@reddoorla/maintenance 0.6.5 → 0.6.7

package/dist/index.js

@@ -31,6 +31,11 @@ var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve, reject) => {
 import { readFile } from "fs/promises";
 import { join } from "path";
 
+// src/util/site.ts
+function siteLabel(site) {
+  return site.name ?? site.path;
+}
+
 // src/configs/baseline-versions.ts
 var baselineVersions = {
   // SvelteKit core
@@ -71,9 +76,6 @@ var baselineVersions = {
 };
 
 // src/audits/deps.ts
-function siteLabel(site) {
-  return site.name ?? site.path;
-}
 function stripCaret(range) {
   return range.replace(/^[\^~]/, "");
 }
@@ -146,9 +148,6 @@ import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "
 import { glob } from "tinyglobby";
 var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
 var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
-function siteLabel2(site) {
-  return site.name ?? site.path;
-}
 async function listFiles(cwd) {
   return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
 }
@@ -158,7 +157,7 @@ async function lintAudit(ctx) {
   if (!existsSync(configPath)) {
     return {
       audit: "lint",
-      site: siteLabel2(site),
+      site: siteLabel(site),
       status: "skip",
       summary: "no eslint config at site root"
     };
@@ -184,7 +183,7 @@ async function lintAudit(ctx) {
   const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
   return {
     audit: "lint",
-    site: siteLabel2(site),
+    site: siteLabel(site),
     status,
     summary,
     details: {
@@ -197,9 +196,6 @@ async function lintAudit(ctx) {
 }
 
 // src/audits/security.ts
-function siteLabel3(site) {
-  return site.name ?? site.path;
-}
 function classify(v) {
   if (v.critical > 0 || v.high > 0) return "fail";
   if (v.moderate > 0 || v.low > 0) return "warn";
@@ -285,7 +281,8 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
   if (errEnvelope && typeof errEnvelope === "object") {
     return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
   }
-  if (!parsed.metadata?.vulnerabilities) {
+  const vulnsMeta = parsed.metadata?.vulnerabilities;
+  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {
     return { kind: "error", reason: "no metadata.vulnerabilities in output" };
   }
   return { kind: "ok", parsed };
@@ -293,7 +290,7 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
 async function securityAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel3(site);
+  const label = siteLabel(site);
   let used = "pnpm audit";
   let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
   if (result.kind !== "ok") {
@@ -374,9 +371,6 @@ var lighthouseConfig = {
 };
 
 // src/audits/lighthouse.ts
-function siteLabel4(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe(path) {
   try {
     const raw = await readFile3(path, "utf-8");
@@ -414,7 +408,7 @@ function messageForAssertion(a) {
 async function lighthouseAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel4(site);
+  const label = siteLabel(site);
   const configDir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
   const configPath = join3(configDir, "lighthouserc.json");
   await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
@@ -512,9 +506,6 @@ var playwrightA11yConfig = defineConfig({
 
 // src/audits/a11y.ts
 var RESULTS_REL = ".reddoor-a11y/results.json";
-function siteLabel5(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe2(path) {
   try {
     const raw = await readFile4(path, "utf-8");
@@ -572,7 +563,7 @@ test("a11y across configured routes", async ({ page }) => {
 async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel5(site);
+  const label = siteLabel(site);
   const specDir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-spec-"));
   const specPath = join4(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
@@ -820,9 +811,8 @@ async function git(cwd, args) {
   return exec("git", args, { cwd, env: process.env });
 }
 function branchName(recipe, when = /* @__PURE__ */ new Date()) {
-  const iso = when.toISOString().replace(/[-:.]/g, "").replace(/Z$/, "Z");
-  const trimmed = iso.replace(/(\d{8}T\d{6})\d+(Z)$/, "$1$2");
-  return `maint/${recipe}-${trimmed}`;
+  const compact = when.toISOString().replace(/[-:.]/g, "");
+  return `maint/${recipe}-${compact}`;
 }
 async function isWorkingTreeClean(cwd) {
   const { stdout } = await git(cwd, ["status", "--porcelain"]);
@@ -853,9 +843,6 @@ async function commit(cwd, message) {
 
 // src/recipes/sync-configs.ts
 var GITIGNORE_CONFIG = "gitignore";
-function siteLabel6(site) {
-  return site.name ?? site.path;
-}
 async function readMaybe(path) {
   try {
     return await readFile5(path, "utf-8");
@@ -886,7 +873,7 @@ async function applyGitignore(cwd, plan) {
   }
 }
 async function syncConfigs(site, opts = {}) {
-  const label = siteLabel6(site);
+  const label = siteLabel(site);
   const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);
   const templateNames = requested.filter((c) => c !== GITIGNORE_CONFIG);
   const templates = templatesByName(templateNames);
@@ -931,8 +918,15 @@ async function syncConfigs(site, opts = {}) {
 }
 
 // src/recipes/bump-deps.ts
-function siteLabel7(site) {
-  return site.name ?? site.path;
+import { stat } from "fs/promises";
+import { join as join6 } from "path";
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
 }
 function outdatedFlagsForGroup(group) {
   if (group === "major") return ["--latest"];
@@ -944,9 +938,27 @@ function upFlagsForGroup(group) {
   return [];
 }
 async function bumpDeps(site, opts = {}) {
-  const label = siteLabel7(site);
+  const label = siteLabel(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
+  const hasPnpmLock = await exists(join6(site.path, "pnpm-lock.yaml"));
+  if (!hasPnpmLock) {
+    const hasNpmLock = await exists(join6(site.path, "package-lock.json"));
+    const hasYarnLock = await exists(join6(site.path, "yarn.lock"));
+    if (hasNpmLock || hasYarnLock) {
+      const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
+      return {
+        recipe: "bump-deps",
+        site: label,
+        status: "failed",
+        commits: [],
+        notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
+      };
+    }
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
+  }
   await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
   const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
     cwd: site.path
@@ -967,9 +979,6 @@ async function bumpDeps(site, opts = {}) {
       notes: `pnpm outdated reported nothing for group=${group}`
     };
   }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
   const branch = branchName("bump-deps");
   await createBranch(site.path, branch);
   await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
@@ -988,7 +997,7 @@ async function bumpDeps(site, opts = {}) {
 }
 
 // src/recipes/svelte-5/index.ts
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/util/pkg.ts
 import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
@@ -996,8 +1005,18 @@ async function readPackageJson(path) {
   const raw = await readFile6(path, "utf-8");
   return JSON.parse(raw);
 }
+function detectIndentFromContent(raw) {
+  const match = raw.match(/\n([ \t]+)"/);
+  return match ? match[1] ?? "  " : "  ";
+}
 async function writePackageJson(path, pkg) {
-  const content = JSON.stringify(pkg, null, 2) + "\n";
+  let indent = "  ";
+  try {
+    const existing = await readFile6(path, "utf-8");
+    indent = detectIndentFromContent(existing);
+  } catch {
+  }
+  const content = JSON.stringify(pkg, null, indent) + "\n";
   await writeFile4(path, content, "utf-8");
 }
 function bumpDep(pkg, name, version, opts = {}) {
@@ -1027,7 +1046,7 @@ function bumpDep(pkg, name, version, opts = {}) {
 }
 
 // src/recipes/svelte-5/step-bump-versions.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var SVELTE_5_VERSIONS = {
   svelte: "^5.55.5",
   "@sveltejs/kit": "^2.59.0",
@@ -1040,7 +1059,7 @@ var SVELTE_5_VERSIONS = {
   "typescript-svelte-plugin": "^0.3.52"
 };
 async function bumpToSvelte5Versions(cwd) {
-  const pkgPath = join6(cwd, "package.json");
+  const pkgPath = join7(cwd, "package.json");
   const pkg = await readPackageJson(pkgPath);
   let next = pkg;
   for (const [name, version] of Object.entries(SVELTE_5_VERSIONS)) {
@@ -1053,7 +1072,7 @@ async function bumpToSvelte5Versions(cwd) {
 
 // src/recipes/svelte-5/step-svelte-config.ts
 import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var VITE_PLUGIN_PKG = "@sveltejs/vite-plugin-svelte";
 var IMPORT_FROM_VITE_PLUGIN = new RegExp(
   String.raw`^import\s+\{\s*([^}]+?)\s*\}\s+from\s+["']` + VITE_PLUGIN_PKG.replace(/[/]/g, "\\/") + String.raw`["'];?[ \t]*\n`,
@@ -1094,7 +1113,7 @@ function dropPreprocessKey(source) {
   return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");
 }
 async function migrateSvelteConfig(cwd) {
-  const path = join7(cwd, "svelte.config.js");
+  const path = join8(cwd, "svelte.config.js");
   let src;
   try {
     src = await readFile7(path, "utf-8");
@@ -1131,9 +1150,9 @@ async function runSvelteMigrate(cwd, spawn2 = defaultSpawn) {
 }
 
 // src/recipes/svelte-5/step-tailwind-upgrade.ts
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
-  const pkg = await readPackageJson(join8(cwd, "package.json"));
+  const pkg = await readPackageJson(join9(cwd, "package.json"));
   const tailwindVersion = pkg.devDependencies?.tailwindcss ?? pkg.dependencies?.tailwindcss;
   if (!tailwindVersion) return { ran: false, reason: "tailwindcss not installed" };
   if (/^\^?4\./.test(tailwindVersion)) return { ran: false, reason: "already on tailwind 4.x" };
@@ -1155,12 +1174,40 @@ async function upgradeTailwind(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-gotchas.ts
 import { readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { glob as glob2 } from "tinyglobby";
 
 // src/recipes/svelte-5/codemods/on-event-to-handler.ts
 var SCRIPT_BLOCK = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var SIMPLE_ON_EVENT = /\bon:([a-z]+)(?=\s*=)/g;
+var MODIFIER_EVENT = /\bon:[a-z]+\|[a-zA-Z]+(?=\s*=)/g;
+function flagEventModifiers(source) {
+  const insertions = [];
+  let m;
+  MODIFIER_EVENT.lastIndex = 0;
+  while ((m = MODIFIER_EVENT.exec(source)) !== null) {
+    const tagStart = source.lastIndexOf("<", m.index);
+    if (tagStart === -1) continue;
+    const prevLineEnd = tagStart - 1;
+    if (prevLineEnd >= 0) {
+      const prevLineStart = source.lastIndexOf("\n", prevLineEnd - 1) + 1;
+      const prevLine = source.slice(prevLineStart, prevLineEnd + 1);
+      if (/<!--\s*@migration-task/.test(prevLine)) continue;
+    }
+    const lineStart = source.lastIndexOf("\n", tagStart - 1) + 1;
+    const indent = source.slice(lineStart, tagStart);
+    const safeIndent = /^[ \t]*$/.test(indent) ? indent : "";
+    insertions.push({ tagStart, indent: safeIndent, modifier: m[0] });
+  }
+  let out = source;
+  for (let i = insertions.length - 1; i >= 0; i--) {
+    const { tagStart, indent, modifier } = insertions[i];
+    const comment = `<!-- @migration-task: Svelte 5 removed event modifier syntax (\`${modifier}\`). Rewrite inline, e.g. onclick={(e) => { e.preventDefault(); ... }}. -->
+${indent}`;
+    out = out.slice(0, tagStart) + comment + out.slice(tagStart);
+  }
+  return out;
+}
 function onEventToHandler(source) {
   const masked = [];
   const placeholder = (i) => ` SCRIPT_${i} `;
@@ -1168,8 +1215,9 @@ function onEventToHandler(source) {
     masked.push(match);
     return placeholder(masked.length - 1);
   });
-  const rewritten = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
-  let out = rewritten;
+  let processed = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
+  processed = flagEventModifiers(processed);
+  let out = processed;
   masked.forEach((blk, i) => {
     out = out.replace(placeholder(i), blk);
   });
@@ -1219,6 +1267,22 @@ function exportLetToProps(source) {
   return source.replace(SCRIPT_BLOCK2, (full) => full.replace(inner, body));
 }
 
+// src/util/svelte-source.ts
+function findStringEnd(source, openIdx) {
+  const quote = source[openIdx];
+  let i = openIdx + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === quote) return i;
+    i++;
+  }
+  return -1;
+}
+
 // src/recipes/svelte-5/codemods/dollar-restprops.ts
 function removeInterfaceBlock(source) {
   const re = /^\s*interface\s+\$\$Props\s*\{/m;
@@ -1242,20 +1306,6 @@ function removeInterfaceBlock(source) {
     out = out.slice(0, match.index) + out.slice(endIdx);
   }
 }
-function findStringEnd(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 function maskStringLiterals(source) {
   const strings = [];
   let out = "";
@@ -1332,7 +1382,8 @@ function stateEffectSyncToDerived(source) {
 
 // src/recipes/svelte-5/codemods/dollar-props-class.ts
 var PROPS_DESTRUCTURE = /let\s*\{([\s\S]*?)\}(\s*:\s*\{([\s\S]*?)\})?\s*=\s*\$props\(\)/;
-var DOLLAR_PROPS_CLASS = /\$\$props\.class\b/g;
+var HAS_DOLLAR_PROPS_CLASS = /\$\$props\.class\b/;
+var DOLLAR_PROPS_CLASS_GLOBAL = /\$\$props\.class\b/g;
 var DOLLAR_PROPS_ANY = /\$\$props\b/;
 var SCRIPT_BLOCK4 = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var MIGRATION_TASK = /^<!--\s*@migration-task[\s\S]*?-->\s*\n?/gm;
@@ -1354,8 +1405,7 @@ function restoreScripts(masked, blocks) {
 }
 function dollarPropsClass(source) {
   const { masked } = maskScripts(source);
-  if (!DOLLAR_PROPS_CLASS.test(masked)) return source;
-  DOLLAR_PROPS_CLASS.lastIndex = 0;
+  if (!HAS_DOLLAR_PROPS_CLASS.test(masked)) return source;
   if (!PROPS_DESTRUCTURE.test(source)) return source;
   let updated = source.replace(PROPS_DESTRUCTURE, (full, body, typeAnno, typeBody) => {
     if (/\bclass\s*:/.test(body)) return full;
@@ -1369,7 +1419,7 @@ function dollarPropsClass(source) {
     return `let { ${newBody} } = $props()`;
   });
   const reMasked = maskScripts(updated);
-  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS, IDENT);
+  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS_GLOBAL, IDENT);
   updated = restoreScripts(templateRewritten, reMasked.blocks);
   const stripped = updated.replace(MIGRATION_TASK, "");
   if (!DOLLAR_PROPS_ANY.test(stripped)) {
@@ -1388,7 +1438,7 @@ function findMatchingClose(source, openIdx) {
   while (i < source.length) {
     const ch = source[i];
     if (ch === '"' || ch === "'" || ch === "`") {
-      const closeStr = findStringClose(source, i);
+      const closeStr = findStringEnd(source, i);
       if (closeStr === -1) return -1;
       i = closeStr + 1;
       continue;
@@ -1402,20 +1452,6 @@ function findMatchingClose(source, openIdx) {
   }
   return -1;
 }
-function findStringClose(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 var MIGRATION_MARKER = "// @migration-task: $effect won't trigger UI updates on plain `let` bindings \u2014 refine mutated locals to $state or split into per-variable $derived.";
 function transformBlocks(body) {
   const out = [];
@@ -1470,7 +1506,7 @@ async function planGotchaCodemods(cwd) {
   const changes = [];
   const relPaths = await glob2(SVELTE_GLOBS, { cwd, ignore: IGNORE2, absolute: false });
   for (const rel of relPaths) {
-    const path = join9(cwd, rel);
+    const path = join10(cwd, rel);
     const before = await readFile8(path, "utf-8");
     const after = CODEMODS.reduce((s, fn) => fn(s), before);
     if (after !== before) changes.push({ rel, after });
@@ -1480,7 +1516,7 @@ async function planGotchaCodemods(cwd) {
 async function applyGotchaCodemods(cwd) {
   const changes = await planGotchaCodemods(cwd);
   for (const c of changes) {
-    await writeFile6(join9(cwd, c.rel), c.after, "utf-8");
+    await writeFile6(join10(cwd, c.rel), c.after, "utf-8");
   }
   return { filesChanged: changes.length };
 }
@@ -1504,7 +1540,7 @@ async function verifyMigration(cwd, spawn2 = defaultSpawn) {
 
 // src/recipes/svelte-5/step-summary.ts
 import { writeFile as writeFile7 } from "fs/promises";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function writeMigrationSummary(input) {
   const lines = [
     `# Svelte 4 \u2192 5 migration summary`,
@@ -1521,18 +1557,15 @@ async function writeMigrationSummary(input) {
     `- Verify Playwright a11y tests still pass.`
   ];
   const content = lines.join("\n") + "\n";
-  const path = join10(input.cwd, "MIGRATION_SVELTE_5.md");
+  const path = join11(input.cwd, "MIGRATION_SVELTE_5.md");
   await writeFile7(path, content, "utf-8");
   return path;
 }
 
 // src/recipes/svelte-5/index.ts
-function siteLabel8(site) {
-  return site.name ?? site.path;
-}
 async function alreadyOnSvelte5(cwd) {
   try {
-    const pkg = await readPackageJson(join11(cwd, "package.json"));
+    const pkg = await readPackageJson(join12(cwd, "package.json"));
     const v = pkg.devDependencies?.svelte ?? pkg.dependencies?.svelte;
     return !!v && /^\^?5\./.test(v);
   } catch {
@@ -1540,7 +1573,7 @@ async function alreadyOnSvelte5(cwd) {
   }
 }
 async function upgradeSvelte4to5(site, opts = {}) {
-  const label = siteLabel8(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   if (await alreadyOnSvelte5(site.path)) {
     return {
@@ -1610,12 +1643,9 @@ async function upgradeSvelte4to5(site, opts = {}) {
 
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join12 } from "path";
-function siteLabel9(site) {
-  return site.name ?? site.path;
-}
+import { join as join13 } from "path";
 async function svelteCodemods(site) {
-  const label = siteLabel9(site);
+  const label = siteLabel(site);
   const changes = await planGotchaCodemods(site.path);
   if (changes.length === 0) {
     return {
@@ -1632,7 +1662,7 @@ async function svelteCodemods(site) {
   const branch = branchName("svelte-codemods");
   await createBranch(site.path, branch);
   for (const c of changes) {
-    await writeFile8(join12(site.path, c.rel), c.after, "utf-8");
+    await writeFile8(join13(site.path, c.rel), c.after, "utf-8");
   }
   const sha = await commit(
     site.path,
@@ -1648,8 +1678,8 @@ async function svelteCodemods(site) {
 }
 
 // src/recipes/convert-to-pnpm.ts
-import { rm as rm3, stat } from "fs/promises";
-import { join as join13 } from "path";
+import { rm as rm3, stat as stat2 } from "fs/promises";
+import { join as join14 } from "path";
 
 // src/recipes/convert-to-pnpm/script-rewrites.ts
 function rewriteScriptForPnpm(script) {
@@ -1671,25 +1701,22 @@ function rewriteScriptsForPnpm(scripts) {
 
 // src/recipes/convert-to-pnpm.ts
 var DEFAULT_PNPM_VERSION = "10.33.1";
-async function exists(path) {
+async function exists2(path) {
   try {
-    await stat(path);
+    await stat2(path);
     return true;
   } catch {
     return false;
   }
 }
-function siteLabel10(site) {
-  return site.name ?? site.path;
-}
 async function convertToPnpm(site, opts = {}) {
-  const label = siteLabel10(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
-  const pnpmLockPath = join13(site.path, "pnpm-lock.yaml");
-  const npmLockPath = join13(site.path, "package-lock.json");
-  const yarnLockPath = join13(site.path, "yarn.lock");
-  if (await exists(pnpmLockPath)) {
+  const pnpmLockPath = join14(site.path, "pnpm-lock.yaml");
+  const npmLockPath = join14(site.path, "package-lock.json");
+  const yarnLockPath = join14(site.path, "yarn.lock");
+  if (await exists2(pnpmLockPath)) {
     return {
       recipe: "convert-to-pnpm",
       site: label,
@@ -1698,8 +1725,8 @@ async function convertToPnpm(site, opts = {}) {
       notes: "site already has pnpm-lock.yaml"
     };
   }
-  const hasNpmLock = await exists(npmLockPath);
-  const hasYarnLock = await exists(yarnLockPath);
+  const hasNpmLock = await exists2(npmLockPath);
+  const hasYarnLock = await exists2(yarnLockPath);
   if (!hasNpmLock && !hasYarnLock) {
     return {
       recipe: "convert-to-pnpm",
@@ -1720,7 +1747,7 @@ async function convertToPnpm(site, opts = {}) {
   const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
   const lockSha = await commit(site.path, `chore(pnpm): remove ${sourceLock}`);
   if (lockSha) shas.push(lockSha);
-  const pkgPath = join13(site.path, "package.json");
+  const pkgPath = join14(site.path, "package.json");
   const pkg = await readPackageJson(pkgPath);
   const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
   if (pkg.scripts && typeof pkg.scripts === "object") {
@@ -1734,7 +1761,7 @@ async function convertToPnpm(site, opts = {}) {
   await writePackageJson(pkgPath, next);
   const pkgSha = await commit(site.path, "chore(pnpm): pin packageManager + rewrite npm scripts");
   if (pkgSha) shas.push(pkgSha);
-  await rm3(join13(site.path, "node_modules"), { recursive: true, force: true });
+  await rm3(join14(site.path, "node_modules"), { recursive: true, force: true });
   const installResult = await spawn2("pnpm", ["install"], {
     cwd: site.path,
     streaming: true
@@ -1760,17 +1787,17 @@ async function convertToPnpm(site, opts = {}) {
 }
 
 // src/recipes/onboard.ts
-import { stat as stat2 } from "fs/promises";
-import { join as join15 } from "path";
+import { stat as stat3 } from "fs/promises";
+import { join as join16 } from "path";
 
 // src/util/self-version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join as join14 } from "path";
+import { dirname, join as join15 } from "path";
 function selfPackageVersion(callerImportMetaUrl) {
   try {
     const here = dirname(fileURLToPath(callerImportMetaUrl));
-    const raw = readFileSync(join14(here, "..", "..", "package.json"), "utf-8");
+    const raw = readFileSync(join15(here, "..", "..", "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.version ?? "0.0.0";
   } catch {
@@ -1783,33 +1810,41 @@ function selfCaretRange(callerImportMetaUrl) {
 
 // src/recipes/onboard.ts
 var PACKAGE_NAME = "@reddoorla/maintenance";
-var AUDIT_DEPS = {
-  lighthouse: [{ name: "@lhci/cli", version: "^0.15.1" }],
-  a11y: [
-    { name: "@playwright/test", version: "^1.59.1" },
-    { name: "@axe-core/playwright", version: "^4.11.3" }
-  ]
+var AUDIT_DEP_NAMES = {
+  lighthouse: ["@lhci/cli"],
+  a11y: ["@playwright/test", "@axe-core/playwright"]
 };
-async function exists2(path) {
+var AUDIT_DEPS = Object.fromEntries(
+  Object.entries(AUDIT_DEP_NAMES).map(([audit, names]) => [
+    audit,
+    names.map((name) => {
+      const version = baselineVersions[name];
+      if (!version) {
+        throw new Error(
+          `baseline-versions is missing audit dep "${name}" \u2014 add it to src/configs/baseline-versions.ts`
+        );
+      }
+      return { name, version };
+    })
+  ])
+);
+async function exists3(path) {
   try {
-    await stat2(path);
+    await stat3(path);
     return true;
   } catch {
     return false;
   }
 }
-function siteLabel11(site) {
-  return site.name ?? site.path;
-}
 function isDeclared(pkg, name) {
   return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
 async function onboard(site, opts = {}) {
-  const label = siteLabel11(site);
+  const label = siteLabel(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const audits = opts.audits ?? ["lighthouse", "a11y"];
   const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
-  if (!await exists2(join15(site.path, "pnpm-lock.yaml"))) {
+  if (!await exists3(join16(site.path, "pnpm-lock.yaml"))) {
     return {
       recipe: "onboard",
       site: label,
@@ -1818,7 +1853,7 @@ async function onboard(site, opts = {}) {
       notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
     };
   }
-  const pkgPath = join15(site.path, "package.json");
+  const pkgPath = join16(site.path, "package.json");
   const pkg = await readPackageJson(pkgPath);
   const toAdd = [];
   if (!isDeclared(pkg, PACKAGE_NAME)) {