@cellajs/cli 0.4.0 → 0.4.1

package/dist/index.js

@@ -2,8 +2,8 @@
 
 // src/cella-cli.ts
 import { existsSync as existsSync12, statSync as statSync3 } from "fs";
-import { join as join17, resolve as resolve7 } from "path";
-import process8 from "process";
+import { join as join18, resolve as resolve7 } from "path";
+import process9 from "process";
 
 // src/cli.ts
 import process5 from "process";
@@ -219,7 +219,7 @@ import process4 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.4.0",
+  version: "0.4.1",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and syncing with upstream Cella.",
@@ -300,7 +300,7 @@ var package_default = {
     "sync",
     "template"
   ],
-  packageManager: "pnpm@11.8.0",
+  packageManager: "pnpm@11.28.7",
   commitlint: {
     extends: [
       "@commitlint/config-conventional"
@@ -536,16 +536,18 @@ function printFileSection(files, title, linkOptions, options) {
     }
   }
 }
+function filesWithStatus(files, status) {
+  return files.filter((f) => f.status === status && !isManagedFile(f.path));
+}
 function printFileGroup(files, status, linkOptions, options) {
-  const filtered = files.filter((f) => f.status === status && !isManagedFile(f.path));
   const config = statusConfig[status];
   const title = options?.title ?? `${config.icon} ${config.label}`;
-  printFileSection(filtered, title, linkOptions, { ...options, icon: config.icon });
+  printFileSection(filesWithStatus(files, status), title, linkOptions, { ...options, icon: config.icon });
 }
 function findProtectedBehind(files) {
   return files.filter((file) => file.upstreamChanged && !isManagedFile(file.path));
 }
-var PROTECTED_BEHIND_HINT = "pinned/ignored files where upstream also changed since the last sync; the fork side wins on conflict, so diff each against upstream and adopt what you need.";
+var PROTECTED_BEHIND_HINT = "pinned/ignored files where upstream also changed since the last sync; the fork side wins on conflict, so review what upstream changed and adopt what you need.";
 function protectionIcon(file) {
   return file.isIgnored ? statusConfig.ignored.icon : statusConfig.pinned.icon;
 }
@@ -553,22 +555,11 @@ function formatUpstreamChangedLines(file) {
   if (file.upstreamChangedLines === void 0) return "";
   return colors_default.yellow(` \xB7 ${plural(file.upstreamChangedLines, "line")} changed upstream`);
 }
-function protectedDiffHints(source, paths) {
-  const range = source?.upstreamDiffRange;
-  if (!range) return [];
-  const listed = new Set(paths);
-  const groups = (source?.protectedUpstreamChanges ?? []).filter((group) => group.paths.some((p) => listed.has(p)));
-  if (groups.length === 0) return [];
-  return [
-    "what upstream changed since the last sync, per pinned/ignored entry:",
-    ...groups.map((group) => `  git diff ${range} -- ${shellPath(group.entry)}`)
-  ];
-}
 function formatUpstreamLinesAbsent(file) {
   const n = file.upstreamLinesAbsent ?? 0;
   return n > 0 ? colors_default.yellow(` \xB7 ${plural(n, "upstream line")} absent`) : "";
 }
-function printAnalysisFileGroups(files, linkOptions, diffSource) {
+function printAnalysisFileGroups(files, linkOptions) {
   const protectedBehind = findProtectedBehind(files);
   printFileGroup(files, "behind", linkOptions, {
     title: colors_default.cyan("\u2193 behind on upstream")
@@ -585,13 +576,7 @@ function printAnalysisFileGroups(files, linkOptions, diffSource) {
     icon: protectionIcon,
     suffix: formatUpstreamChangedLines,
     dateSource: "upstream",
-    hint: [
-      PROTECTED_BEHIND_HINT,
-      ...protectedDiffHints(
-        diffSource,
-        protectedBehind.map((file) => file.path)
-      )
-    ]
+    hint: PROTECTED_BEHIND_HINT
   });
   printFileGroup(files, "drifted", linkOptions, {
     title: `${warningMark} ${colors_default.yellow("drifted from upstream")}`,
@@ -636,18 +621,15 @@ function printProtectedConflicts(result) {
     const icon = file ? protectionIcon(file) : statusConfig.pinned.icon;
     console.info(`  ${icon} ${path}${file ? formatUpstreamChangedLines(file) : ""}`);
   }
-  for (const line of [PROTECTED_BEHIND_HINT, ...protectedDiffHints(result, paths)]) console.info(colors_default.dim(`  ${line}`));
-}
-function plural(count2, singular, pluralForm = `${singular}s`) {
-  return `${count2} ${count2 === 1 ? singular : pluralForm}`;
+  console.info(colors_default.dim(`  ${PROTECTED_BEHIND_HINT}`));
 }
-function shellPath(path) {
-  return /^[\w./@+-]+$/.test(path) ? path : `'${path.replace(/'/g, `'\\''`)}'`;
+function plural(count3, singular, pluralForm = `${singular}s`) {
+  return `${count3} ${count3 === 1 ? singular : pluralForm}`;
 }
 function printIgnoredUpstreamChanges(result) {
   const groups = result.ignoredUpstreamChanges ?? [];
   if (groups.length === 0) return;
-  const total = groups.reduce((count2, group) => count2 + group.paths.length, 0);
+  const total = groups.reduce((count3, group) => count3 + group.paths.length, 0);
   console.info();
   console.info(
     `${warningMark} ${colors_default.yellow(`ignored paths changed upstream \xB7 ${plural(total, "file")} under ${plural(groups.length, "entry", "entries")}`)}`
@@ -657,11 +639,8 @@ function printIgnoredUpstreamChanges(result) {
     if (group.added > 0) counts.push(`${group.added} new`);
     if (group.deleted > 0) counts.push(`${group.deleted} deleted`);
     console.info(`  ${statusConfig.ignored.icon} ${group.entry} ${colors_default.dim(`\xB7 ${counts.join(", ")}`)}`);
-    if (result.upstreamDiffRange) {
-      console.info(colors_default.dim(`    git diff ${result.upstreamDiffRange} -- ${shellPath(group.entry)}`));
-    }
   }
-  console.info(colors_default.dim("  the fork left these untouched and ignored paths never sync: diff and adopt what you need."));
+  console.info(colors_default.dim("  the fork left these untouched and ignored paths never sync: review and adopt what you need."));
 }
 function printUpstreamOverrideChanges(result) {
   const report = result.upstreamOverrides;
@@ -1393,18 +1372,6 @@ function groupIgnoredUpstreamChanges(files, ignored) {
   for (const group of groups.values()) group.paths.sort();
   return entries.flatMap((entry) => groups.get(entry) ?? []);
 }
-function groupProtectedUpstreamChanges(paths, config) {
-  const [, findEntry] = entryMatcher([...config.overrides?.pinned ?? [], ...config.overrides?.ignored ?? []]);
-  const groups = /* @__PURE__ */ new Map();
-  for (const path of paths) {
-    const entry = findEntry(path) ?? path;
-    const group = groups.get(entry) ?? { entry, paths: [] };
-    group.paths.push(path);
-    groups.set(entry, group);
-  }
-  for (const group of groups.values()) group.paths.sort();
-  return [...groups.values()];
-}
 async function validateOverrides(config, forkPath, upstreamRef) {
   const warnings = [];
   const ignored = config.overrides?.ignored ?? [];
@@ -1524,7 +1491,7 @@ var serviceDefinitions = [
   },
   {
     name: "audit",
-    description: "update outdated packages, then rebuild the security overrides from a fresh audit",
+    description: "update outdated packages and runtime pins, then rebuild the security overrides from a fresh audit",
     options: [["--list", "report only: no prompts, and nothing is written"]]
   },
   {
@@ -1845,8 +1812,8 @@ async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, for
     packageJsonSync: forkConfig.settings.packageJsonSync ?? DEFAULT_PACKAGE_JSON_SYNC
   };
   const changes = diffOverrideLists(base, incoming, fork);
-  const count2 = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
-  return count2 > 0 ? { kind: "changes", ...changes } : void 0;
+  const count3 = Object.values(changes).reduce((n, list) => n + list.added.length + list.removed.length, 0);
+  return count3 > 0 ? { kind: "changes", ...changes } : void 0;
 }
 
 // src/services/analyze-core.ts
@@ -2281,7 +2248,7 @@ function resultMeta(config, ctx) {
     upstreamCommit: ctx.upstreamCommit
   };
 }
-async function upstreamOnlyReports(config, ctx, files, protectedConflicts) {
+async function upstreamOnlyReports(config, ctx, files) {
   const { forkPath } = config;
   try {
     const [baseSha, upstreamSha, upstreamOverrides] = await Promise.all([
@@ -2293,8 +2260,7 @@ async function upstreamOnlyReports(config, ctx, files, protectedConflicts) {
     return {
       upstreamDiffRange: `${baseSha}..${upstreamSha}`,
       upstreamOverrides,
-      ignoredUpstreamChanges: groupIgnoredUpstreamChanges(files, config.overrides?.ignored ?? []),
-      protectedUpstreamChanges: groupProtectedUpstreamChanges(protectedConflicts, config)
+      ignoredUpstreamChanges: groupIgnoredUpstreamChanges(files, config.overrides?.ignored ?? [])
     };
   } catch {
     return {};
@@ -2379,7 +2345,7 @@ async function runSyncMerge(config, ctx, onProgress, onStep) {
     autoMergedFiles,
     protectedConflicts,
     ...resultMeta(config, ctx),
-    ...await upstreamOnlyReports(config, ctx, analyzedFiles, protectedConflicts),
+    ...await upstreamOnlyReports(config, ctx, analyzedFiles),
     ...notesResult(notes)
   };
 }
@@ -2397,7 +2363,7 @@ async function runAnalyzePreview(config, ctx, onProgress, onStep) {
   );
   await enrichChangeInfo(forkPath, analyzedFiles, ctx.mergeBase, "HEAD", ctx.upstreamRef);
   const protectedConflicts = analyzedFiles.filter((f) => f.upstreamChanged).map((f) => f.path);
-  const reports = await upstreamOnlyReports(config, ctx, analyzedFiles, protectedConflicts);
+  const reports = await upstreamOnlyReports(config, ctx, analyzedFiles);
   onStep?.("analysis complete", `${analyzedFiles.length} files analyzed, dry run, no changes applied`);
   return {
     success: true,
@@ -2618,6 +2584,234 @@ async function runMigrate(config) {
   }
 }
 
+// src/services/review-page.ts
+import { basename as basename2 } from "path";
+import process7 from "process";
+import { pathToFileURL } from "url";
+
+// src/utils/diff.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdirSync, writeFileSync } from "fs";
+import { join as join9 } from "path";
+import process6 from "process";
+function gitDiffFile(cwd, range, filePath) {
+  try {
+    return execFileSync2("git", ["diff", "--no-color", range, "--", filePath], { cwd, maxBuffer: MAX_BUFFER });
+  } catch (error) {
+    const stderr = error.stderr?.toString().trim();
+    throw new Error(stderr || `failed to diff ${filePath}`);
+  }
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+async function renderDiffPage(sections, meta) {
+  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
+  const renderFile = async (file) => {
+    const { prerenderedHTML } = await preloadPatchDiff({
+      patch: file.patch,
+      options: {
+        diffStyle: "split",
+        themeType: "system",
+        lineDiffType: "word-alt",
+        hunkSeparators: "line-info",
+        overflow: "wrap"
+      }
+    });
+    return `<div class="diff-shell"><template shadowrootmode="open">
+${prerenderedHTML}
+</template></div>`;
+  };
+  const blocks = [];
+  for (const [index2, section] of sections.entries()) {
+    const files = [];
+    for (const file of section.files) files.push(await renderFile(file));
+    const count3 = section.files.length + (section.omitted?.length ?? 0);
+    const title = section.title ? `<h2>${escapeHtml(section.title)} <span class="count">\xB7 ${count3} ${count3 === 1 ? "file" : "files"}</span></h2>` : "";
+    const hint = section.hint ? `<p class="hint">${escapeHtml(section.hint)}</p>` : "";
+    const omitted = section.omitted?.length ? `<p class="hint">Not shown here (binary, too large, or past the page limit):</p><ul class="omitted">${section.omitted.map((path) => `<li><code>${escapeHtml(path)}</code></li>`).join("")}</ul>` : "";
+    blocks.push(`<section id="section-${index2 + 1}">${title}${hint}${files.join("\n")}${omitted}</section>`);
+  }
+  const titled = sections.filter((section) => section.title);
+  const index = titled.length > 1 ? `<nav><ol>${sections.map(
+    (section, i) => section.title ? `<li><a href="#section-${i + 1}">${escapeHtml(section.title)}</a> <span class="count">\xB7 ${section.files.length + (section.omitted?.length ?? 0)}</span></li>` : ""
+  ).join("")}</ol></nav>` : "";
+  const note = meta.note ? `<span class="note">${escapeHtml(meta.note)}</span>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(meta.title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
+    background: light-dark(#fafafa, #111);
+    color: light-dark(#111, #eee);
+  }
+  header {
+    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
+    padding: 0.9rem 1.25rem;
+    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    position: sticky; top: 0; z-index: 1;
+    background: inherit;
+  }
+  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
+  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
+  header .note { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
+  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
+  nav ol { margin: 0 0 1.5rem; padding-left: 1.25rem; line-height: 1.7; }
+  nav a { color: inherit; }
+  section { scroll-margin-top: 4rem; }
+  h2 { font-size: 1.05rem; margin: 2rem 0 0.25rem; }
+  .count { font-weight: normal; opacity: 0.6; }
+  .hint { margin: 0 0 1rem; font-size: 0.9rem; opacity: 0.75; max-width: 80ch; }
+  .diff-shell {
+    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
+    border-radius: 8px; overflow: hidden;
+    background: light-dark(#fff, #161616);
+    margin-bottom: 1rem;
+  }
+  .omitted { font-size: 0.85rem; opacity: 0.8; }
+  .omitted code { font-family: ui-monospace, monospace; }
+</style>
+</head>
+<body>
+<header>
+  <span class="brand">\u29C8 cella diff</span>
+  <code>${escapeHtml(meta.title)}</code>
+  ${note}
+</header>
+<main>
+${index}
+${blocks.join("\n")}
+</main>
+</body>
+</html>`;
+}
+async function writeDiffPage(sections, meta, repoPath, name) {
+  const html = await renderDiffPage(sections, meta);
+  const gitDir = execFileSync2("git", ["rev-parse", "--absolute-git-dir"], { cwd: repoPath, encoding: "utf8" }).trim();
+  const dir = join9(gitDir, "cella-diff");
+  mkdirSync(dir, { recursive: true });
+  const outPath = join9(dir, `${name.replace(/[^\w.-]+/g, "-")}.html`);
+  writeFileSync(outPath, html);
+  return outPath;
+}
+function openInBrowser(target) {
+  try {
+    execFileSync2(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/services/review-page.ts
+var MAX_PAGE_FILES = 50;
+var MAX_PATCH_BYTES = 512 * 1024;
+function reviewSections(result, command) {
+  const [base, upstream] = result.upstreamDiffRange?.split("..") ?? [];
+  if (!base || !upstream) return [];
+  const sinceSync = `${base}..${upstream}`;
+  const dropped = command === "sync" ? {
+    title: "protected files kept the fork version",
+    hint: "What upstream changed in these files since the last sync. The fork kept its own version, so none of it arrived: adopt what you need.",
+    range: sinceSync,
+    paths: result.protectedConflicts ?? []
+  } : {
+    title: "protected but behind upstream",
+    hint: "What upstream changed in these files since the last sync. They are pinned or ignored, so the sync keeps the fork version and none of it arrives: adopt what you need.",
+    range: sinceSync,
+    paths: findProtectedBehind(result.files).map((file) => file.path)
+  };
+  const sections = [
+    dropped,
+    {
+      title: "ignored paths changed upstream",
+      hint: "What upstream changed under ignored paths since the last sync. The fork left these files untouched, and ignored paths never sync.",
+      range: sinceSync,
+      paths: (result.ignoredUpstreamChanges ?? []).flatMap((group) => group.paths)
+    },
+    {
+      title: "pinned files that match the previous upstream",
+      hint: "What upstream changed in these files since the last sync. The fork copy still equals the previous upstream, so the pin only drops these changes: unpin to take them.",
+      range: sinceSync,
+      paths: findMaskingPins(result.files).map((file) => file.path)
+    }
+  ];
+  if (command === "analyze") {
+    sections.push(
+      {
+        title: "protected in fork, upstream lines absent",
+        hint: "The fork's version against upstream's, both as they are now: added lines are upstream content the fork does not have, dropped by an earlier sync or removed on purpose.",
+        range: `HEAD..${upstream}`,
+        paths: filesWithStatus(result.files, "ahead").filter((file) => (file.upstreamLinesAbsent ?? 0) > 0).map((file) => file.path)
+      },
+      {
+        title: "drifted from upstream",
+        hint: "What the fork changed in these files since the last sync. They are not pinned or ignored, so upstream changes still merge into them.",
+        range: `${base}..HEAD`,
+        paths: filesWithStatus(result.files, "drifted").map((file) => file.path)
+      }
+    );
+  }
+  return sections.filter((section) => section.paths.length > 0);
+}
+async function writeReviewPage(forkPath, sections, meta) {
+  const [base, upstream] = meta.range.split("..");
+  let diffs = 0;
+  const pageSections = [];
+  for (const section of sections) {
+    const pageSection = { title: section.title, hint: section.hint, files: [], omitted: [] };
+    for (const path of section.paths) {
+      if (diffs >= MAX_PAGE_FILES) {
+        pageSection.omitted?.push(path);
+        continue;
+      }
+      const patch = gitDiffFile(forkPath, section.range, path);
+      if (patch.length === 0) continue;
+      if (patch.length > MAX_PATCH_BYTES || !patch.includes("\n@@ ")) {
+        pageSection.omitted?.push(path);
+        continue;
+      }
+      pageSection.files.push({ path, patch: patch.toString() });
+      diffs++;
+    }
+    if (pageSection.files.length > 0 || pageSection.omitted?.length) pageSections.push(pageSection);
+  }
+  if (diffs === 0) return void 0;
+  const page = await writeDiffPage(
+    pageSections,
+    { title: `${meta.command} review`, note: `${basename2(forkPath)} \xB7 last sync ${base} \u2192 upstream ${upstream}` },
+    forkPath,
+    `${meta.command}-review`
+  );
+  return { path: page, diffs };
+}
+async function reportReviewPage(forkPath, result, command) {
+  const sections = reviewSections(result, command);
+  if (sections.length === 0 || !result.upstreamDiffRange) return;
+  createSpinner("writing review page...");
+  let page;
+  try {
+    page = await writeReviewPage(forkPath, sections, { command, range: result.upstreamDiffRange });
+  } catch {
+    page = void 0;
+  }
+  spinnerSuccess();
+  if (!page) return;
+  const opened = command === "sync" && process7.stdout.isTTY === true && openInBrowser(page.path);
+  console.info();
+  console.info(
+    `${colors_default.cyan("\u29C8")} review page with ${plural(page.diffs, "diff")}${opened ? ", opened in the browser" : ""}:`
+  );
+  console.info(colors_default.dim(`  ${hyperlink(page.path, pathToFileURL(page.path).href)}`));
+}
+
 // src/services/analyze.ts
 var scopeStatuses = {
   all: /* @__PURE__ */ new Set(["ahead", "drifted", "diverged"]),
@@ -2668,18 +2862,18 @@ async function runAnalyze(config) {
     fileLinkMode: config.settings.fileLinkMode,
     forkPath: config.forkPath
   };
-  printAnalysisFileGroups(result.files, linkOptions, result);
+  printAnalysisFileGroups(result.files, linkOptions);
   printEngineReports(result, "analysis summary");
+  await reportReviewPage(config.forkPath, result, "analyze");
   await printMigrationNotesLine(config, result);
   console.info();
   return result;
 }
 
 // src/services/audit.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync3 } from "fs";
-import { basename as basename2, join as join10, relative as relative3 } from "path";
-import { checkbox, confirm as confirm2, Separator } from "@inquirer/prompts";
+import { readFileSync as readFileSync4 } from "fs";
+import { basename as basename4, join as join12, relative as relative3 } from "path";
+import { checkbox, Separator } from "@inquirer/prompts";
 
 // src/utils/audit-utils.ts
 import { execFile as execFile2 } from "child_process";
@@ -2712,11 +2906,6 @@ function getReleasesUrl(repoUrl) {
   if (!isGitHubRepoUrl(repoUrl)) return null;
   return `${repoUrl}/releases`;
 }
-function isMajorVersionChange(current, latest) {
-  const from = parseComparableVersion(current);
-  const to = parseComparableVersion(latest);
-  return !!from && !!to && to.major > from.major;
-}
 async function runPnpm(args, cwd) {
   try {
     const { stdout, stderr } = await execFileAsync2("pnpm", args, {
@@ -2742,9 +2931,23 @@ async function runPnpmAudit(cwd) {
   if (!result || typeof result.advisories !== "object" || result.advisories === null) return null;
   return result;
 }
+async function readReleaseAgeMinutes(cwd) {
+  const minutes = Number.parseInt((await runPnpm(["config", "get", "minimumReleaseAge"], cwd)).stdout, 10);
+  return Number.isNaN(minutes) ? 0 : minutes;
+}
 async function fetchPublishTimes(name, cwd) {
   const times = await runPnpmJson(["view", name, "time", "--json"], cwd);
-  return times && typeof times === "object" ? times : null;
+  return times && typeof times === "object" && !("error" in times) ? times : null;
+}
+function editJsonText(content, change) {
+  const json = JSON.parse(content);
+  change(json);
+  const indent = content.match(/^[ \t]+(?=")/m)?.[0] ?? "  ";
+  return `${JSON.stringify(json, null, indent)}${content.endsWith("\n") ? "\n" : ""}`;
+}
+function rewriteSpecifier(spec, latest) {
+  const match = spec.match(/^([\^~]?)\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?$/);
+  return match ? `${match[1]}${latest}` : null;
 }
 var vulnIcons = {
   critical: colors_default.red("\u25CF"),
@@ -2770,6 +2973,259 @@ function formatDependents(dependents) {
   return `${dependents[0]} +${dependents.length - 1}`;
 }
 
+// src/utils/runtimes.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename as basename3, dirname as dirname5, join as join10 } from "path";
+var DAY = 24 * 60 * 60 * 1e3;
+var FROZEN_AFTER = 180 * DAY;
+var RECENT_PUSH = 30 * DAY;
+var EXACT_VERSION = /^\d+\.\d+\.\d+$/;
+var FROM_LINE = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?\s*$/i;
+var NODE_ARG_TAG = /^(?:docker\.io\/)?(?:library\/)?node:\$\{?\w+\}?([\w.-]*)$/;
+var MINOR_TAG = /^(\d+(?:\.\d+){1,2})(-[\w.-]+)?$/;
+var isDockerfile = (path) => /(^|\.)Dockerfile$|^Dockerfile\./i.test(basename3(path));
+function parseDockerfile(file, content) {
+  const images = [];
+  const nodeImageSuffixes = [];
+  const stages = /* @__PURE__ */ new Set();
+  content.split("\n").forEach((text, line) => {
+    const match = text.match(FROM_LINE);
+    if (!match) return;
+    const [, ref, stage] = match;
+    const fromStage = stages.has(ref.toLowerCase());
+    if (stage) stages.add(stage.toLowerCase());
+    if (fromStage || ref.includes("@")) return;
+    const nodeArg = ref.match(NODE_ARG_TAG);
+    if (nodeArg) {
+      nodeImageSuffixes.push(nodeArg[1]);
+      return;
+    }
+    if (ref.includes("$")) return;
+    const slash = ref.lastIndexOf("/");
+    const colon = ref.lastIndexOf(":");
+    if (colon <= slash) return;
+    let image = ref.slice(0, colon);
+    const tag = ref.slice(colon + 1);
+    const host = image.includes("/") ? image.split("/")[0] : "";
+    if (host === "docker.io") image = image.slice(host.length + 1).replace(/^library\//, "");
+    else if (host.includes(".") || host.includes(":") || host === "localhost") return;
+    if (image === "scratch") return;
+    images.push({ file, line, image, tag });
+  });
+  return { images, nodeImageSuffixes };
+}
+async function readRuntimePins(forkPath) {
+  let manifest = {};
+  try {
+    manifest = JSON.parse(readFileSync2(join10(forkPath, "package.json"), "utf8"));
+  } catch {
+  }
+  const node = manifest.engines?.node?.trim() ?? "";
+  const pnpm = manifest.packageManager?.match(/^pnpm@(\d+\.\d+\.\d+)(?:\+.*)?$/)?.[1] ?? null;
+  const tracked = (await git(["ls-files", "-z"], forkPath, { ignoreErrors: true })).split("\0").filter(isDockerfile);
+  const images = [];
+  const nodeImageSuffixes = /* @__PURE__ */ new Set();
+  for (const file of tracked) {
+    let content;
+    try {
+      content = readFileSync2(join10(forkPath, file), "utf8");
+    } catch {
+      continue;
+    }
+    const parsed = parseDockerfile(file, content);
+    images.push(...parsed.images);
+    for (const suffix of parsed.nodeImageSuffixes) nodeImageSuffixes.add(suffix);
+  }
+  return {
+    node: EXACT_VERSION.test(node) ? node : null,
+    pnpm,
+    images,
+    nodeImageSuffixes: [...nodeImageSuffixes]
+  };
+}
+async function fetchJson(url, init) {
+  try {
+    const response = await fetch(url, { ...init, signal: AbortSignal.timeout(1e4) });
+    return response.ok ? await response.json() : null;
+  } catch {
+    return null;
+  }
+}
+var hubRepository = (image) => image.includes("/") ? image : `library/${image}`;
+var hubTag = (entry) => {
+  const { name, last_updated } = entry ?? {};
+  const pushedAt = Date.parse(last_updated ?? "");
+  return name && !Number.isNaN(pushedAt) ? { name, pushedAt } : null;
+};
+async function fetchNodeReleases(major, now) {
+  const index = await fetchJson("https://nodejs.org/dist/index.json");
+  if (!Array.isArray(index)) return null;
+  const releases = index.map((entry) => entry).filter((entry) => entry.version && parseComparableVersion(entry.version)?.major === major).map((entry) => ({
+    version: String(entry.version).replace(/^v/, ""),
+    publishedAt: Date.parse(entry.date ?? ""),
+    security: entry.security === true
+  })).filter((release) => !Number.isNaN(release.publishedAt));
+  await Promise.all(
+    releases.filter((release) => now - release.publishedAt < 2 * DAY).map(async (release) => {
+      try {
+        const response = await fetch(`https://nodejs.org/dist/v${release.version}/SHASUMS256.txt`, {
+          method: "HEAD",
+          signal: AbortSignal.timeout(1e4)
+        });
+        const modified = Date.parse(response.headers.get("last-modified") ?? "");
+        release.publishedAt = Number.isNaN(modified) ? release.publishedAt + DAY : modified;
+      } catch {
+        release.publishedAt += DAY;
+      }
+    })
+  );
+  return releases;
+}
+async function fetchImageTags(pin) {
+  const shape = pin.tag.match(MINOR_TAG);
+  if (!shape) return null;
+  const base = `https://hub.docker.com/v2/repositories/${hubRepository(pin.image)}/tags`;
+  const filter = shape[2] ?? `${shape[1].split(".")[0]}.`;
+  const [list, pinned] = await Promise.all([
+    fetchJson(`${base}?page_size=100&ordering=last_updated&name=${encodeURIComponent(filter)}`),
+    fetchJson(`${base}/${encodeURIComponent(pin.tag)}`)
+  ]);
+  const results = list?.results;
+  if (!Array.isArray(results)) return null;
+  return { pinned: hubTag(pinned), tags: results.flatMap((entry) => hubTag(entry) ?? []) };
+}
+async function fetchRuntimeFeeds(pins, cwd, now) {
+  const nodeMajor = pins.node ? parseComparableVersion(pins.node)?.major : void 0;
+  const [node, published, advisories, images] = await Promise.all([
+    nodeMajor === void 0 ? null : fetchNodeReleases(nodeMajor, now),
+    pins.pnpm ? fetchPublishTimes("pnpm", cwd) : null,
+    pins.pnpm ? fetchJson("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ pnpm: [pins.pnpm] })
+    }) : null,
+    Promise.all(pins.images.map(fetchImageTags))
+  ]);
+  const pnpmAdvisories = advisories?.pnpm;
+  return {
+    node,
+    pnpm: published && advisories ? { published, advisories: pnpmAdvisories ?? [] } : null,
+    images
+  };
+}
+var count = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
+var monthYear = (time) => new Date(time).toLocaleString("en", { month: "short", year: "numeric", timeZone: "UTC" }).toLowerCase();
+function newestAged(pinned, versions, cutoff) {
+  const major = parseComparableVersion(pinned)?.major;
+  return versions.filter(
+    (entry) => !isPrerelease(entry.version) && parseComparableVersion(entry.version)?.major === major && compareVersionStrings(entry.version, pinned) > 0 && entry.publishedAt <= cutoff
+  ).sort((a, b) => compareVersionStrings(b.version, a.version))[0];
+}
+function planRuntimeUpdates(pins, feeds, options) {
+  const cutoff = options.now - options.releaseAgeMinutes * 60 * 1e3;
+  const updates = [];
+  const unchecked = [];
+  if (pins.node) {
+    if (!feeds.node) unchecked.push("node");
+    const target = feeds.node && newestAged(pins.node, feeds.node, cutoff);
+    if (target) {
+      const node = pins.node;
+      const security = (feeds.node ?? []).some(
+        (release) => release.security && compareVersionStrings(release.version, node) > 0 && compareVersionStrings(release.version, target.version) <= 0
+      );
+      updates.push({
+        name: "node",
+        current: node,
+        target: target.version,
+        file: "package.json",
+        severity: security ? "high" : null,
+        note: security ? "security release" : "",
+        releasesUrl: `https://nodejs.org/en/blog/release/v${target.version}`,
+        pin: { kind: "node" }
+      });
+    }
+  }
+  if (pins.pnpm) {
+    if (!feeds.pnpm) unchecked.push("pnpm");
+    const published = Object.entries(feeds.pnpm?.published ?? {}).map(([version, time]) => ({
+      version,
+      publishedAt: Date.parse(time)
+    }));
+    const target = feeds.pnpm && newestAged(pins.pnpm, published, cutoff);
+    if (target) {
+      const pnpm = pins.pnpm;
+      const fixed = (feeds.pnpm?.advisories ?? []).filter(
+        (advisory) => satisfiesComparators(pnpm, advisory.vulnerable_versions) && !satisfiesComparators(target.version, advisory.vulnerable_versions)
+      ).length;
+      updates.push({
+        name: "pnpm",
+        current: pnpm,
+        target: target.version,
+        file: "package.json",
+        severity: fixed > 0 ? "high" : null,
+        note: fixed > 0 ? count(fixed, "advisory", "advisories") : "",
+        releasesUrl: `https://github.com/pnpm/pnpm/releases/tag/v${target.version}`,
+        pin: { kind: "pnpm" }
+      });
+    }
+  }
+  pins.images.forEach((pin, i) => {
+    const shape = pin.tag.match(MINOR_TAG);
+    if (!shape) return;
+    const feed = feeds.images[i];
+    if (!feed) {
+      unchecked.push(pin.image);
+      return;
+    }
+    const [, version, suffix = ""] = shape;
+    const parts = version.split(".").length;
+    const major = version.split(".")[0];
+    const target = feed.tags.map((tag) => ({ tag, match: tag.name.match(MINOR_TAG) })).filter(
+      ({ match }) => match && (match[2] ?? "") === suffix && match[1].split(".").length === parts && match[1].split(".")[0] === major && compareVersionStrings(match[1], version) > 0
+    ).sort((a, b) => compareVersionStrings(b.match?.[1] ?? "", a.match?.[1] ?? ""))[0];
+    if (!target?.match) return;
+    const frozen = !!feed.pinned && options.now - feed.pinned.pushedAt > FROZEN_AFTER && options.now - target.tag.pushedAt < RECENT_PUSH;
+    const repository = hubRepository(pin.image);
+    updates.push({
+      name: pin.image,
+      current: version,
+      target: target.match[1],
+      file: pin.file,
+      severity: frozen ? "moderate" : null,
+      note: frozen && feed.pinned ? `tag frozen since ${monthYear(feed.pinned.pushedAt)}` : "",
+      releasesUrl: repository.startsWith("library/") ? `https://hub.docker.com/_/${pin.image}/tags` : `https://hub.docker.com/r/${repository}/tags`,
+      pin: { kind: "image", line: pin.line, ref: `${pin.image}:${pin.tag}`, to: `${pin.image}:${target.tag.name}` }
+    });
+  });
+  return { updates, unchecked };
+}
+function applyRuntimeUpdate(content, update) {
+  const { pin } = update;
+  if (pin.kind === "image") {
+    const lines = content.split("\n");
+    lines[pin.line] = lines[pin.line].replace(pin.ref, pin.to);
+    return lines.join("\n");
+  }
+  return editJsonText(content, (json) => {
+    if (pin.kind === "node") json.engines.node = update.target;
+    else json.packageManager = `pnpm@${update.target}`;
+  });
+}
+async function missingNodeImages(version, suffixes) {
+  const missing = await Promise.all(
+    suffixes.map(async (suffix) => {
+      const tag = `${version}${suffix}`;
+      const found = await fetchJson(`https://hub.docker.com/v2/repositories/library/node/tags/${tag}`);
+      return found ? [] : [`node:${tag}`];
+    })
+  );
+  return missing.flat();
+}
+function pinLocation(file) {
+  const dir = dirname5(file);
+  return dir === "." ? file : dir;
+}
+
 // src/utils/security-plan.ts
 var SEVERITIES = ["critical", "high", "moderate", "low", "info"];
 function isAuditOverride(key) {
@@ -2965,37 +3421,37 @@ function writeAuditSettings(content, next) {
 
 // src/services/audit-security.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync7, mkdirSync, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { cpSync, existsSync as existsSync7, mkdirSync as mkdirSync2, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname5, join as join9, relative as relative2 } from "path";
+import { dirname as dirname6, join as join11, relative as relative2 } from "path";
 import { confirm, select as select2 } from "@inquirer/prompts";
 var WORKSPACE_FILE = "pnpm-workspace.yaml";
 var LOCK_FILE = "pnpm-lock.yaml";
 var RESOLUTION_FILES = ["package.json", LOCK_FILE, ".npmrc", ".pnpmfile.cjs"];
-var readOr = (path, fallback = "") => existsSync7(path) ? readFileSync2(path, "utf8") : fallback;
-var count = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
+var readOr = (path, fallback = "") => existsSync7(path) ? readFileSync3(path, "utf8") : fallback;
+var count2 = (n, noun, plural2 = `${noun}s`) => `${n} ${n === 1 ? noun : plural2}`;
 var isBreaking = (item) => item.remedy.kind !== "none" && item.remedy.breaking;
 var needsDecision = (item) => item.standing === "new" && (item.remedy.kind !== "override" || item.remedy.breaking || item.direct);
 var sameEntries = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([key, value]) => b[key] === value);
 async function createStaging(forkPath, workspaceYaml) {
-  const staging = mkdtempSync(join9(tmpdir(), "cella-audit-"));
+  const staging = mkdtempSync(join11(tmpdir(), "cella-audit-"));
   const projects = await runPnpmJson(["ls", "-r", "--depth", "-1", "--json"], forkPath) ?? [];
   const files = [
     ...RESOLUTION_FILES,
     ...readPatchFiles(workspaceYaml),
-    ...projects.map((project) => join9(relative2(forkPath, project.path), "package.json"))
+    ...projects.map((project) => join11(relative2(forkPath, project.path), "package.json"))
   ];
   for (const file of new Set(files)) {
-    if (file.startsWith("..") || !existsSync7(join9(forkPath, file))) continue;
-    mkdirSync(dirname5(join9(staging, file)), { recursive: true });
-    cpSync(join9(forkPath, file), join9(staging, file));
+    if (file.startsWith("..") || !existsSync7(join11(forkPath, file))) continue;
+    mkdirSync2(dirname6(join11(staging, file)), { recursive: true });
+    cpSync(join11(forkPath, file), join11(staging, file));
   }
   return staging;
 }
 async function resolveStaging(staging, workspaceYaml, settings) {
-  writeFileSync(join9(staging, WORKSPACE_FILE), writeAuditSettings(workspaceYaml, settings));
+  writeFileSync2(join11(staging, WORKSPACE_FILE), writeAuditSettings(workspaceYaml, settings));
   const result = await runPnpm(["install", "--lockfile-only", "--no-frozen-lockfile", "--ignore-scripts"], staging);
-  return result.ok ? { lock: readOr(join9(staging, LOCK_FILE)) } : { error: `${result.stdout}${result.stderr}`.trim() };
+  return result.ok ? { lock: readOr(join11(staging, LOCK_FILE)) } : { error: `${result.stdout}${result.stderr}`.trim() };
 }
 function lockedVersions(lock, name) {
   const escaped = name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
@@ -3096,9 +3552,11 @@ function changeLine(label, before, after) {
   const counts = moved ? `${before.length} \u2192 ${after.length}` : String(after.length);
   return `  ${label.padEnd(9)}  ${counts.padEnd(7)}  ${colors_default.dim(moved || "unchanged")}`;
 }
+var NO_EDITS = { manifests: {}, files: {} };
 async function runSecurityPass(forkPath, options) {
-  const workspaceYaml = readOr(join9(forkPath, WORKSPACE_FILE));
-  const workspaceLock = readOr(join9(forkPath, LOCK_FILE));
+  const { releaseAgeMinutes, edits = NO_EDITS } = options;
+  const workspaceYaml = readOr(join11(forkPath, WORKSPACE_FILE));
+  const workspaceLock = readOr(join11(forkPath, LOCK_FILE));
   let previous;
   try {
     previous = readAuditSettings(workspaceYaml);
@@ -3106,12 +3564,13 @@ async function runSecurityPass(forkPath, options) {
     console.error(
       `${colors_default.red("\u2717")} ${WORKSPACE_FILE} could not be read: ${error instanceof Error ? error.message : error}`
     );
-    return;
+    return false;
   }
   const auditKeys = Object.keys(previous.overrides).filter(isAuditOverride);
   const lasting = Object.fromEntries(Object.entries(previous.overrides).filter(([key]) => !isAuditOverride(key)));
+  const updatesManifests = Object.keys(edits.manifests).length > 0;
   const spinner = createSpinner(
-    auditKeys.length > 0 ? `resolving without the ${count(auditKeys.length, "audit override")}...` : "resolving the workspace..."
+    auditKeys.length > 0 ? `resolving without the ${count2(auditKeys.length, "audit override")}...` : "resolving the workspace..."
   );
   const fail = (message, detail = "") => {
     spinner.stop();
@@ -3119,16 +3578,21 @@ async function runSecurityPass(forkPath, options) {
     if (detail) console.error(colors_default.dim(detail.split("\n").slice(-12).join("\n")));
     console.info(colors_default.dim("  the workspace is unchanged"));
     console.info();
+    return false;
   };
   const staging = await createStaging(forkPath, workspaceYaml);
   try {
+    for (const [file, content] of Object.entries(edits.manifests)) writeFileSync2(join11(staging, file), content);
     const bare = await resolveStaging(staging, workspaceYaml, { ...previous, overrides: lasting, ignoredGhsas: [] });
-    if ("error" in bare) return fail("could not resolve the workspace without its audit overrides", bare.error);
+    if ("error" in bare) {
+      const without = updatesManifests ? "with the selected updates" : "without its audit overrides";
+      return fail(`could not resolve the workspace ${without}`, bare.error);
+    }
     spinnerText("checking for vulnerabilities...");
     const audit = await runPnpmAudit(staging);
     if (!audit) return fail("pnpm audit gave no answer, so nothing can be decided");
     const advisories = advisoriesFromAudit(audit);
-    spinnerText(`checking ${count(advisories.length, "advisory", "advisories")} against the registry...`);
+    spinnerText(`checking ${count2(advisories.length, "advisory", "advisories")} against the registry...`);
     const versionedExcludes = previous.releaseAgeExcludes.flatMap((entry) => parseVersionedExclude(entry)?.name ?? []);
     const names = [.../* @__PURE__ */ new Set([...advisories.map((advisory) => advisory.module), ...versionedExcludes])];
     const times = await Promise.all(names.map((name) => fetchPublishTimes(name, forkPath)));
@@ -3137,8 +3601,6 @@ async function runSecurityPass(forkPath, options) {
     );
     const unanswered = advisories.map((advisory) => advisory.module).filter((name) => !published[name]);
     if (unanswered.length > 0) return fail(`the registry did not answer for ${[...new Set(unanswered)].join(", ")}`);
-    const releaseAge = Number.parseInt((await runPnpm(["config", "get", "minimumReleaseAge"], forkPath)).stdout, 10);
-    const releaseAgeMinutes = Number.isNaN(releaseAge) ? 0 : releaseAge;
     const releaseAgeHours = Math.round(releaseAgeMinutes / 60);
     const planInput = { advisories, published, previous, releaseAgeMinutes, now: Date.now() };
     const items = planSecurity(planInput);
@@ -3156,60 +3618,72 @@ async function runSecurityPass(forkPath, options) {
     if (!options.apply) {
       if (changes) console.info(colors_default.dim("run without --list to apply"));
       console.info();
-      return;
+      return false;
     }
     let decisions;
     try {
       decisions = await decide(items, releaseAgeHours);
     } catch {
       console.info(colors_default.dim("  cancelled, the workspace is unchanged"));
-      return;
+      return false;
     }
     const open = decisions.filter((decision) => decision.action === "open").map((decision) => decision.item.module);
     const kept = Object.assign({}, lasting, ...open.map((module) => standingOverrides(module, planInput)));
     const next = settingsFor(decisions, kept, excludes);
     const nextYaml = writeAuditSettings(workspaceYaml, next);
-    if (nextYaml === workspaceYaml) {
-      const state = `${count(auditKeys.length, "override")} \xB7 ${next.ignoredGhsas.length} ignored`;
+    const settingsChanged = nextYaml !== workspaceYaml;
+    const otherFiles = Object.keys(edits.files);
+    const writeFiles = () => {
+      for (const [file, content] of Object.entries(edits.files)) writeFileSync2(join11(forkPath, file), content);
+      if (otherFiles.length > 0) console.info(`${checkMark} ${otherFiles.join(", ")} updated`);
+    };
+    if (!settingsChanged && !updatesManifests) {
+      writeFiles();
+      const state = `${count2(auditKeys.length, "override")} \xB7 ${next.ignoredGhsas.length} ignored`;
       console.info(`${checkMark} security settings are current ${colors_default.dim(`\xB7 ${state}`)}`);
       printOpen(open);
-      return;
+      return true;
     }
     const summarize = () => {
+      if (!settingsChanged) return;
       console.info(colors_default.bold(WORKSPACE_FILE));
       console.info(changeLine("overrides", auditKeys, Object.keys(next.overrides).filter(isAuditOverride)));
       console.info(changeLine("excludes", previous.releaseAgeExcludes, next.releaseAgeExcludes));
       console.info(changeLine("ignored", previous.ignoredGhsas, next.ignoredGhsas));
       console.info();
     };
-    if (sameEntries(next.overrides, previous.overrides)) {
-      writeFileSync(join9(forkPath, WORKSPACE_FILE), nextYaml);
+    if (!updatesManifests && sameEntries(next.overrides, previous.overrides)) {
+      writeFiles();
+      writeFileSync2(join11(forkPath, WORKSPACE_FILE), nextYaml);
       console.info(`${checkMark} ${WORKSPACE_FILE} updated ${colors_default.dim("\xB7 nothing to install")}`);
       printOpen(open);
       summarize();
-      return;
+      return true;
     }
     const stagingSpinner = createSpinner("resolving with the new settings...");
     const staged = await resolveStaging(staging, workspaceYaml, next);
     stagingSpinner.stop();
     if ("error" in staged) return fail("could not resolve the workspace with the new settings", staged.error);
-    writeFileSync(join9(forkPath, WORKSPACE_FILE), nextYaml);
-    writeFileSync(join9(forkPath, LOCK_FILE), staged.lock);
+    const written = { ...edits.files, ...edits.manifests, [WORKSPACE_FILE]: nextYaml, [LOCK_FILE]: staged.lock };
+    const before = Object.fromEntries(Object.keys(written).map((file) => [file, readOr(join11(forkPath, file))]));
+    before[WORKSPACE_FILE] = workspaceYaml;
+    before[LOCK_FILE] = workspaceLock;
+    for (const [file, content] of Object.entries(written)) writeFileSync2(join11(forkPath, file), content);
     const install = spawnSync2("pnpm", ["install"], { cwd: forkPath, stdio: "inherit" });
     console.info();
     if (install.status !== 0) {
-      writeFileSync(join9(forkPath, WORKSPACE_FILE), workspaceYaml);
-      writeFileSync(join9(forkPath, LOCK_FILE), workspaceLock);
+      for (const [file, content] of Object.entries(before)) writeFileSync2(join11(forkPath, file), content);
       console.error(`${colors_default.red("\u2717")} pnpm install failed (exit code ${install.status})`);
-      console.info(colors_default.dim(`  ${WORKSPACE_FILE} and ${LOCK_FILE} are back as they were; run pnpm install to match`));
+      console.info(colors_default.dim(`  ${Object.keys(before).join(", ")} are back as they were; run pnpm install to match`));
       console.info();
-      return;
+      return false;
     }
     const verified = await runPnpmAudit(forkPath);
     const reported = verified ? [...new Set(advisoriesFromAudit(verified).map((advisory) => advisory.module))] : open;
     console.info(`${checkMark} installed${reported.length === 0 ? ` ${colors_default.dim("\xB7")} audit clean` : ""}`);
     printOpen(reported);
     summarize();
+    return true;
   } finally {
     spinner.stop();
     rmSync(staging, { recursive: true, force: true });
@@ -3217,7 +3691,7 @@ async function runSecurityPass(forkPath, options) {
 }
 function printOpen(modules) {
   if (modules.length > 0) {
-    console.info(`${warningMark} ${count(modules.length, "package")} still reported: ${modules.join(", ")}`);
+    console.info(`${warningMark} ${count2(modules.length, "package")} still reported: ${modules.join(", ")}`);
   }
   console.info();
 }
@@ -3250,7 +3724,7 @@ function printPlan(plan) {
   printDropped("ignore dropped", droppedIgnores);
   const lastingCount = Object.keys(plan.lasting).length;
   if (lastingCount > 0) {
-    console.info(colors_default.dim(`${count(lastingCount, "override")} without a version selector left as written`));
+    console.info(colors_default.dim(`${count2(lastingCount, "override")} without a version selector left as written`));
   }
   if (items.some(isBreaking)) {
     console.info(colors_default.dim("\u26A0 a breaking jump: another major, or another minor below 1.0"));
@@ -3260,13 +3734,14 @@ function printPlan(plan) {
 }
 
 // src/services/audit.ts
+var DEPENDENCY_SECTIONS = ["dependencies", "devDependencies", "optionalDependencies"];
 function createDependentPkgReader() {
   const cache = /* @__PURE__ */ new Map();
   return (location) => {
     let cached = cache.get(location);
     if (cached === void 0) {
       try {
-        cached = JSON.parse(readFileSync3(join10(location, "package.json"), "utf8"));
+        cached = JSON.parse(readFileSync4(join12(location, "package.json"), "utf8"));
       } catch {
         cached = null;
       }
@@ -3277,85 +3752,105 @@ function createDependentPkgReader() {
 }
 async function runAudit(config) {
   const { forkPath } = config;
-  const spinner = createSpinner("checking for outdated packages...");
+  const spinner = createSpinner("checking packages and runtimes...");
   try {
-    const [outdated, auditResult] = await Promise.all([
+    const pins = await readRuntimePins(forkPath);
+    const now = Date.now();
+    const [outdated, auditResult, releaseAgeMinutes, feeds] = await Promise.all([
       runPnpmJson(["-r", "outdated", "--json", "--long"], forkPath),
-      runPnpmAudit(forkPath)
+      runPnpmAudit(forkPath),
+      readReleaseAgeMinutes(forkPath),
+      fetchRuntimeFeeds(pins, forkPath, now)
     ]);
     if (!outdated) {
       spinnerFail("pnpm outdated gave no answer: run pnpm -r outdated to see why");
       console.info(`${warningMark} security pass skipped: it runs after the update check`);
       return;
     }
-    const outdatedPackages = outdated;
-    const packageNames = Object.keys(outdatedPackages);
-    if (packageNames.length === 0) {
-      spinnerSuccess("all packages are up to date");
+    const runtimes = planRuntimeUpdates(pins, feeds, { releaseAgeMinutes, now });
+    const rows = [
+      ...packageRows(outdated, auditResult ? advisoriesFromAudit(auditResult) : []),
+      ...runtimes.updates.map(runtimeRow)
+    ];
+    if (rows.length === 0) {
+      spinnerSuccess("all packages and runtimes are up to date");
+      printNotes(forkPath, runtimes.unchecked);
       console.info();
-      await runSecurityPass(forkPath, { apply: !config.list });
+      await runSecurityPass(forkPath, { apply: !config.list, releaseAgeMinutes });
       return;
     }
-    const advisories = auditResult ? advisoriesFromAudit(auditResult) : [];
-    const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
-    const readDependentPkg = createDependentPkgReader();
-    const enhancedPackages = packageNames.map((name) => {
-      const pkg = outdatedPackages[name];
-      const repoUrl = getRepoUrl(pkg.latestManifest?.repository?.url);
-      const pinnedIn = [];
-      for (const d of pkg.dependentPackages) {
-        const spec = readDependentPkg(d.location)?.[pkg.dependencyType]?.[name] || "";
-        if (spec && !spec.startsWith("^") && !spec.startsWith("~") && !spec.startsWith(">")) {
-          pinnedIn.push(d.name);
-        }
-      }
-      return {
-        name,
-        current: pkg.current,
-        latest: pkg.latest,
-        dependentPackages: pkg.dependentPackages,
-        isDev: pkg.dependencyType === "devDependencies",
-        isMajorUpdate: isMajorVersionChange(pkg.current, pkg.latest),
-        pinnedIn,
-        repoUrl,
-        releasesUrl: getReleasesUrl(repoUrl),
-        severity: severityOf(name)
-      };
-    });
-    enhancedPackages.sort((a, b) => {
-      const depCompare = dependentsText(a).localeCompare(dependentsText(b));
-      if (depCompare !== 0) return depCompare;
-      return a.name.localeCompare(b.name);
-    });
     spinner.stop();
-    printOutdatedResults(enhancedPackages, forkPath);
+    printOutdatedResults(rows, forkPath);
+    printNotes(forkPath, runtimes.unchecked);
     console.info();
-    const outcome = config.list ? "skipped" : await promptForUpdates(enhancedPackages, forkPath);
-    if (outcome === "cancelled") return;
-    if (outcome === "failed") {
-      console.info(`${warningMark} security pass skipped: it needs a workspace that installs`);
+    if (config.list) {
+      await runSecurityPass(forkPath, { apply: false, releaseAgeMinutes });
       return;
     }
-    await runSecurityPass(forkPath, { apply: !config.list });
+    const selected = await promptForUpdates(rows);
+    if (!selected) return;
+    const { edits, bumped } = await planEdits(forkPath, rows, selected, pins.nodeImageSuffixes);
+    if (await runSecurityPass(forkPath, { apply: true, releaseAgeMinutes, edits })) printNext(bumped);
   } finally {
     spinner.stop();
   }
 }
-var dependentsText = (pkg) => formatDependents(pkg.dependentPackages.map((d) => d.name));
-function printOutdatedResults(enhancedPackages, forkPath) {
+function packageRows(outdated, advisories) {
+  const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
+  const readDependentPkg = createDependentPkgReader();
+  const rows = Object.entries(outdated).map(([name, pkg]) => {
+    const repoUrl = getRepoUrl(pkg.latestManifest?.repository?.url);
+    const current = pkg.current ?? "missing";
+    const pinnedIn = [];
+    for (const d of pkg.dependentPackages) {
+      const spec = readDependentPkg(d.location)?.[pkg.dependencyType]?.[name] || "";
+      if (spec && !spec.startsWith("^") && !spec.startsWith("~") && !spec.startsWith(">")) {
+        pinnedIn.push(d.name);
+      }
+    }
+    return {
+      name,
+      current,
+      latest: pkg.latest,
+      dependentPackages: pkg.dependentPackages,
+      isDev: pkg.dependencyType === "devDependencies",
+      breaking: isBreakingJump(current, pkg.latest),
+      pinnedIn,
+      repoUrl,
+      releasesUrl: getReleasesUrl(repoUrl),
+      severity: severityOf(name)
+    };
+  });
+  return rows.sort((a, b) => inText(a).localeCompare(inText(b)) || a.name.localeCompare(b.name));
+}
+function runtimeRow(update) {
+  return {
+    name: update.name,
+    current: update.current,
+    latest: update.target,
+    dependentPackages: [],
+    isDev: false,
+    breaking: isBreakingJump(update.current, update.target),
+    pinnedIn: [],
+    repoUrl: null,
+    releasesUrl: update.releasesUrl,
+    severity: update.severity,
+    runtime: update
+  };
+}
+var rowKey = (row) => row.runtime ? `runtime:${row.runtime.file}:${row.name}` : row.name;
+var isRed = (row) => row.severity === "critical" || row.severity === "high";
+var inText = (row) => row.runtime ? pinLocation(row.runtime.file) : formatDependents(row.dependentPackages.map((d) => d.name));
+function printOutdatedResults(rows, forkPath) {
   const DEV_TAG = " (dev)";
+  const RUNTIME_TAG = " (runtime)";
   const MAX_NAME_LEN = 35;
   const MAX_DEPENDENTS_LEN = 15;
-  const maxNameLen = Math.min(
-    MAX_NAME_LEN,
-    Math.max(7, ...enhancedPackages.map((p) => p.name.length + (p.isDev ? DEV_TAG.length : 0)))
-  );
-  const maxCurrentLen = Math.max(7, ...enhancedPackages.map((p) => p.current.length));
-  const maxLatestLen = Math.max(6, ...enhancedPackages.map((p) => p.latest.length));
-  const maxDependentsLen = Math.min(
-    MAX_DEPENDENTS_LEN,
-    Math.max(10, ...enhancedPackages.map((p) => dependentsText(p).length))
-  );
+  const tag = (row) => row.runtime ? RUNTIME_TAG : row.isDev ? DEV_TAG : "";
+  const maxNameLen = Math.min(MAX_NAME_LEN, Math.max(7, ...rows.map((p) => p.name.length + tag(p).length)));
+  const maxCurrentLen = Math.max(7, ...rows.map((p) => p.current.length));
+  const maxLatestLen = Math.max(6, ...rows.map((p) => p.latest.length));
+  const maxDependentsLen = Math.min(MAX_DEPENDENTS_LEN, Math.max(10, ...rows.map((p) => inText(p).length)));
   const header = [
     " ",
     colors_default.bold("package".padEnd(maxNameLen)),
@@ -3365,15 +3860,14 @@ function printOutdatedResults(enhancedPackages, forkPath) {
     colors_default.bold("links")
   ].join(" ");
   console.info(header);
-  for (const pkg of enhancedPackages) {
+  for (const pkg of rows) {
     const vulnIndicator = pkg.severity ? getVulnIcon(pkg.severity) : " ";
-    const fullName = pkg.isDev ? `${pkg.name}${DEV_TAG}` : pkg.name;
-    const displayName = middleTruncate(fullName, maxNameLen);
+    const displayName = middleTruncate(`${pkg.name}${tag(pkg)}`, maxNameLen);
     const name = colors_default.white(displayName.padEnd(maxNameLen));
     const current = colors_default.red(pkg.current.padEnd(maxCurrentLen));
     const latestText = pkg.latest.padEnd(maxLatestLen);
-    const latest = pkg.isMajorUpdate ? colors_default.bold(colors_default.green(latestText)) : colors_default.green(latestText);
-    const dependents = colors_default.dim(middleTruncate(dependentsText(pkg), maxDependentsLen).padEnd(maxDependentsLen));
+    const latest = pkg.breaking ? colors_default.bold(colors_default.green(latestText)) : colors_default.green(latestText);
+    const dependents = colors_default.dim(middleTruncate(inText(pkg), maxDependentsLen).padEnd(maxDependentsLen));
     const links = [];
     if (pkg.releasesUrl) {
       links.push(hyperlink(colors_default.blue("rel"), pkg.releasesUrl));
@@ -3386,9 +3880,9 @@ function printOutdatedResults(enhancedPackages, forkPath) {
   }
   console.info();
   const dependentMap = /* @__PURE__ */ new Map();
-  for (const pkg of enhancedPackages) {
+  for (const pkg of rows) {
     for (const { name, location } of pkg.dependentPackages) {
-      const dependentName = name || basename2(location);
+      const dependentName = name || basename4(location);
       const existing = dependentMap.get(dependentName);
       if (existing) {
         existing.count++;
@@ -3399,55 +3893,66 @@ function printOutdatedResults(enhancedPackages, forkPath) {
   }
   const sortedDependents = [...dependentMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
   const maxDependentNameLen = Math.max(0, ...sortedDependents.map(([name]) => name.length));
-  for (const [dependentName, { location, count: count2 }] of sortedDependents) {
-    const packageJsonPath2 = join10(location, "package.json");
+  for (const [dependentName, { location, count: count3 }] of sortedDependents) {
+    const packageJsonPath2 = join12(location, "package.json");
     const relativePath = relative3(forkPath, packageJsonPath2);
     const paddedName = dependentName.padEnd(maxDependentNameLen);
     console.info(
-      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath2}`)} ${colors_default.dim(`${count2}`)}`
+      `  ${colors_default.dim("\u2022")} ${paddedName}  ${hyperlink(relativePath, `file://${packageJsonPath2}`)} ${colors_default.dim(`${count3}`)}`
     );
   }
 }
-function buildUpdateChoices(packages) {
-  const makeChoice = (pkg) => {
-    const devTag = pkg.isDev ? colors_default.dim(" (dev)") : "";
-    const version = `${colors_default.red(pkg.current)} \u2192 ${colors_default.green(pkg.latest)}`;
-    const pinnedWarning = pkg.pinnedIn.length > 0 ? `  ${warningMark} ${colors_default.dim(`pinned in ${pkg.pinnedIn.join(", ")}`)}` : "";
+function printNotes(forkPath, unchecked) {
+  let held = [];
+  try {
+    const updateConfig = readTopLevel(readFileSync4(join12(forkPath, "pnpm-workspace.yaml"), "utf8"), "updateConfig");
+    const ignored = updateConfig?.ignoreDependencies;
+    held = Array.isArray(ignored) ? ignored.map(String) : [];
+  } catch {
+  }
+  if (held.length > 0) console.info(`  ${colors_default.dim(`held: ${held.join(", ")} \xB7 pnpm-workspace.yaml updateConfig`)}`);
+  if (unchecked.length > 0)
+    console.info(`  ${colors_default.dim(`not checked, no answer from the feed: ${unchecked.join(", ")}`)}`);
+}
+function buildUpdateChoices(rows) {
+  const makeChoice = (row) => {
+    const devTag = row.isDev ? colors_default.dim(" (dev)") : "";
+    const version = `${colors_default.red(row.current)} \u2192 ${colors_default.green(row.latest)}`;
+    const notes = [
+      row.breaking ? colors_default.bold("breaking") : "",
+      row.runtime?.note ? colors_default.dim(row.runtime.note) : "",
+      row.pinnedIn.length > 0 ? `${warningMark} ${colors_default.dim(`pinned in ${row.pinnedIn.join(", ")}`)}` : ""
+    ].filter(Boolean);
     return {
-      name: `${pkg.name}${devTag}  ${version}${pinnedWarning}`,
-      value: pkg.name,
-      checked: false
+      name: `${row.name}${devTag}  ${version}${notes.length > 0 ? `  ${notes.join("  ")}` : ""}`,
+      value: rowKey(row),
+      checked: isRed(row)
     };
   };
-  const pinned = packages.filter((p) => p.pinnedIn.length > 0);
-  const regular = packages.filter((p) => p.pinnedIn.length === 0);
+  const runtimes = rows.filter((p) => p.runtime);
+  const pinned = rows.filter((p) => !p.runtime && p.pinnedIn.length > 0);
+  const regular = rows.filter((p) => !p.runtime && p.pinnedIn.length === 0);
   const choices = [];
+  if (runtimes.length > 0) {
+    choices.push(new Separator(colors_default.yellow(`\u2500\u2500 runtimes (${runtimes.length}) \u2500\u2500`)));
+    choices.push(...runtimes.map(makeChoice));
+  }
   if (pinned.length > 0) {
     choices.push(new Separator(colors_default.yellow(`\u2500\u2500 pinned (${pinned.length}) \u2500\u2500`)));
     choices.push(...pinned.map(makeChoice));
   }
   if (regular.length > 0) {
-    if (pinned.length > 0) choices.push(new Separator(colors_default.dim(`\u2500\u2500 packages (${regular.length}) \u2500\u2500`)));
+    if (choices.length > 0) choices.push(new Separator(colors_default.dim(`\u2500\u2500 packages (${regular.length}) \u2500\u2500`)));
     choices.push(...regular.map(makeChoice));
   }
   return choices;
 }
-async function promptForUpdates(packages, forkPath) {
-  let wantsUpdate;
+async function promptForUpdates(rows) {
   try {
-    wantsUpdate = await confirm2({ message: "update packages?", default: true });
-  } catch {
-    return "cancelled";
-  }
-  console.info();
-  if (!wantsUpdate) return "skipped";
-  const choices = buildUpdateChoices(packages);
-  let selected;
-  try {
-    selected = await checkbox({
-      message: "toggle packages to update",
-      choices,
-      required: true,
+    const selected = await checkbox({
+      message: `toggle what to update ${colors_default.dim("\xB7 enter with nothing ticked skips")}`,
+      choices: buildUpdateChoices(rows),
+      required: false,
       pageSize: 20,
       loop: false,
       theme: {
@@ -3460,83 +3965,93 @@ async function promptForUpdates(packages, forkPath) {
             const tips = keys.map(([key, action]) => `${colors_default.dim(key)} ${action}`);
             return tips.join("  ");
           },
-          renderSelectedChoices: (selectedChoices) => colors_default.dim(`${selectedChoices.length} package${selectedChoices.length !== 1 ? "s" : ""} selected`)
+          renderSelectedChoices: (selectedChoices) => colors_default.dim(`${selectedChoices.length} selected`)
         }
       }
     });
+    console.info();
+    return selected;
   } catch {
-    return "cancelled";
+    return null;
   }
-  return executeUpdates(packages, forkPath, selected);
 }
-async function executeUpdates(packages, forkPath, selectedPackages) {
-  console.info();
-  console.info(colors_default.green(`\u2713 updating ${selectedPackages.length} package${selectedPackages.length !== 1 ? "s" : ""}`));
-  console.info();
-  const selectedMajor = packages.filter((p) => selectedPackages.includes(p.name) && p.isMajorUpdate);
-  if (selectedMajor.length > 0) {
-    const majorNames = selectedMajor.map((p) => colors_default.bold(p.name)).join(", ");
-    try {
-      const proceed = await confirm2({
-        message: `${selectedMajor.length} major update${selectedMajor.length > 1 ? "s" : ""} selected (${majorNames}). proceed?`,
-        default: true
-      });
-      if (!proceed) {
-        console.info(colors_default.dim("  update cancelled"));
-        console.info();
-        return "skipped";
-      }
-    } catch {
-      return "cancelled";
+function bumpText(update) {
+  if (update.pin.kind === "node") return `engines.node ${update.target}`;
+  if (update.pin.kind === "pnpm") return `packageManager pnpm@${update.target}`;
+  return update.pin.to;
+}
+async function planEdits(forkPath, rows, selected, nodeImageSuffixes) {
+  const contents = /* @__PURE__ */ new Map();
+  const summary = /* @__PURE__ */ new Map();
+  const bumped = [];
+  const edit = (file, label, item, resolves, change) => {
+    const entry = contents.get(file) ?? { content: readFileSync4(join12(forkPath, file), "utf8"), resolves: false };
+    const next = change(entry.content);
+    if (next === entry.content) return;
+    contents.set(file, { content: next, resolves: entry.resolves || resolves });
+    summary.set(label, [...summary.get(label) ?? [], item]);
+  };
+  const chosen = rows.filter((row) => selected.includes(rowKey(row)));
+  for (const row of chosen) {
+    if (row.runtime) continue;
+    for (const { name: dependent, location } of row.dependentPackages) {
+      const file = relative3(forkPath, join12(location, "package.json"));
+      edit(
+        file,
+        dependent || file,
+        row.name,
+        true,
+        (content) => editJsonText(content, (json) => {
+          for (const section of DEPENDENCY_SECTIONS) {
+            const deps = json[section];
+            const spec = deps?.[row.name];
+            if (!deps || spec === void 0) continue;
+            const next = rewriteSpecifier(spec, row.latest);
+            if (next) deps[row.name] = next;
+            else console.info(`${warningMark} ${row.name} in ${dependent || file} left as written: ${spec}`);
+          }
+        })
+      );
     }
   }
-  const catalogPackages = readCatalogPackageNames(forkPath);
-  const workspacePackages = /* @__PURE__ */ new Map();
-  for (const pkgName of selectedPackages) {
-    const pkg = packages.find((p) => p.name === pkgName);
-    if (!pkg) continue;
-    for (const { name: dependent } of pkg.dependentPackages) {
-      const group = workspacePackages.get(dependent);
-      if (group) group.push(pkgName);
-      else workspacePackages.set(dependent, [pkgName]);
+  for (const row of chosen) {
+    const update = row.runtime;
+    if (!update) continue;
+    if (update.pin.kind === "node") {
+      const missing = await missingNodeImages(update.target, nodeImageSuffixes);
+      if (missing.length > 0) {
+        console.info(`${warningMark} node ${update.target} skipped: ${missing.join(", ")} is not on docker hub yet`);
+        continue;
+      }
     }
+    edit(update.file, update.file, bumpText(update), false, (content) => applyRuntimeUpdate(content, update));
+    bumped.push(update);
   }
-  for (const [workspace, pkgs] of workspacePackages) {
-    const pkgList = pkgs.join(", ");
-    console.info(`${colors_default.cyan("\u2191")} ${colors_default.bold(workspace)}: ${colors_default.dim(pkgList)}`);
+  for (const [label, items] of summary) {
+    console.info(`${colors_default.cyan("\u2191")} ${colors_default.bold(label)}: ${colors_default.dim(items.join(", "))}`);
   }
-  console.info();
-  const selectedCatalogPackages = selectedPackages.filter((pkgName) => catalogPackages.has(pkgName));
-  if (selectedCatalogPackages.length > 0) {
-    console.info(colors_default.dim(`normalizing catalog consumers: ${selectedCatalogPackages.join(", ")}`));
-    const normalizeResult = spawnSync3("pnpm", ["-r", "up", ...selectedCatalogPackages], {
-      cwd: forkPath,
-      stdio: "inherit"
-    });
-    console.info();
-    if (normalizeResult.status !== 0) {
-      console.error(colors_default.red(`\u2717 catalog normalization failed (exit code ${normalizeResult.status})`));
-      return "failed";
-    }
-  }
-  const result = spawnSync3("pnpm", ["-r", "up", "--latest", ...selectedPackages], { cwd: forkPath, stdio: "inherit" });
-  console.info();
-  if (result.status !== 0) {
-    console.error(colors_default.red(`\u2717 update failed (exit code ${result.status})`));
-    return "failed";
+  if (summary.size > 0) console.info();
+  const edits = { manifests: {}, files: {} };
+  for (const [file, { content, resolves }] of contents) {
+    (resolves ? edits.manifests : edits.files)[file] = content;
   }
-  console.info(colors_default.green(`\u2713 ${selectedPackages.length} package${selectedPackages.length > 1 ? "s" : ""} updated`));
-  console.info();
-  return "updated";
+  return { edits, bumped };
 }
-function readCatalogPackageNames(forkPath) {
-  const workspacePath = join10(forkPath, "pnpm-workspace.yaml");
-  try {
-    const content = readFileSync3(workspacePath, "utf8");
-    return new Set(Object.keys(readTopLevel(content, "catalog") ?? {}));
-  } catch {
-    return /* @__PURE__ */ new Set();
+function printNext(bumped) {
+  const steps = [];
+  const node = bumped.find((update) => update.pin.kind === "node");
+  if (node && process.version !== `v${node.target}`) {
+    const command = getEnv("VOLTA_HOME") ? `volta install node@${node.target}` : `switch to node ${node.target}`;
+    steps.push([command, `this machine runs ${process.version.slice(1)}`]);
   }
+  for (const update of bumped) {
+    if (update.pin.kind === "image") steps.push([`docker build -f ${update.file} .`, "check that the image builds"]);
+  }
+  if (steps.length === 0) return;
+  const width = Math.max(...steps.map(([command]) => command.length));
+  console.info(colors_default.bold("next"));
+  for (const [command, why] of steps) console.info(`  ${colors_default.dim("\u2022")} ${command.padEnd(width)}   ${colors_default.dim(why)}`);
+  console.info();
 }
 
 // src/services/contributions.ts
@@ -3552,111 +4067,9 @@ import {
 } from "@inquirer/core";
 import { select as select3 } from "@inquirer/prompts";
 
-// src/utils/diff.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, join as join11 } from "path";
-import process6 from "process";
-function gitDiffFile(cwd, range, filePath, options = {}) {
-  const args = ["diff", "--no-color"];
-  if (options.dstPrefix) args.push("--src-prefix=cella/", `--dst-prefix=${options.dstPrefix}/`);
-  args.push(range, "--", filePath);
-  try {
-    return execFileSync2("git", args, { cwd, maxBuffer: MAX_BUFFER });
-  } catch (error) {
-    const stderr = error.stderr?.toString().trim();
-    throw new Error(stderr || `failed to diff ${filePath}`);
-  }
-}
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-async function renderDiffPage(patch, meta) {
-  const { preloadPatchDiff } = await import("@pierre/diffs/ssr");
-  const { prerenderedHTML } = await preloadPatchDiff({
-    patch,
-    options: {
-      diffStyle: "split",
-      themeType: "system",
-      lineDiffType: "word-alt",
-      hunkSeparators: "line-info",
-      overflow: "wrap",
-      disableFileHeader: true
-    }
-  });
-  const title = `${escapeHtml(meta.filePath)} \xB7 ${escapeHtml(meta.srcLabel)} vs ${escapeHtml(meta.dstLabel)}`;
-  const note = meta.note ? `<span class="note">\xB7 ${escapeHtml(meta.note)}</span>` : "";
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
-  :root { color-scheme: light dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
-    background: light-dark(#fafafa, #111);
-    color: light-dark(#111, #eee);
-  }
-  header {
-    display: flex; align-items: baseline; gap: 0.75rem; flex-wrap: wrap;
-    padding: 0.9rem 1.25rem;
-    border-bottom: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    position: sticky; top: 0;
-    background: inherit;
-  }
-  header .brand { font-weight: 600; color: light-dark(#0891b2, #22d3ee); }
-  header code { font-family: ui-monospace, monospace; font-size: 0.9rem; }
-  header .sides { margin-left: auto; font-size: 0.8rem; opacity: 0.7; }
-  main { max-width: 1400px; margin: 1rem auto; padding: 0 1rem 2rem; }
-  .diff-shell {
-    border: 1px solid light-dark(#e2e2e2, #2a2a2a);
-    border-radius: 8px; overflow: hidden;
-    background: light-dark(#fff, #161616);
-  }
-</style>
-</head>
-<body>
-<header>
-  <span class="brand">\u29C8 cella diff</span>
-  <code>${escapeHtml(meta.filePath)}</code>
-  <span class="sides">${escapeHtml(meta.srcLabel)} \u2190 \u2192 ${escapeHtml(meta.dstLabel)} ${note}</span>
-</header>
-<main>
-  <!-- Declarative shadow DOM: the library's CSS targets :host, which only
-       matches inside a shadow root (its browser component renders into one). -->
-  <div class="diff-shell">
-    <template shadowrootmode="open">
-${prerenderedHTML}
-    </template>
-  </div>
-</main>
-</body>
-</html>`;
-}
-function openWithDefaultApp(target) {
-  try {
-    execFileSync2(process6.platform === "darwin" ? "open" : "xdg-open", [target], { stdio: "ignore" });
-  } catch {
-  }
-}
-async function openDiffInBrowser(patch, meta, repoPath) {
-  const html = await renderDiffPage(patch, meta);
-  const dir = join11(tmpdir2(), `cella-diff-${basename3(repoPath)}`);
-  mkdirSync2(dir, { recursive: true });
-  const outPath = join11(dir, `${meta.filePath.replace(/[^\w.-]+/g, "-")}.html`);
-  writeFileSync2(outPath, html);
-  openWithDefaultApp(outPath);
-  return outPath;
-}
-
 // src/services/contrib-core.ts
 import { rmSync as rmSync2 } from "fs";
-import { dirname as dirname6, join as join12, resolve as resolve4 } from "path";
+import { dirname as dirname7, join as join13, resolve as resolve4 } from "path";
 async function listFilesAtRef(repoPath, ref) {
   const raw = await git(["ls-tree", "-r", "--name-only", ref], repoPath);
   return new Set(raw.split("\n").filter(Boolean));
@@ -3672,10 +4085,10 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
   const baseFiles = await listFilesAtRef(repoPath, baseRef);
   const baseDirs = /* @__PURE__ */ new Set(["."]);
   for (const f of baseFiles) {
-    let dir = dirname6(f);
+    let dir = dirname7(f);
     while (dir !== ".") {
       baseDirs.add(dir);
-      dir = dirname6(dir);
+      dir = dirname7(dir);
     }
   }
   const files = [];
@@ -3688,7 +4101,7 @@ async function detectContributableFiles(repoPath, baseRef, forkRef, config, fork
     if (inCella && !inFork) {
       kind = "deleted";
     } else if (!inCella && inFork) {
-      if (!baseDirs.has(dirname6(file.path))) continue;
+      if (!baseDirs.has(dirname7(file.path))) continue;
       kind = "created";
     } else {
       kind = "modified";
@@ -3712,7 +4125,7 @@ async function readBlobInfo(repoPath, ref, filePath) {
 async function buildContribBranch(repoPath, baseRef, forkRef, files, forkName) {
   const branch = `contrib/${forkName}`;
   const gitDir = resolve4(repoPath, await git(["rev-parse", "--git-dir"], repoPath));
-  const tmpIndex = join12(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
+  const tmpIndex = join13(gitDir, `tmp-contrib-index-${forkName.replace(/[^\w.-]/g, "_")}`);
   const indexEnv = { GIT_INDEX_FILE: tmpIndex };
   try {
     await git(["read-tree", baseRef], repoPath, { env: indexEnv });
@@ -3748,10 +4161,10 @@ ${commitBody}`;
 
 // src/services/fork-utils.ts
 import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname7, resolve as resolve5 } from "path";
+import { dirname as dirname8, resolve as resolve5 } from "path";
 async function resolveForkBasePath(repoPath) {
   const commonDir = await git(["rev-parse", "--git-common-dir"], repoPath, { ignoreErrors: true });
-  return commonDir ? dirname7(resolve5(repoPath, commonDir)) : repoPath;
+  return commonDir ? dirname8(resolve5(repoPath, commonDir)) : repoPath;
 }
 function validateForkPath(fork, basePath, requireConfig = false) {
   const resolvedPath = resolve5(basePath, fork.localPath);
@@ -3831,8 +4244,13 @@ var contribPrompt = createPrompt((config, done) => {
       try {
         const patch = gitDiffFile(cwd, `${baseRef}..${branch}`, path);
         if (patch.length === 0) return setStatusMsg(`no changes for ${path}`);
-        await openDiffInBrowser(patch.toString(), { filePath: path, srcLabel: "cella", dstLabel: forkName }, cwd);
-        setStatusMsg(`opened ${path} in browser`);
+        const page2 = await writeDiffPage(
+          [{ files: [{ path, patch: patch.toString() }] }],
+          { title: path, note: `cella \u2190 \u2192 ${forkName}` },
+          cwd,
+          path
+        );
+        setStatusMsg(openInBrowser(page2) ? `opened ${path} in browser` : `diff page: ${page2}`);
       } catch (error) {
         setStatusMsg(`diff failed: ${errorMessage(error)}`);
       }
@@ -4061,20 +4479,20 @@ async function runContributions(config) {
 
 // src/services/forks.ts
 import { resolve as resolve6 } from "path";
-import process7 from "process";
+import process8 from "process";
 import { Separator as Separator2, select as select5 } from "@inquirer/prompts";
 
 // src/services/sync.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/utils/gh.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 function ghAvailable() {
-  return spawnSync4("gh", ["--version"], { stdio: "ignore" }).status === 0;
+  return spawnSync3("gh", ["--version"], { stdio: "ignore" }).status === 0;
 }
 function runGh(cwd, args) {
-  const result = spawnSync4("gh", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const result = spawnSync3("gh", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
   return { ok: result.status === 0, output };
 }
@@ -4106,12 +4524,12 @@ function closePr(cwd, ref) {
 }
 
 // src/services/packages.ts
-import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join15 } from "path";
 
 // src/services/package-usage.ts
-import { existsSync as existsSync9, readFileSync as readFileSync4, statSync } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join14 } from "path";
 var MAX_FILE_BYTES = 1024 * 1024;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4119,7 +4537,7 @@ function escapeRegExp(value) {
 function readSearchable(filePath) {
   try {
     if (statSync(filePath).size > MAX_FILE_BYTES) return "";
-    const text = readFileSync4(filePath, "utf8");
+    const text = readFileSync5(filePath, "utf8");
     return text.includes("\0") ? "" : text;
   } catch {
     return "";
@@ -4127,7 +4545,7 @@ function readSearchable(filePath) {
 }
 function fileSource(forkPath, path) {
   let text;
-  return { path, label: path, text: () => text ??= readSearchable(join13(forkPath, path)) };
+  return { path, label: path, text: () => text ??= readSearchable(join14(forkPath, path)) };
 }
 async function readScriptsAtRef(forkPath, ref, path) {
   try {
@@ -4139,7 +4557,7 @@ async function readScriptsAtRef(forkPath, ref, path) {
 async function scriptSources(forkPath, upstreamRef, baseRef, path) {
   let forkScripts;
   try {
-    forkScripts = JSON.parse(readFileSync4(join13(forkPath, path), "utf8")).scripts ?? {};
+    forkScripts = JSON.parse(readFileSync5(join14(forkPath, path), "utf8")).scripts ?? {};
   } catch {
     return [];
   }
@@ -4149,11 +4567,11 @@ async function scriptSources(forkPath, upstreamRef, baseRef, path) {
 }
 function binNames(forkPath, location, name) {
   const bareName = name.split("/").pop();
-  for (const dir of [join13(forkPath, location), forkPath]) {
-    const manifest = join13(dir, "node_modules", name, "package.json");
+  for (const dir of [join14(forkPath, location), forkPath]) {
+    const manifest = join14(dir, "node_modules", name, "package.json");
     if (!existsSync9(manifest)) continue;
     try {
-      const { bin } = JSON.parse(readFileSync4(manifest, "utf8"));
+      const { bin } = JSON.parse(readFileSync5(manifest, "utf8"));
       if (typeof bin === "string") return [bareName];
       return bin && typeof bin === "object" ? Object.keys(bin) : [];
     } catch {
@@ -4334,7 +4752,7 @@ function setTopLevelKey(pkg, key, value) {
 function readPackageJson(filePath) {
   if (!existsSync10(filePath)) return null;
   try {
-    return JSON.parse(readFileSync5(filePath, "utf8"));
+    return JSON.parse(readFileSync6(filePath, "utf8"));
   } catch (error) {
     throw new Error(`cannot parse ${filePath}: ${errorMessage(error)}`);
   }
@@ -4366,13 +4784,13 @@ async function syncPackageJson(config, baseRef, usage, relativePath, keysToSync)
   const changes = [];
   const kept = [];
   const pkgRelPath = packageJsonPath(relativePath);
-  const pkgPath = join14(forkPath, pkgRelPath);
+  const pkgPath = join15(forkPath, pkgRelPath);
   const forkPkg = readPackageJson(pkgPath);
   const upstream = await readPackageJsonAtRef(forkPath, upstreamRef, relativePath);
   const basePkg = baseRef ? (await readPackageJsonAtRef(forkPath, baseRef, relativePath))?.data : void 0;
   if (!upstream) return { updated: false, changes, kept };
   if (!forkPkg) {
-    const workspaceArrived = relativePath !== "" && existsSync10(join14(forkPath, relativePath));
+    const workspaceArrived = relativePath !== "" && existsSync10(join15(forkPath, relativePath));
     if (basePkg || !workspaceArrived || isIgnored(pkgRelPath, config)) return { updated: false, changes, kept };
     writeFileSync3(pkgPath, upstream.raw.endsWith("\n") ? upstream.raw : `${upstream.raw}
 `, "utf8");
@@ -4578,6 +4996,7 @@ async function runSync(config, options) {
   const staged = result.files.some((file) => SYNC_APPLIED_STATUSES.includes(file.status));
   const stagedBranch = options?.stagedBranch && result.conflicts.length === 0 && staged ? options.stagedBranch : void 0;
   printSyncComplete(result, { stagedBranch });
+  await reportReviewPage(config.forkPath, result, "sync");
   await printMigrationNotesLine(config, result);
   return result;
 }
@@ -4686,7 +5105,7 @@ async function shipSyncBranch(config, branch) {
     console.info(colors_default.dim("opening a pull request..."));
     const prBody = await buildSyncPrBodyForBranch(forkPath, cutBase);
     const bodyArgs = prBody ? ["--body", prBody] : ["--fill"];
-    const pr = spawnSync5("gh", ["pr", "create", "--base", base, "--head", branch, "--title", prTitle, ...bodyArgs], {
+    const pr = spawnSync4("gh", ["pr", "create", "--base", base, "--head", branch, "--title", prTitle, ...bodyArgs], {
       cwd: forkPath,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -4717,7 +5136,7 @@ ${pr.stderr ?? ""}`.match(/https?:\/\/\S+/)?.[0];
 function finalizeWorkspace(forkPath) {
   for (const args of [["install"], ["check"]]) {
     console.info(colors_default.dim(`running pnpm ${args.join(" ")}...`));
-    const result = spawnSync5("pnpm", args, { cwd: forkPath, stdio: "inherit" });
+    const result = spawnSync4("pnpm", args, { cwd: forkPath, stdio: "inherit" });
     if (result.status !== 0) return false;
   }
   return true;
@@ -4983,7 +5402,7 @@ async function runForks(config) {
       loop: false
     });
     if (selectedPath === "_exit") {
-      process7.exit(0);
+      process8.exit(0);
     }
     const resolvedForkPath = resolve6(forkBasePath, selectedPath);
     const selectedFork = forks.find((f) => f.localPath === selectedPath);
@@ -4998,11 +5417,11 @@ async function runForks(config) {
 
 // src/services/stats.ts
 import { readFile as readFile3 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // src/utils/coverage-utils.ts
-import { existsSync as existsSync11, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { join as join15, relative as relative4, sep as sep2 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import { join as join16, relative as relative4, sep as sep2 } from "path";
 var STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1e3;
 function colorPct(pct) {
   if (typeof pct !== "number" || !Number.isFinite(pct)) return colors_default.dim("n/a");
@@ -5020,14 +5439,14 @@ function formatAge(ms) {
   return `${mins} minute${mins === 1 ? "" : "s"} ago`;
 }
 function printCoverageSummary(forkPath) {
-  const file = join15(forkPath, ".coverage", "coverage-summary.json");
+  const file = join16(forkPath, ".coverage", "coverage-summary.json");
   let summary;
   let mtimeMs = 0;
   let problem = "no coverage data found";
   if (existsSync11(file)) {
     try {
       mtimeMs = statSync2(file).mtimeMs;
-      summary = JSON.parse(readFileSync6(file, "utf8"));
+      summary = JSON.parse(readFileSync7(file, "utf8"));
     } catch {
       problem = "could not read coverage-summary.json";
     }
@@ -5071,7 +5490,7 @@ function printCoverageSummary(forkPath) {
 // src/services/stats.ts
 var sourceExtensions = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs", "json", "jsonc", "css", "html"]);
 async function getWorkspacePackages(forkPath) {
-  const content = await readFile3(join16(forkPath, "pnpm-workspace.yaml"), "utf8");
+  const content = await readFile3(join17(forkPath, "pnpm-workspace.yaml"), "utf8");
   const patterns = readTopLevel(content, "packages");
   return (Array.isArray(patterns) ? patterns.map(String) : []).map((pattern) => {
     if (pattern.endsWith("/*")) {
@@ -5429,14 +5848,14 @@ function getForkPath() {
     }
     return resolved;
   }
-  let cwd = process8.cwd();
+  let cwd = process9.cwd();
   if (cwd.endsWith("/cli/cella") || cwd.endsWith("\\cli\\cella")) {
     cwd = resolve7(cwd, "../..");
   }
   return cwd;
 }
 function preflight(forkPath) {
-  if (!existsSync12(join17(forkPath, ".git"))) {
+  if (!existsSync12(join18(forkPath, ".git"))) {
     throw new Error(`not a git repository: ${forkPath}`);
   }
 }
@@ -5454,7 +5873,7 @@ var services = {
   }
 };
 function isHelpOrVersionRequest() {
-  return process8.argv.slice(2).some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-v") || process8.argv[2] === "help";
+  return process9.argv.slice(2).some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-v") || process9.argv[2] === "help";
 }
 async function main() {
   try {
@@ -5473,7 +5892,7 @@ async function main() {
   } catch (error) {
     console.error();
     console.error(`${colors_default.red("\u2717")} ${errorMessage(error)}`);
-    process8.exit(1);
+    process9.exit(1);
   }
 }
 main();