@cellajs/cli 0.6.5 → 0.6.7

package/dist/index.js

@@ -49,6 +49,7 @@ async function importFromApp(forkPath, file) {
   setEnv("NODE_ENV", "development");
   return import(pathToFileURL(path).href);
 }
+var movedPath = (forkPath, current, legacy) => !existsSync(join(forkPath, current)) && existsSync(join(forkPath, legacy)) ? legacy : current;
 async function loadAppFacts(forkPath) {
   const parsed2 = appConfigSchema.safeParse((await importFromApp(forkPath, "shared/index.ts")).appConfig);
   if (!parsed2.success)
@@ -233,7 +234,7 @@ import process6 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.6.5",
+  version: "0.6.7",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and upgrading it with upstream Cella.",
@@ -761,6 +762,15 @@ async function gitMv(cwd, oldPath, newPath) {
   await mkdir2(newDir, { recursive: true });
   await git(["mv", "-f", oldPath, newPath], cwd);
 }
+async function moveFromRef(cwd, ref, from, to) {
+  const [mode, , blob] = (await git(["ls-tree", ref, "--", from], cwd)).split(/\s+/);
+  if (!blob) throw new Error(`${ref} holds no ${from}`);
+  await gitRm(cwd, [to], { cached: true });
+  await git(["update-index", "--add", "--cacheinfo", `${mode},${blob},${to}`], cwd);
+  await mkdir2(dirname3(join3(cwd, to)), { recursive: true });
+  await git(["checkout-index", "-f", "--", to], cwd);
+  await removeFileFully(cwd, from);
+}
 async function fileExistsInWorktree(cwd, filePath) {
   return existsSync3(join3(cwd, filePath));
 }
@@ -1309,6 +1319,9 @@ function printUpstreamOverrideChanges(result) {
     for (const entry of report[list2].removed) {
       lines.push(`  ${colors_default.red("\u2212")} ${list2}: ${entry}${colors_default.dim(" \xB7 dropped upstream, still in your config")}`);
     }
+    for (const { from, to } of report[list2].moved ?? []) {
+      lines.push(colors_default.dim(`  ~ ${list2}: ${from} \u2192 ${to} \xB7 renamed upstream, your config never had it`));
+    }
   }
   console.info(
     `${warningMark} ${colors_default.yellow(`upstream changed its CLI config \xB7 ${plural(lines.length, "entry", "entries")} to review`)}`
@@ -1373,11 +1386,12 @@ var STARTUP_TIMEOUT_MS = 5 * 6e4;
 var STOP_TIMEOUT_MS = 1e4;
 var DATABASE = "testbed";
 var DATABASE_SERVICE = "db_testbed";
-var showcasePath = (forkPath) => join4(forkPath, "json/showcase.json");
+var showcaseFile = (forkPath) => movedPath(forkPath, "backend/scripts/seeds/showcase.json", "json/showcase.json");
+var showcasePath = (forkPath) => join4(forkPath, showcaseFile(forkPath));
 var hasShowcase = (forkPath) => existsSync4(showcasePath(forkPath));
 function showcaseAdmin(forkPath) {
   const { admin } = JSON.parse(readFileSync2(showcasePath(forkPath), "utf8"));
-  if (typeof admin?.email !== "string") throw new Error("json/showcase.json names no admin email");
+  if (typeof admin?.email !== "string") throw new Error(`${showcaseFile(forkPath)} names no admin email`);
   return admin.email;
 }
 var shiftPort = (url) => {
@@ -1392,8 +1406,8 @@ async function resolveTestbed(forkPath, data = "seed") {
     throw new Error("shared/src/local-database.ts names no testbed database: upgrade the app from cella first");
   }
   const composeEnv = databases.composeEnv();
-  const envFile = join4(forkPath, "backend/.env");
-  const fileEnv = existsSync4(envFile) ? parseEnv(readFileSync2(envFile, "utf8")) : {};
+  const envFile = [join4(forkPath, ".env"), join4(forkPath, "backend/.env")].find((path) => existsSync4(path));
+  const fileEnv = envFile ? parseEnv(readFileSync2(envFile, "utf8")) : {};
   const portOffset = facts.devPortOffset + PORT_SHIFT;
   return {
     forkPath,
@@ -1402,7 +1416,7 @@ async function resolveTestbed(forkPath, data = "seed") {
     databasePort,
     portOffset,
     env: {
-      // The seed creates the admin that backend/.env names, and a command signs in as that user
+      // The seed creates the admin that the env file names, and a command signs in as that user
       ...fileEnv.ADMIN_EMAIL ? { ADMIN_EMAIL: fileEnv.ADMIN_EMAIL } : {},
       ...getEnvSnapshot(),
       ...data === "showcase" ? { ADMIN_EMAIL: showcaseAdmin(forkPath) } : {},
@@ -1666,7 +1680,7 @@ async function withTestbed(forkPath, use, { fresh = false, destructive = false,
 }
 async function runTestbed(forkPath, options) {
   if (options.job === "stop") return stopTestbed(await resolveTestbed(forkPath));
-  if (options.showcase && !hasShowcase(forkPath)) throw new Error("this app keeps no json/showcase.json");
+  if (options.showcase && !hasShowcase(forkPath)) throw new Error(`this app keeps no ${showcaseFile(forkPath)}`);
   const data = options.showcase ? "showcase" : "seed";
   if (options.command.length > 0) {
     return withTestbed(forkPath, (testbed2) => runCommand(forkPath, testbed2.env, options.command), { ...options, data });
@@ -1701,7 +1715,7 @@ var testbedCommand = {
   ],
   options: [
     ["--fresh", "start from an empty database: migrate and seed it again"],
-    ["--showcase", "hold the showcase of json/showcase.json, which the screenshots shoot, for a review loop"]
+    ["--showcase", "hold the showcase seed, which the screenshots shoot, for a review loop"]
   ],
   passthrough: [
     "command",
@@ -1716,8 +1730,8 @@ var testbedCommand = {
 };
 
 // src/tools/a11y/audit.ts
-import { mkdirSync as mkdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 
 // src/tools/a11y/axe-scan.ts
 import axe from "axe-core";
@@ -2387,8 +2401,97 @@ function recordDecisions(forkPath, decisions) {
 }
 
 // src/tools/a11y/probes/page-structure.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
+
+// src/tools/i18n/locales.ts
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { join as join7 } from "path";
+var localesDir = (forkPath) => movedPath(forkPath, "shared/locales", "locales");
+var MANIFEST = "namespaces.json";
+var SOURCE_LANGUAGE = "en";
+var entryPattern = /^(\s+)("(?:[^"\\]|\\.)*")\s*:\s*("(?:[^"\\]|\\.)*"),?\s*$/;
+function parseLocaleFile(path, text2) {
+  if (text2.trim() === "{}") return { path, indent: "  ", entries: [] };
+  const lines = text2.replace(/\n$/, "").split("\n");
+  if (lines[0] !== "{" || lines.at(-1) !== "}") return "not one JSON object with one entry per line";
+  const entries = [];
+  let indent = "  ";
+  for (const line of lines.slice(1, -1)) {
+    const match = entryPattern.exec(line);
+    if (!match) return `cannot read the line ${JSON.stringify(line.trim())}`;
+    indent = match[1];
+    entries.push({ key: JSON.parse(match[2]), value: JSON.parse(match[3]), raw: [match[2], match[3]] });
+  }
+  return { path, indent, entries };
+}
+function serializeLocaleFile(file) {
+  if (file.entries.length === 0) return "{}\n";
+  return `{
+${file.entries.map(({ raw }) => `${file.indent}${raw[0]}: ${raw[1]}`).join(",\n")}
+}
+`;
+}
+function writeLocaleFile(forkPath, file) {
+  writeFileSync3(join7(forkPath, file.path), serializeLocaleFile(file));
+}
+var textsOf = (file) => Object.fromEntries((file?.entries ?? []).map(({ key, value }) => [key, value]));
+var readJsonObject = (path) => {
+  const parsed2 = JSON.parse(readFileSync4(path, "utf8"));
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) throw new Error(`${path} is not a JSON object`);
+  return Object.fromEntries(Object.entries(parsed2));
+};
+function readLocales(forkPath) {
+  const localesPath = localesDir(forkPath);
+  const dir = join7(forkPath, localesPath);
+  if (!existsSync7(join7(dir, SOURCE_LANGUAGE))) throw new Error(`no ${localesPath}/${SOURCE_LANGUAGE}/ in ${forkPath}`);
+  const languages = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort((a, b) => a === SOURCE_LANGUAGE ? -1 : b === SOURCE_LANGUAGE ? 1 : a.localeCompare(b));
+  const files2 = /* @__PURE__ */ new Map();
+  for (const language2 of languages) {
+    for (const name of readdirSync(join7(dir, language2)).filter((name2) => name2.endsWith(".json"))) {
+      const path = `${localesPath}/${language2}/${name}`;
+      const parsed2 = parseLocaleFile(path, readFileSync4(join7(forkPath, path), "utf8"));
+      if (typeof parsed2 === "string") throw new Error(`${path}: ${parsed2}; pnpm lint:fix writes one entry per line`);
+      files2.set(`${language2}/${name.slice(0, -".json".length)}`, parsed2);
+    }
+  }
+  const manifestPath = join7(dir, MANIFEST);
+  if (!existsSync7(manifestPath)) throw new Error(`no ${localesPath}/${MANIFEST}: upgrade the app from cella first`);
+  const merged = readJsonObject(manifestPath);
+  const namespaces = /* @__PURE__ */ new Map();
+  for (const [namespace, sources] of Object.entries(merged)) {
+    if (!Array.isArray(sources) || !sources.every((source) => typeof source === "string")) {
+      throw new Error(`${localesPath}/${MANIFEST}: ${namespace} must list file names`);
+    }
+    namespaces.set(namespace, sources);
+  }
+  const mergedFiles = new Set([...namespaces.values()].flat());
+  const ownFiles = [...new Set([...files2.keys()].map((key) => key.split("/")[1]))].filter(
+    (file) => !mergedFiles.has(file)
+  );
+  for (const file of ownFiles.sort()) namespaces.set(file, [file]);
+  return { dir: localesPath, languages, namespaces, files: files2 };
+}
+function namespaceTexts(locales, language2, namespace) {
+  const sources = locales.namespaces.get(namespace) ?? [];
+  return Object.assign({}, ...sources.map((file) => textsOf(locales.files.get(`${language2}/${file}`))));
+}
+var lineOf = (file, key) => file.entries.findIndex((entry) => entry.key === key) + 2;
+var pluralSuffix = /_(ordinal_)?(zero|one|two|few|many|other)$/;
+function pluralForm(key) {
+  const match = pluralSuffix.exec(key);
+  if (!match) return void 0;
+  return { base: key.slice(0, match.index), category: match[2], ordinal: !!match[1] };
+}
+var withPluralForms = (key) => [
+  key,
+  ...["zero", "one", "two", "few", "many", "other"].flatMap((category) => [
+    `${key}_${category}`,
+    `${key}_ordinal_${category}`
+  ])
+];
+
+// src/tools/a11y/probes/page-structure.ts
 var titles = { criteria: ["2.4.2"], check: "probe:titles", what: "A distinct, descriptive page title" };
 var language = {
   criteria: ["3.1.1"],
@@ -2422,7 +2525,7 @@ var pageStructure = async (page, state, { app }) => {
 var languageSwitch = async (page, state, { app, forkPath }) => {
   if (state.open) return [];
   const names = JSON.parse(
-    readFileSync4(join7(forkPath, "locales", app.defaultLanguage, "common.json"), "utf8")
+    readFileSync5(join8(forkPath, localesDir(forkPath), app.defaultLanguage, "common.json"), "utf8")
   );
   const findings2 = [];
   for (const other of app.languages.filter((lng) => lng !== app.defaultLanguage)) {
@@ -2756,15 +2859,15 @@ var inputs = async (page, state) => {
 };
 
 // src/tools/a11y/review-packet.ts
-import { mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
-var packetDir = (run, stateId) => join8(run.resultsDir, "review", stateId);
+import { mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
+var packetDir = (run, stateId) => join9(run.resultsDir, "review", stateId);
 function writePacketFile(run, stateId, name, content) {
   mkdirSync2(packetDir(run, stateId), { recursive: true });
-  writeFileSync3(join8(packetDir(run, stateId), name), content);
+  writeFileSync4(join9(packetDir(run, stateId), name), content);
 }
 function removePacketFile(run, stateId, name) {
-  rmSync2(join8(packetDir(run, stateId), name), { force: true });
+  rmSync2(join9(packetDir(run, stateId), name), { force: true });
 }
 function pageFacts() {
   const text2 = (el) => (el?.textContent ?? "").trim().replace(/\s+/g, " ");
@@ -3224,8 +3327,8 @@ var seconds = (since) => `${((Date.now() - since) / 1e3).toFixed(1)}s`;
 async function runAudit(run, scope, testbed, options) {
   const startedAt = Date.now();
   const email = options.email ?? testbed.env.ADMIN_EMAIL;
-  if (!email) throw new Error("no audit user: pass --email, or set ADMIN_EMAIL in backend/.env");
-  const builtAt = statSync(join9(run.forkPath, "frontend/dist/index.html"), { throwIfNoEntry: false })?.mtime;
+  if (!email) throw new Error("no audit user: pass --email, or set ADMIN_EMAIL in .env");
+  const builtAt = statSync(join10(run.forkPath, "frontend/dist/index.html"), { throwIfNoEntry: false })?.mtime;
   printStep("auditing", `${testbed.frontendUrl}, frontend build of ${builtAt?.toLocaleString() ?? "unknown date"}`);
   const states = options.states.length > 0 ? scope.states.filter((state) => options.states.includes(state.id)) : scope.states;
   const session = await startAudit(run.forkPath, scope, { email, env: testbed.env });
@@ -3265,12 +3368,12 @@ async function runAudit(run, scope, testbed, options) {
   mkdirSync3(run.resultsDir, { recursive: true });
   const axe2 = summarizeAxe(scans);
   for (const [id, items] of axe2.evidence) for (const item of items) evidence.add([id], item);
-  writeFileSync4(join9(run.resultsDir, "axe.json"), `${JSON.stringify({ ...axe2.report, errors }, null, 2)}
+  writeFileSync5(join10(run.resultsDir, "axe.json"), `${JSON.stringify({ ...axe2.report, errors }, null, 2)}
 `);
   evidence.addFindings(acrossStates(findings2));
   runCodeChecks(evidence, run, scope.sources);
   const skipped2 = Object.keys(errors).length;
-  const target = options.states.length > 0 || skipped2 ? join9(run.resultsDir, "ledger-partial.json") : join9(run.forkPath, ledgerFile);
+  const target = options.states.length > 0 || skipped2 ? join10(run.resultsDir, "ledger-partial.json") : join10(run.forkPath, ledgerFile);
   const ledger = writeLedger(
     run.forkPath,
     evidence.byCriterion,
@@ -3294,10 +3397,10 @@ async function runAudit(run, scope, testbed, options) {
 }
 
 // src/tools/a11y/decide.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { resolve as resolve4 } from "path";
 function runDecide(forkPath, { file, decision }) {
-  const input2 = file ? JSON.parse(readFileSync5(resolve4(file), "utf8")) : [decision];
+  const input2 = file ? JSON.parse(readFileSync6(resolve4(file), "utf8")) : [decision];
   if (!Array.isArray(input2)) throw new Error(`${file} holds no list of decisions`);
   const decisions = input2.map(parseDecision);
   const ledger = recordDecisions(forkPath, decisions);
@@ -3311,8 +3414,8 @@ function runDecide(forkPath, { file, decision }) {
 
 // src/tools/a11y/report.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { copyFileSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { copyFileSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join11 } from "path";
 var statusLabel = {
   supports: "Supports",
   "partially-supports": "Partially Supports",
@@ -3431,7 +3534,7 @@ Not evaluated.
 
 This report describes the product as tested on the report date. Accessibility can change as the product changes.
 `;
-  const tracked = spawnSync5("git", ["ls-files", "frontend/src", "backend/src", "locales"], {
+  const tracked = spawnSync5("git", ["ls-files", "frontend/src", "backend/src", "shared/locales", "locales"], {
     cwd: forkPath,
     encoding: "utf8"
   }).stdout.split("\n");
@@ -3458,7 +3561,7 @@ NVDA and Firefox on Windows, keyboard only, in light and dark mode.
 
 ## Confirm: decided by an agent (${byAgent.length})
 
-The agent judged these from the review packets in \`${join10(resultsDir, "review")}/\`. Check its evidence, then record your own
+The agent judged these from the review packets in \`${join11(resultsDir, "review")}/\`. Check its evidence, then record your own
 decision; a wrong Supports here ends up in the published report.
 
 ${byAgent.map((r) => {
@@ -3502,11 +3605,11 @@ ${failing.map((r) => {
   }).join("\n")}
 `;
   mkdirSync4(resultsDir, { recursive: true });
-  writeFileSync5(join10(resultsDir, "vpat-draft.md"), vpat);
-  writeFileSync5(join10(resultsDir, "manual-pass.md"), checklist);
+  writeFileSync6(join11(resultsDir, "vpat-draft.md"), vpat);
+  writeFileSync6(join11(resultsDir, "manual-pass.md"), checklist);
   const html = toHtml(vpat, `${app.name} Accessibility Conformance Report`);
-  const pdfPath = join10(resultsDir, "conformance-report.pdf");
-  writeFileSync5(join10(resultsDir, "conformance-report.html"), html);
+  const pdfPath = join11(resultsDir, "conformance-report.pdf");
+  writeFileSync6(join11(resultsDir, "conformance-report.html"), html);
   const { chromium } = await loadPlaywright(forkPath);
   const browser = await chromium.launch();
   try {
@@ -3526,12 +3629,12 @@ ${failing.map((r) => {
     if (unconfirmed && !draft) {
       const ids = [...open, ...byAgent].map((r) => r.id).join(", ");
       throw new Error(
-        `not published: ${open.length} criteria are open and ${byAgent.length} are decided by an agent only (${ids}). See ${join10(resultsDir, "manual-pass.md")}, or add --draft to publish it as a draft`
+        `not published: ${open.length} criteria are open and ${byAgent.length} are decided by an agent only (${ids}). See ${join11(resultsDir, "manual-pass.md")}, or add --draft to publish it as a draft`
       );
     }
     const publicPath = "frontend/public/static/common/accessibility-conformance-report.pdf";
-    mkdirSync4(dirname4(join10(forkPath, publicPath)), { recursive: true });
-    copyFileSync(pdfPath, join10(forkPath, publicPath));
+    mkdirSync4(dirname4(join11(forkPath, publicPath)), { recursive: true });
+    copyFileSync(pdfPath, join11(forkPath, publicPath));
     const count3 = (status) => ledger.criteria.filter((r) => r.status === status).length;
     const review = {
       standard: ledger.standard,
@@ -3622,7 +3725,7 @@ var a11yCommand = {
   options: [
     ["--states <ids>", "audit: these states only, comma separated; writes ledger-partial.json, never the ledger"],
     ["--workers <n>", "audit: states audited at the same time (default 4)"],
-    ["--email <address>", "audit: the audit user (default ADMIN_EMAIL in backend/.env)"],
+    ["--email <address>", "audit: the audit user (default ADMIN_EMAIL in .env)"],
     ["--publish", "report: put the PDF where the app serves it and print what the statement needs"],
     ["--draft", "report: publish while rows still need a person; the statement calls the results provisional"],
     ["--file <path>", "decide: a JSON list of decisions"],
@@ -3638,8 +3741,8 @@ var a11yCommand = {
 };
 
 // src/tools/bench/command.ts
-import { existsSync as existsSync7, readdirSync } from "fs";
-import { basename, join as join11 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync2 } from "fs";
+import { basename, join as join12 } from "path";
 
 // src/tools/bench/request.ts
 var BENCH_REQUEST_ENV = "CELLA_BENCH";
@@ -3648,11 +3751,11 @@ var BENCH_REQUEST_ENV = "CELLA_BENCH";
 var BENCH_DIR = "backend/bench";
 var ENTRY_COMMAND = ["pnpm", "exec", "tsx", "--no-experimental-webstorage", "bench/run.ts"];
 async function runBench(forkPath, options) {
-  if (!existsSync7(join11(forkPath, BENCH_DIR, "run.ts"))) {
+  if (!existsSync8(join12(forkPath, BENCH_DIR, "run.ts"))) {
     throw new Error(`${BENCH_DIR}/run.ts is missing: upgrade the app from cella first`);
   }
-  const scenariosDir = join11(forkPath, BENCH_DIR, "scenarios");
-  const names = readdirSync(scenariosDir).filter((file) => file.endsWith(".ts")).map((file) => basename(file, ".ts")).sort();
+  const scenariosDir = join12(forkPath, BENCH_DIR, "scenarios");
+  const names = readdirSync2(scenariosDir).filter((file) => file.endsWith(".ts")).map((file) => basename(file, ".ts")).sort();
   if (options.scenario && !names.includes(options.scenario)) {
     throw new Error(`unknown scenario '${options.scenario}'. expected one of: ${names.join(", ")}`);
   }
@@ -3664,7 +3767,7 @@ async function runBench(forkPath, options) {
     scenariosDir,
     dataDir: toolDir(forkPath, "bench", "repository")
   };
-  const run = (env) => runCommand(join11(forkPath, "backend"), { ...env, [BENCH_REQUEST_ENV]: JSON.stringify(request) }, ENTRY_COMMAND);
+  const run = (env) => runCommand(join12(forkPath, "backend"), { ...env, [BENCH_REQUEST_ENV]: JSON.stringify(request) }, ENTRY_COMMAND);
   return options.isolated ? withTestbed(forkPath, (testbed) => run(testbed.env)) : run(getEnvSnapshot());
 }
 var benchCommand = {
@@ -3703,98 +3806,12 @@ import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
 import { join as join14 } from "path";
 
-// src/tools/i18n/locales.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join12 } from "path";
-var LOCALES_DIR = "locales";
-var MANIFEST = "namespaces.json";
-var SOURCE_LANGUAGE = "en";
-var entryPattern = /^(\s+)("(?:[^"\\]|\\.)*")\s*:\s*("(?:[^"\\]|\\.)*"),?\s*$/;
-function parseLocaleFile(path, text2) {
-  if (text2.trim() === "{}") return { path, indent: "  ", entries: [] };
-  const lines = text2.replace(/\n$/, "").split("\n");
-  if (lines[0] !== "{" || lines.at(-1) !== "}") return "not one JSON object with one entry per line";
-  const entries = [];
-  let indent = "  ";
-  for (const line of lines.slice(1, -1)) {
-    const match = entryPattern.exec(line);
-    if (!match) return `cannot read the line ${JSON.stringify(line.trim())}`;
-    indent = match[1];
-    entries.push({ key: JSON.parse(match[2]), value: JSON.parse(match[3]), raw: [match[2], match[3]] });
-  }
-  return { path, indent, entries };
-}
-function serializeLocaleFile(file) {
-  if (file.entries.length === 0) return "{}\n";
-  return `{
-${file.entries.map(({ raw }) => `${file.indent}${raw[0]}: ${raw[1]}`).join(",\n")}
-}
-`;
-}
-function writeLocaleFile(forkPath, file) {
-  writeFileSync6(join12(forkPath, file.path), serializeLocaleFile(file));
-}
-var textsOf = (file) => Object.fromEntries((file?.entries ?? []).map(({ key, value }) => [key, value]));
-var readJsonObject = (path) => {
-  const parsed2 = JSON.parse(readFileSync6(path, "utf8"));
-  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) throw new Error(`${path} is not a JSON object`);
-  return Object.fromEntries(Object.entries(parsed2));
-};
-function readLocales(forkPath) {
-  const dir = join12(forkPath, LOCALES_DIR);
-  if (!existsSync8(join12(dir, SOURCE_LANGUAGE))) throw new Error(`no ${LOCALES_DIR}/${SOURCE_LANGUAGE}/ in ${forkPath}`);
-  const languages = readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort((a, b) => a === SOURCE_LANGUAGE ? -1 : b === SOURCE_LANGUAGE ? 1 : a.localeCompare(b));
-  const files2 = /* @__PURE__ */ new Map();
-  for (const language2 of languages) {
-    for (const name of readdirSync2(join12(dir, language2)).filter((name2) => name2.endsWith(".json"))) {
-      const path = `${LOCALES_DIR}/${language2}/${name}`;
-      const parsed2 = parseLocaleFile(path, readFileSync6(join12(forkPath, path), "utf8"));
-      if (typeof parsed2 === "string") throw new Error(`${path}: ${parsed2}; pnpm lint:fix writes one entry per line`);
-      files2.set(`${language2}/${name.slice(0, -".json".length)}`, parsed2);
-    }
-  }
-  const manifestPath = join12(dir, MANIFEST);
-  if (!existsSync8(manifestPath)) throw new Error(`no ${LOCALES_DIR}/${MANIFEST}: upgrade the app from cella first`);
-  const merged = readJsonObject(manifestPath);
-  const namespaces = /* @__PURE__ */ new Map();
-  for (const [namespace, sources] of Object.entries(merged)) {
-    if (!Array.isArray(sources) || !sources.every((source) => typeof source === "string")) {
-      throw new Error(`${LOCALES_DIR}/${MANIFEST}: ${namespace} must list file names`);
-    }
-    namespaces.set(namespace, sources);
-  }
-  const mergedFiles = new Set([...namespaces.values()].flat());
-  const ownFiles = [...new Set([...files2.keys()].map((key) => key.split("/")[1]))].filter(
-    (file) => !mergedFiles.has(file)
-  );
-  for (const file of ownFiles.sort()) namespaces.set(file, [file]);
-  return { languages, namespaces, files: files2 };
-}
-function namespaceTexts(locales, language2, namespace) {
-  const sources = locales.namespaces.get(namespace) ?? [];
-  return Object.assign({}, ...sources.map((file) => textsOf(locales.files.get(`${language2}/${file}`))));
-}
-var lineOf = (file, key) => file.entries.findIndex((entry) => entry.key === key) + 2;
-var pluralSuffix = /_(ordinal_)?(zero|one|two|few|many|other)$/;
-function pluralForm(key) {
-  const match = pluralSuffix.exec(key);
-  if (!match) return void 0;
-  return { base: key.slice(0, match.index), category: match[2], ordinal: !!match[1] };
-}
-var withPluralForms = (key) => [
-  key,
-  ...["zero", "one", "two", "few", "many", "other"].flatMap((category) => [
-    `${key}_${category}`,
-    `${key}_ordinal_${category}`
-  ])
-];
-
 // src/tools/i18n/scan.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
 import { dirname as dirname5, join as join13 } from "path";
 var codeFile = /\.(?:[cm]?[jt]sx?)$/;
-var skipped = (path) => path.endsWith(".d.ts") || path.startsWith("locales/") || path.startsWith("cella/alignments/") || path.split("/").some((segment) => segment === "node_modules" || segment === "gen" || segment.includes(".gen."));
+var skipped = (path) => path.endsWith(".d.ts") || path.startsWith("locales/") || path.startsWith("shared/locales/") || path.startsWith("cella/alignments/") || path.split("/").some((segment) => segment === "node_modules" || segment === "gen" || segment.includes(".gen."));
 var MAX_FILE_BYTES = 1e6;
 var MAX_COMBINATIONS = 500;
 var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4211,10 +4228,10 @@ function printList(title, items) {
   console.info(`    ${colors_default.dim(`${items.slice(0, LIST_MAX).join(", ")}${more}`)}`);
 }
 var describe = ({ key, missing, extra }) => [key, ...missing.map((name) => `-${name}`), ...extra.map((name) => `+${name}`)].join(" ");
-function printStatus(report) {
+function printStatus(report, dir) {
   const label = ({ name, files: files2 }) => files2.length > 1 || files2[0] !== name ? `${name} (${files2.join(" + ")})` : name;
   console.info(
-    `${colors_default.bold(`${LOCALES_DIR}/`)} ${colors_default.dim(`${report.languages.join(", ")} \xB7 namespaces ${report.namespaces.map(label).join(", ")}`)}`
+    `${colors_default.bold(`${dir}/`)} ${colors_default.dim(`${report.languages.join(", ")} \xB7 namespaces ${report.namespaces.map(label).join(", ")}`)}`
   );
   console.info();
   console.info(colors_default.dim(row2(columns.map(([title]) => title))));
@@ -4286,9 +4303,10 @@ function printStatus(report) {
   console.info(`  ${colors_default.dim("missing and same-as-English keys: --json lists them \xB7 cella i18n unused")}`);
 }
 function runStatus(forkPath, json) {
-  const report = buildStatus(readLocales(forkPath));
+  const locales = readLocales(forkPath);
+  const report = buildStatus(locales);
   if (json) writeStdout(JSON.stringify(report, null, 2));
-  else printStatus(report);
+  else printStatus(report, locales.dir);
   return defectCount(report) === 0 ? 0 : 1;
 }
 
@@ -5391,7 +5409,7 @@ async function spinnersGone(page, quiet = 1e3, cap = 45e3) {
 var hasMfaScript = (forkPath) => Boolean(JSON.parse(readFileSync13(join21(forkPath, "backend/package.json"), "utf8")).scripts?.["showcase:mfa"]);
 async function shoot(forkPath, list2, testbed, options) {
   const email = options.email ?? testbed.env.ADMIN_EMAIL;
-  if (!email) throw new Error("no shot user: pass --email, or set ADMIN_EMAIL in backend/.env");
+  if (!email) throw new Error("no shot user: pass --email, or set ADMIN_EMAIL in .env");
   const todo = options.ids.length > 0 ? list2.shots.filter((shot2) => options.ids.includes(shot2.id)) : list2.shots;
   const user = mintSession(email, { forkPath, env: testbed.env });
   const scratch = mkdtempSync(join21(tmpdir(), "cella-screenshots-"));
@@ -5520,7 +5538,7 @@ var screenshotsCommand = {
   operands: ["[ids...]", "the shots to take (default: all)"],
   options: [
     ["--out <dir>", "write into this folder, a trial run that leaves the working tree alone"],
-    ["--email <address>", "the shot user (default the showcase admin, else ADMIN_EMAIL in backend/.env)"]
+    ["--email <address>", "the shot user (default the showcase admin, else ADMIN_EMAIL in .env)"]
   ],
   parse: ({ operands, opts }) => ({
     ids: operands,
@@ -5779,7 +5797,9 @@ var alignmentExempt = [
   "json/",
   "locales/",
   "sdk/gen",
-  "shared/config"
+  "shared/config",
+  "shared/json/",
+  "shared/locales/"
 ];
 function ownedPaths(configSource) {
   const lists = [...configSource.matchAll(/\b(?:ignored|pinned): \[([\s\S]*?)\n {4}\]/g)].map((match) => match[1]);
@@ -7035,13 +7055,27 @@ function parseOverrideLists(source) {
   }
 }
 function diffOverrideLists(base, incoming, fork) {
+  const basenameOf2 = (entry) => entry.slice(entry.lastIndexOf("/") + 1);
   const diff = (key) => {
     const baseSet = new Set(base[key].map(normalizeEntry).filter(Boolean));
     const incomingSet = new Set(incoming[key].map(normalizeEntry).filter(Boolean));
     const forkEntries = fork[key].map(normalizeEntry).filter(Boolean);
+    const newEntries = [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries));
+    const renameSources = [...baseSet].filter(
+      (entry) => !incomingSet.has(entry) && !forkEntries.includes(entry) && !isUnderAnyFolder(entry, forkEntries)
+    );
+    const moved = [];
+    const added = newEntries.filter((entry) => {
+      const sourceAt = renameSources.findIndex((source) => basenameOf2(source) === basenameOf2(entry));
+      if (sourceAt === -1) return true;
+      moved.push({ from: renameSources[sourceAt], to: entry });
+      renameSources.splice(sourceAt, 1);
+      return false;
+    });
     return {
-      added: [...incomingSet].filter((entry) => !baseSet.has(entry) && !isUnderAnyFolder(entry, forkEntries)),
-      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry))
+      added,
+      removed: [...baseSet].filter((entry) => !incomingSet.has(entry) && forkEntries.includes(entry)),
+      ...moved.length > 0 ? { moved } : {}
     };
   };
   const diffKeys = () => {
@@ -7069,9 +7103,17 @@ async function compareUpstreamOverrides(repoPath, mergeBaseRef, incomingRef, for
     packageJsonKeys: forkConfig.settings.packageJsonKeys ?? DEFAULT_PACKAGE_JSON_KEYS
   };
   const changes = diffOverrideLists(base, incoming, fork);
-  const count3 = Object.values(changes).reduce((n, list2) => n + list2.added.length + list2.removed.length, 0);
+  const count3 = Object.values(changes).reduce(
+    (n, list2) => n + list2.added.length + list2.removed.length + (list2.moved?.length ?? 0),
+    0
+  );
   return count3 > 0 ? { kind: "changes", ...changes } : void 0;
 }
+function hasBlockingOverrideChanges(report) {
+  if (report.kind !== "changes") return false;
+  const lists = [report.pinned, report.ignored, report.packageJsonKeys];
+  return lists.some((list2) => list2.added.length > 0 || list2.removed.length > 0);
+}
 
 // src/utils/overrides.ts
 function normalizeEntry(entry) {
@@ -7120,8 +7162,9 @@ async function validateOverrides(config, forkPath, upstreamRef) {
     const path = normalizeEntry(entry);
     const ignoredEntry = ignored.find((folder) => isUnderAnyFolder(path, [folder]));
     if (/[*?]/.test(entry)) warnings.push(`pin uses glob (not supported, use a path or folder): ${entry}`);
-    else if (!existsSync21(join28(forkPath, path))) warnings.push(`pin not found: ${entry}`);
-    else if (ignoredEntry) warnings.push(`pin does nothing, '${normalizeEntry(ignoredEntry)}' is ignored: ${entry}`);
+    else if (!existsSync21(join28(forkPath, path))) {
+      if (!upstream || !await fileExistsAtRef(forkPath, upstream, path)) warnings.push(`pin not found: ${entry}`);
+    } else if (ignoredEntry) warnings.push(`pin does nothing, '${normalizeEntry(ignoredEntry)}' is ignored: ${entry}`);
     else if (!upstream) continue;
     else if (await fileExistsAtRef(forkPath, upstream, path)) pinsUpstreamHas.push(entry);
     else warnings.push(`pin does nothing, upstream no longer has it: ${entry}`);
@@ -7142,6 +7185,7 @@ async function validateOverrides(config, forkPath, upstreamRef) {
       warnings.push(`ignored entry uses glob (not supported, use a path or folder): ${entry}`);
     } else if (!existsSync21(join28(forkPath, path))) {
       if (upstreamRef && await fileExistsAtRef(forkPath, upstreamRef, path)) continue;
+      if (isGeneratedFile(path)) continue;
       warnings.push(`ignored entry not found: ${entry}`);
     }
   }
@@ -7472,6 +7516,109 @@ import { existsSync as existsSync22 } from "fs";
 import { rm as rm2 } from "fs/promises";
 import { join as join29 } from "path";
 
+// src/utils/audit-utils.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+function outdatedPackageName(key) {
+  const name = key.split(" ")[0];
+  const at = name.indexOf("@", 1);
+  return at === -1 ? name : name.slice(0, at);
+}
+function getRepoUrl(repositoryUrl) {
+  if (!repositoryUrl) return null;
+  let url = repositoryUrl;
+  if (url.startsWith("git+")) {
+    url = url.slice(4);
+  }
+  if (url.endsWith(".git")) {
+    url = url.slice(0, -4);
+  }
+  if (url.startsWith("git://")) {
+    url = url.replace("git://", "https://");
+  }
+  return url;
+}
+function isGitHubRepoUrl(repoUrl) {
+  if (!repoUrl) return false;
+  try {
+    const parsed2 = new URL(repoUrl);
+    return parsed2.hostname === "github.com" || parsed2.hostname === "www.github.com";
+  } catch {
+    return false;
+  }
+}
+function getReleasesUrl(repoUrl) {
+  if (!isGitHubRepoUrl(repoUrl)) return null;
+  return `${repoUrl}/releases`;
+}
+async function runPnpm(args, cwd) {
+  try {
+    const { stdout, stderr } = await execFileAsync2("pnpm", args, {
+      encoding: "utf8",
+      maxBuffer: 10 * 1024 * 1024,
+      cwd
+    });
+    return { ok: true, stdout, stderr };
+  } catch (error) {
+    const { stdout = "", stderr = "" } = error;
+    return { ok: false, stdout, stderr: stdout || stderr ? stderr : String(error) };
+  }
+}
+async function runPnpmJson(args, cwd) {
+  try {
+    return JSON.parse((await runPnpm([...args, "--loglevel=error"], cwd)).stdout);
+  } catch {
+    return null;
+  }
+}
+async function runPnpmAudit(cwd) {
+  const result = await runPnpmJson(["audit", "--json"], cwd);
+  if (!result || typeof result.advisories !== "object" || result.advisories === null) return null;
+  return result;
+}
+async function readReleaseAgeMinutes(cwd) {
+  const minutes = Number.parseInt((await runPnpm(["config", "get", "minimumReleaseAge"], cwd)).stdout, 10);
+  return Number.isNaN(minutes) ? 0 : minutes;
+}
+async function fetchPublishTimes(name, cwd) {
+  const times = await runPnpmJson(["view", name, "time", "--json"], cwd);
+  return times && typeof times === "object" && !("error" in times) ? times : null;
+}
+function editJsonText(content, change) {
+  const json = JSON.parse(content);
+  change(json);
+  const indent = content.match(/^[ \t]+(?=")/m)?.[0] ?? "  ";
+  return `${JSON.stringify(json, null, indent)}${content.endsWith("\n") ? "\n" : ""}`;
+}
+function rewriteSpecifier(spec, latest) {
+  const match = spec.match(/^([\^~]?)\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?$/);
+  return match ? `${match[1]}${latest}` : null;
+}
+var vulnIcons = {
+  critical: colors_default.red("\u25CF"),
+  high: colors_default.red("\u25CF"),
+  moderate: colors_default.yellow("\u25CF"),
+  low: colors_default.blue("\u25CF"),
+  info: colors_default.gray("\u25CF")
+};
+function getVulnIcon(severity) {
+  return vulnIcons[severity] ?? colors_default.gray("\u25CF");
+}
+function middleTruncate(str2, maxLen) {
+  if (str2.length <= maxLen) return str2;
+  const ellipsis = "\u2026";
+  const charsToShow = maxLen - ellipsis.length;
+  const frontChars = Math.ceil(charsToShow / 2);
+  const backChars = Math.floor(charsToShow / 2);
+  return str2.slice(0, frontChars) + ellipsis + str2.slice(-backChars);
+}
+function formatDependents(dependents) {
+  if (dependents.length === 0) return "";
+  if (dependents.length === 1) return dependents[0];
+  return `${dependents[0]} +${dependents.length - 1}`;
+}
+
 // src/utils/versions.ts
 function parseComparableVersion(version) {
   const trimmed = version.trim();
@@ -7535,6 +7682,10 @@ async function readUpstreamCliRange(repoPath, ref) {
     return null;
   }
 }
+function releaseAgeExcludeHint(range) {
+  const version = range.match(/\d+\S*/)?.[0] ?? range;
+  return `  pnpm delays fresh releases (minimumReleaseAge): if the install is refused, add '${CLI_PACKAGE}@${version}' to minimumReleaseAgeExclude in pnpm-workspace.yaml.`;
+}
 function cliVersionMismatch(running, range) {
   if (/^\s*(<|>(?!=))/.test(range)) return null;
   const required = parseComparableVersion(range);
@@ -7550,6 +7701,81 @@ function cliVersionMismatch(running, range) {
 function isReportableIgnored(filePath) {
   return !isManagedFile(filePath) && !isGeneratedFile(filePath);
 }
+var basenameOf = (path) => path.slice(path.lastIndexOf("/") + 1);
+var dirnameOf = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+function directoryMoves(changes) {
+  const votes = /* @__PURE__ */ new Map();
+  for (const [newPath, change] of changes) {
+    if (change.status !== "R" || !change.oldPath || basenameOf(change.oldPath) !== basenameOf(newPath)) continue;
+    const from = dirnameOf(change.oldPath);
+    const counts = votes.get(from) ?? /* @__PURE__ */ new Map();
+    counts.set(dirnameOf(newPath), (counts.get(dirnameOf(newPath)) ?? 0) + 1);
+    votes.set(from, counts);
+  }
+  const moves = /* @__PURE__ */ new Map();
+  for (const [from, counts] of votes) {
+    const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+    if (ranked.length === 1 || ranked[0][1] > ranked[1][1]) moves.set(from, ranked[0][0]);
+  }
+  return moves;
+}
+var joinDir = (dir, name) => dir ? `${dir}/${name}` : name;
+function repairIncomingRenames(changes, context) {
+  const dirMoves = directoryMoves(changes);
+  const snapshot = new Map(changes);
+  const crossed = [];
+  const keptTargets = /* @__PURE__ */ new Set();
+  const renameSources = /* @__PURE__ */ new Set();
+  for (const [newPath, change] of changes) {
+    if (change.status !== "R" || !change.oldPath) continue;
+    renameSources.add(change.oldPath);
+    if (basenameOf(change.oldPath) === basenameOf(newPath)) keptTargets.add(newPath);
+    else crossed.push({ from: newPath, oldPath: change.oldPath, change });
+  }
+  const desired = /* @__PURE__ */ new Map();
+  for (const pair of crossed) {
+    const name = basenameOf(pair.oldPath);
+    const mappedDir = dirMoves.get(dirnameOf(pair.oldPath));
+    const candidates = [
+      ...mappedDir === void 0 ? [] : [joinDir(mappedDir, name)],
+      joinDir(dirnameOf(pair.from), name)
+    ];
+    const target = candidates.find(
+      (path) => context.incomingPaths.has(path) && !context.basePaths.has(path) && !keptTargets.has(path)
+    );
+    desired.set(pair.from, target ?? pair.from);
+  }
+  const targets = [...desired.values()];
+  if (new Set(targets).size === targets.length) {
+    const targetSet = new Set(targets);
+    for (const pair of crossed) {
+      const target = desired.get(pair.from);
+      if (target === pair.from) continue;
+      changes.set(target, {
+        status: "R",
+        oldPath: pair.oldPath,
+        baseHash: pair.change.baseHash,
+        targetHash: snapshot.get(target)?.targetHash ?? null
+      });
+    }
+    for (const pair of crossed) {
+      if (desired.get(pair.from) === pair.from || targetSet.has(pair.from)) continue;
+      changes.set(pair.from, { status: "A", baseHash: null, targetHash: snapshot.get(pair.from)?.targetHash ?? null });
+    }
+  }
+  for (const oldPath of context.localPaths) {
+    if (context.incomingPaths.has(oldPath) || !context.basePaths.has(oldPath)) continue;
+    if (renameSources.has(oldPath) || !context.isProtected(oldPath)) continue;
+    const mappedDir = dirMoves.get(dirnameOf(oldPath));
+    if (mappedDir === void 0) continue;
+    const target = joinDir(mappedDir, basenameOf(oldPath));
+    if (!context.incomingPaths.has(target) || context.basePaths.has(target) || changes.get(target)?.status !== "A")
+      continue;
+    changes.set(target, { status: "R", oldPath, baseHash: null, targetHash: changes.get(target)?.targetHash ?? null });
+    changes.delete(oldPath);
+    renameSources.add(oldPath);
+  }
+}
 async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predicates, onProgress) {
   onProgress?.("collecting file hashes (batch)...");
   const [forkHashes, upstreamHashes, baseHashes] = await Promise.all([
@@ -7559,6 +7785,12 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
   ]);
   const upstreamChanges = await getFileChanges(repoPath, mergeBaseRef, incomingRef);
   const forkChanges = await getFileChanges(repoPath, mergeBaseRef, localRef);
+  repairIncomingRenames(upstreamChanges, {
+    basePaths: new Set(baseHashes.keys()),
+    incomingPaths: new Set(upstreamHashes.keys()),
+    localPaths: new Set(forkHashes.keys()),
+    isProtected: (path) => predicates.isIgnored(path) || predicates.isPinned(path)
+  });
   const upstreamRenames = /* @__PURE__ */ new Map();
   for (const [newPath, change] of upstreamChanges) {
     if (change.status === "R" && change.oldPath) {
@@ -7615,8 +7847,9 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       const forkModifiedOld = forkOldHash !== baseOldHash;
       const oldPathPinned = predicates.isPinned(oldPath);
       let upstreamChanged2;
-      if (fileIsPinned || oldPathPinned || predicates.isIgnored(oldPath)) {
+      if (fileIsPinned || fileIsIgnored || oldPathPinned || predicates.isIgnored(oldPath)) {
         status = "pinned";
+        if (oldPathInFork) renamedFrom = oldPath;
         if (forkModifiedOld && upstreamHash !== baseOldHash) {
           upstreamChanged2 = true;
           renamedProtected.add(filePath);
@@ -7642,7 +7875,7 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       status = "ignored";
     } else if (!inFork && inUpstream) {
       const locallyDeleted = baseHash !== null && upstreamHash === baseHash;
-      status = fileIsPinned || locallyDeleted ? "deleted" : "behind";
+      status = fileIsPinned && baseHash !== null || locallyDeleted ? "deleted" : "behind";
     } else if (inFork && !inUpstream) {
       if (baseHash !== null) {
         status = fileIsPinned ? "ahead" : "behind";
@@ -7754,6 +7987,9 @@ async function readOriginGitHubUrl(forkPath) {
 function isProtectedFile(file) {
   return file.isIgnored || file.isPinned;
 }
+function isPinnedFirstArrival(file) {
+  return file.isPinned && !file.isIgnored && !file.existsInFork && file.existsInUpstream && file.status === "behind";
+}
 function syncPredicates(config) {
   return {
     isIgnored: (path) => isIgnored(path, config),
@@ -7772,9 +8008,11 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
   );
   const batchRestorePaths = [];
   const batchRemovePaths = [];
+  const movedProtected = [];
   for (const file of analyzedFiles) {
-    if (file.status === "identical" || file.status === "ahead") continue;
-    if (file.isIgnored || file.isPinned && !file.renamedFrom) {
+    if (file.status === "identical" || file.status === "ahead" || isPinnedFirstArrival(file)) continue;
+    if (file.status === "pinned" && file.renamedFrom) movedProtected.push({ from: file.renamedFrom, to: file.path });
+    else if (file.isIgnored || file.isPinned) {
       (file.existsInFork ? batchRestorePaths : batchRemovePaths).push(file.path);
     }
   }
@@ -7791,16 +8029,23 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
       await removeFileFromWorktree(forkPath, filePath);
     }
   }
+  for (const { from, to } of movedProtected) {
+    onProgress?.(`\u2192 ${from} \u2192 ${to}: keeping your copy (moved in upstream)`);
+    await moveFromRef(forkPath, "HEAD", from, to);
+  }
   for (const file of analyzedFiles) {
     const { path: filePath, status, existsInFork } = file;
-    if (status === "identical" || status === "ahead" || isProtectedFile(file)) continue;
+    if (status === "identical" || status === "ahead" || isProtectedFile(file) && !isPinnedFirstArrival(file))
+      continue;
     if (status === "diverged") {
       onProgress?.(`\u2192 ${filePath}: using git merge result (diverged)`);
       continue;
     }
     if (status === "behind") {
       if (!existsInFork) {
-        onProgress?.(`\u2192 ${filePath}: adding from upstream (new file)`);
+        onProgress?.(
+          `\u2192 ${filePath}: adding from upstream (${isPinnedFirstArrival(file) ? "pinned, upstream's copy is your first" : "new file"})`
+        );
         await checkoutFromRef(forkPath, upstreamRef, [filePath]);
       } else if (!file.existsInUpstream) {
         onProgress?.(`\u2192 ${filePath}: removing (deleted in upstream)`);
@@ -7939,7 +8184,11 @@ async function prepareUpstream(config, onProgress, onStep) {
   config.upstreamRef = upstreamRef;
   const cliRange = await readUpstreamCliRange(forkPath, upstreamRef);
   const cliMismatch = cliRange ? cliVersionMismatch(VERSION, cliRange) : null;
-  if (cliMismatch) throw new Error(cliMismatch);
+  if (cliMismatch && cliRange) {
+    const delayed = await readReleaseAgeMinutes(forkPath) > 0;
+    throw new Error(delayed ? `${cliMismatch}
+${releaseAgeExcludeHint(cliRange)}` : cliMismatch);
+  }
   onProgress?.("checking sync base...");
   await ensureSyncBase(forkPath, "HEAD", upstreamRef);
   const upstreamGitHubUrl = getGitHubBaseUrl(config.settings.upstreamUrl) ?? void 0;
@@ -7982,7 +8231,7 @@ async function assertSyncConfigFollowed(config, ctx) {
   const report = await compareUpstreamOverrides(config.forkPath, ctx.mergeBase, ctx.upstreamRef, config).catch(
     () => void 0
   );
-  if (report?.kind === "changes") throw new UpstreamConfigChangedError(report);
+  if (report && hasBlockingOverrideChanges(report)) throw new UpstreamConfigChangedError(report);
 }
 function resultMeta(config, ctx) {
   return {
@@ -9045,109 +9294,6 @@ import { readFileSync as readFileSync19 } from "fs";
 import { basename as basename9, join as join35, relative as relative4 } from "path";
 import { checkbox, Separator } from "@inquirer/prompts";
 
-// src/utils/audit-utils.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
-function outdatedPackageName(key) {
-  const name = key.split(" ")[0];
-  const at = name.indexOf("@", 1);
-  return at === -1 ? name : name.slice(0, at);
-}
-function getRepoUrl(repositoryUrl) {
-  if (!repositoryUrl) return null;
-  let url = repositoryUrl;
-  if (url.startsWith("git+")) {
-    url = url.slice(4);
-  }
-  if (url.endsWith(".git")) {
-    url = url.slice(0, -4);
-  }
-  if (url.startsWith("git://")) {
-    url = url.replace("git://", "https://");
-  }
-  return url;
-}
-function isGitHubRepoUrl(repoUrl) {
-  if (!repoUrl) return false;
-  try {
-    const parsed2 = new URL(repoUrl);
-    return parsed2.hostname === "github.com" || parsed2.hostname === "www.github.com";
-  } catch {
-    return false;
-  }
-}
-function getReleasesUrl(repoUrl) {
-  if (!isGitHubRepoUrl(repoUrl)) return null;
-  return `${repoUrl}/releases`;
-}
-async function runPnpm(args, cwd) {
-  try {
-    const { stdout, stderr } = await execFileAsync2("pnpm", args, {
-      encoding: "utf8",
-      maxBuffer: 10 * 1024 * 1024,
-      cwd
-    });
-    return { ok: true, stdout, stderr };
-  } catch (error) {
-    const { stdout = "", stderr = "" } = error;
-    return { ok: false, stdout, stderr: stdout || stderr ? stderr : String(error) };
-  }
-}
-async function runPnpmJson(args, cwd) {
-  try {
-    return JSON.parse((await runPnpm([...args, "--loglevel=error"], cwd)).stdout);
-  } catch {
-    return null;
-  }
-}
-async function runPnpmAudit(cwd) {
-  const result = await runPnpmJson(["audit", "--json"], cwd);
-  if (!result || typeof result.advisories !== "object" || result.advisories === null) return null;
-  return result;
-}
-async function readReleaseAgeMinutes(cwd) {
-  const minutes = Number.parseInt((await runPnpm(["config", "get", "minimumReleaseAge"], cwd)).stdout, 10);
-  return Number.isNaN(minutes) ? 0 : minutes;
-}
-async function fetchPublishTimes(name, cwd) {
-  const times = await runPnpmJson(["view", name, "time", "--json"], cwd);
-  return times && typeof times === "object" && !("error" in times) ? times : null;
-}
-function editJsonText(content, change) {
-  const json = JSON.parse(content);
-  change(json);
-  const indent = content.match(/^[ \t]+(?=")/m)?.[0] ?? "  ";
-  return `${JSON.stringify(json, null, indent)}${content.endsWith("\n") ? "\n" : ""}`;
-}
-function rewriteSpecifier(spec, latest) {
-  const match = spec.match(/^([\^~]?)\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?$/);
-  return match ? `${match[1]}${latest}` : null;
-}
-var vulnIcons = {
-  critical: colors_default.red("\u25CF"),
-  high: colors_default.red("\u25CF"),
-  moderate: colors_default.yellow("\u25CF"),
-  low: colors_default.blue("\u25CF"),
-  info: colors_default.gray("\u25CF")
-};
-function getVulnIcon(severity) {
-  return vulnIcons[severity] ?? colors_default.gray("\u25CF");
-}
-function middleTruncate(str2, maxLen) {
-  if (str2.length <= maxLen) return str2;
-  const ellipsis = "\u2026";
-  const charsToShow = maxLen - ellipsis.length;
-  const frontChars = Math.ceil(charsToShow / 2);
-  const backChars = Math.floor(charsToShow / 2);
-  return str2.slice(0, frontChars) + ellipsis + str2.slice(-backChars);
-}
-function formatDependents(dependents) {
-  if (dependents.length === 0) return "";
-  if (dependents.length === 1) return dependents[0];
-  return `${dependents[0]} +${dependents.length - 1}`;
-}
-
 // src/utils/local-tools.ts
 import { execFile as execFile3 } from "child_process";
 import { existsSync as existsSync24, realpathSync as realpathSync2 } from "fs";
@@ -10897,9 +11043,18 @@ function readSearchable(filePath) {
     return "";
   }
 }
+var codeFilePattern = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/;
+var proseFilePattern = /\.(?:md|mdx|markdown)$/i;
+function stripComments(text2) {
+  return text2.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+}
 function fileSource(forkPath, path) {
   let text2;
-  return { path, label: path, text: () => text2 ??= readSearchable(join37(forkPath, path)) };
+  const read = () => {
+    const content = readSearchable(join37(forkPath, path));
+    return codeFilePattern.test(path) ? stripComments(content) : content;
+  };
+  return { path, label: path, text: () => text2 ??= read() };
 }
 async function readScriptsAtRef(forkPath, ref, path) {
   try {
@@ -10952,7 +11107,7 @@ async function loadForkUsage(forkPath, upstreamRef, baseRef) {
   const sources = [];
   for (const path of diff.split("\0").filter(Boolean)) {
     if (isPackageJson(path)) sources.push(...await scriptSources(forkPath, upstreamRef, baseRef, path));
-    else if (!isManagedFile(path)) sources.push(fileSource(forkPath, path));
+    else if (!isManagedFile(path) && !proseFilePattern.test(path)) sources.push(fileSource(forkPath, path));
   }
   const findIn = (scoped, patterns) => scoped.find((source) => patterns.some((pattern) => pattern.test(source.text())))?.label;
   return {