@reddoorla/maintenance 0.6.5 → 0.6.7

package/dist/cli/bin.js

@@ -41,6 +41,11 @@ var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve9, reject) => {
 import { readFile } from "fs/promises";
 import { join } from "path";
 
+// src/util/site.ts
+function siteLabel(site) {
+  return site.name ?? site.path;
+}
+
 // src/configs/baseline-versions.ts
 var baselineVersions = {
   // SvelteKit core
@@ -81,9 +86,6 @@ var baselineVersions = {
 };
 
 // src/audits/deps.ts
-function siteLabel(site) {
-  return site.name ?? site.path;
-}
 function stripCaret(range) {
   return range.replace(/^[\^~]/, "");
 }
@@ -156,9 +158,6 @@ import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "
 import { glob } from "tinyglobby";
 var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
 var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
-function siteLabel2(site) {
-  return site.name ?? site.path;
-}
 async function listFiles(cwd) {
   return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
 }
@@ -168,7 +167,7 @@ async function lintAudit(ctx) {
   if (!existsSync(configPath)) {
     return {
       audit: "lint",
-      site: siteLabel2(site),
+      site: siteLabel(site),
       status: "skip",
       summary: "no eslint config at site root"
     };
@@ -194,7 +193,7 @@ async function lintAudit(ctx) {
   const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
   return {
     audit: "lint",
-    site: siteLabel2(site),
+    site: siteLabel(site),
     status,
     summary,
     details: {
@@ -207,9 +206,6 @@ async function lintAudit(ctx) {
 }
 
 // src/audits/security.ts
-function siteLabel3(site) {
-  return site.name ?? site.path;
-}
 function classify(v) {
   if (v.critical > 0 || v.high > 0) return "fail";
   if (v.moderate > 0 || v.low > 0) return "warn";
@@ -295,7 +291,8 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
   if (errEnvelope && typeof errEnvelope === "object") {
     return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
   }
-  if (!parsed.metadata?.vulnerabilities) {
+  const vulnsMeta = parsed.metadata?.vulnerabilities;
+  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {
     return { kind: "error", reason: "no metadata.vulnerabilities in output" };
   }
   return { kind: "ok", parsed };
@@ -303,7 +300,7 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
 async function securityAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel3(site);
+  const label = siteLabel(site);
   let used = "pnpm audit";
   let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
   if (result.kind !== "ok") {
@@ -384,9 +381,6 @@ var lighthouseConfig = {
 };
 
 // src/audits/lighthouse.ts
-function siteLabel4(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe(path) {
   try {
     const raw = await readFile3(path, "utf-8");
@@ -424,7 +418,7 @@ function messageForAssertion(a) {
 async function lighthouseAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel4(site);
+  const label = siteLabel(site);
   const configDir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
   const configPath = join3(configDir, "lighthouserc.json");
   await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
@@ -522,9 +516,6 @@ var playwrightA11yConfig = defineConfig({
 
 // src/audits/a11y.ts
 var RESULTS_REL = ".reddoor-a11y/results.json";
-function siteLabel5(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe2(path) {
   try {
     const raw = await readFile4(path, "utf-8");
@@ -582,7 +573,7 @@ test("a11y across configured routes", async ({ page }) => {
 async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel5(site);
+  const label = siteLabel(site);
   const specDir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-spec-"));
   const specPath = join4(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
@@ -1007,9 +998,8 @@ async function git(cwd, args) {
   return exec("git", args, { cwd, env: process.env });
 }
 function branchName(recipe, when = /* @__PURE__ */ new Date()) {
-  const iso = when.toISOString().replace(/[-:.]/g, "").replace(/Z$/, "Z");
-  const trimmed = iso.replace(/(\d{8}T\d{6})\d+(Z)$/, "$1$2");
-  return `maint/${recipe}-${trimmed}`;
+  const compact = when.toISOString().replace(/[-:.]/g, "");
+  return `maint/${recipe}-${compact}`;
 }
 async function isWorkingTreeClean(cwd) {
   const { stdout } = await git(cwd, ["status", "--porcelain"]);
@@ -1040,8 +1030,16 @@ async function commit(cwd, message) {
 
 // src/recipes/sync-configs.ts
 var GITIGNORE_CONFIG = "gitignore";
-function siteLabel6(site) {
-  return site.name ?? site.path;
+var ALL_CONFIG_NAMES = [
+  "lighthouse",
+  "eslint",
+  "prettier",
+  "playwright-a11y",
+  "svelte",
+  "gitignore"
+];
+function isConfigName(value) {
+  return ALL_CONFIG_NAMES.includes(value);
 }
 async function readMaybe(path) {
   try {
@@ -1073,7 +1071,7 @@ async function applyGitignore(cwd, plan) {
   }
 }
 async function syncConfigs(site, opts = {}) {
-  const label = siteLabel6(site);
+  const label = siteLabel(site);
   const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);
   const templateNames = requested.filter((c) => c !== GITIGNORE_CONFIG);
   const templates = templatesByName(templateNames);
@@ -1119,12 +1117,34 @@ async function syncConfigs(site, opts = {}) {
 
 // src/cli/commands/sync-configs.ts
 function parseOnly2(value) {
-  return value ? value.split(",").map((s) => s.trim()) : void 0;
+  if (!value) return void 0;
+  const names = value.split(",").map((s) => s.trim());
+  for (const n of names) {
+    if (!isConfigName(n)) {
+      throw Object.assign(
+        new Error(`unknown config in --only: "${n}". Valid: ${ALL_CONFIG_NAMES.join(", ")}`),
+        { exitCode: 2 }
+      );
+    }
+  }
+  return names;
+}
+async function dryPlanGitignore(cwd) {
+  let existing;
+  try {
+    existing = await readFile7(join7(cwd, ".gitignore"), "utf-8");
+  } catch {
+    return "would create .gitignore";
+  }
+  const merge = mergeGitignore(existing, CANONICAL_GITIGNORE_ENTRIES);
+  if (merge.added.length === 0) return null;
+  return `would update .gitignore (${merge.added.length} canonical entries to add)`;
 }
 async function dryPlan(cwd, which) {
-  const targets = which ? templatesByName(which) : ALL_TEMPLATES;
+  const includeGitignore = which ? which.includes("gitignore") : true;
+  const templateTargets = which ? templatesByName(which.filter((c) => c !== "gitignore")) : ALL_TEMPLATES;
   const lines = [];
-  for (const t of targets) {
+  for (const t of templateTargets) {
     let existing = "";
     try {
       existing = await readFile7(join7(cwd, t.path), "utf-8");
@@ -1132,6 +1152,10 @@ async function dryPlan(cwd, which) {
     }
     if (existing !== t.contents) lines.push(`would update ${t.path} (config: ${t.config})`);
   }
+  if (includeGitignore) {
+    const gi = await dryPlanGitignore(cwd);
+    if (gi) lines.push(gi);
+  }
   return lines.length === 0 ? "no changes needed" : lines.join("\n");
 }
 function formatResult(r) {
@@ -1170,8 +1194,15 @@ async function runSyncConfigsCommand(site, opts) {
 import { resolve as resolve4 } from "path";
 
 // src/recipes/bump-deps.ts
-function siteLabel7(site) {
-  return site.name ?? site.path;
+import { stat as stat2 } from "fs/promises";
+import { join as join8 } from "path";
+async function exists(path) {
+  try {
+    await stat2(path);
+    return true;
+  } catch {
+    return false;
+  }
 }
 function outdatedFlagsForGroup(group) {
   if (group === "major") return ["--latest"];
@@ -1183,9 +1214,27 @@ function upFlagsForGroup(group) {
   return [];
 }
 async function bumpDeps(site, opts = {}) {
-  const label = siteLabel7(site);
+  const label = siteLabel(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
+  const hasPnpmLock = await exists(join8(site.path, "pnpm-lock.yaml"));
+  if (!hasPnpmLock) {
+    const hasNpmLock = await exists(join8(site.path, "package-lock.json"));
+    const hasYarnLock = await exists(join8(site.path, "yarn.lock"));
+    if (hasNpmLock || hasYarnLock) {
+      const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
+      return {
+        recipe: "bump-deps",
+        site: label,
+        status: "failed",
+        commits: [],
+        notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
+      };
+    }
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
   await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
   const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
     cwd: site.path
@@ -1206,9 +1255,6 @@ async function bumpDeps(site, opts = {}) {
       notes: `pnpm outdated reported nothing for group=${group}`
     };
   }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
   const branch = branchName("bump-deps");
   await createBranch(site.path, branch);
   await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
@@ -1262,7 +1308,7 @@ async function runBumpDepsCommand(site, opts) {
 import { resolve as resolve5 } from "path";
 
 // src/recipes/svelte-5/index.ts
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/util/pkg.ts
 import { readFile as readFile8, writeFile as writeFile4 } from "fs/promises";
@@ -1270,8 +1316,18 @@ async function readPackageJson(path) {
   const raw = await readFile8(path, "utf-8");
   return JSON.parse(raw);
 }
+function detectIndentFromContent(raw) {
+  const match = raw.match(/\n([ \t]+)"/);
+  return match ? match[1] ?? "  " : "  ";
+}
 async function writePackageJson(path, pkg) {
-  const content = JSON.stringify(pkg, null, 2) + "\n";
+  let indent = "  ";
+  try {
+    const existing = await readFile8(path, "utf-8");
+    indent = detectIndentFromContent(existing);
+  } catch {
+  }
+  const content = JSON.stringify(pkg, null, indent) + "\n";
   await writeFile4(path, content, "utf-8");
 }
 function bumpDep(pkg, name, version2, opts = {}) {
@@ -1301,7 +1357,7 @@ function bumpDep(pkg, name, version2, opts = {}) {
 }
 
 // src/recipes/svelte-5/step-bump-versions.ts
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var SVELTE_5_VERSIONS = {
   svelte: "^5.55.5",
   "@sveltejs/kit": "^2.59.0",
@@ -1314,7 +1370,7 @@ var SVELTE_5_VERSIONS = {
   "typescript-svelte-plugin": "^0.3.52"
 };
 async function bumpToSvelte5Versions(cwd) {
-  const pkgPath = join8(cwd, "package.json");
+  const pkgPath = join9(cwd, "package.json");
   const pkg = await readPackageJson(pkgPath);
   let next = pkg;
   for (const [name, version2] of Object.entries(SVELTE_5_VERSIONS)) {
@@ -1327,7 +1383,7 @@ async function bumpToSvelte5Versions(cwd) {
 
 // src/recipes/svelte-5/step-svelte-config.ts
 import { readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
 var IMPORT_FROM_VITE_PLUGIN = new RegExp(
   String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
@@ -1368,7 +1424,7 @@ function dropPreprocessKey(source) {
   return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
 }
 async function migrateSvelteConfig(cwd) {
-  const path = join9(cwd, "svelte.config.js");
+  const path = join10(cwd, "svelte.config.js");
   let src;
   try {
     src = await readFile9(path, "utf-8");
@@ -1405,9 +1461,9 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
-  const pkg = await readPackageJson(join10(cwd, "package.json"));
+  const pkg = await readPackageJson(join11(cwd, "package.json"));
   const tailwindVersion = pkg.devDependencies?.tailwindcss ?? pkg.dependencies?.tailwindcss;
   if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
   if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
@@ -1429,12 +1485,40 @@ async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-gotchas.ts
 import { readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { glob as glob2 } from "tinyglobby";
 
 // src/recipes/svelte-5/codemods/on-event-to-handler.ts
 var SCRIPT_BLOCK = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var SIMPLE_ON_EVENT = /\bon:([a-z]+)(?=\s*=)/g;
+var MODIFIER_EVENT = /\bon:[a-z]+\|[a-zA-Z]+(?=\s*=)/g;
+function flagEventModifiers(source) {
+  const insertions = [];
+  let m;
+  MODIFIER_EVENT.lastIndex = 0;
+  while ((m = MODIFIER_EVENT.exec(source)) !== null) {
+    const tagStart = source.lastIndexOf("<", m.index);
+    if (tagStart === -1) continue;
+    const prevLineEnd = tagStart - 1;
+    if (prevLineEnd >= 0) {
+      const prevLineStart = source.lastIndexOf("\n", prevLineEnd - 1) + 1;
+      const prevLine = source.slice(prevLineStart, prevLineEnd + 1);
+      if (/<!--\s*@migration-task/.test(prevLine)) continue;
+    }
+    const lineStart = source.lastIndexOf("\n", tagStart - 1) + 1;
+    const indent = source.slice(lineStart, tagStart);
+    const safeIndent = /^[ \t]*$/.test(indent) ? indent : "";
+    insertions.push({ tagStart, indent: safeIndent, modifier: m[0] });
+  }
+  let out = source;
+  for (let i = insertions.length - 1; i >= 0; i--) {
+    const { tagStart, indent, modifier } = insertions[i];
+    const comment = `<!-- @migration-task: Svelte 5 removed event modifier syntax (\`${modifier}\`). Rewrite inline, e.g. onclick={(e) => { e.preventDefault(); ... }}. -->
+${indent}`;
+    out = out.slice(0, tagStart) + comment + out.slice(tagStart);
+  }
+  return out;
+}
 function onEventToHandler(source) {
   const masked = [];
   const placeholder = (i) => ` SCRIPT_${i} `;
@@ -1442,8 +1526,9 @@ function onEventToHandler(source) {
     masked.push(match);
     return placeholder(masked.length - 1);
   });
-  const rewritten = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
-  let out = rewritten;
+  let processed = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
+  processed = flagEventModifiers(processed);
+  let out = processed;
   masked.forEach((blk, i) => {
     out = out.replace(placeholder(i), blk);
   });
@@ -1493,6 +1578,22 @@ function exportLetToProps(source) {
   return source.replace(SCRIPT_BLOCK2, (full) => full.replace(inner, body));
 }
 
+// src/util/svelte-source.ts
+function findStringEnd(source, openIdx) {
+  const quote = source[openIdx];
+  let i = openIdx + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === quote) return i;
+    i++;
+  }
+  return -1;
+}
+
 // src/recipes/svelte-5/codemods/dollar-restprops.ts
 function removeInterfaceBlock(source) {
   const re = /^\s*interface\s+\$\$Props\s*\{/m;
@@ -1516,20 +1617,6 @@ function removeInterfaceBlock(source) {
     out = out.slice(0, match.index) + out.slice(endIdx);
   }
 }
-function findStringEnd(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 function maskStringLiterals(source) {
   const strings = [];
   let out = "";
@@ -1606,7 +1693,8 @@ function stateEffectSyncToDerived(source) {
 
 // src/recipes/svelte-5/codemods/dollar-props-class.ts
 var PROPS_DESTRUCTURE = /let\s*\{([\s\S]*?)\}(\s*:\s*\{([\s\S]*?)\})?\s*=\s*\$props\(\)/;
-var DOLLAR_PROPS_CLASS = /\$\$props\.class\b/g;
+var HAS_DOLLAR_PROPS_CLASS = /\$\$props\.class\b/;
+var DOLLAR_PROPS_CLASS_GLOBAL = /\$\$props\.class\b/g;
 var DOLLAR_PROPS_ANY = /\$\$props\b/;
 var SCRIPT_BLOCK4 = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var MIGRATION_TASK = /^<!--\s*@migration-task[\s\S]*?-->\s*\n?/gm;
@@ -1628,8 +1716,7 @@ function restoreScripts(masked, blocks) {
 }
 function dollarPropsClass(source) {
   const { masked } = maskScripts(source);
-  if (!DOLLAR_PROPS_CLASS.test(masked)) return source;
-  DOLLAR_PROPS_CLASS.lastIndex = 0;
+  if (!HAS_DOLLAR_PROPS_CLASS.test(masked)) return source;
   if (!PROPS_DESTRUCTURE.test(source)) return source;
   let updated = source.replace(PROPS_DESTRUCTURE, (full, body, typeAnno, typeBody) => {
     if (/\bclass\s*:/.test(body)) return full;
@@ -1643,7 +1730,7 @@ function dollarPropsClass(source) {
     return `let { ${newBody} } = $props()`;
   });
   const reMasked = maskScripts(updated);
-  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS, IDENT);
+  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS_GLOBAL, IDENT);
   updated = restoreScripts(templateRewritten, reMasked.blocks);
   const stripped = updated.replace(MIGRATION_TASK, "");
   if (!DOLLAR_PROPS_ANY.test(stripped)) {
@@ -1662,7 +1749,7 @@ function findMatchingClose(source, openIdx) {
   while (i < source.length) {
     const ch = source[i];
     if (ch === '"' || ch === "'" || ch === "`") {
-      const closeStr = findStringClose(source, i);
+      const closeStr = findStringEnd(source, i);
       if (closeStr === -1) return -1;
       i = closeStr + 1;
       continue;
@@ -1676,20 +1763,6 @@ function findMatchingClose(source, openIdx) {
   }
   return -1;
 }
-function findStringClose(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 var MIGRATION_MARKER = "// @migration-task: $effect won't trigger UI updates on plain `let` bindings \u2014 refine mutated locals to $state or split into per-variable $derived.";
 function transformBlocks(body) {
   const out = [];
@@ -1744,7 +1817,7 @@ async function planGotchaCodemods(cwd) {
   const changes = [];
   const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
   for (const rel of relPaths) {
-    const path = join11(cwd, rel);
+    const path = join12(cwd, rel);
     const before = await readFile10(path, "utf-8");
     const after = CODEMODS.reduce((s, fn) => fn(s), before);
     if (after !== before) changes.push({ rel, after });
@@ -1754,7 +1827,7 @@ async function planGotchaCodemods(cwd) {
 async function applyGotchaCodemods(cwd) {
   const changes = await planGotchaCodemods(cwd);
   for (const c of changes) {
-    await writeFile6(join11(cwd, c.rel), c.after, "utf-8");
+    await writeFile6(join12(cwd, c.rel), c.after, "utf-8");
   }
   return { filesChanged: changes.length };
 }
@@ -1778,7 +1851,7 @@ async function verifyMigration(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-summary.ts
 import { writeFile as writeFile7 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 async function writeMigrationSummary(input) {
   const lines = [
     `# Svelte 4 \u2192 5 migration summary`,
@@ -1795,18 +1868,15 @@ async function writeMigrationSummary(input) {
     `- Verify Playwright a11y tests still pass.`
   ];
   const content = lines.join("\n") + "\n";
-  const path = join12(input.cwd, "MIGRATION_SVELTE_5.md");
+  const path = join13(input.cwd, "MIGRATION_SVELTE_5.md");
   await writeFile7(path, content, "utf-8");
   return path;
 }
 
 // src/recipes/svelte-5/index.ts
-function siteLabel8(site) {
-  return site.name ?? site.path;
-}
 async function alreadyOnSvelte5(cwd) {
   try {
-    const pkg = await readPackageJson(join13(cwd, "package.json"));
+    const pkg = await readPackageJson(join14(cwd, "package.json"));
     const v = pkg.devDependencies?.svelte ?? pkg.dependencies?.svelte;
     return !!v && /^\^?5\./.test(v);
   } catch {
@@ -1814,7 +1884,7 @@ async function alreadyOnSvelte5(cwd) {
   }
 }
 async function upgradeSvelte4to5(site, opts = {}) {
-  const label = siteLabel8(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   if (await alreadyOnSvelte5(site.path)) {
     return {
@@ -1923,8 +1993,8 @@ async function runUpgradeCommand(upgradeName, site, opts = {}) {
 import { resolve as resolve6 } from "path";
 
 // src/recipes/convert-to-pnpm.ts
-import { rm as rm3, stat as stat2 } from "fs/promises";
-import { join as join14 } from "path";
+import { rm as rm3, stat as stat3 } from "fs/promises";
+import { join as join15 } from "path";
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -1946,25 +2016,22 @@ function rewriteScriptsForPnpm(scripts) {
 
 // src/recipes/convert-to-pnpm.ts
 var DEFAULT_PNPM_VERSION = "10.33.1";
-async function exists(path) {
+async function exists2(path) {
   try {
-    await stat2(path);
+    await stat3(path);
     return true;
   } catch {
     return false;
   }
 }
-function siteLabel9(site) {
-  return site.name ?? site.path;
-}
 async function convertToPnpm(site, opts = {}) {
-  const label = siteLabel9(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
-  const pnpmLockPath = join14(site.path, "pnpm-lock.yaml");
-  const npmLockPath = join14(site.path, "package-lock.json");
-  const yarnLockPath = join14(site.path, "yarn.lock");
-  if (await exists(pnpmLockPath)) {
+  const pnpmLockPath = join15(site.path, "pnpm-lock.yaml");
+  const npmLockPath = join15(site.path, "package-lock.json");
+  const yarnLockPath = join15(site.path, "yarn.lock");
+  if (await exists2(pnpmLockPath)) {
     return {
       recipe: "convert-to-pnpm",
       site: label,
@@ -1973,8 +2040,8 @@ async function convertToPnpm(site, opts = {}) {
       notes: "site already has pnpm-lock.yaml"
     };
   }
-  const hasNpmLock = await exists(npmLockPath);
-  const hasYarnLock = await exists(yarnLockPath);
+  const hasNpmLock = await exists2(npmLockPath);
+  const hasYarnLock = await exists2(yarnLockPath);
   if (!hasNpmLock && !hasYarnLock) {
     return {
       recipe: "convert-to-pnpm",
@@ -1995,7 +2062,7 @@ async function convertToPnpm(site, opts = {}) {
   const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
   const lockSha = await commit(site.path, `chore(pnpm): remove ${sourceLock}`);
   if (lockSha) shas.push(lockSha);
-  const pkgPath = join14(site.path, "package.json");
+  const pkgPath = join15(site.path, "package.json");
   const pkg = await readPackageJson(pkgPath);
   const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
   if (pkg.scripts && typeof pkg.scripts === "object") {
@@ -2009,7 +2076,7 @@ async function convertToPnpm(site, opts = {}) {
   await writePackageJson(pkgPath, next);
   const pkgSha = await commit(site.path, "chore(pnpm): pin packageManager + rewrite npm scripts");
   if (pkgSha) shas.push(pkgSha);
-  await rm3(join14(site.path, "node_modules"), { recursive: true, force: true });
+  await rm3(join15(site.path, "node_modules"), { recursive: true, force: true });
   const installResult = await spawn2("pnpm", ["install"], {
     cwd: site.path,
     streaming: true
@@ -2063,17 +2130,17 @@ async function runConvertToPnpmCommand(site, opts) {
 import { resolve as resolve7 } from "path";
 
 // src/recipes/onboard.ts
-import { stat as stat3 } from "fs/promises";
-import { join as join16 } from "path";
+import { stat as stat4 } from "fs/promises";
+import { join as join17 } from "path";
 
 // src/util/self-version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join as join15 } from "path";
+import { dirname, join as join16 } from "path";
 function selfPackageVersion(callerImportMetaUrl) {
   try {
     const here2 = dirname(fileURLToPath(callerImportMetaUrl));
-    const raw = readFileSync(join15(here2, "..", "..", "package.json"), "utf-8");
+    const raw = readFileSync(join16(here2, "..", "..", "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "0.0.0";
   } catch {
@@ -2086,33 +2153,41 @@ function selfCaretRange(callerImportMetaUrl) {
 
 // src/recipes/onboard.ts
 var PACKAGE_NAME = "@reddoorla/maintenance";
-var AUDIT_DEPS = {
-  lighthouse: [{ name: "@lhci/cli", version: "^0.15.1" }],
-  a11y: [
-    { name: "@playwright/test", version: "^1.59.1" },
-    { name: "@axe-core/playwright", version: "^4.11.3" }
-  ]
+var AUDIT_DEP_NAMES = {
+  lighthouse: ["@lhci/cli"],
+  a11y: ["@playwright/test", "@axe-core/playwright"]
 };
-async function exists2(path) {
+var AUDIT_DEPS = Object.fromEntries(
+  Object.entries(AUDIT_DEP_NAMES).map(([audit, names]) => [
+    audit,
+    names.map((name) => {
+      const version2 = baselineVersions[name];
+      if (!version2) {
+        throw new Error(
+          `baseline-versions is missing audit dep "${name}" \u2014 add it to src/configs/baseline-versions.ts`
+        );
+      }
+      return { name, version: version2 };
+    })
+  ])
+);
+async function exists3(path) {
   try {
-    await stat3(path);
+    await stat4(path);
     return true;
   } catch {
     return false;
   }
 }
-function siteLabel10(site) {
-  return site.name ?? site.path;
-}
 function isDeclared(pkg, name) {
   return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
 async function onboard(site, opts = {}) {
-  const label = siteLabel10(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const audits = opts.audits ?? ["lighthouse", "a11y"];
   const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
-  if (!await exists2(join16(site.path, "pnpm-lock.yaml"))) {
+  if (!await exists3(join17(site.path, "pnpm-lock.yaml"))) {
     return {
       recipe: "onboard",
       site: label,
@@ -2121,7 +2196,7 @@ async function onboard(site, opts = {}) {
       notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
     };
   }
-  const pkgPath = join16(site.path, "package.json");
+  const pkgPath = join17(site.path, "package.json");
   const pkg = await readPackageJson(pkgPath);
   const toAdd = [];
   if (!isDeclared(pkg, PACKAGE_NAME)) {
@@ -2225,12 +2300,9 @@ import { resolve as resolve8 } from "path";
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join17 } from "path";
-function siteLabel11(site) {
-  return site.name ?? site.path;
-}
+import { join as join18 } from "path";
 async function svelteCodemods(site) {
-  const label = siteLabel11(site);
+  const label = siteLabel(site);
   const changes = await planGotchaCodemods(site.path);
   if (changes.length === 0) {
     return {
@@ -2247,7 +2319,7 @@ async function svelteCodemods(site) {
   const branch = branchName("svelte-codemods");
   await createBranch(site.path, branch);
   for (const c of changes) {
-    await writeFile8(join17(site.path, c.rel), c.after, "utf-8");
+    await writeFile8(join18(site.path, c.rel), c.after, "utf-8");
   }
   const sha = await commit(
     site.path,
@@ -2289,10 +2361,10 @@ async function runSvelteCodemodsCommand(site, opts) {
 
 // src/cli/version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function resolvePackageVersion(fromDir) {
   try {
-    const raw = readFileSync2(join18(fromDir, "..", "..", "package.json"), "utf-8");
+    const raw = readFileSync2(join19(fromDir, "..", "..", "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "unknown";
   } catch {
@@ -2318,6 +2390,17 @@ var RECIPE_DESCRIPTIONS = {
   "convert-to-pnpm": "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).",
   onboard: "Install @reddoorla/maintenance + audit deps on a site (preferred first step)."
 };
+async function runOrExit(fn, opts) {
+  try {
+    const { output, code } = await fn();
+    console.log(output);
+    process.exit(code);
+  } catch (err) {
+    const e = err;
+    console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+    process.exit(e.exitCode ?? 1);
+  }
+}
 var cli = cac("reddoor-maint");
 cli.option("--cwd <path>", "Override working directory (default: process.cwd())");
 cli.option("--verbose", "Verbose output (full stack on errors)");
@@ -2332,101 +2415,31 @@ cli.command("list-recipes", "Print the available recipes.").action(() => {
   }
 });
 cli.command("audit [site]", "Run audits against a site (default: cwd).").option("--only <names>", "Comma-separated audit names (e.g. deps,lighthouse)").option("--json", "Machine-readable JSON output").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js); aggregates across sites").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runAuditCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runAuditCommand(site, opts), opts)
 );
 cli.command("sync-configs [site]", "Sync canonical configs into a site.").option("--only <names>", "Comma-separated config names (e.g. eslint,prettier)").option("--dry", "Print diff without writing").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runSyncConfigsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runSyncConfigsCommand(site, opts), opts)
 );
 cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>", "patch | minor | major", { default: "minor" }).option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runBumpDepsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runBumpDepsCommand(site, opts), opts)
 );
 cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to-5).").example("reddoor-maint upgrade svelte-4-to-5 ./my-site").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (upgrade, site, opts) => {
-    try {
-      const { output, code } = await runUpgradeCommand(upgrade, site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (upgrade, site, opts) => runOrExit(() => runUpgradeCommand(upgrade, site, opts), opts)
 );
 cli.command(
   "convert-to-pnpm [site]",
   "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts)."
 ).option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runConvertToPnpmCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runConvertToPnpmCommand(site, opts), opts)
 );
 cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an already-migrated site.").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runSvelteCodemodsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runSvelteCodemodsCommand(site, opts), opts)
 );
 cli.command(
   "onboard [site]",
   "Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm)."
 ).option("--audits <names>", "Comma-separated audit subset: lighthouse,a11y (default: both)").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runOnboardCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runOnboardCommand(site, opts), opts)
 );
 cli.help();
 cli.version(version);