.js.map

package/dist/chunk-XO2RUYVM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/a11y-fixtures-page/index.ts","../src/recipes/a11y-fixtures-page/template.ts","../src/recipes/init.ts"],"sourcesContent":["import { access, mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { A11Y_FIXTURES_PAGE_RELATIVE, A11Y_FIXTURES_PAGE_TEMPLATE } from \"./template.js\";\n\nasync function fileExists(path: string): Promise<boolean> {\n  try {\n    await access(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Writes a starter `src/routes/dev/a11y-fixtures/+page.svelte` if the route\n * doesn't already exist. The hardcoded URL in `src/configs/lighthouse.ts` +\n * `src/configs/playwright-a11y.ts` targets this path — newly-onboarded sites\n * need the route to exist for either audit to pass. Operator edits to an\n * existing page are never clobbered (noop on existing file).\n */\nexport async function a11yFixturesPage(site: Site): Promise<RecipeResult> {\n  const target = join(site.path, A11Y_FIXTURES_PAGE_RELATIVE);\n  return withRecipe<{ target: string }>({\n    name: \"a11y-fixtures-page\",\n    site,\n    plan: async () => {\n      if (await fileExists(target)) {\n        return { kind: \"noop\", notes: `${A11Y_FIXTURES_PAGE_RELATIVE} already exists` };\n      }\n      return { kind: \"apply\", plan: { target } };\n    },\n    apply: async (planned, { commit }) => {\n      await mkdir(dirname(planned.target), { recursive: true });\n      await writeFile(planned.target, A11Y_FIXTURES_PAGE_TEMPLATE, \"utf-8\");\n      await commit(\"feat: add /dev/a11y-fixtures starter route\");\n      return { kind: \"ok\" };\n    },\n  });\n}\n","/** Relative path inside a site where the a11y fixtures route lives. The\n * hardcoded URL in `src/configs/lighthouse.ts` + `src/configs/playwright-a11y.ts`\n * is `/dev/a11y-fixtures`, so a SvelteKit `+page.svelte` here resolves. */\nexport const A11Y_FIXTURES_PAGE_RELATIVE = \"src/routes/dev/a11y-fixtures/+page.svelte\";\n\n/** Stub `+page.svelte` for newly-onboarded sites. Generic on purpose —\n * landmarks, heading hierarchy, and a relative link cover the axe-core +\n * lhci defaults without committing the operator to any specific fixture\n * shape. Replace with site-specific patterns over time. */\nexport const A11Y_FIXTURES_PAGE_TEMPLATE = `<svelte:head>\n  <title>a11y fixtures — Reddoor</title>\n  <meta\n    name=\"description\"\n    content=\"Reddoor accessibility fixtures — semantic landmarks, heading hierarchy, and a stable target for @lhci/cli and Playwright + axe-core coverage. Not linked from the public site.\"\n  />\n</svelte:head>\n\n<main>\n  <header>\n    <h1>Accessibility fixtures</h1>\n    <p>\n      This page exists so <code>@lhci/cli</code> and Playwright + axe-core have a\n      stable target with predictable a11y characteristics. It is not linked from\n      the public site.\n    </p>\n  </header>\n\n  <section aria-labelledby=\"landmarks-heading\">\n    <h2 id=\"landmarks-heading\">Landmarks</h2>\n    <p>\n      A single <code>main</code> wraps the page; sections each declare\n      <code>aria-labelledby</code> matched to their heading id so screen readers\n      and axe both see a clean outline.\n    </p>\n  </section>\n\n  <section aria-labelledby=\"links-heading\">\n    <h2 id=\"links-heading\">Links</h2>\n    <p>\n      <a href=\"/\">Back to home</a> — relative link with descriptive visible text,\n      so no <code>aria-label</code> override is needed.\n    </p>\n  </section>\n</main>\n`;\n","import type { AuditResult, RecipeResult, Site } from \"../types.js\";\nimport { siteLabel } from \"../util/site.js\";\nimport { convertToPnpm } from \"./convert-to-pnpm.js\";\nimport { onboard } from \"./onboard.js\";\nimport { syncConfigs } from \"./sync-configs.js\";\nimport { svelteCodemods } from \"./svelte-codemods.js\";\nimport { a11yFixturesPage } from \"./a11y-fixtures-page/index.js\";\nimport { runAudits } from \"../audits/index.js\";\n\nexport type InitStepResult =\n  | { kind: \"recipe\"; result: RecipeResult }\n  | { kind: \"audit\"; results: AuditResult[] }\n  | { kind: \"error\"; message: string };\n\nexport type InitStep = {\n  name: string;\n  run: (site: Site) => Promise<InitStepResult>;\n};\n\nexport type InitResult = {\n  site: string;\n  steps: Array<{ name: string; result: InitStepResult }>;\n  /** True if every step ran; false if an `error` or `failed` recipe result\n   * short-circuited the chain. `noop` recipes do not break completeness. */\n  complete: boolean;\n};\n\nexport type InitOptions = {\n  /** Override the default step list. Tests inject mocked steps; production\n   * code relies on the default. */\n  steps?: InitStep[];\n};\n\nfunction recipeStep(name: string, fn: (site: Site) => Promise<RecipeResult>): InitStep {\n  return {\n    name,\n    run: async (site) => ({ kind: \"recipe\", result: await fn(site) }),\n  };\n}\n\n/** convert-to-pnpm → onboard → sync-configs → svelte-codemods →\n * a11y-fixtures-page → audit. Order is deliberate — every step depends on\n * the prior one's output (pnpm before onboard's installs, onboard's deps\n * before sync-configs writes lighthouserc, fixtures page before audit\n * actually has a route to hit). */\nexport const DEFAULT_INIT_STEPS: InitStep[] = [\n  recipeStep(\"convert-to-pnpm\", convertToPnpm),\n  recipeStep(\"onboard\", onboard),\n  recipeStep(\"sync-configs\", syncConfigs),\n  recipeStep(\"svelte-codemods\", svelteCodemods),\n  recipeStep(\"a11y-fixtures-page\", a11yFixturesPage),\n  {\n    name: \"audit\",\n    run: async (site) => ({ kind: \"audit\", results: await runAudits(site) }),\n  },\n];\n\n/**\n * One-shot guided onboarding. Runs the default step sequence against a\n * site, collecting per-step results into an InitResult. Each underlying\n * recipe still creates its own branch — init is a thin orchestrator, not\n * a branch-collapser; the operator ends up with one stack of branches per\n * mutated step (recipes that noop don't branch).\n *\n * Stops the chain on the first uncaught error or `failed` recipe result.\n * `noop` results are expected (e.g. running init twice) and continue the\n * chain. The final audit pass runs if no prior step errored.\n */\nexport async function init(site: Site, opts: InitOptions = {}): Promise<InitResult> {\n  const steps = opts.steps ?? DEFAULT_INIT_STEPS;\n  const out: Array<{ name: string; result: InitStepResult }> = [];\n\n  for (const step of steps) {\n    let result: InitStepResult;\n    try {\n      result = await step.run(site);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      out.push({ name: step.name, result: { kind: \"error\", message } });\n      return { site: siteLabel(site), steps: out, complete: false };\n    }\n    out.push({ name: step.name, result });\n    if (result.kind === \"recipe\" && result.result.status === \"failed\") {\n      return { site: siteLabel(site), steps: out, complete: false };\n    }\n  }\n\n  return { site: siteLabel(site), steps: out, complete: true };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,iBAAiB;AACzC,SAAS,SAAS,YAAY;;;ACEvB,IAAM,8BAA8B;AAMpC,IAAM,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ADH3C,eAAe,WAAW,MAAgC;AACxD,MAAI;AACF,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,iBAAiB,MAAmC;AACxE,QAAM,SAAS,KAAK,KAAK,MAAM,2BAA2B;AAC1D,SAAO,WAA+B;AAAA,IACpC,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,MAAM,WAAW,MAAM,GAAG;AAC5B,eAAO,EAAE,MAAM,QAAQ,OAAO,GAAG,2BAA2B,kBAAkB;AAAA,MAChF;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,OAAO,EAAE;AAAA,IAC3C;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,OAAO,MAAM;AACpC,YAAM,MAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,YAAM,UAAU,QAAQ,QAAQ,6BAA6B,OAAO;AACpE,YAAM,OAAO,4CAA4C;AACzD,aAAO,EAAE,MAAM,KAAK;AAAA,IACtB;AAAA,EACF,CAAC;AACH;;;AEPA,SAAS,WAAW,MAAc,IAAqD;AACrF,SAAO;AAAA,IACL;AAAA,IACA,KAAK,OAAO,UAAU,EAAE,MAAM,UAAU,QAAQ,MAAM,GAAG,IAAI,EAAE;AAAA,EACjE;AACF;AAOO,IAAM,qBAAiC;AAAA,EAC5C,WAAW,mBAAmB,aAAa;AAAA,EAC3C,WAAW,WAAW,OAAO;AAAA,EAC7B,WAAW,gBAAgB,WAAW;AAAA,EACtC,WAAW,mBAAmB,cAAc;AAAA,EAC5C,WAAW,sBAAsB,gBAAgB;AAAA,EACjD;AAAA,IACE,MAAM;AAAA,IACN,KAAK,OAAO,UAAU,EAAE,MAAM,SAAS,SAAS,MAAM,UAAU,IAAI,EAAE;AAAA,EACxE;AACF;AAaA,eAAsB,KAAK,MAAY,OAAoB,CAAC,GAAwB;AAClF,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,MAAuD,CAAC;AAE9D,aAAW,QAAQ,OAAO;AACxB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,KAAK,IAAI,IAAI;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAI,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,EAAE,MAAM,SAAS,QAAQ,EAAE,CAAC;AAChE,aAAO,EAAE,MAAM,UAAU,IAAI,GAAG,OAAO,KAAK,UAAU,MAAM;AAAA,IAC9D;AACA,QAAI,KAAK,EAAE,MAAM,KAAK,MAAM,OAAO,CAAC;AACpC,QAAI,OAAO,SAAS,YAAY,OAAO,OAAO,WAAW,UAAU;AACjE,aAAO,EAAE,MAAM,UAAU,IAAI,GAAG,OAAO,KAAK,UAAU,MAAM;AAAA,IAC9D;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,UAAU,IAAI,GAAG,OAAO,KAAK,UAAU,KAAK;AAC7D;","names":[]}

package/dist/chunk-XTK5VIQB.js

@@ -0,0 +1,97 @@
+// src/util/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var exec = promisify(execFile);
+async function git(cwd, args) {
+  return exec("git", args, { cwd, env: process.env });
+}
+function branchName(recipe, when = /* @__PURE__ */ new Date()) {
+  const compact = when.toISOString().replace(/[-:.]/g, "");
+  return `maint/${recipe}-${compact}`;
+}
+async function currentBranch(cwd) {
+  const { stdout } = await git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  return stdout.trim();
+}
+async function isWorkingTreeClean(cwd) {
+  const { stdout } = await git(cwd, ["status", "--porcelain"]);
+  return stdout.trim().length === 0;
+}
+async function createBranch(cwd, name) {
+  await git(cwd, ["checkout", "-b", name]);
+}
+async function checkoutBranch(cwd, name) {
+  await git(cwd, ["checkout", name]);
+}
+async function forceCheckoutBranch(cwd, name) {
+  await git(cwd, ["checkout", "-f", name]);
+}
+async function deleteBranch(cwd, name) {
+  await git(cwd, ["branch", "-D", name]);
+}
+async function stageAll(cwd) {
+  await git(cwd, ["add", "-A"]);
+}
+async function listTrackedFiles(cwd) {
+  const { stdout } = await git(cwd, ["ls-files"]);
+  return stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+}
+async function removeFromIndex(cwd, paths) {
+  if (paths.length === 0) return;
+  await git(cwd, ["rm", "-r", "--cached", "--", ...paths]);
+}
+async function commit(cwd, message) {
+  await stageAll(cwd);
+  const { stdout: status } = await git(cwd, ["status", "--porcelain"]);
+  if (status.trim().length === 0) return null;
+  await git(cwd, ["commit", "-m", message]);
+  const { stdout: sha } = await git(cwd, ["rev-parse", "HEAD"]);
+  return sha.trim();
+}
+var OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+function isOwnerRepo(repo) {
+  if (repo.includes("..")) return false;
+  return OWNER_REPO_RE.test(repo);
+}
+function sameOwnerRepo(a, b) {
+  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);
+  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);
+  if (na === null || nb === null) return false;
+  return na.toLowerCase() === nb.toLowerCase();
+}
+function parseOwnerRepo(remoteUrl) {
+  const trimmed = remoteUrl.trim().replace(/\.git$/, "").replace(/\/$/, "");
+  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);
+  const path = scp ? scp[1] : trimmed.replace(/^https?:\/\/[^/]+\//, "");
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
+}
+async function getRemoteUrl(cwd) {
+  const { stdout } = await git(cwd, ["remote", "get-url", "origin"]);
+  return stdout.trim();
+}
+async function push(cwd, branch) {
+  await git(cwd, ["push", "-u", "origin", branch]);
+}
+
+export {
+  branchName,
+  currentBranch,
+  isWorkingTreeClean,
+  createBranch,
+  checkoutBranch,
+  forceCheckoutBranch,
+  deleteBranch,
+  stageAll,
+  listTrackedFiles,
+  removeFromIndex,
+  commit,
+  OWNER_REPO_RE,
+  isOwnerRepo,
+  sameOwnerRepo,
+  parseOwnerRepo,
+  getRemoteUrl,
+  push
+};
+//# sourceMappingURL=chunk-XTK5VIQB.js.map

package/dist/chunk-XTK5VIQB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/git.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\n\nconst exec = promisify(execFile);\n\nasync function git(cwd: string, args: string[]): Promise<{ stdout: string; stderr: string }> {\n  return exec(\"git\", args, { cwd, env: process.env });\n}\n\nexport function branchName(recipe: string, when: Date = new Date()): string {\n  // ISO with millisecond precision: 2026-05-20T10:30:00.123Z → 20260520T103000123Z.\n  // Millis (vs. second-precision) shrinks the collision window for parallel runs.\n  const compact = when.toISOString().replace(/[-:.]/g, \"\");\n  return `maint/${recipe}-${compact}`;\n}\n\nexport async function currentBranch(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  return stdout.trim();\n}\n\nexport async function isWorkingTreeClean(cwd: string): Promise<boolean> {\n  const { stdout } = await git(cwd, [\"status\", \"--porcelain\"]);\n  return stdout.trim().length === 0;\n}\n\nexport async function createBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-b\", name]);\n}\n\n/** Check out an existing branch. Throws (via git) if the branch is missing or\n *  the checkout is blocked (e.g. uncommitted changes that would be overwritten). */\nexport async function checkoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", name]);\n}\n\n/**\n * Force-check-out an existing branch, DISCARDING any uncommitted changes on the\n * current branch. Used by the recipe failure path to return the operator to\n * their original branch even when a recipe left the work-in-progress branch\n * dirty. Only ever called with the operator's ORIGINAL branch as `name`. Does\n * not run `git clean`, so untracked operator files are left untouched.\n */\nexport async function forceCheckoutBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"checkout\", \"-f\", name]);\n}\n\n/**\n * Delete a local branch with `-D` (force). Used by the recipe failure path to\n * remove the branch the recipe itself created so a re-run starts clean. Callers\n * MUST only ever pass the recipe-created branch here, never the operator's\n * original branch.\n */\nexport async function deleteBranch(cwd: string, name: string): Promise<void> {\n  await git(cwd, [\"branch\", \"-D\", name]);\n}\n\nexport async function stageAll(cwd: string): Promise<void> {\n  await git(cwd, [\"add\", \"-A\"]);\n}\n\nexport async function listTrackedFiles(cwd: string): Promise<string[]> {\n  const { stdout } = await git(cwd, [\"ls-files\"]);\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\nexport async function removeFromIndex(cwd: string, paths: string[]): Promise<void> {\n  if (paths.length === 0) return;\n  await git(cwd, [\"rm\", \"-r\", \"--cached\", \"--\", ...paths]);\n}\n\n/**\n * Stages all current changes and commits with `message`. Returns the commit SHA,\n * or `null` if there was nothing to commit.\n */\nexport async function commit(cwd: string, message: string): Promise<string | null> {\n  await stageAll(cwd);\n  const { stdout: status } = await git(cwd, [\"status\", \"--porcelain\"]);\n  if (status.trim().length === 0) return null;\n  await git(cwd, [\"commit\", \"-m\", message]);\n  const { stdout: sha } = await git(cwd, [\"rev-parse\", \"HEAD\"]);\n  return sha.trim();\n}\n\n/**\n * Strict GitHub repo identity: exactly two `[A-Za-z0-9._-]` segments separated\n * by a single slash. Rejects a scheme, host, extra path segment, traversal\n * (`..`), whitespace, or an argv flag — anything that could retarget a `gh`\n * write at an unintended (attacker/typo-controlled) repo.\n */\nexport const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\\/[A-Za-z0-9._-]+$/;\n\n/** True when `repo` is a clean `owner/repo` (see {@link OWNER_REPO_RE}). The\n *  explicit `..` reject covers traversal segments the char-class would otherwise\n *  admit (`.` is a legal repo char, so `../evil` matches the shape regex). */\nexport function isOwnerRepo(repo: string): boolean {\n  if (repo.includes(\"..\")) return false;\n  return OWNER_REPO_RE.test(repo);\n}\n\n/**\n * True when two repo references name the same `owner/repo`. Each side may be a\n * full remote URL (https or scp-style), or already an `owner/repo`. Used to\n * verify an existing checkout's `origin` matches the site's expected repo\n * before reusing it. Returns false if either side is unparseable.\n */\nexport function sameOwnerRepo(a: string, b: string): boolean {\n  const na = isOwnerRepo(a.trim()) ? a.trim() : parseOwnerRepo(a);\n  const nb = isOwnerRepo(b.trim()) ? b.trim() : parseOwnerRepo(b);\n  if (na === null || nb === null) return false;\n  return na.toLowerCase() === nb.toLowerCase();\n}\n\n/** Derive `owner/repo` from a git remote URL (https or scp-style). Null if unparseable. */\nexport function parseOwnerRepo(remoteUrl: string): string | null {\n  const trimmed = remoteUrl\n    .trim()\n    .replace(/\\.git$/, \"\")\n    .replace(/\\/$/, \"\");\n  // scp-style: git@github.com:owner/repo\n  const scp = trimmed.match(/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:(.+)$/);\n  const path = scp ? scp[1]! : trimmed.replace(/^https?:\\/\\/[^/]+\\//, \"\");\n  const segments = path.split(\"/\").filter(Boolean);\n  if (segments.length < 2) return null;\n  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;\n}\n\n/** `origin` remote URL for a checkout, trimmed. Throws (via git) if there's no origin. */\nexport async function getRemoteUrl(cwd: string): Promise<string> {\n  const { stdout } = await git(cwd, [\"remote\", \"get-url\", \"origin\"]);\n  return stdout.trim();\n}\n\n/** Push a branch to origin, setting upstream. Throws on non-zero (execFile rejects). */\nexport async function push(cwd: string, branch: string): Promise<void> {\n  await git(cwd, [\"push\", \"-u\", \"origin\", branch]);\n}\n"],"mappings":";AAAA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAE1B,IAAM,OAAO,UAAU,QAAQ;AAE/B,eAAe,IAAI,KAAa,MAA6D;AAC3F,SAAO,KAAK,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC;AACpD;AAEO,SAAS,WAAW,QAAgB,OAAa,oBAAI,KAAK,GAAW;AAG1E,QAAM,UAAU,KAAK,YAAY,EAAE,QAAQ,UAAU,EAAE;AACvD,SAAO,SAAS,MAAM,IAAI,OAAO;AACnC;AAEA,eAAsB,cAAc,KAA8B;AAChE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,mBAAmB,KAA+B;AACtE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AAC3D,SAAO,OAAO,KAAK,EAAE,WAAW;AAClC;AAEA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAIA,eAAsB,eAAe,KAAa,MAA6B;AAC7E,QAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC;AACnC;AASA,eAAsB,oBAAoB,KAAa,MAA6B;AAClF,QAAM,IAAI,KAAK,CAAC,YAAY,MAAM,IAAI,CAAC;AACzC;AAQA,eAAsB,aAAa,KAAa,MAA6B;AAC3E,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,CAAC;AACvC;AAEA,eAAsB,SAAS,KAA4B;AACzD,QAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;AAC9B;AAEA,eAAsB,iBAAiB,KAAgC;AACrE,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;AAC9C,SAAO,OACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/B;AAEA,eAAsB,gBAAgB,KAAa,OAAgC;AACjF,MAAI,MAAM,WAAW,EAAG;AACxB,QAAM,IAAI,KAAK,CAAC,MAAM,MAAM,YAAY,MAAM,GAAG,KAAK,CAAC;AACzD;AAMA,eAAsB,OAAO,KAAa,SAAyC;AACjF,QAAM,SAAS,GAAG;AAClB,QAAM,EAAE,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,aAAa,CAAC;AACnE,MAAI,OAAO,KAAK,EAAE,WAAW,EAAG,QAAO;AACvC,QAAM,IAAI,KAAK,CAAC,UAAU,MAAM,OAAO,CAAC;AACxC,QAAM,EAAE,QAAQ,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC;AAC5D,SAAO,IAAI,KAAK;AAClB;AAQO,IAAM,gBAAgB;AAKtB,SAAS,YAAY,MAAuB;AACjD,MAAI,KAAK,SAAS,IAAI,EAAG,QAAO;AAChC,SAAO,cAAc,KAAK,IAAI;AAChC;AAQO,SAAS,cAAc,GAAW,GAAoB;AAC3D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,QAAM,KAAK,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;AAC9D,MAAI,OAAO,QAAQ,OAAO,KAAM,QAAO;AACvC,SAAO,GAAG,YAAY,MAAM,GAAG,YAAY;AAC7C;AAGO,SAAS,eAAe,WAAkC;AAC/D,QAAM,UAAU,UACb,KAAK,EACL,QAAQ,UAAU,EAAE,EACpB,QAAQ,OAAO,EAAE;AAEpB,QAAM,MAAM,QAAQ,MAAM,wCAAwC;AAClE,QAAM,OAAO,MAAM,IAAI,CAAC,IAAK,QAAQ,QAAQ,uBAAuB,EAAE;AACtE,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,SAAO,GAAG,SAAS,SAAS,SAAS,CAAC,CAAC,IAAI,SAAS,SAAS,SAAS,CAAC,CAAC;AAC1E;AAGA,eAAsB,aAAa,KAA8B;AAC/D,QAAM,EAAE,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,UAAU,WAAW,QAAQ,CAAC;AACjE,SAAO,OAAO,KAAK;AACrB;AAGA,eAAsB,KAAK,KAAa,QAA+B;AACrE,QAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,UAAU,MAAM,CAAC;AACjD;","names":[]}

package/dist/chunk-XXTZBPUY.js

@@ -0,0 +1,9 @@
+// src/util/site.ts
+function siteLabel(site) {
+  return site.name || site.path;
+}
+
+export {
+  siteLabel
+};
+//# sourceMappingURL=chunk-XXTZBPUY.js.map

package/dist/chunk-XXTZBPUY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/site.ts"],"sourcesContent":["import type { Site } from \"../types.js\";\n\n/** Human-friendly label for log/output formatting. Prefer the inventory's\n * `name` when present (e.g. \"caltex-landing\") and fall back to the\n * filesystem `path` when unnamed. Every audit + recipe uses this.\n *\n * Uses `||` (not `??`) deliberately: an Airtable Name that slugs to the EMPTY\n * string (`siteSlug(\"!!!\")` → \"\") is `\"\"`, not null/undefined, so `??` would let\n * it through and render a blank label. `||` falls back to the path. */\nexport function siteLabel(site: Site): string {\n  return site.name || site.path;\n}\n"],"mappings":";AASO,SAAS,UAAU,MAAoB;AAC5C,SAAO,KAAK,QAAQ,KAAK;AAC3B;","names":[]}

package/dist/chunk-ZYBOT5PM.js

@@ -0,0 +1,153 @@
+import {
+  withRecipe
+} from "./chunk-XKOZUVK2.js";
+import {
+  bumpDep,
+  readPackageJson,
+  writePackageJson
+} from "./chunk-OTGB6YQO.js";
+import {
+  baselineVersions
+} from "./chunk-LKGVSM2O.js";
+import {
+  defaultSpawn
+} from "./chunk-HVOOCK6L.js";
+
+// src/util/self-version.ts
+import { readFileSync, existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+function selfPackageVersion(callerImportMetaUrl) {
+  try {
+    let dir = dirname(fileURLToPath(callerImportMetaUrl));
+    while (true) {
+      const candidate = join(dir, "package.json");
+      if (existsSync(candidate)) {
+        const raw = readFileSync(candidate, "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name === "@reddoorla/maintenance") {
+          return pkg.version ?? "0.0.0";
+        }
+      }
+      const parent = dirname(dir);
+      if (parent === dir) return "0.0.0";
+      dir = parent;
+    }
+  } catch {
+    return "0.0.0";
+  }
+}
+function selfCaretRange(callerImportMetaUrl) {
+  return `^${selfPackageVersion(callerImportMetaUrl)}`;
+}
+
+// src/recipes/onboard.ts
+import { stat } from "fs/promises";
+import { join as join2 } from "path";
+var PACKAGE_NAME = "@reddoorla/maintenance";
+var AUDIT_DEP_NAMES = {
+  lighthouse: ["@lhci/cli"],
+  a11y: ["@playwright/test", "@axe-core/playwright"]
+};
+var FRAMEWORK_DEP_NAMES = ["@sveltejs/adapter-netlify"];
+var FRAMEWORK_DEPS = FRAMEWORK_DEP_NAMES.map(
+  (name) => {
+    const version = baselineVersions[name];
+    if (!version) {
+      throw new Error(
+        `baseline-versions is missing framework dep "${name}" \u2014 add it to src/configs/baseline-versions.ts`
+      );
+    }
+    return { name, version };
+  }
+);
+var AUDIT_DEPS = Object.fromEntries(
+  Object.entries(AUDIT_DEP_NAMES).map(([audit, names]) => [
+    audit,
+    names.map((name) => {
+      const version = baselineVersions[name];
+      if (!version) {
+        throw new Error(
+          `baseline-versions is missing audit dep "${name}" \u2014 add it to src/configs/baseline-versions.ts`
+        );
+      }
+      return { name, version };
+    })
+  ])
+);
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isDeclared(pkg, name) {
+  return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
+}
+async function onboard(site, opts = {}) {
+  const spawn = opts.spawn ?? defaultSpawn;
+  const audits = opts.audits ?? ["lighthouse", "a11y"];
+  const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
+  return withRecipe({
+    name: "onboard",
+    site,
+    plan: async () => {
+      if (!await exists(join2(site.path, "pnpm-lock.yaml"))) {
+        return {
+          kind: "failed",
+          notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
+        };
+      }
+      const pkgPath = join2(site.path, "package.json");
+      const pkg = await readPackageJson(pkgPath);
+      const toAdd = [];
+      if (!isDeclared(pkg, PACKAGE_NAME)) {
+        toAdd.push({ name: PACKAGE_NAME, version: packageVersion });
+      }
+      for (const dep of FRAMEWORK_DEPS) {
+        if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+      }
+      for (const audit of audits) {
+        for (const dep of AUDIT_DEPS[audit]) {
+          if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+        }
+      }
+      if (toAdd.length === 0) {
+        return {
+          kind: "noop",
+          notes: `site already has ${PACKAGE_NAME}, framework deps, and audit deps (${audits.join("+")})`
+        };
+      }
+      return { kind: "apply", plan: { pkg, toAdd } };
+    },
+    apply: async ({ pkg, toAdd }, { commit, cwd }) => {
+      const pkgPath = join2(cwd, "package.json");
+      let next = pkg;
+      for (const dep of toAdd) {
+        next = bumpDep(next, dep.name, dep.version);
+      }
+      await writePackageJson(pkgPath, next);
+      const installResult = await spawn("pnpm", ["install"], { cwd, streaming: true });
+      if (installResult.code !== 0) {
+        return {
+          kind: "failed",
+          notes: `pnpm install failed (exit ${installResult.code})`
+        };
+      }
+      await commit(`chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`);
+      return {
+        kind: "ok",
+        notes: `Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(", ")}`
+      };
+    }
+  });
+}
+
+export {
+  selfPackageVersion,
+  selfCaretRange,
+  onboard
+};
+//# sourceMappingURL=chunk-ZYBOT5PM.js.map

package/dist/chunk-ZYBOT5PM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util/self-version.ts","../src/recipes/onboard.ts"],"sourcesContent":["import { readFileSync, existsSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Read this package's own version at runtime so recipe defaults don't go\n * stale at each minor bump.\n *\n * Pass `import.meta.url` from the calling file. Walks UP from the caller\n * looking for the first `package.json` whose `name` matches this package\n * (`@reddoorla/maintenance`). The older \"two levels up\" shortcut held for\n * `src/X/Y.ts` and `dist/cli/bin.js` (both happen to be 2 dirs deep) but\n * broke for `dist/index.js` (only 1 dir deep) — silently returned \"0.0.0\"\n * and pinned consumers to `^0.0.0`. Same bug class as the 0.10.1 bundled-\n * assets ENOENT (2026-05-27). Walk-up is robust regardless of bundling\n * layout.\n *\n * Returns \"0.0.0\" if no matching package.json is reachable (defensive\n * fallback; callers should treat that as a signal to either override\n * explicitly or fail loudly).\n */\nexport function selfPackageVersion(callerImportMetaUrl: string): string {\n  try {\n    let dir = dirname(fileURLToPath(callerImportMetaUrl));\n    while (true) {\n      const candidate = join(dir, \"package.json\");\n      if (existsSync(candidate)) {\n        const raw = readFileSync(candidate, \"utf-8\");\n        const pkg = JSON.parse(raw) as { name?: string; version?: string };\n        // Only accept OUR package.json — keep walking past random ancestor\n        // package.jsons (the consumer's own, anything in node_modules) that\n        // happen to sit above the bundle.\n        if (pkg.name === \"@reddoorla/maintenance\") {\n          return pkg.version ?? \"0.0.0\";\n        }\n      }\n      const parent = dirname(dir);\n      if (parent === dir) return \"0.0.0\";\n      dir = parent;\n    }\n  } catch {\n    return \"0.0.0\";\n  }\n}\n\n/** Caret-pinned range against this package's own version: e.g. \"^0.6.2\". */\nexport function selfCaretRange(callerImportMetaUrl: string): string {\n  return `^${selfPackageVersion(callerImportMetaUrl)}`;\n}\n","import { stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../types.js\";\nimport { readPackageJson, writePackageJson, bumpDep, type PackageJsonLike } from \"../util/pkg.js\";\nimport { defaultSpawn, type SpawnFn } from \"../audits/util/spawn.js\";\nimport { selfCaretRange } from \"../util/self-version.js\";\nimport { baselineVersions } from \"../configs/baseline-versions.js\";\nimport { withRecipe } from \"./_with-recipe.js\";\n\nexport type OnboardAudit = \"lighthouse\" | \"a11y\";\n\nexport type OnboardOptions = {\n  spawn?: SpawnFn;\n  /** Which audit-related deps to ensure. Defaults to all known audits. */\n  audits?: OnboardAudit[];\n  /** Version range to pin for @reddoorla/maintenance. Defaults to a caret\n   *  range against this package's own version at runtime — no manual\n   *  syncing required at each minor bump. */\n  packageVersion?: string;\n};\n\nconst PACKAGE_NAME = \"@reddoorla/maintenance\";\n\nconst AUDIT_DEP_NAMES: Record<OnboardAudit, string[]> = {\n  lighthouse: [\"@lhci/cli\"],\n  a11y: [\"@playwright/test\", \"@axe-core/playwright\"],\n};\n\n/** Framework deps onboard ensures for every site, independent of which audits\n * are requested. The sync-configs svelte.config.js template does\n * `import adapter from \"@sveltejs/adapter-netlify\"`, so a site that lacks the\n * adapter declared can't build once configs are synced — onboard closes that\n * gap at the same time it adds the maintenance package. */\nconst FRAMEWORK_DEP_NAMES = [\"@sveltejs/adapter-netlify\"];\n\n/** Resolve framework dep versions from baselineVersions at module load so they\n * can't drift from the single source of truth — mirrors AUDIT_DEPS. Throws at\n * import time if a name is missing there (a programming error). */\nexport const FRAMEWORK_DEPS: Array<{ name: string; version: string }> = FRAMEWORK_DEP_NAMES.map(\n  (name) => {\n    const version = baselineVersions[name];\n    if (!version) {\n      throw new Error(\n        `baseline-versions is missing framework dep \"${name}\" — add it to src/configs/baseline-versions.ts`,\n      );\n    }\n    return { name, version };\n  },\n);\n\n/** Look up each audit dep's version in baselineVersions at module load so\n * AUDIT_DEPS can't drift from the single source of truth across releases.\n * Throws at import time if baseline-versions is missing an audit dep —\n * which would be a programming error (every audit dep name above must\n * appear in baselineVersions). */\nexport const AUDIT_DEPS: Record<\n  OnboardAudit,\n  Array<{ name: string; version: string }>\n> = Object.fromEntries(\n  (Object.entries(AUDIT_DEP_NAMES) as Array<[OnboardAudit, string[]]>).map(([audit, names]) => [\n    audit,\n    names.map((name) => {\n      const version = baselineVersions[name];\n      if (!version) {\n        throw new Error(\n          `baseline-versions is missing audit dep \"${name}\" — add it to src/configs/baseline-versions.ts`,\n        );\n      }\n      return { name, version };\n    }),\n  ]),\n) as Record<OnboardAudit, Array<{ name: string; version: string }>>;\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction isDeclared(pkg: PackageJsonLike, name: string): boolean {\n  return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);\n}\n\ntype Plan = {\n  pkg: PackageJsonLike;\n  toAdd: Array<{ name: string; version: string }>;\n};\n\nexport async function onboard(site: Site, opts: OnboardOptions = {}): Promise<RecipeResult> {\n  const spawn = opts.spawn ?? defaultSpawn;\n  const audits = opts.audits ?? ([\"lighthouse\", \"a11y\"] as OnboardAudit[]);\n  const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);\n\n  return withRecipe<Plan>({\n    name: \"onboard\",\n    site,\n    plan: async () => {\n      // Pre-flight: site must already be on pnpm. We don't auto-convert here;\n      // that's the convert-to-pnpm recipe's job, and combining them would\n      // hide the package-manager transition inside a bigger PR.\n      if (!(await exists(join(site.path, \"pnpm-lock.yaml\")))) {\n        return {\n          kind: \"failed\",\n          notes: \"no pnpm-lock.yaml at site root — run convert-to-pnpm first\",\n        };\n      }\n\n      const pkgPath = join(site.path, \"package.json\");\n      const pkg = await readPackageJson(pkgPath);\n\n      // Determine what's missing. Anything already declared (even at a wildly\n      // different version) is left alone — onboard never downgrades.\n      const toAdd: Array<{ name: string; version: string }> = [];\n      if (!isDeclared(pkg, PACKAGE_NAME)) {\n        toAdd.push({ name: PACKAGE_NAME, version: packageVersion });\n      }\n      for (const dep of FRAMEWORK_DEPS) {\n        if (!isDeclared(pkg, dep.name)) toAdd.push(dep);\n      }\n      for (const audit of audits) {\n        for (const dep of AUDIT_DEPS[audit]) {\n          if (!isDeclared(pkg, dep.name)) toAdd.push(dep);\n        }\n      }\n\n      if (toAdd.length === 0) {\n        return {\n          kind: \"noop\",\n          notes: `site already has ${PACKAGE_NAME}, framework deps, and audit deps (${audits.join(\"+\")})`,\n        };\n      }\n      return { kind: \"apply\", plan: { pkg, toAdd } };\n    },\n    apply: async ({ pkg, toAdd }, { commit, cwd }) => {\n      const pkgPath = join(cwd, \"package.json\");\n      let next: PackageJsonLike = pkg;\n      for (const dep of toAdd) {\n        next = bumpDep(next, dep.name, dep.version);\n      }\n      await writePackageJson(pkgPath, next);\n\n      // Run pnpm install so the lockfile reflects the new deps before we commit.\n      // Stream output — install on a real site can take 30s+.\n      const installResult = await spawn(\"pnpm\", [\"install\"], { cwd, streaming: true });\n      if (installResult.code !== 0) {\n        return {\n          kind: \"failed\",\n          notes: `pnpm install failed (exit ${installResult.code})`,\n        };\n      }\n\n      await commit(`chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`);\n      return {\n        kind: \"ok\",\n        notes: `Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(\", \")}`,\n      };\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,cAAc,kBAAkB;AACzC,SAAS,qBAAqB;AAC9B,SAAS,SAAS,YAAY;AAmBvB,SAAS,mBAAmB,qBAAqC;AACtE,MAAI;AACF,QAAI,MAAM,QAAQ,cAAc,mBAAmB,CAAC;AACpD,WAAO,MAAM;AACX,YAAM,YAAY,KAAK,KAAK,cAAc;AAC1C,UAAI,WAAW,SAAS,GAAG;AACzB,cAAM,MAAM,aAAa,WAAW,OAAO;AAC3C,cAAM,MAAM,KAAK,MAAM,GAAG;AAI1B,YAAI,IAAI,SAAS,0BAA0B;AACzC,iBAAO,IAAI,WAAW;AAAA,QACxB;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,WAAW,IAAK,QAAO;AAC3B,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,eAAe,qBAAqC;AAClE,SAAO,IAAI,mBAAmB,mBAAmB,CAAC;AACpD;;;AChDA,SAAS,YAAY;AACrB,SAAS,QAAAA,aAAY;AAoBrB,IAAM,eAAe;AAErB,IAAM,kBAAkD;AAAA,EACtD,YAAY,CAAC,WAAW;AAAA,EACxB,MAAM,CAAC,oBAAoB,sBAAsB;AACnD;AAOA,IAAM,sBAAsB,CAAC,2BAA2B;AAKjD,IAAM,iBAA2D,oBAAoB;AAAA,EAC1F,CAAC,SAAS;AACR,UAAM,UAAU,iBAAiB,IAAI;AACrC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,+CAA+C,IAAI;AAAA,MACrD;AAAA,IACF;AACA,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACF;AAOO,IAAM,aAGT,OAAO;AAAA,EACR,OAAO,QAAQ,eAAe,EAAsC,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;AAAA,IAC3F;AAAA,IACA,MAAM,IAAI,CAAC,SAAS;AAClB,YAAM,UAAU,iBAAiB,IAAI;AACrC,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI;AAAA,UACR,2CAA2C,IAAI;AAAA,QACjD;AAAA,MACF;AACA,aAAO,EAAE,MAAM,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,UAAM,KAAK,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAsB,MAAuB;AAC/D,SAAO,QAAQ,IAAI,eAAe,IAAI,KAAK,IAAI,kBAAkB,IAAI,CAAC;AACxE;AAOA,eAAsB,QAAQ,MAAY,OAAuB,CAAC,GAA0B;AAC1F,QAAM,QAAQ,KAAK,SAAS;AAC5B,QAAM,SAAS,KAAK,UAAW,CAAC,cAAc,MAAM;AACpD,QAAM,iBAAiB,KAAK,kBAAkB,eAAe,YAAY,GAAG;AAE5E,SAAO,WAAiB;AAAA,IACtB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAIhB,UAAI,CAAE,MAAM,OAAOC,MAAK,KAAK,MAAM,gBAAgB,CAAC,GAAI;AACtD,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO;AAAA,QACT;AAAA,MACF;AAEA,YAAM,UAAUA,MAAK,KAAK,MAAM,cAAc;AAC9C,YAAM,MAAM,MAAM,gBAAgB,OAAO;AAIzC,YAAM,QAAkD,CAAC;AACzD,UAAI,CAAC,WAAW,KAAK,YAAY,GAAG;AAClC,cAAM,KAAK,EAAE,MAAM,cAAc,SAAS,eAAe,CAAC;AAAA,MAC5D;AACA,iBAAW,OAAO,gBAAgB;AAChC,YAAI,CAAC,WAAW,KAAK,IAAI,IAAI,EAAG,OAAM,KAAK,GAAG;AAAA,MAChD;AACA,iBAAW,SAAS,QAAQ;AAC1B,mBAAW,OAAO,WAAW,KAAK,GAAG;AACnC,cAAI,CAAC,WAAW,KAAK,IAAI,IAAI,EAAG,OAAM,KAAK,GAAG;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,MAAM,WAAW,GAAG;AACtB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO,oBAAoB,YAAY,qCAAqC,OAAO,KAAK,GAAG,CAAC;AAAA,QAC9F;AAAA,MACF;AACA,aAAO,EAAE,MAAM,SAAS,MAAM,EAAE,KAAK,MAAM,EAAE;AAAA,IAC/C;AAAA,IACA,OAAO,OAAO,EAAE,KAAK,MAAM,GAAG,EAAE,QAAQ,IAAI,MAAM;AAChD,YAAM,UAAUA,MAAK,KAAK,cAAc;AACxC,UAAI,OAAwB;AAC5B,iBAAW,OAAO,OAAO;AACvB,eAAO,QAAQ,MAAM,IAAI,MAAM,IAAI,OAAO;AAAA,MAC5C;AACA,YAAM,iBAAiB,SAAS,IAAI;AAIpC,YAAM,gBAAgB,MAAM,MAAM,QAAQ,CAAC,SAAS,GAAG,EAAE,KAAK,WAAW,KAAK,CAAC;AAC/E,UAAI,cAAc,SAAS,GAAG;AAC5B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO,6BAA6B,cAAc,IAAI;AAAA,QACxD;AAAA,MACF;AAEA,YAAM,OAAO,gCAAgC,YAAY,IAAI,cAAc,EAAE;AAC7E,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,SAAS,MAAM,MAAM,YAAY,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,EACF,CAAC;AACH;","names":["join","join"]}