@bigcommerce/catalyst 1.4.0 → 1.4.1

package/dist/cli.js

@@ -25,7 +25,7 @@ import { randomBytes, randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@bigcommerce/catalyst",
-  version: "1.4.0",
+  version: "1.4.1",
   type: "module",
   repository: {
     type: "git",
@@ -215,7 +215,7 @@ import { Command as Command15 } from "commander";
 import { colorize as colorize13 } from "consola/utils";
 
 // src/cli/commands/auth.ts
-import { Command } from "commander";
+import { Command, Option as Option2 } from "commander";
 import { z as z5 } from "zod";
 
 // src/cli/lib/auth-errors.ts
@@ -685,6 +685,19 @@ async function fetchStoreProfile2(storeHash, accessToken, apiHost) {
   }
   return result.data.data;
 }
+async function checkCredentials(storeHash, accessToken, apiHost) {
+  try {
+    const { store_name: storeName } = await fetchStoreProfile2(storeHash, accessToken, apiHost);
+    return { valid: true, storeName };
+  } catch (error) {
+    if (error instanceof UnauthorizedError) return { valid: false, reason: "unauthorized" };
+    return {
+      valid: false,
+      reason: "unverifiable",
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
 var whoami = new Command("whoami").configureHelp({ showGlobalOptions: true }).description("Verify stored credentials and display store/project info.").addHelpText(
   "after",
   `
@@ -739,7 +752,7 @@ Example:
   }
 });
 var login2 = new Command("login").configureHelp({ showGlobalOptions: true }).description(
-  "Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. If already logged in, displays current credentials and suggests running `catalyst auth logout` to re-authenticate."
+  "Authenticate via browser using the OAuth device code flow. Falls back to an interactive store hash + access token prompt if the browser flow is unavailable. Passing --store-hash and --access-token verifies and stores those credentials instead. If already logged in with credentials that still work, displays them and suggests `catalyst auth logout`; if the stored token has expired or been revoked, re-authenticates in place."
 ).addHelpText(
   "after",
   `
@@ -748,19 +761,67 @@ Examples:
   $ catalyst auth login
 
   # Login with existing credentials (skips interactive flow)
-  $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>`
-).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).action(async (options) => {
+  $ catalyst auth login --store-hash <STORE_HASH> --access-token <ACCESS_TOKEN>
+
+  # Re-authenticate without checking the stored credentials first
+  $ catalyst auth login --force`
+).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).addOption(
+  new Option2(
+    "--force",
+    "Skip the check on any credentials already stored and re-authenticate regardless."
+  )
+).action(async (options, command) => {
   try {
     const config2 = getProjectConfig();
     const apiHost = resolveApiHost(options, config2);
     const storeHash = options.storeHash ?? config2.get("storeHash");
     const accessToken = options.accessToken ?? config2.get("accessToken");
-    if (storeHash && accessToken) {
-      consola.info(`Already logged in to store ${storeHash}.`);
-      consola.info("Run `catalyst auth logout` first to re-authenticate.");
+    const suppliedOnCli = command.getOptionValueSource("storeHash") === "cli" && command.getOptionValueSource("accessToken") === "cli";
+    if (suppliedOnCli && storeHash && accessToken) {
+      if (!options.force) {
+        const status = await checkCredentials(storeHash, accessToken, apiHost);
+        if (!status.valid && status.reason === "unauthorized") {
+          consola.error(`The credentials provided for store ${storeHash} were rejected.`);
+          consola.info(
+            "Check the store hash and access token, or run `catalyst auth login` without them to authenticate in the browser."
+          );
+          process.exit(1);
+          return;
+        }
+        if (!status.valid) {
+          consola.warn(`Couldn't verify the credentials provided: ${status.message}`);
+        }
+      }
+      config2.set("storeHash", storeHash);
+      config2.set("accessToken", accessToken);
+      consola.success(`Logged in to store ${storeHash}.`);
       process.exit(0);
       return;
     }
+    if (storeHash && accessToken && !options.force) {
+      const status = await checkCredentials(storeHash, accessToken, apiHost);
+      if (status.valid) {
+        consola.info(`Already logged in to ${status.storeName} (${storeHash}).`);
+        consola.info(
+          "Run `catalyst auth logout` first to re-authenticate, or `catalyst auth login --force` to skip this check."
+        );
+        process.exit(0);
+        return;
+      }
+      if (status.reason === "unverifiable") {
+        consola.warn(
+          `Found credentials for store ${storeHash} but couldn't verify them: ${status.message}`
+        );
+        consola.info(
+          "Keeping them. Re-run once the API is reachable, or `catalyst auth login --force` to re-authenticate regardless."
+        );
+        process.exit(0);
+        return;
+      }
+      consola.warn(
+        `Stored credentials for store ${storeHash} are no longer valid \u2014 re-authenticating.`
+      );
+    }
     const credentials = await login(options.loginUrl, apiHost);
     config2.set("storeHash", credentials.storeHash);
     config2.set("accessToken", credentials.accessToken);
@@ -807,7 +868,7 @@ Example:
 var auth = new Command("auth").configureHelp({ showGlobalOptions: true }).description("Manage authentication for the BigCommerce CLI.").addCommand(whoami).addCommand(login2).addCommand(logout);
 
 // src/cli/commands/build.ts
-import { Command as Command2, InvalidArgumentError, Option as Option2 } from "commander";
+import { Command as Command2, InvalidArgumentError, Option as Option3 } from "commander";
 import { execa as execa2 } from "execa";
 import { copyFile, cp, rm, writeFile } from "fs/promises";
 import { join as join6 } from "path";
@@ -918,7 +979,7 @@ var cleanupCloudflareIncompatibilities = async (projectDir) => {
     return;
   }
   const shouldRemove = await confirm2({
-    message: 'Catalyst found instrumentation.ts, which is incompatible with the Cloudflare Workers bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start). Remove it and drop @vercel/otel from package.json?',
+    message: 'Catalyst found instrumentation.ts, which is incompatible with the Cloudflare Workers bundle when it uses @vercel/otel (causes "Failed to prepare server" at cold start).\nRemove it and drop @vercel/otel from package.json? (required for native hosting)',
     default: true
   });
   if (!shouldRemove) {
@@ -1523,12 +1584,12 @@ Examples:
   # Build with a specific Wrangler version
   $ catalyst build --wrangler-version 4.24.3`
 ).addOption(
-  new Option2(
+  new Option3(
     "--project-uuid <uuid>",
     "Project UUID to be included in the deployment configuration."
   ).env("CATALYST_PROJECT_UUID")
 ).addOption(
-  new Option2(
+  new Option3(
     "--wrangler-version <version>",
     `Wrangler version or dist-tag to build with. Defaults to ${WRANGLER_VERSION}.`
   ).argParser(parseWranglerVersion)
@@ -1557,7 +1618,7 @@ Examples:
 
 // src/cli/commands/channels.ts
 import { confirm as confirm3, select as select4 } from "@inquirer/prompts";
-import { Command as Command3, InvalidArgumentError as InvalidArgumentError2, Option as Option3 } from "commander";
+import { Command as Command3, InvalidArgumentError as InvalidArgumentError2, Option as Option4 } from "commander";
 import { colorize as colorize5 } from "consola/utils";
 
 // src/cli/lib/channel-checkout-url-flow.ts
@@ -1900,7 +1961,7 @@ async function resolveChannel(options) {
     );
   }
   const id = await select2({
-    message: "Select the channel to update.",
+    message: options.message ?? "Select the channel to update.",
     choices: catalystChannels.map((c) => ({
       name: c.name,
       value: c.id,
@@ -2317,22 +2378,22 @@ Examples:
   # Fall back to the shared checkout domain
   $ catalyst channels update --channel-id 123 --remove-checkout-url`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option3(
+  new Option4(
     "--channel-id <id>",
     "Skip the channel prompt and target this channel directly."
   ).argParser((value) => Number(value))
 ).addOption(
-  new Option3(
+  new Option4(
     "--hostname <hostname>",
     "Skip the hostname prompt and use this hostname directly. Must be one of the project's deployment_hostnames."
   )
 ).addOption(
-  new Option3(
+  new Option4(
     "--checkout-url <url>",
     "Set the channel's checkout URL. Must share a main domain with the storefront URL."
   ).argParser(parseCheckoutUrl)
 ).addOption(
-  new Option3(
+  new Option4(
     "--remove-checkout-url",
     "Remove the channel's custom checkout URL so checkout falls back to the shared checkout domain."
   ).conflicts("checkoutUrl")
@@ -2406,14 +2467,14 @@ Examples:
   # Append extra environment variables to .env.local
   $ catalyst channels link --channel-id 123 --env MY_FLAG=1`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(loginUrlOption()).addOption(
-  new Option3("--channel-id <id>", "Link this channel directly, skipping the picker.").argParser(
+  new Option4("--channel-id <id>", "Link this channel directly, skipping the picker.").argParser(
     parseChannelId
   )
 ).option(
   "--env <vars...>",
   "Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable)."
 ).addOption(
-  new Option3("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   const config2 = getProjectConfig();
   const apiHost = resolveApiHost(options, config2);
@@ -2484,11 +2545,11 @@ Examples:
 ).option(
   "--additional-locales <locales...>",
   "Additional storefront locales, max 4 (e.g. --additional-locales es fr). Skips the additional-languages prompt."
-).addOption(new Option3("--sample-data", "Install sample data on the new channel.")).addOption(new Option3("--no-sample-data", "Create the channel without sample data.")).option(
+).addOption(new Option4("--sample-data", "Install sample data on the new channel.")).addOption(new Option4("--no-sample-data", "Create the channel without sample data.")).option(
   "--link",
   "Link the new channel to this project \u2014 write its credentials to .env.local without prompting."
 ).addOption(
-  new Option3("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   if (options.additionalLocales && options.additionalLocales.length > 4) {
     consola.error("You can only set up to 4 additional locales.");
@@ -2570,7 +2631,10 @@ async function resolveChannelTarget(options) {
     storeHash,
     accessToken,
     apiHost,
-    channelId: options.channelId
+    channelId: options.channelId,
+    // Read-only: these commands report on a channel, so the picker must not
+    // say "to update" — the shared default is written for `channels update`.
+    message: "Select a channel."
   });
   return {
     config: config2,
@@ -2592,7 +2656,7 @@ Examples:
   # Target a channel directly
   $ catalyst channels info --channel-id 123`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(
-  new Option3(
+  new Option4(
     "--channel-id <id>",
     "Skip the channel prompt and target this channel directly."
   ).argParser(parseChannelId)
@@ -2638,7 +2702,7 @@ Examples:
 var channels = new Command3("channels").alias("channel").configureHelp({ showGlobalOptions: true }).description("Manage BigCommerce channels.").addCommand(info, { isDefault: true }).addCommand(create).addCommand(link).addCommand(update);
 
 // src/cli/commands/create.ts
-import { Command as Command4, InvalidArgumentError as InvalidArgumentError3, Option as Option4 } from "@commander-js/extra-typings";
+import { Command as Command4, InvalidArgumentError as InvalidArgumentError3, Option as Option5 } from "@commander-js/extra-typings";
 import { input as input5, select as select5 } from "@inquirer/prompts";
 import { execSync as execSync2 } from "child_process";
 import { colorize as colorize6 } from "consola/utils";
@@ -2915,7 +2979,7 @@ Examples:
   "Arbitrary environment variables to set in .env.local. Format: KEY=VALUE (repeatable).",
   parseEnvFlag
 ).addOption(
-  new Option4(
+  new Option5(
     "--hosting <mode>",
     'Hosting mode: "self-hosted" (default) or "commerce" to set up Commerce Hosting at create time. When omitted, scaffolding is hosting-agnostic; run `catalyst deploy` later to opt in.'
   ).choices(["self-hosted", "commerce"])
@@ -2923,11 +2987,11 @@ Examples:
   "--use-existing",
   "Only used with --hosting commerce and --project-name. When the named project already exists on the store, reuse it instead of prompting. Has no effect without --hosting commerce."
 ).addOption(
-  new Option4("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
+  new Option5("--bigcommerce-hostname <hostname>", "BigCommerce hostname").default("bigcommerce.com").hideHelp()
 ).addOption(
-  new Option4("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
+  new Option5("--login-url <url>", "BigCommerce login URL.").env("BIGCOMMERCE_LOGIN_URL").default(DEFAULT_LOGIN_URL).hideHelp()
 ).addOption(
-  new Option4("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
+  new Option5("--cli-api-origin <origin>", "Catalyst CLI API origin").default("https://cxm-prd.bigcommerceapp.com").hideHelp()
 ).action(async (options) => {
   const { ghRef, repository } = options;
   if (options.useExisting && options.hosting !== "commerce") {
@@ -3083,7 +3147,7 @@ ${steps.map((step) => `  ${colorize6("yellow", step)}`).join("\n")}`
 });
 
 // src/cli/commands/debug.ts
-import { Command as Command5, Option as Option5 } from "commander";
+import { Command as Command5, Option as Option6 } from "commander";
 
 // src/cli/lib/collect-diagnostics.ts
 import { parse } from "dotenv";
@@ -3334,7 +3398,7 @@ Examples:
 
   # Print machine-readable JSON (useful for copy/paste or piping)
   $ catalyst debug --json`
-).addOption(new Option5("--json", "Output the report as JSON.")).action((options) => {
+).addOption(new Option6("--json", "Output the report as JSON.")).action((options) => {
   const diagnostics = collectDiagnostics();
   if (options.json) {
     consola.log(JSON.stringify(diagnostics, null, 2));
@@ -3346,7 +3410,7 @@ Examples:
 // src/cli/commands/deploy.ts
 import { confirm as confirm4 } from "@inquirer/prompts";
 import AdmZip from "adm-zip";
-import { Command as Command6, Option as Option6 } from "commander";
+import { Command as Command6, Option as Option7 } from "commander";
 import { colorize as colorize7 } from "consola/utils";
 import { access as access2, readdir, readFile } from "fs/promises";
 import { join as join13 } from "path";
@@ -3616,7 +3680,7 @@ Example:
   "--update-checkout-url",
   "After a successful deploy, prompt to update a channel's checkout URL."
 ).addOption(
-  new Option6(
+  new Option7(
     "--secret <value>",
     "Secret to set for this deployment (repeatable). Overrides a stored value for the same key. Format: --secret KEY=VALUE"
   ).argParser((value, previous = []) => {
@@ -3626,7 +3690,7 @@ Example:
   "--prebuilt",
   "Skip the build step. Requires .bigcommerce/dist/ to already contain build output."
 ).addOption(
-  new Option6(
+  new Option7(
     "--wrangler-version <version>",
     `Wrangler version or dist-tag to build with. Ignored with --prebuilt. Defaults to ${WRANGLER_VERSION}.`
   ).argParser(parseWranglerVersion)
@@ -3785,7 +3849,7 @@ Example:
 
 // src/cli/commands/domains.ts
 import { confirm as confirm5, select as select6 } from "@inquirer/prompts";
-import { Command as Command7, Option as Option7 } from "commander";
+import { Command as Command7, Option as Option8 } from "commander";
 import { colorize as colorize9 } from "consola/utils";
 
 // src/cli/lib/domains.ts
@@ -4357,7 +4421,7 @@ Examples:
   # Show pending domains only
   $ catalyst domains list --status pending`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).option("--domain <domain>", "Only show a specific domain.").addOption(
-  new Option7("--status <status>", "Filter by verification status.").choices(
+  new Option8("--status <status>", "Filter by verification status.").choices(
     DOMAIN_STATUS_FILTERS
   )
 ).action(async (options) => {
@@ -4662,7 +4726,7 @@ var env = new Command8("env").configureHelp({ showGlobalOptions: true }).descrip
 ).addCommand(add2).addCommand(remove2).addCommand(list2);
 
 // src/cli/commands/logs.ts
-import { Command as Command9, InvalidArgumentError as InvalidArgumentError4, Option as Option8 } from "commander";
+import { Command as Command9, InvalidArgumentError as InvalidArgumentError4, Option as Option9 } from "commander";
 import { colorize as colorize10 } from "consola/utils";
 import { z as z16 } from "zod";
 var DEFAULT_CONNECTION_TTL_MS = 1 * 60 * 1e3;
@@ -4879,7 +4943,7 @@ Examples:
   # Tail logs as raw JSON (useful for piping to other tools)
   $ catalyst logs tail --format json`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option8("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
+  new Option9("--format <format>", "Output format for log events.").choices(["json", "pretty", "default", "short", "request"]).default("default")
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -4980,7 +5044,7 @@ Examples:
   # Raw JSON (NDJSON) for piping to other tools
   $ catalyst logs query --since 2d --format json`
 ).addOption(storeHashOption()).addOption(accessTokenOption()).addOption(apiHostOption()).addOption(projectUuidOption()).addOption(
-  new Option8(
+  new Option9(
     "--since <duration>",
     "Relative window ending at --end (default: now), e.g. 30m, 6h, 2d (units: s, m, h, d)."
   ).conflicts("start")
@@ -4988,28 +5052,28 @@ Examples:
   "--end <time>",
   "Window end: ISO-8601 timestamp or Unix epoch (seconds). Defaults to now. The window must not exceed 7 days."
 ).option("--method <method>", "Filter by request HTTP method (case-insensitive).").addOption(
-  new Option8("--status-code <code>", "Filter by response status code (100-599).").argParser(
+  new Option9("--status-code <code>", "Filter by response status code (100-599).").argParser(
     parseIntInRange("--status-code", 100, 599)
   )
 ).option("--url-like <substring>", "Filter by URL substring (case-sensitive).").addOption(
-  new Option8("--level-min <level>", "Minimum log level.").choices(Array.from(LOG_LEVELS))
+  new Option9("--level-min <level>", "Minimum log level.").choices(Array.from(LOG_LEVELS))
 ).addOption(
-  new Option8(
+  new Option9(
     "--limit <count>",
     "Maximum entries per page (1-500). Defaults to the API default (100)."
   ).argParser(parseIntInRange("--limit", 1, 500))
 ).addOption(
-  new Option8(
+  new Option9(
     "--after <cursor>",
     "Return the page after (older than) this cursor, from a previous page's end_cursor."
   ).conflicts("before")
 ).addOption(
-  new Option8(
+  new Option9(
     "--before <cursor>",
     "Return the page before (newer than) this cursor, from a previous page's start_cursor."
   )
 ).addOption(
-  new Option8("--format <format>", "Output format for log entries.").choices(["json", "pretty", "default", "short", "request"]).default("default")
+  new Option9("--format <format>", "Output format for log entries.").choices(["json", "pretty", "default", "short", "request"]).default("default")
 ).action(async (options) => {
   try {
     const config2 = getProjectConfig();
@@ -5352,7 +5416,7 @@ Example:
 });
 
 // src/cli/commands/telemetry.ts
-import { Argument, Command as Command12, Option as Option9 } from "commander";
+import { Argument, Command as Command12, Option as Option10 } from "commander";
 import { colorize as colorize12 } from "consola/utils";
 var telemetryService = getTelemetry();
 var isEnabled = telemetryService.isEnabled();
@@ -5370,7 +5434,7 @@ Examples:
 
   # Disable telemetry collection
   $ catalyst telemetry --disable`
-).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option9("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
+).addArgument(new Argument("[arg]").choices(["disable", "enable", "status"])).addOption(new Option10("--enable", `Enables CLI telemetry collection.`).conflicts("disable")).option("--disable", `Disables CLI telemetry collection.`).action((arg, options) => {
   if (options.enable || arg === "enable") {
     telemetryService.setEnabled(true);
     isEnabled = true;
@@ -5397,7 +5461,7 @@ Examples:
 });
 
 // src/cli/commands/upgrade.ts
-import { Command as Command13, Option as Option10 } from "@commander-js/extra-typings";
+import { Command as Command13, Option as Option11 } from "@commander-js/extra-typings";
 import { confirm as confirm7 } from "@inquirer/prompts";
 import { execa as execa4 } from "execa";
 import {
@@ -5559,6 +5623,72 @@ async function findStaleCli(pkgRaw) {
   const current = minVersion2(range)?.version;
   return current !== void 0 && semverLt2(current, latest) ? { current, latest } : null;
 }
+var CLI_MANAGED_SCRIPTS = ["build", "start", "deploy"];
+var ScriptsPackageJson = z17.looseObject({
+  scripts: z17.record(z17.string(), z17.string()).optional()
+});
+var readScripts = (raw) => {
+  try {
+    return ScriptsPackageJson.parse(JSON.parse(raw)).scripts ?? {};
+  } catch {
+    return {};
+  }
+};
+var SCRIPTS_BLOCK = /"scripts"\s*:\s*\{(?:[^{}"]|"(?:[^"\\]|\\.)*")*\}/;
+var rewriteScriptCommand = (raw, name, command) => {
+  const block = SCRIPTS_BLOCK.exec(raw);
+  if (!block) return raw;
+  const splice = (replacement) => raw.slice(0, block.index) + replacement + raw.slice(block.index + block[0].length);
+  const updated = block[0].replace(
+    new RegExp(`("${escapeRegExp(name)}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`),
+    (_match, key) => `${key}${JSON.stringify(command)}`
+  );
+  if (updated !== block[0]) return splice(updated);
+  const closeIdx = block[0].length - 1;
+  const head = block[0].slice(0, closeIdx).replace(/\s+$/, "");
+  const closeIndent = /\n([ \t]*)$/.exec(block[0].slice(0, closeIdx))?.[1] ?? "";
+  const entryIndent = /\n([ \t]*)"/.exec(block[0])?.[1] ?? `${closeIndent}  `;
+  const separator = head.endsWith("{") ? "" : ",";
+  return splice(
+    `${head}${separator}
+${entryIndent}${JSON.stringify(name)}: ${JSON.stringify(command)}
+${closeIndent}}`
+  );
+};
+async function normalizeManagedScripts(ourPkgRaw, baseDir, theirsDir) {
+  const basePath = join15(baseDir, "package.json");
+  const theirsPath = join15(theirsDir, "package.json");
+  const [originalBase, originalTheirs] = await Promise.all([
+    readFile2(basePath, "utf-8").catch(() => null),
+    readFile2(theirsPath, "utf-8").catch(() => null)
+  ]);
+  if (originalBase === null || originalTheirs === null) return { pinned: [], upstreamChanged: [] };
+  const ourScripts = readScripts(ourPkgRaw);
+  const baseScripts = readScripts(originalBase);
+  const theirsScripts = readScripts(originalTheirs);
+  const decisions = CLI_MANAGED_SCRIPTS.flatMap((name) => {
+    const ours = ourScripts[name];
+    return ours !== void 0 && ours !== baseScripts[name] ? [{ name, ours }] : [];
+  });
+  const upstreamChanged = decisions.flatMap(({ name }) => {
+    const base = baseScripts[name] ?? null;
+    const theirs = theirsScripts[name] ?? null;
+    return base !== theirs ? [{ name, base, theirs }] : [];
+  });
+  const baseRaw = decisions.reduce(
+    (acc, { name, ours }) => rewriteScriptCommand(acc, name, ours),
+    originalBase
+  );
+  const theirsRaw = decisions.reduce(
+    (acc, { name, ours }) => rewriteScriptCommand(acc, name, ours),
+    originalTheirs
+  );
+  await Promise.all([
+    baseRaw === originalBase ? null : writeFile2(basePath, baseRaw),
+    theirsRaw === originalTheirs ? null : writeFile2(theirsPath, theirsRaw)
+  ]);
+  return { pinned: decisions.map(({ name }) => name), upstreamChanged };
+}
 async function mergeFile(oursPath, basePath, theirsPath) {
   const merged = await execa4(
     "git",
@@ -5930,6 +6060,20 @@ ${rows}
 They resolve to your local packages/ copies, which \`catalyst upgrade\` does not update \u2014 so they never receive upgrades.`
   );
 }
+function printManagedScriptFindings(findings) {
+  if (findings.length === 0) return;
+  const pad = Math.max(...findings.map((finding) => finding.name.length));
+  const show = (command) => command ?? "(absent)";
+  const rows = findings.map(
+    (finding) => `  ${finding.name.padEnd(pad)}  ${show(finding.base)} \u2192 ${show(finding.theirs)}`
+  ).join("\n");
+  consola.warn(
+    `Core's own version of ${findings.length} npm script${findings.length === 1 ? "" : "s"} the CLI manages for you changed:
+${rows}
+
+Your project keeps its \`catalyst\`-backed command, which is almost always what you want \u2014 \`catalyst build\`/\`start\`/\`deploy\` wrap the equivalent \`next\` command. Apply the change by hand only if you have opted out of the CLI scripts.`
+  );
+}
 function printSummary({
   result,
   relDir,
@@ -5973,23 +6117,42 @@ Resolve them, then: git add ${relDir} && git commit${install}`
     );
   }
 }
+async function reconcileNativeHosting(catalystRoot, result) {
+  const state = getProjectState(catalystRoot);
+  if (!state.isLinked && !state.isTransformed) return;
+  const instrumentationRel = "instrumentation.ts";
+  const instrumentationPath = join15(catalystRoot, instrumentationRel);
+  const hadInstrumentation = await pathExists(instrumentationPath);
+  try {
+    await cleanupCloudflareIncompatibilities(catalystRoot);
+  } catch (err) {
+    consola.warn(
+      `Couldn't fully reconcile native-hosting files (${err instanceof Error ? err.message : String(err)}). Remove @vercel/otel from package.json by hand if the merge brought it back.`
+    );
+  }
+  if (hadInstrumentation && !await pathExists(instrumentationPath)) {
+    result.conflicted = result.conflicted.filter((rel) => rel !== instrumentationRel);
+    result.applied = result.applied.filter((rel) => rel !== instrumentationRel);
+    result.added = result.added.filter((rel) => rel !== instrumentationRel);
+  }
+}
 var upgrade = new Command13("upgrade").configureHelp({ showGlobalOptions: true }).aliases([
   "up",
   // These are hidden aliases
   "upgrayedd",
   "ugrad"
 ]).description("Upgrade your Catalyst project to a newer version by applying a 3-way merge.").argument("[version]", "Target version to upgrade to (default: latest)").addOption(
-  new Option10(
+  new Option11(
     "--ref <ref>",
     "Full git tag to upgrade to, e.g. an integration family like @bigcommerce/catalyst-makeswift@1.7.0. Overrides [version]."
   )
-).addOption(new Option10("--from <ref>", "Base ref to upgrade from (when catalyst.ref is missing)")).option("--dry-run", "Generate and display the diff without applying it").option("--yes", "Skip confirmation prompts (e.g. inferred base ref)").addOption(
-  new Option10(
+).addOption(new Option11("--from <ref>", "Base ref to upgrade from (when catalyst.ref is missing)")).option("--dry-run", "Generate and display the diff without applying it").option("--yes", "Skip confirmation prompts (e.g. inferred base ref)").addOption(
+  new Option11(
     "--strategy <strategy>",
     "Merge engine: tree (git merge-tree, full fidelity), per-file (git merge-file, no-history fallback), or auto (tree when git >= 2.38, else per-file)"
   ).choices(["auto", "tree", "per-file"]).default("auto").hideHelp()
 ).addOption(
-  new Option10("--repository <owner/repo>", "GitHub repository to pull versions from").default(
+  new Option11("--repository <owner/repo>", "GitHub repository to pull versions from").default(
     DEFAULT_REPOSITORY
   )
 ).addHelpText(
@@ -6104,6 +6267,11 @@ to raise the GitHub API rate limit.`
       baseVersions,
       targetVersions
     );
+    const { upstreamChanged: managedScripts } = await normalizeManagedScripts(
+      project.rawContent,
+      baseDir,
+      theirsDir
+    );
     if (options.dryRun) {
       const diffSpinner = yoctoSpinner4().start("Generating diff...");
       const diff = await execa4(
@@ -6124,6 +6292,7 @@ to raise the GitHub API rate limit.`
       consola.log("\nDiff preview (--dry-run, not applied):\n");
       consola.log(diff.stdout);
       printWorkspaceFindings(workspaceDeps);
+      printManagedScriptFindings(managedScripts);
       return;
     }
     const strategy = await resolveStrategy(options.strategy);
@@ -6171,6 +6340,7 @@ to raise the GitHub API rate limit.`
         );
       }
     }
+    printManagedScriptFindings(managedScripts);
     printWorkspaceFindings(workspaceDeps);
     let migratedDeps = 0;
     if (workspaceDeps.length) {
@@ -6190,6 +6360,7 @@ to raise the GitHub API rate limit.`
         );
       }
     }
+    await reconcileNativeHosting(catalystRoot, result);
     try {
       await applyIndexState(gitRoot, relDir, baseDir, theirsDir, result, stampedText !== null);
     } catch (err) {