@reddoorla/maintenance 0.6.6 → 0.6.8

package/dist/cli/bin.js

@@ -41,6 +41,11 @@ var defaultSpawn = (cmd, args, opts = {}) => new Promise((resolve9, reject) => {
 import { readFile } from "fs/promises";
 import { join } from "path";
 
+// src/util/site.ts
+function siteLabel(site) {
+  return site.name ?? site.path;
+}
+
 // src/configs/baseline-versions.ts
 var baselineVersions = {
   // SvelteKit core
@@ -81,9 +86,6 @@ var baselineVersions = {
 };
 
 // src/audits/deps.ts
-function siteLabel(site) {
-  return site.name ?? site.path;
-}
 function stripCaret(range) {
   return range.replace(/^[\^~]/, "");
 }
@@ -156,9 +158,6 @@ import { check as prettierCheck, resolveConfig as prettierResolveConfig } from "
 import { glob } from "tinyglobby";
 var TARGET_GLOBS = ["**/*.{ts,js,svelte}"];
 var IGNORE = ["node_modules/**", "dist/**", ".svelte-kit/**", "build/**", ".netlify/**"];
-function siteLabel2(site) {
-  return site.name ?? site.path;
-}
 async function listFiles(cwd) {
   return glob(TARGET_GLOBS, { cwd, ignore: IGNORE, absolute: false });
 }
@@ -168,7 +167,7 @@ async function lintAudit(ctx) {
   if (!existsSync(configPath)) {
     return {
       audit: "lint",
-      site: siteLabel2(site),
+      site: siteLabel(site),
       status: "skip",
       summary: "no eslint config at site root"
     };
@@ -194,7 +193,7 @@ async function lintAudit(ctx) {
   const summary = status === "pass" ? `lint clean across ${relFiles.length} files` : `${eslintErrors} eslint errors, ${eslintWarnings} warnings, ${prettierUnformatted.length} unformatted`;
   return {
     audit: "lint",
-    site: siteLabel2(site),
+    site: siteLabel(site),
     status,
     summary,
     details: {
@@ -207,9 +206,6 @@ async function lintAudit(ctx) {
 }
 
 // src/audits/security.ts
-function siteLabel3(site) {
-  return site.name ?? site.path;
-}
 function classify(v) {
   if (v.critical > 0 || v.high > 0) return "fail";
   if (v.moderate > 0 || v.low > 0) return "warn";
@@ -295,7 +291,8 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
   if (errEnvelope && typeof errEnvelope === "object") {
     return { kind: "error", reason: errEnvelope.code ?? "error envelope returned" };
   }
-  if (!parsed.metadata?.vulnerabilities) {
+  const vulnsMeta = parsed.metadata?.vulnerabilities;
+  if (!vulnsMeta || Object.keys(vulnsMeta).length === 0) {
     return { kind: "error", reason: "no metadata.vulnerabilities in output" };
   }
   return { kind: "ok", parsed };
@@ -303,7 +300,7 @@ async function runAuditTool(spawn2, cmd, args, cwd) {
 async function securityAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel3(site);
+  const label = siteLabel(site);
   let used = "pnpm audit";
   let result = await runAuditTool(spawn2, "pnpm", ["audit", "--json", "--prod"], site.path);
   if (result.kind !== "ok") {
@@ -384,9 +381,6 @@ var lighthouseConfig = {
 };
 
 // src/audits/lighthouse.ts
-function siteLabel4(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe(path) {
   try {
     const raw = await readFile3(path, "utf-8");
@@ -424,7 +418,7 @@ function messageForAssertion(a) {
 async function lighthouseAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel4(site);
+  const label = siteLabel(site);
   const configDir = await mkdtemp(join3(tmpdir(), "reddoor-lhci-"));
   const configPath = join3(configDir, "lighthouserc.json");
   await writeFile(configPath, JSON.stringify(lighthouseConfig), "utf-8");
@@ -522,9 +516,6 @@ var playwrightA11yConfig = defineConfig({
 
 // src/audits/a11y.ts
 var RESULTS_REL = ".reddoor-a11y/results.json";
-function siteLabel5(site) {
-  return site.name ?? site.path;
-}
 async function readJsonMaybe2(path) {
   try {
     const raw = await readFile4(path, "utf-8");
@@ -582,7 +573,7 @@ test("a11y across configured routes", async ({ page }) => {
 async function a11yAudit(ctx) {
   const spawn2 = ctx.spawn ?? defaultSpawn;
   const site = ctx.site;
-  const label = siteLabel5(site);
+  const label = siteLabel(site);
   const specDir = await mkdtemp2(join4(tmpdir2(), "reddoor-a11y-spec-"));
   const specPath = join4(specDir, "a11y.spec.ts");
   await writeFile2(specPath, buildSpec(), "utf-8");
@@ -1007,9 +998,8 @@ async function git(cwd, args) {
   return exec("git", args, { cwd, env: process.env });
 }
 function branchName(recipe, when = /* @__PURE__ */ new Date()) {
-  const iso = when.toISOString().replace(/[-:.]/g, "").replace(/Z$/, "Z");
-  const trimmed = iso.replace(/(\d{8}T\d{6})\d+(Z)$/, "$1$2");
-  return `maint/${recipe}-${trimmed}`;
+  const compact = when.toISOString().replace(/[-:.]/g, "");
+  return `maint/${recipe}-${compact}`;
 }
 async function isWorkingTreeClean(cwd) {
   const { stdout } = await git(cwd, ["status", "--porcelain"]);
@@ -1038,6 +1028,65 @@ async function commit(cwd, message) {
   return sha.trim();
 }
 
+// src/recipes/_with-recipe.ts
+async function withRecipe(body) {
+  const label = siteLabel(body.site);
+  if (body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  const planned = await body.plan();
+  if (planned.kind === "noop") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "noop",
+      commits: [],
+      ...planned.notes ? { notes: planned.notes } : {}
+    };
+  }
+  if (planned.kind === "failed") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: [],
+      notes: planned.notes
+    };
+  }
+  if (!body.checkTreeFirst && !await isWorkingTreeClean(body.site.path)) {
+    throw new Error(`refusing to run: working tree is not clean at ${body.site.path}`);
+  }
+  const branch = branchName(body.name);
+  await createBranch(body.site.path, branch);
+  const shas = [];
+  const result = await body.apply(planned.plan, {
+    cwd: body.site.path,
+    branch,
+    commit: async (msg) => {
+      const sha = await commit(body.site.path, msg);
+      if (sha) shas.push(sha);
+      return sha;
+    }
+  });
+  if (result.kind === "failed") {
+    return {
+      recipe: body.name,
+      site: label,
+      status: "failed",
+      commits: shas,
+      notes: result.notes
+    };
+  }
+  const notes = result.notes ? `${result.notes}; branch: ${branch}` : `branch: ${branch}`;
+  return {
+    recipe: body.name,
+    site: label,
+    status: shas.length > 0 ? "applied" : "noop",
+    commits: shas,
+    notes
+  };
+}
+
 // src/recipes/sync-configs.ts
 var GITIGNORE_CONFIG = "gitignore";
 var ALL_CONFIG_NAMES = [
@@ -1051,9 +1100,6 @@ var ALL_CONFIG_NAMES = [
 function isConfigName(value) {
   return ALL_CONFIG_NAMES.includes(value);
 }
-function siteLabel6(site) {
-  return site.name ?? site.path;
-}
 async function readMaybe(path) {
   try {
     return await readFile6(path, "utf-8");
@@ -1084,48 +1130,33 @@ async function applyGitignore(cwd, plan) {
   }
 }
 async function syncConfigs(site, opts = {}) {
-  const label = siteLabel6(site);
   const requested = opts.which ?? ALL_TEMPLATES.map((t) => t.config).concat(GITIGNORE_CONFIG);
   const templateNames = requested.filter((c) => c !== GITIGNORE_CONFIG);
   const templates = templatesByName(templateNames);
   const includeGitignore = requested.includes(GITIGNORE_CONFIG);
-  const templateDiffs = await planTemplateDiffs(site.path, templates);
-  const gitignorePlan = includeGitignore ? await planGitignore(site.path) : { kind: "noop" };
-  if (templateDiffs.length === 0 && gitignorePlan.kind === "noop") {
-    return {
-      recipe: "sync-configs",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "all targeted configs already match"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("sync-configs");
-  await createBranch(site.path, branch);
-  const shas = [];
-  for (const t of templateDiffs) {
-    await writeFile3(join6(site.path, t.path), t.contents, "utf-8");
-    const sha = await commit(
-      site.path,
-      `chore: sync ${t.config} config from @reddoorla/maintenance`
-    );
-    if (sha) shas.push(sha);
-  }
-  if (gitignorePlan.kind === "apply") {
-    await applyGitignore(site.path, gitignorePlan);
-    const sha = await commit(site.path, `chore: sync gitignore from @reddoorla/maintenance`);
-    if (sha) shas.push(sha);
-  }
-  return {
-    recipe: "sync-configs",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
+  return withRecipe({
+    name: "sync-configs",
+    site,
+    plan: async () => {
+      const templateDiffs = await planTemplateDiffs(site.path, templates);
+      const gitignorePlan = includeGitignore ? await planGitignore(site.path) : { kind: "noop" };
+      if (templateDiffs.length === 0 && gitignorePlan.kind === "noop") {
+        return { kind: "noop", notes: "all targeted configs already match" };
+      }
+      return { kind: "apply", plan: { templateDiffs, gitignorePlan } };
+    },
+    apply: async ({ templateDiffs, gitignorePlan }, { commit: commit2 }) => {
+      for (const t of templateDiffs) {
+        await writeFile3(join6(site.path, t.path), t.contents, "utf-8");
+        await commit2(`chore: sync ${t.config} config from @reddoorla/maintenance`);
+      }
+      if (gitignorePlan.kind === "apply") {
+        await applyGitignore(site.path, gitignorePlan);
+        await commit2(`chore: sync gitignore from @reddoorla/maintenance`);
+      }
+      return { kind: "ok" };
+    }
+  });
 }
 
 // src/cli/commands/sync-configs.ts
@@ -1209,9 +1240,6 @@ import { resolve as resolve4 } from "path";
 // src/recipes/bump-deps.ts
 import { stat as stat2 } from "fs/promises";
 import { join as join8 } from "path";
-function siteLabel7(site) {
-  return site.name ?? site.path;
-}
 async function exists(path) {
   try {
     await stat2(path);
@@ -1230,62 +1258,51 @@ function upFlagsForGroup(group) {
   return [];
 }
 async function bumpDeps(site, opts = {}) {
-  const label = siteLabel7(site);
   const group = opts.group ?? "minor";
   const spawn2 = opts.spawn ?? defaultSpawn;
-  const hasPnpmLock = await exists(join8(site.path, "pnpm-lock.yaml"));
-  if (!hasPnpmLock) {
-    const hasNpmLock = await exists(join8(site.path, "package-lock.json"));
-    const hasYarnLock = await exists(join8(site.path, "yarn.lock"));
-    if (hasNpmLock || hasYarnLock) {
-      const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
-      return {
-        recipe: "bump-deps",
-        site: label,
-        status: "failed",
-        commits: [],
-        notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
-      };
+  return withRecipe({
+    name: "bump-deps",
+    site,
+    // pnpm install (in plan) mutates the lockfile, so the clean-tree check
+    // MUST happen first — otherwise a desynced-lockfile resync would silently
+    // land on top of whatever else was in the tree.
+    checkTreeFirst: true,
+    plan: async () => {
+      const hasPnpmLock = await exists(join8(site.path, "pnpm-lock.yaml"));
+      if (!hasPnpmLock) {
+        const hasNpmLock = await exists(join8(site.path, "package-lock.json"));
+        const hasYarnLock = await exists(join8(site.path, "yarn.lock"));
+        if (hasNpmLock || hasYarnLock) {
+          const competing = hasNpmLock ? "package-lock.json" : "yarn.lock";
+          return {
+            kind: "failed",
+            notes: `site has ${competing} but no pnpm-lock.yaml \u2014 run convert-to-pnpm first`
+          };
+        }
+      }
+      await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
+      const outdated = await spawn2(
+        "pnpm",
+        ["outdated", "--json", ...outdatedFlagsForGroup(group)],
+        { cwd: site.path }
+      );
+      let parsed;
+      try {
+        parsed = JSON.parse(outdated.stdout || "{}");
+      } catch {
+        parsed = {};
+      }
+      if (Object.keys(parsed).length === 0) {
+        return { kind: "noop", notes: `pnpm outdated reported nothing for group=${group}` };
+      }
+      return { kind: "apply", plan: { group } };
+    },
+    apply: async ({ group: g }, { commit: commit2, cwd }) => {
+      await spawn2("pnpm", ["up", ...upFlagsForGroup(g)], { cwd, streaming: true });
+      await commit2(`chore(deps): bump dependencies (${g})`);
+      return { kind: "ok" };
     }
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  await spawn2("pnpm", ["install"], { cwd: site.path, streaming: true });
-  const outdated = await spawn2("pnpm", ["outdated", "--json", ...outdatedFlagsForGroup(group)], {
-    cwd: site.path
   });
-  let parsed;
-  try {
-    parsed = JSON.parse(outdated.stdout || "{}");
-  } catch {
-    parsed = {};
-  }
-  const nothingToDo = Object.keys(parsed).length === 0;
-  if (nothingToDo) {
-    return {
-      recipe: "bump-deps",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: `pnpm outdated reported nothing for group=${group}`
-    };
-  }
-  const branch = branchName("bump-deps");
-  await createBranch(site.path, branch);
-  await spawn2("pnpm", ["up", ...upFlagsForGroup(group)], {
-    cwd: site.path,
-    streaming: true
-  });
-  const sha = await commit(site.path, `chore(deps): bump dependencies (${group})`);
-  const shas = sha ? [sha] : [];
-  return {
-    recipe: "bump-deps",
-    site: label,
-    status: shas.length > 0 ? "applied" : "noop",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/cli/commands/bump-deps.ts
@@ -1507,6 +1524,34 @@ import { glob as glob2 } from "tinyglobby";
 // src/recipes/svelte-5/codemods/on-event-to-handler.ts
 var SCRIPT_BLOCK = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var SIMPLE_ON_EVENT = /\bon:([a-z]+)(?=\s*=)/g;
+var MODIFIER_EVENT = /\bon:[a-z]+\|[a-zA-Z]+(?=\s*=)/g;
+function flagEventModifiers(source) {
+  const insertions = [];
+  let m;
+  MODIFIER_EVENT.lastIndex = 0;
+  while ((m = MODIFIER_EVENT.exec(source)) !== null) {
+    const tagStart = source.lastIndexOf("<", m.index);
+    if (tagStart === -1) continue;
+    const prevLineEnd = tagStart - 1;
+    if (prevLineEnd >= 0) {
+      const prevLineStart = source.lastIndexOf("\n", prevLineEnd - 1) + 1;
+      const prevLine = source.slice(prevLineStart, prevLineEnd + 1);
+      if (/<!--\s*@migration-task/.test(prevLine)) continue;
+    }
+    const lineStart = source.lastIndexOf("\n", tagStart - 1) + 1;
+    const indent = source.slice(lineStart, tagStart);
+    const safeIndent = /^[ \t]*$/.test(indent) ? indent : "";
+    insertions.push({ tagStart, indent: safeIndent, modifier: m[0] });
+  }
+  let out = source;
+  for (let i = insertions.length - 1; i >= 0; i--) {
+    const { tagStart, indent, modifier } = insertions[i];
+    const comment = `<!-- @migration-task: Svelte 5 removed event modifier syntax (\`${modifier}\`). Rewrite inline, e.g. onclick={(e) => { e.preventDefault(); ... }}. -->
+${indent}`;
+    out = out.slice(0, tagStart) + comment + out.slice(tagStart);
+  }
+  return out;
+}
 function onEventToHandler(source) {
   const masked = [];
   const placeholder = (i) => ` SCRIPT_${i} `;
@@ -1514,8 +1559,9 @@ function onEventToHandler(source) {
     masked.push(match);
     return placeholder(masked.length - 1);
   });
-  const rewritten = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
-  let out = rewritten;
+  let processed = intermediate.replace(SIMPLE_ON_EVENT, (_full, name) => `on${name}`);
+  processed = flagEventModifiers(processed);
+  let out = processed;
   masked.forEach((blk, i) => {
     out = out.replace(placeholder(i), blk);
   });
@@ -1565,6 +1611,22 @@ function exportLetToProps(source) {
   return source.replace(SCRIPT_BLOCK2, (full) => full.replace(inner, body));
 }
 
+// src/util/svelte-source.ts
+function findStringEnd(source, openIdx) {
+  const quote = source[openIdx];
+  let i = openIdx + 1;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
+    }
+    if (ch === quote) return i;
+    i++;
+  }
+  return -1;
+}
+
 // src/recipes/svelte-5/codemods/dollar-restprops.ts
 function removeInterfaceBlock(source) {
   const re = /^\s*interface\s+\$\$Props\s*\{/m;
@@ -1588,20 +1650,6 @@ function removeInterfaceBlock(source) {
     out = out.slice(0, match.index) + out.slice(endIdx);
   }
 }
-function findStringEnd(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 function maskStringLiterals(source) {
   const strings = [];
   let out = "";
@@ -1678,7 +1726,8 @@ function stateEffectSyncToDerived(source) {
 
 // src/recipes/svelte-5/codemods/dollar-props-class.ts
 var PROPS_DESTRUCTURE = /let\s*\{([\s\S]*?)\}(\s*:\s*\{([\s\S]*?)\})?\s*=\s*\$props\(\)/;
-var DOLLAR_PROPS_CLASS = /\$\$props\.class\b/g;
+var HAS_DOLLAR_PROPS_CLASS = /\$\$props\.class\b/;
+var DOLLAR_PROPS_CLASS_GLOBAL = /\$\$props\.class\b/g;
 var DOLLAR_PROPS_ANY = /\$\$props\b/;
 var SCRIPT_BLOCK4 = /<script\b[^>]*>[\s\S]*?<\/script>/g;
 var MIGRATION_TASK = /^<!--\s*@migration-task[\s\S]*?-->\s*\n?/gm;
@@ -1700,8 +1749,7 @@ function restoreScripts(masked, blocks) {
 }
 function dollarPropsClass(source) {
   const { masked } = maskScripts(source);
-  if (!DOLLAR_PROPS_CLASS.test(masked)) return source;
-  DOLLAR_PROPS_CLASS.lastIndex = 0;
+  if (!HAS_DOLLAR_PROPS_CLASS.test(masked)) return source;
   if (!PROPS_DESTRUCTURE.test(source)) return source;
   let updated = source.replace(PROPS_DESTRUCTURE, (full, body, typeAnno, typeBody) => {
     if (/\bclass\s*:/.test(body)) return full;
@@ -1715,7 +1763,7 @@ function dollarPropsClass(source) {
     return `let { ${newBody} } = $props()`;
   });
   const reMasked = maskScripts(updated);
-  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS, IDENT);
+  const templateRewritten = reMasked.masked.replace(DOLLAR_PROPS_CLASS_GLOBAL, IDENT);
   updated = restoreScripts(templateRewritten, reMasked.blocks);
   const stripped = updated.replace(MIGRATION_TASK, "");
   if (!DOLLAR_PROPS_ANY.test(stripped)) {
@@ -1734,7 +1782,7 @@ function findMatchingClose(source, openIdx) {
   while (i < source.length) {
     const ch = source[i];
     if (ch === '"' || ch === "'" || ch === "`") {
-      const closeStr = findStringClose(source, i);
+      const closeStr = findStringEnd(source, i);
       if (closeStr === -1) return -1;
       i = closeStr + 1;
       continue;
@@ -1748,20 +1796,6 @@ function findMatchingClose(source, openIdx) {
   }
   return -1;
 }
-function findStringClose(source, openIdx) {
-  const quote = source[openIdx];
-  let i = openIdx + 1;
-  while (i < source.length) {
-    const ch = source[i];
-    if (ch === "\\") {
-      i += 2;
-      continue;
-    }
-    if (ch === quote) return i;
-    i++;
-  }
-  return -1;
-}
 var MIGRATION_MARKER = "// @migration-task: $effect won't trigger UI updates on plain `let` bindings \u2014 refine mutated locals to $state or split into per-variable $derived.";
 function transformBlocks(body) {
   const out = [];
@@ -1873,9 +1907,6 @@ async function writeMigrationSummary(input) {
 }
 
 // src/recipes/svelte-5/index.ts
-function siteLabel8(site) {
-  return site.name ?? site.path;
-}
 async function alreadyOnSvelte5(cwd) {
   try {
     const pkg = await readPackageJson(join14(cwd, "package.json"));
@@ -1886,72 +1917,49 @@ async function alreadyOnSvelte5(cwd) {
   }
 }
 async function upgradeSvelte4to5(site, opts = {}) {
-  const label = siteLabel8(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
-  if (await alreadyOnSvelte5(site.path)) {
-    return {
-      recipe: "svelte-4-to-5",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "site already declares svelte ^5.x"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("svelte-4-to-5");
-  await createBranch(site.path, branch);
-  const shas = [];
-  const bumped = await bumpToSvelte5Versions(site.path);
-  if (bumped) {
-    const sha = await commit(site.path, "chore(svelte5): bump svelte/kit/vite/vite-plugin-svelte");
-    if (sha) shas.push(sha);
-  }
-  const configChanged = await migrateSvelteConfig(site.path);
-  if (configChanged) {
-    const sha = await commit(
-      site.path,
-      "refactor(svelte5): migrate svelte.config.js (drop vitePreprocess)"
-    );
-    if (sha) shas.push(sha);
-  }
-  const migrate = await runSvelteMigrate(site.path, spawn2);
-  if (migrate.ran) {
-    const sha = await commit(site.path, "refactor(svelte5): run official svelte-migrate codemod");
-    if (sha) shas.push(sha);
-  }
-  const tw = await upgradeTailwind(site.path, spawn2);
-  if (tw.ran) {
-    const sha = await commit(site.path, "chore(svelte5): tailwindcss 3 \u2192 4 upgrade");
-    if (sha) shas.push(sha);
-  }
-  const codemods = await applyGotchaCodemods(site.path);
-  if (codemods.filesChanged > 0) {
-    const sha = await commit(
-      site.path,
-      `refactor(svelte5): apply gotcha codemods (${codemods.filesChanged} files)`
-    );
-    if (sha) shas.push(sha);
-  }
-  await verifyMigration(site.path, spawn2);
-  const verifySha = await commit(site.path, "chore(svelte5): pnpm install + check");
-  if (verifySha) shas.push(verifySha);
-  await writeMigrationSummary({
-    cwd: site.path,
-    filesChangedByCodemods: codemods.filesChanged,
-    svelteMigrateRan: migrate.ran,
-    tailwindUpgraded: tw.ran
+  return withRecipe({
+    name: "svelte-4-to-5",
+    site,
+    plan: async () => {
+      if (await alreadyOnSvelte5(site.path)) {
+        return { kind: "noop", notes: "site already declares svelte ^5.x" };
+      }
+      return { kind: "apply", plan: true };
+    },
+    apply: async (_plan, { commit: commit2, cwd }) => {
+      const bumped = await bumpToSvelte5Versions(cwd);
+      if (bumped) {
+        await commit2("chore(svelte5): bump svelte/kit/vite/vite-plugin-svelte");
+      }
+      const configChanged = await migrateSvelteConfig(cwd);
+      if (configChanged) {
+        await commit2("refactor(svelte5): migrate svelte.config.js (drop vitePreprocess)");
+      }
+      const migrate = await runSvelteMigrate(cwd, spawn2);
+      if (migrate.ran) {
+        await commit2("refactor(svelte5): run official svelte-migrate codemod");
+      }
+      const tw = await upgradeTailwind(cwd, spawn2);
+      if (tw.ran) {
+        await commit2("chore(svelte5): tailwindcss 3 \u2192 4 upgrade");
+      }
+      const codemods = await applyGotchaCodemods(cwd);
+      if (codemods.filesChanged > 0) {
+        await commit2(`refactor(svelte5): apply gotcha codemods (${codemods.filesChanged} files)`);
+      }
+      await verifyMigration(cwd, spawn2);
+      await commit2("chore(svelte5): pnpm install + check");
+      await writeMigrationSummary({
+        cwd,
+        filesChangedByCodemods: codemods.filesChanged,
+        svelteMigrateRan: migrate.ran,
+        tailwindUpgraded: tw.ran
+      });
+      await commit2("docs(svelte5): add MIGRATION_SVELTE_5.md summary");
+      return { kind: "ok" };
+    }
   });
-  const summarySha = await commit(site.path, "docs(svelte5): add MIGRATION_SVELTE_5.md summary");
-  if (summarySha) shas.push(summarySha);
-  return {
-    recipe: "svelte-4-to-5",
-    site: label,
-    status: shas.length > 0 ? "applied" : "noop",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/cli/commands/upgrade.ts
@@ -2026,84 +2034,56 @@ async function exists2(path) {
     return false;
   }
 }
-function siteLabel9(site) {
-  return site.name ?? site.path;
-}
 async function convertToPnpm(site, opts = {}) {
-  const label = siteLabel9(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const pnpmVersion = opts.pnpmVersion ?? DEFAULT_PNPM_VERSION;
   const pnpmLockPath = join15(site.path, "pnpm-lock.yaml");
   const npmLockPath = join15(site.path, "package-lock.json");
   const yarnLockPath = join15(site.path, "yarn.lock");
-  if (await exists2(pnpmLockPath)) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "site already has pnpm-lock.yaml"
-    };
-  }
-  const hasNpmLock = await exists2(npmLockPath);
-  const hasYarnLock = await exists2(yarnLockPath);
-  if (!hasNpmLock && !hasYarnLock) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "no convertible lockfile (package-lock.json or yarn.lock) at site root"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("convert-to-pnpm");
-  await createBranch(site.path, branch);
-  const shas = [];
-  if (hasNpmLock) await rm3(npmLockPath, { force: true });
-  if (hasYarnLock) await rm3(yarnLockPath, { force: true });
-  const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
-  const lockSha = await commit(site.path, `chore(pnpm): remove ${sourceLock}`);
-  if (lockSha) shas.push(lockSha);
-  const pkgPath = join15(site.path, "package.json");
-  const pkg = await readPackageJson(pkgPath);
-  const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
-  if (pkg.scripts && typeof pkg.scripts === "object") {
-    const { scripts: rewritten, changedCount } = rewriteScriptsForPnpm(
-      pkg.scripts
-    );
-    if (changedCount > 0) {
-      next.scripts = rewritten;
+  return withRecipe({
+    name: "convert-to-pnpm",
+    site,
+    plan: async () => {
+      if (await exists2(pnpmLockPath)) {
+        return { kind: "noop", notes: "site already has pnpm-lock.yaml" };
+      }
+      const hasNpmLock = await exists2(npmLockPath);
+      const hasYarnLock = await exists2(yarnLockPath);
+      if (!hasNpmLock && !hasYarnLock) {
+        return {
+          kind: "noop",
+          notes: "no convertible lockfile (package-lock.json or yarn.lock) at site root"
+        };
+      }
+      return { kind: "apply", plan: { hasNpmLock, hasYarnLock } };
+    },
+    apply: async ({ hasNpmLock, hasYarnLock }, { commit: commit2, cwd }) => {
+      if (hasNpmLock) await rm3(npmLockPath, { force: true });
+      if (hasYarnLock) await rm3(yarnLockPath, { force: true });
+      const sourceLock = hasNpmLock ? "package-lock.json" : "yarn.lock";
+      await commit2(`chore(pnpm): remove ${sourceLock}`);
+      const pkgPath = join15(cwd, "package.json");
+      const pkg = await readPackageJson(pkgPath);
+      const next = { ...pkg, packageManager: `pnpm@${pnpmVersion}` };
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        const { scripts: rewritten, changedCount } = rewriteScriptsForPnpm(
+          pkg.scripts
+        );
+        if (changedCount > 0) {
+          next.scripts = rewritten;
+        }
+      }
+      await writePackageJson(pkgPath, next);
+      await commit2("chore(pnpm): pin packageManager + rewrite npm scripts");
+      await rm3(join15(cwd, "node_modules"), { recursive: true, force: true });
+      const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
+      if (installResult.code !== 0) {
+        return { kind: "failed", notes: `pnpm install failed (exit ${installResult.code})` };
+      }
+      await commit2("chore(pnpm): add pnpm-lock.yaml");
+      return { kind: "ok" };
     }
-  }
-  await writePackageJson(pkgPath, next);
-  const pkgSha = await commit(site.path, "chore(pnpm): pin packageManager + rewrite npm scripts");
-  if (pkgSha) shas.push(pkgSha);
-  await rm3(join15(site.path, "node_modules"), { recursive: true, force: true });
-  const installResult = await spawn2("pnpm", ["install"], {
-    cwd: site.path,
-    streaming: true
   });
-  if (installResult.code !== 0) {
-    return {
-      recipe: "convert-to-pnpm",
-      site: label,
-      status: "failed",
-      commits: shas,
-      notes: `pnpm install failed (exit ${installResult.code}). branch ${branch} left for inspection.`
-    };
-  }
-  const installSha = await commit(site.path, "chore(pnpm): add pnpm-lock.yaml");
-  if (installSha) shas.push(installSha);
-  return {
-    recipe: "convert-to-pnpm",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}`
-  };
 }
 
 // src/cli/commands/convert-to-pnpm.ts
@@ -2184,81 +2164,63 @@ async function exists3(path) {
     return false;
   }
 }
-function siteLabel10(site) {
-  return site.name ?? site.path;
-}
 function isDeclared(pkg, name) {
   return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
 async function onboard(site, opts = {}) {
-  const label = siteLabel10(site);
   const spawn2 = opts.spawn ?? defaultSpawn;
   const audits = opts.audits ?? ["lighthouse", "a11y"];
   const packageVersion = opts.packageVersion ?? selfCaretRange(import.meta.url);
-  if (!await exists3(join17(site.path, "pnpm-lock.yaml"))) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "failed",
-      commits: [],
-      notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
-    };
-  }
-  const pkgPath = join17(site.path, "package.json");
-  const pkg = await readPackageJson(pkgPath);
-  const toAdd = [];
-  if (!isDeclared(pkg, PACKAGE_NAME)) {
-    toAdd.push({ name: PACKAGE_NAME, version: packageVersion });
-  }
-  for (const audit of audits) {
-    for (const dep of AUDIT_DEPS[audit]) {
-      if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+  return withRecipe({
+    name: "onboard",
+    site,
+    plan: async () => {
+      if (!await exists3(join17(site.path, "pnpm-lock.yaml"))) {
+        return {
+          kind: "failed",
+          notes: "no pnpm-lock.yaml at site root \u2014 run convert-to-pnpm first"
+        };
+      }
+      const pkgPath = join17(site.path, "package.json");
+      const pkg = await readPackageJson(pkgPath);
+      const toAdd = [];
+      if (!isDeclared(pkg, PACKAGE_NAME)) {
+        toAdd.push({ name: PACKAGE_NAME, version: packageVersion });
+      }
+      for (const audit of audits) {
+        for (const dep of AUDIT_DEPS[audit]) {
+          if (!isDeclared(pkg, dep.name)) toAdd.push(dep);
+        }
+      }
+      if (toAdd.length === 0) {
+        return {
+          kind: "noop",
+          notes: `site already has ${PACKAGE_NAME} and audit deps (${audits.join("+")})`
+        };
+      }
+      return { kind: "apply", plan: { pkg, toAdd } };
+    },
+    apply: async ({ pkg, toAdd }, { commit: commit2, cwd }) => {
+      const pkgPath = join17(cwd, "package.json");
+      let next = pkg;
+      for (const dep of toAdd) {
+        next = bumpDep(next, dep.name, dep.version);
+      }
+      await writePackageJson(pkgPath, next);
+      const installResult = await spawn2("pnpm", ["install"], { cwd, streaming: true });
+      if (installResult.code !== 0) {
+        return {
+          kind: "failed",
+          notes: `pnpm install failed (exit ${installResult.code})`
+        };
+      }
+      await commit2(`chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`);
+      return {
+        kind: "ok",
+        notes: `Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(", ")}`
+      };
     }
-  }
-  if (toAdd.length === 0) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: `site already has ${PACKAGE_NAME} and audit deps (${audits.join("+")})`
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("onboard");
-  await createBranch(site.path, branch);
-  let next = pkg;
-  for (const dep of toAdd) {
-    next = bumpDep(next, dep.name, dep.version);
-  }
-  await writePackageJson(pkgPath, next);
-  const installResult = await spawn2("pnpm", ["install"], {
-    cwd: site.path,
-    streaming: true
   });
-  if (installResult.code !== 0) {
-    return {
-      recipe: "onboard",
-      site: label,
-      status: "failed",
-      commits: [],
-      notes: `pnpm install failed (exit ${installResult.code}). branch ${branch} left for inspection.`
-    };
-  }
-  const sha = await commit(
-    site.path,
-    `chore(reddoor): onboard with ${PACKAGE_NAME} ${packageVersion}`
-  );
-  const shas = sha ? [sha] : [];
-  return {
-    recipe: "onboard",
-    site: label,
-    status: "applied",
-    commits: shas,
-    notes: `branch: ${branch}. Added ${toAdd.length} dep(s): ${toAdd.map((d) => d.name).join(", ")}`
-  };
 }
 
 // src/cli/commands/onboard.ts
@@ -2309,40 +2271,25 @@ import { resolve as resolve8 } from "path";
 // src/recipes/svelte-codemods.ts
 import { writeFile as writeFile8 } from "fs/promises";
 import { join as join18 } from "path";
-function siteLabel11(site) {
-  return site.name ?? site.path;
-}
 async function svelteCodemods(site) {
-  const label = siteLabel11(site);
-  const changes = await planGotchaCodemods(site.path);
-  if (changes.length === 0) {
-    return {
-      recipe: "svelte-codemods",
-      site: label,
-      status: "noop",
-      commits: [],
-      notes: "no codemod targets matched"
-    };
-  }
-  if (!await isWorkingTreeClean(site.path)) {
-    throw new Error(`refusing to run: working tree is not clean at ${site.path}`);
-  }
-  const branch = branchName("svelte-codemods");
-  await createBranch(site.path, branch);
-  for (const c of changes) {
-    await writeFile8(join18(site.path, c.rel), c.after, "utf-8");
-  }
-  const sha = await commit(
-    site.path,
-    `refactor(svelte5): apply codemods (${changes.length} files)`
-  );
-  return {
-    recipe: "svelte-codemods",
-    site: label,
-    status: "applied",
-    commits: sha ? [sha] : [],
-    notes: `branch: ${branch}`
-  };
+  return withRecipe({
+    name: "svelte-codemods",
+    site,
+    plan: async () => {
+      const changes = await planGotchaCodemods(site.path);
+      if (changes.length === 0) {
+        return { kind: "noop", notes: "no codemod targets matched" };
+      }
+      return { kind: "apply", plan: changes };
+    },
+    apply: async (changes, { commit: commit2, cwd }) => {
+      for (const c of changes) {
+        await writeFile8(join18(cwd, c.rel), c.after, "utf-8");
+      }
+      await commit2(`refactor(svelte5): apply codemods (${changes.length} files)`);
+      return { kind: "ok" };
+    }
+  });
 }
 
 // src/cli/commands/svelte-codemods.ts
@@ -2401,6 +2348,17 @@ var RECIPE_DESCRIPTIONS = {
   "convert-to-pnpm": "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts).",
   onboard: "Install @reddoorla/maintenance + audit deps on a site (preferred first step)."
 };
+async function runOrExit(fn, opts) {
+  try {
+    const { output, code } = await fn();
+    console.log(output);
+    process.exit(code);
+  } catch (err) {
+    const e = err;
+    console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
+    process.exit(e.exitCode ?? 1);
+  }
+}
 var cli = cac("reddoor-maint");
 cli.option("--cwd <path>", "Override working directory (default: process.cwd())");
 cli.option("--verbose", "Verbose output (full stack on errors)");
@@ -2415,101 +2373,31 @@ cli.command("list-recipes", "Print the available recipes.").action(() => {
   }
 });
 cli.command("audit [site]", "Run audits against a site (default: cwd).").option("--only <names>", "Comma-separated audit names (e.g. deps,lighthouse)").option("--json", "Machine-readable JSON output").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js); aggregates across sites").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runAuditCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runAuditCommand(site, opts), opts)
 );
 cli.command("sync-configs [site]", "Sync canonical configs into a site.").option("--only <names>", "Comma-separated config names (e.g. eslint,prettier)").option("--dry", "Print diff without writing").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runSyncConfigsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runSyncConfigsCommand(site, opts), opts)
 );
 cli.command("bump-deps [site]", "Bump dependencies.").option("--group <group>", "patch | minor | major", { default: "minor" }).option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runBumpDepsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runBumpDepsCommand(site, opts), opts)
 );
 cli.command("upgrade <upgrade> [site]", "Run a named upgrade recipe (svelte-4-to-5).").example("reddoor-maint upgrade svelte-4-to-5 ./my-site").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (upgrade, site, opts) => {
-    try {
-      const { output, code } = await runUpgradeCommand(upgrade, site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (upgrade, site, opts) => runOrExit(() => runUpgradeCommand(upgrade, site, opts), opts)
 );
 cli.command(
   "convert-to-pnpm [site]",
   "Convert an npm/yarn site to pnpm (lockfile, packageManager, scripts)."
 ).option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runConvertToPnpmCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runConvertToPnpmCommand(site, opts), opts)
 );
 cli.command("svelte-codemods [site]", "Apply Svelte 5 gotcha codemods to an already-migrated site.").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runSvelteCodemodsCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runSvelteCodemodsCommand(site, opts), opts)
 );
 cli.command(
   "onboard [site]",
   "Install @reddoorla/maintenance + audit deps on a site (run after convert-to-pnpm)."
 ).option("--audits <names>", "Comma-separated audit subset: lighthouse,a11y (default: both)").option("--fleet <inventory>", "Inventory file (.json or .mjs/.js)").option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
-  async (site, opts) => {
-    try {
-      const { output, code } = await runOnboardCommand(site, opts);
-      console.log(output);
-      process.exit(code);
-    } catch (err) {
-      const e = err;
-      console.error(opts.verbose ? e.stack ?? e.message : e.message ?? String(err));
-      process.exit(e.exitCode ?? 1);
-    }
-  }
+  async (site, opts) => runOrExit(() => runOnboardCommand(site, opts), opts)
 );
 cli.help();
 cli.version(version);