@reddoorla/maintenance 0.6.1 → 0.6.2

package/dist/cli/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli/bin.ts
-import { dirname } from "path";
-import { fileURLToPath } from "url";
+import { dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { cac } from "cac";
 
 // src/cli/commands/audit.ts
@@ -761,6 +761,13 @@ function assertSafeName(name) {
     throw new Error(`unsafe site name (traversal segment not allowed): ${name}`);
   }
 }
+function assertSafeRepoUrl(repoUrl) {
+  if (!/^(https?|ssh|git|file):\/\//.test(repoUrl) && !/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:/.test(repoUrl)) {
+    throw new Error(
+      `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) or use scp-style "user@host:path" (got: ${JSON.stringify(repoUrl)})`
+    );
+  }
+}
 async function isNonEmptyDir(path) {
   try {
     const s = await stat(path);
@@ -778,13 +785,14 @@ async function cloneIfNeeded(site, opts) {
   }
   const name = site.name ?? deriveNameFromRepoUrl(site.repoUrl);
   assertSafeName(name);
+  assertSafeRepoUrl(site.repoUrl);
   const target = join5(opts.workdir, name);
   await mkdir(opts.workdir, { recursive: true });
   if (await isNonEmptyDir(target)) {
     return { ...site, name, path: target };
   }
   const spawn2 = opts.spawn ?? defaultSpawn;
-  const result = await spawn2("git", ["clone", site.repoUrl, target], {
+  const result = await spawn2("git", ["clone", "--", site.repoUrl, target], {
     cwd: opts.workdir,
     timeoutMs: 5 * 6e4
   });
@@ -1572,6 +1580,80 @@ function dollarPropsClass(source) {
   return updated;
 }
 
+// src/recipes/svelte-5/codemods/legacy-reactive.ts
+var SCRIPT_BLOCK4 = /<script\b([^>]*)>([\s\S]*?)<\/script>/g;
+var SIMPLE_REACTIVE = /^([ \t]*)\$:\s*(\w+)\s*=\s*([^;\n]+);?[ \t]*$/gm;
+var BLOCK_REACTIVE_HEAD = /(^|\n)([ \t]*)\$:\s*\{/g;
+function findMatchingClose(source, openIdx) {
+  let depth = 0;
+  let i = openIdx;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const closeStr = findStringClose(source, i);
+      if (closeStr === -1) return -1;
+      i = closeStr + 1;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return i;
+    }
+    i++;
+  }
+  return -1;
+}
+function findStringClose(source, openIdx) {
+  const quote = source[openIdx];
+  let i = openIdx + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === quote) return i;
+    i++;
+  }
+  return -1;
+}
+function transformBlocks(body) {
+  const out = [];
+  let last = 0;
+  BLOCK_REACTIVE_HEAD.lastIndex = 0;
+  let m;
+  while ((m = BLOCK_REACTIVE_HEAD.exec(body)) !== null) {
+    const leadingNewline = m[1] ?? "";
+    const indent = m[2] ?? "";
+    const headEnd = m.index + m[0].length;
+    const openBraceIdx = headEnd - 1;
+    const closeBraceIdx = findMatchingClose(body, openBraceIdx);
+    if (closeBraceIdx === -1) continue;
+    out.push(body.slice(last, m.index));
+    out.push(leadingNewline);
+    const blockBody = body.slice(openBraceIdx + 1, closeBraceIdx);
+    out.push(`${indent}$effect(() => {${blockBody}});`);
+    last = closeBraceIdx + 1;
+    BLOCK_REACTIVE_HEAD.lastIndex = last;
+  }
+  out.push(body.slice(last));
+  return out.join("");
+}
+function transformSimple(body) {
+  return body.replace(SIMPLE_REACTIVE, (_full, indent, name, expr) => {
+    return `${indent}let ${name} = $derived(${expr.trim()});`;
+  });
+}
+function legacyReactiveToRunes(source) {
+  return source.replace(SCRIPT_BLOCK4, (full, _attrs, body) => {
+    let next = transformBlocks(body);
+    next = transformSimple(next);
+    if (next === body) return full;
+    return full.replace(body, next);
+  });
+}
+
 // src/recipes/svelte-5/step-gotchas.ts
 var SVELTE_GLOBS = ["src/**/*.svelte"];
 var IGNORE2 = ["node_modules/**", ".svelte-kit/**", "build/**"];
@@ -1580,7 +1662,8 @@ var CODEMODS = [
   exportLetToProps,
   removeDollarRestProps,
   stateEffectSyncToDerived,
-  dollarPropsClass
+  dollarPropsClass,
+  legacyReactiveToRunes
 ];
 async function planGotchaCodemods(cwd) {
   const changes = [];
@@ -1905,9 +1988,28 @@ import { resolve as resolve7 } from "path";
 
 // src/recipes/onboard.ts
 import { stat as stat3 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
+
+// src/util/self-version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join as join15 } from "path";
+function selfPackageVersion(callerImportMetaUrl) {
+  try {
+    const here2 = dirname(fileURLToPath(callerImportMetaUrl));
+    const raw = readFileSync(join15(here2, "..", "..", "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function selfCaretRange(callerImportMetaUrl) {
+  return `^${selfPackageVersion(callerImportMetaUrl)}`;
+}
+
+// src/recipes/onboard.ts
 var PACKAGE_NAME = "@reddoorla/maintenance";
-var DEFAULT_PACKAGE_VERSION = "^0.2.0";
 var AUDIT_DEPS = {
   lighthouse: [{ name: "@lhci/cli", version: "^0.15.1" }],
   a11y: [
@@ -1933,8 +2035,8 @@ async function onboard(site, opts = {}) {
   const label = siteLabel10(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const audits = opts.audits ?? ["lighthouse", "a11y"];
-  const packageVersion = opts.packageVersion ?? DEFAULT_PACKAGE_VERSION;
-  if (!await exists2(join15(site.path, "pnpm-lock.yaml"))) {
+  const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
+  if (!await exists2(join16(site.path, "pnpm-lock.yaml"))) {
     return {
       recipe: "onboard",
       site: label,
@@ -1943,7 +2045,7 @@ async function onboard(site, opts = {}) {
       notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
     };
   }
-  const pkgPath = join15(site.path, "package.json");
+  const pkgPath = join16(site.path, "package.json");
   const pkg = await readPackageJson(pkgPath);
   const toAdd = [];
   if (!isDeclared(pkg, PACKAGE_NAME)) {
@@ -2047,7 +2149,7 @@ import { resolve as resolve8 } from "path";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function siteLabel11(site) {
   return site.name ?? site.path;
 }
@@ -2069,7 +2171,7 @@ async function svelteCodemods(site) {
   const branch = branchName("svelte-codemods");
   await createBranch(site.path, branch);
   for (const c of changes) {
-    await writeFile8(join16(site.path, c.rel), c.after, "utf-8");
+    await writeFile8(join17(site.path, c.rel), c.after, "utf-8");
   }
   const sha = await commit(
     site.path,
@@ -2110,11 +2212,11 @@ async function runSvelteCodemodsCommand(site, opts) {
 }
 
 // src/cli/version.ts
-import { readFileSync } from "fs";
-import { join as join17 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join18 } from "path";
 function resolvePackageVersion(fromDir) {
   try {
-    const raw = readFileSync(join17(fromDir, "..", "..", "package.json"), "utf-8");
+    const raw = readFileSync2(join18(fromDir, "..", "..", "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "unknown";
   } catch {
@@ -2123,7 +2225,7 @@ function resolvePackageVersion(fromDir) {
 }
 
 // src/cli/bin.ts
-var here = dirname(fileURLToPath(import.meta.url));
+var here = dirname2(fileURLToPath2(import.meta.url));
 var version = resolvePackageVersion(here);
 var AUDIT_DESCRIPTIONS = {
   deps: "Diff site package.json against the bundled baseline version map.",