@mfeflow/core 0.4.0 → 0.6.0

package/dist/index.js

@@ -1,14 +1,16 @@
 import { createRequire } from "node:module";
-import { FEATURE_CONDITION, FEATURE_NAME, REGISTRY_NAMESPACE, SCHEMA_URLS, TRANSFORM_OPS, errorDocsUrl, isLoopbackHttp, isMfeflowProject, isRegistryProtocol, isSafeRelativePath, registryIndexUrl, registryTemplateProblem, validateFeatureManifest, validateFeatureRegistryIndex, validateMfeflowProject } from "@mfeflow/contracts";
-import { createHash } from "node:crypto";
-import promises from "node:fs/promises";
+import { DOCS_URL, EXPOSE, FEATURE_CONDITION, FEATURE_NAME, MFE_NAME, REGISTRY_NAMESPACE, SCHEMA_URLS, TRANSFORM_OPS, errorDocsUrl, isLoopbackHttp, isMfeflowProject, isPrivateHost, isRegistryProtocol, isSafeRelativePath, redactUrl, redactUrlsIn, registryIndexUrl, registryTemplateProblem, validateFeatureManifest, validateFeatureRegistryIndex, validateMfeflowProject } from "@mfeflow/contracts";
 import node_path from "node:path";
+import promises from "node:fs/promises";
+import { createHash } from "node:crypto";
 import { formatPatch, structuredPatch } from "diff";
-import { isMap, isSeq, parseDocument, stringify } from "yaml";
+import { isMap, isSeq, parse as external_yaml_parse, parseDocument, stringify } from "yaml";
+import semver, { valid, validRange } from "semver";
+import { pathToFileURL } from "node:url";
 import { Eta } from "eta";
-import { isArrayExpression, isArrowFunctionExpression, isBooleanLiteral, isCallExpression, isFunctionDeclaration, isFunctionExpression, isIdentifier, isImportDeclaration, isImportDefaultSpecifier, isImportNamespaceSpecifier, isImportSpecifier, isJSXElement, isJSXFragment, isJSXIdentifier, isMemberExpression, isNode, isNullLiteral, isNumericLiteral, isObjectExpression, isObjectProperty, isParenthesizedExpression, isReturnStatement, isStringLiteral, isTSAsExpression, isTSNonNullExpression, isTSSatisfiesExpression, isUnaryExpression, isValidIdentifier, isVariableDeclaration } from "@babel/types";
+import { isArrayExpression, isArrowFunctionExpression, isAssignmentExpression, isAwaitExpression, isBinaryExpression, isBooleanLiteral, isCallExpression, isClassDeclaration, isConditionalExpression, isExportDefaultDeclaration, isExportNamedDeclaration, isExportSpecifier, isExpressionStatement, isFunctionDeclaration, isFunctionExpression, isIdentifier, isImportDeclaration, isImportDefaultSpecifier, isImportNamespaceSpecifier, isImportSpecifier, isJSXElement, isJSXFragment, isJSXIdentifier, isLogicalExpression, isMemberExpression, isMetaProperty, isNewExpression, isNode, isNullLiteral, isNumericLiteral, isObjectExpression, isObjectPattern, isObjectProperty, isParenthesizedExpression, isReturnStatement, isStringLiteral, isTSAsExpression, isTSNonNullExpression, isTSSatisfiesExpression, isTSTypeAssertion, isTemplateLiteral, isUnaryExpression, isValidIdentifier, isVariableDeclaration } from "@babel/types";
 import { parse, parseExpression } from "@babel/parser";
-import { valid, validRange } from "semver";
+import node_os from "node:os";
 const ERROR_CATALOGUE = {
     E101: {
         title: 'A shared singleton is missing from the shared list',
@@ -59,8 +61,8 @@ const ERROR_CATALOGUE = {
         fix: 'Restore the folder, or remove the app from "apps" in mfeflow.json.'
     },
     E113: {
-        title: 'mfe.json is missing or invalid',
-        fix: `Give the app a valid mfe.json (name, owner, shells, routes, exposes). The schema is at ${SCHEMA_URLS.mfe}.`
+        title: 'mfeflow.app.json is missing or invalid',
+        fix: `Give the app a valid mfeflow.app.json (name, owner, shells, routes, exposes). The schema is at ${SCHEMA_URLS.mfe}.`
     },
     E114: {
         title: 'A registry entry is missing or invalid',
@@ -71,8 +73,8 @@ const ERROR_CATALOGUE = {
         fix: 'Give one of them another port in its rsbuild config and in "apps" in mfeflow.json.'
     },
     E116: {
-        title: 'Two remotes claim the same route, or an mfe.json disagrees with mfeflow.json',
-        fix: 'Give each route to one remote, and keep the name in mfe.json equal to the app name.'
+        title: 'Two remotes claim routes that overlap, or an app file disagrees with mfeflow.json',
+        fix: 'Give each route to one remote (a wildcard such as /checkout/* also covers /checkout/pay), and keep the name in mfeflow.app.json equal to the app name.'
     },
     E117: {
         title: 'A copied file changed since mfeflow wrote it',
@@ -94,6 +96,18 @@ const ERROR_CATALOGUE = {
         title: 'A server env key is not listed in turbo.json',
         fix: 'Add the key to "globalEnv" in turbo.json. Turborepo hides unlisted variables from tasks and replays a cached build without running env.ts, so a missing value would not fail the build.'
     },
+    E122: {
+        title: 'An app has both mfeflow.app.json and the old mfe.json',
+        fix: `Keep mfeflow.app.json and delete mfe.json. Move any field you still need into mfeflow.app.json first. See ${DOCS_URL}/reference/mfeflow-app-json.`
+    },
+    E123: {
+        title: 'This folder already has an mfeflow.json',
+        fix: 'adopt only starts a project file; it never changes one. Use `mfeflow add` or `mfeflow upgrade` on this project, or run adopt in a folder that has no mfeflow.json.'
+    },
+    E124: {
+        title: 'adopt found nothing it can set up',
+        fix: 'adopt needs a Module Federation host (shell) it can read, and a literal `name` for each app. Run it in the folder that holds the shell, or a workspace root that contains it, and read `mfeflow adopt --dry-run` for what was skipped.'
+    },
     E201: {
         title: 'Feature not found',
         fix: 'List what is available with `mfeflow features`, or check the spelling.'
@@ -160,7 +174,7 @@ const ERROR_CATALOGUE = {
     },
     E302: {
         title: 'A remote is not compatible with its shell',
-        fix: 'Align the remote and the shell on the same major of the package, or update the "platform" range in the remote\'s mfe.json.'
+        fix: 'Align the remote and the shell on the same major of the package, or update the "platform" range in the remote\'s mfeflow.app.json.'
     },
     E303: {
         title: 'A runtime plugin imports a shared module',
@@ -168,7 +182,7 @@ const ERROR_CATALOGUE = {
     },
     E304: {
         title: 'A bundle is over its budget',
-        fix: 'Cut what the app ships on first load, or raise the budget in mfeflow.json ("budget") or mfe.json ("budgets") on purpose.'
+        fix: 'Cut what the app ships on first load, or raise the budget in mfeflow.json ("budget") or mfeflow.app.json ("budgets") on purpose.'
     },
     E305: {
         title: 'There is no build output to measure',
@@ -178,6 +192,10 @@ const ERROR_CATALOGUE = {
         title: 'A dev server could not start',
         fix: "Free the port or change it in mfeflow.json and the app's rsbuild config, then run `mfeflow dev` again."
     },
+    E307: {
+        title: 'The shell to check against could not be read',
+        fix: 'Pass --against a registry index, a deployed shell mf-manifest.json or a local file of either. A URL must be https (http only for localhost) and under 1 MB.'
+    },
     E401: {
         title: 'Could not fetch from the registry',
         fix: 'Check the URL in "registries" and your network, then try again.'
@@ -193,6 +211,78 @@ const ERROR_CATALOGUE = {
     E404: {
         title: 'A feature in the registry folder cannot be published',
         fix: 'Fix the features listed above. They are checked with the same rules `mfeflow add @namespace/name` applies, so a feature that passes here installs for users.'
+    },
+    E501: {
+        title: 'A deploy failed the schema gate',
+        fix: `Fix what the message names: the remote's mfeflow.app.json, its mf-manifest.json or the version. Nothing was uploaded. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E502: {
+        title: 'A route of this remote overlaps a route of another remote',
+        fix: `Give each URL to one remote (/checkout/* also covers /checkout/pay), then deploy again. Nothing was uploaded. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E503: {
+        title: "The remote's shared ranges do not fit the shell that is deployed",
+        fix: `Align the remote with the shell on the package named above, or deploy the shell first. Nothing was uploaded. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E504: {
+        title: 'The remote is over its first-load JS budget',
+        fix: `Cut what the remote loads first, or raise budgets.initialJsKb in its mfeflow.app.json on purpose. Nothing was uploaded. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E505: {
+        title: 'A rollout was asked for, and a static host cannot split traffic',
+        fix: `Deploy to one version at a time, or use the registry server for percentage rollouts. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E506: {
+        title: 'The registry host is not set up or cannot be used',
+        fix: `Pass --host file:<dir> or s3://<bucket>[/prefix], or set registry.host in mfeflow.json. Deploys also need --base-url or registry.baseUrl. S3 settings come from MFEFLOW_S3_ENDPOINT, MFEFLOW_S3_REGION, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E507: {
+        title: 'There is no build output to deploy',
+        fix: `Run \`pnpm build\` in the remote first. The build folder needs an mf-manifest.json, and the remote needs a version in package.json or --version. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E508: {
+        title: 'There is no such version to move to',
+        fix: `Run \`mfeflow status\` to see what each environment serves and the versions you can go back to. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E509: {
+        title: 'Files of the target version are missing on the host',
+        fix: `Deploy that version again from its build, or pick another version with --to. The index was not changed. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E510: {
+        title: 'Another deploy changed the index at the same time',
+        fix: `Run \`mfeflow status\` to see what is served now, then run the command again. The index was not changed by this run. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E511: {
+        title: 'This version is already published with different content',
+        fix: `A published version never changes. Bump the version and deploy again. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E512: {
+        title: 'Local registry files and the host disagree',
+        fix: `Run the deploy, promote or rollback that was meant to move the environment, or fix registry/envs by hand. Artifacts uploaded with --no-publish are not served until you deploy them. See ${DOCS_URL}/guide/deploy-and-rollback.`
+    },
+    E405: {
+        title: 'The registry is not trusted yet',
+        fix: 'Run `mfeflow registry trust @namespace` once to allow requests to it, or remove it from "registries".'
+    },
+    E406: {
+        title: 'The registry changed a feature since you added it',
+        fix: 'Nothing was written. Look at what changed; if you accept the new content, run the command again with --accept-changed-content.'
+    },
+    E601: {
+        title: 'Cannot tell which version of mfeflow made this project',
+        fix: 'Add "cli": "<version>" to mfeflow.json (the version you created the project with), or give the shell a plain @mfeflow/runtime range in its package.json, then run the command again.'
+    },
+    E602: {
+        title: 'The project is newer than the version you are upgrading to',
+        fix: 'Upgrade only moves forward. Install a newer mfeflow, or leave the project as it is.'
+    },
+    E603: {
+        title: 'A feature migration could not be loaded or failed',
+        fix: 'Nothing was written. Update mfeflow to a build that ships the migration, or report the feature and versions named above.'
+    },
+    E604: {
+        title: 'Files you changed need a decision',
+        fix: 'Nothing was written. Run `mfeflow upgrade --dry-run` to see each diff, then pass --accept <path> to take the new version of a file, --keep <path> to keep yours, or `all` for every file.'
     }
 };
 class MfeflowError extends Error {
@@ -231,14 +321,15 @@ function readPackageJson() {
     if (!isPackageJson(pkg)) throw new MfeflowError('E106', 'package.json is missing a name or version');
     return pkg;
 }
-function normalizeEol(content) {
-    return content.replace(/\r\n/g, '\n');
-}
-function hashContent(content) {
-    return `sha256-${createHash('sha256').update(normalizeEol(content)).digest('hex')}`;
+function resolveInRoot(root, relative) {
+    if (!isSafeRelativePath(relative)) throw new MfeflowError('E105', `"${relative}"`);
+    const absolute = node_path.resolve(root, ...relative.split('/'));
+    const inside = node_path.relative(root, absolute);
+    if (inside.startsWith('..') || node_path.isAbsolute(inside)) throw new MfeflowError('E105', `"${relative}"`);
+    return absolute;
 }
-async function inOrder(items, step) {
-    for (const item of items)await step(item);
+function joinPosix(...parts) {
+    return node_path.posix.join(...parts.filter((p)=>'' !== p));
 }
 const realFs = {
     readFile: (file)=>promises.readFile(file, 'utf8'),
@@ -294,15 +385,46 @@ async function writeFileAtomic(ops, file, content) {
         });
     }
 }
-function resolveInRoot(root, relative) {
-    if (!isSafeRelativePath(relative)) throw new MfeflowError('E105', `"${relative}"`);
-    const absolute = node_path.resolve(root, ...relative.split('/'));
-    const inside = node_path.relative(root, absolute);
-    if (inside.startsWith('..') || node_path.isAbsolute(inside)) throw new MfeflowError('E105', `"${relative}"`);
-    return absolute;
+async function symlinkedPrefix(ops, root, relative) {
+    const parts = relative.split('/');
+    const prefixes = parts.map((_, i)=>parts.slice(0, i + 1).join('/'));
+    const linked = await Promise.all(prefixes.map(async (prefix)=>({
+            prefix,
+            link: await ops.isSymlink(resolveInRoot(root, prefix))
+        })));
+    return linked.find((entry)=>entry.link)?.prefix;
+}
+const APP_FILE = 'mfeflow.app.json';
+const LEGACY_APP_FILE = 'mfe.json';
+async function readAppFile(dir, ops = realFs) {
+    const [text, legacyText] = await Promise.all([
+        readIfExists(ops, node_path.join(dir, APP_FILE)),
+        readIfExists(ops, node_path.join(dir, LEGACY_APP_FILE))
+    ]);
+    if (void 0 !== text && void 0 !== legacyText) throw new MfeflowError('E122', `${dir} has both ${APP_FILE} and ${LEGACY_APP_FILE}`);
+    if (void 0 !== text) return {
+        name: APP_FILE,
+        text,
+        legacy: false
+    };
+    if (void 0 !== legacyText) return {
+        name: LEGACY_APP_FILE,
+        text: legacyText,
+        legacy: true
+    };
 }
-function joinPosix(...parts) {
-    return node_path.posix.join(...parts.filter((p)=>'' !== p));
+function legacyAppFileNotice(folders) {
+    const files = folders.map((dir)=>`${dir}/${LEGACY_APP_FILE}`).join(', ');
+    return `Notice: ${LEGACY_APP_FILE} is now ${APP_FILE}. Rename ${files}; the old name still works for now.`;
+}
+function normalizeEol(content) {
+    return content.replace(/\r\n/g, '\n');
+}
+function hashContent(content) {
+    return `sha256-${createHash('sha256').update(normalizeEol(content)).digest('hex')}`;
+}
+async function inOrder(items, step) {
+    for (const item of items)await step(item);
 }
 const PROJECT_FILE = 'mfeflow.json';
 function describeIssues(issues) {
@@ -325,11 +447,15 @@ function serializeProject(project) {
     if (issues.length > 0) throw new MfeflowError('E104', describeIssues(issues));
     const { $schema, ...rest } = project;
     const files = rest.files && Object.fromEntries(Object.entries(rest.files).toSorted(byKey));
+    const kept = rest.kept && Object.fromEntries(Object.entries(rest.kept).toSorted(byKey));
     const ordered = {
         $schema: $schema ?? SCHEMA_URLS.project,
         ...rest,
         ...files ? {
             files
+        } : {},
+        ...kept ? {
+            kept
         } : {}
     };
     return `${JSON.stringify(ordered, null, 2)}\n`;
@@ -367,11 +493,14 @@ function recordPlan(project, plan) {
     const features = {
         ...project.features
     };
-    for (const f of plan.features)features[f.name] = f.options ? {
+    for (const f of plan.features)features[f.name] = {
         version: f.version,
-        options: f.options
-    } : {
-        version: f.version
+        ...f.options ? {
+            options: f.options
+        } : {},
+        ...void 0 === f.integrity ? {} : {
+            integrity: f.integrity
+        }
     };
     const next = {
         ...project,
@@ -431,6 +560,11 @@ function emptyPlan() {
     };
 }
 const WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const DEPENDENCY_SECTIONS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies'
+];
 class PlanBuilder {
     read;
     options;
@@ -477,6 +611,9 @@ class PlanBuilder {
     async content(file) {
         return (await this.open(file)).current ?? void 0;
     }
+    async existed(file) {
+        return null !== (await this.open(file)).original;
+    }
     async captureProject() {
         this.state.projectBefore = await this.read(PROJECT_FILE) ?? null;
     }
@@ -499,6 +636,13 @@ class PlanBuilder {
         this.touch(entry);
         entry.current = edit(entry.current);
     }
+    async replace(file, content) {
+        const entry = await this.open(file);
+        if (null === entry.current) throw new MfeflowError('E208', `${file} does not exist`);
+        if ('third-party' === this.trust && entry.current !== content) throw new MfeflowError('E207', file);
+        this.touch(entry);
+        entry.current = content;
+    }
     async delete(file) {
         const entry = await this.open(file);
         this.touch(entry);
@@ -527,8 +671,73 @@ class PlanBuilder {
             file,
             name,
             range: wanted,
-            dev
+            dev,
+            ...'third-party' === this.trust ? {
+                thirdParty: true
+            } : {}
+        });
+    }
+    async setRange(file, name, range) {
+        if (!isRegistryRange(range)) throw new MfeflowError('E202', `${name}: "${range}" is not a semver range or a dist-tag`);
+        const source = await this.content(file);
+        if (void 0 === source) throw new MfeflowError('E208', `${file} does not exist`);
+        const existing = this.declaredRange(file, source, name, range);
+        if (existing === range || existing.startsWith('workspace:')) return;
+        if (!existing.startsWith('catalog:') && !isRegistryRange(existing)) return void this.warn(`${file}: ${name} is ${JSON.stringify(existing)}; left as it is, not moved to ${range}`);
+        if ('third-party' === this.trust) throw new MfeflowError('E207', `${file}: ${name} is already ${JSON.stringify(existing)}; the feature wants ${range}`);
+        if (existing.startsWith('catalog:')) return void await this.setCatalogEntry(name, existing.slice(8), range);
+        await this.patch(file, (text)=>editJsonObject(file, text, (pkg)=>{
+                let changed = false;
+                for (const section of DEPENDENCY_SECTIONS){
+                    const listed = asRecord(pkg[section])[name];
+                    if ('string' == typeof listed && listed !== range && isRegistryRange(listed)) {
+                        pkg[section] = {
+                            ...asRecord(pkg[section]),
+                            [name]: range
+                        };
+                        changed = true;
+                    }
+                }
+                return changed;
+            }));
+    }
+    declaredRange(file, source, name, wanted) {
+        const pkg = parseJsonObject(file, source);
+        const listed = DEPENDENCY_SECTIONS.map((section)=>asRecord(pkg[section])[name]).filter((value)=>'string' == typeof value);
+        const found = listed.find((value)=>value !== wanted) ?? listed[0];
+        if (void 0 !== found) return found;
+        throw new MfeflowError('E208', `${file} does not depend on ${name}`);
+    }
+    async setCatalogEntry(name, catalogName, range) {
+        const path = '' === catalogName || 'default' === catalogName ? [
+            'catalog'
+        ] : [
+            'catalogs',
+            catalogName
+        ];
+        const source = await this.content(WORKSPACE_FILE);
+        const doc = void 0 === source ? void 0 : parseDocument(source);
+        const problem = doc?.errors[0];
+        if (problem) throw new MfeflowError('E208', `${WORKSPACE_FILE} is not valid YAML (${problem.message})`, {
+            cause: problem
         });
+        if (void 0 === doc || !isMap(doc.getIn(path)) || !doc.hasIn([
+            ...path,
+            name
+        ])) throw new MfeflowError('E208', `${WORKSPACE_FILE} has no catalog entry for ${name}`);
+        doc.setIn([
+            ...path,
+            name
+        ], range);
+        let text;
+        try {
+            text = doc.toString();
+        } catch (error) {
+            throw new MfeflowError('E208', `${WORKSPACE_FILE} could not be written back (${messageOf(error)})`, {
+                cause: error
+            });
+        }
+        await this.patch(WORKSPACE_FILE, ()=>text);
     }
     async addScript(file, name, command) {
         let added = true;
@@ -600,6 +809,10 @@ class PlanBuilder {
         };
     }
 }
+function isRegistryRange(range) {
+    if ('' === range || range !== range.trim() || range.includes('/')) return false;
+    return /^[a-z][a-z0-9-]*$/.test(range) || null !== validRange(range);
+}
 function isPinnedElsewhere(range) {
     return range.startsWith('catalog:') || range.startsWith('workspace:');
 }
@@ -625,16 +838,20 @@ const VERB = {
     patch: 'patch ',
     delete: 'delete'
 };
+const dependencyLine = (d)=>`  ${d.file}  ${d.name}@${d.range}${d.dev ? ' (dev)' : ''}`;
 function summarize(plan) {
     const count = (action)=>plan.changes.filter((c)=>c.action === action).length;
     const lines = [
         `${String(count('create'))} to create, ${String(count('patch'))} to patch, ${String(count('delete'))} to delete`
     ];
     for (const c of plan.changes)lines.push(`  ${VERB[c.action]}  ${c.path}`);
-    if (plan.dependencies.length > 0) {
-        lines.push(`Dependencies (${String(plan.dependencies.length)}):`);
-        for (const d of plan.dependencies)lines.push(`  ${d.file}  ${d.name}@${d.range}${d.dev ? ' (dev)' : ''}`);
+    const dependencies = plan.dependencies.filter((d)=>true !== d.thirdParty);
+    const newPackages = plan.dependencies.filter((d)=>true === d.thirdParty);
+    if (dependencies.length > 0) {
+        lines.push(`Dependencies (${String(dependencies.length)}):`);
+        for (const d of dependencies)lines.push(dependencyLine(d));
     }
+    if (newPackages.length > 0) lines.push('', `NEW PACKAGES from a third-party feature (${String(newPackages.length)}):`, ...newPackages.map(dependencyLine), "  Check each one before you install. npm and yarn run a package's install scripts;", '  pnpm 10 and later blocks them until you allow them.', '');
     if (plan.scripts.length > 0) {
         lines.push(`Scripts added to package.json, not run (${String(plan.scripts.length)}):`);
         for (const s of plan.scripts)lines.push(`  ${s.file}  ${s.name}: ${s.command}`);
@@ -687,19 +904,19 @@ const DEVICE_NAMES = new Set([
     'lpt³'
 ]);
 const INVISIBLE = /[\p{Cc}\p{Cf}\p{Cn}\p{Co}\p{Cs}]/u;
-function refuse(file, why) {
+function write_policy_refuse(file, why) {
     throw new MfeflowError('E105', `"${file}" ${why}`);
 }
 function assertWritable(file) {
-    if (INVISIBLE.test(file)) refuse(file, 'has control or invisible characters');
+    if (INVISIBLE.test(file)) write_policy_refuse(file, 'has control or invisible characters');
     const key = policyKey(file);
-    if ('mfeflow.json' === key) refuse(file, 'is not a place features write to');
+    if ('mfeflow.json' === key) write_policy_refuse(file, 'is not a place features write to');
     for (const segment of key.split('/')){
-        if ('.git' === segment || 'node_modules' === segment) refuse(file, 'is not a place features write to');
-        if (segment.includes(':')) refuse(file, 'has a ":" (a Windows stream)');
-        if (/[. ]$/.test(segment)) refuse(file, 'has a name ending in a dot or space');
+        if ('.git' === segment || 'node_modules' === segment) write_policy_refuse(file, 'is not a place features write to');
+        if (segment.includes(':')) write_policy_refuse(file, 'has a ":" (a Windows stream)');
+        if (/[. ]$/.test(segment)) write_policy_refuse(file, 'has a name ending in a dot or space');
         const base = (segment.split('.')[0] ?? '').trimEnd();
-        if (DEVICE_NAMES.has(base)) refuse(file, 'is a Windows device name');
+        if (DEVICE_NAMES.has(base)) write_policy_refuse(file, 'is a Windows device name');
     }
 }
 const THIRD_PARTY_FOLDERS = new Set([
@@ -745,7 +962,7 @@ async function applyPlan(plan, options) {
     const realRoot = await ops.realpath(options.root);
     await inOrder(targets, async ({ change, file })=>{
         await assertContained(ops, realRoot, file, change.path);
-        await assertTrustedRoute(ops, options.root, change);
+        await assertTrustedRoute(ops, options.root, change, true === options.refuseSymlinks);
     });
     const current = await verifyUnchanged(targets, ops);
     if (options.dryRun) return {
@@ -762,7 +979,7 @@ async function applyPlan(plan, options) {
             const dir = await ops.mkdir(node_path.dirname(file));
             if (dir) createdDirs.push(dir);
             await assertContained(ops, realRoot, node_path.dirname(file), change.path);
-            await assertTrustedRoute(ops, options.root, change);
+            await assertTrustedRoute(ops, options.root, change, true === options.refuseSymlinks);
             const temp = tempSibling(file);
             staged.set(file, temp);
             await ops.writeFile(temp, change.after);
@@ -905,17 +1122,13 @@ async function assertContained(ops, realRoot, target, shown) {
     const inside = node_path.relative(realRoot, real);
     if (inside.startsWith('..') || node_path.isAbsolute(inside)) throw new MfeflowError('E105', `"${shown}" resolves through a symlink to ${real}`);
 }
-async function assertTrustedRoute(ops, root, change) {
-    if ('third-party' !== change.trust) return;
-    assertWritable(change.path);
-    const parts = change.path.split('/');
-    const prefixes = parts.map((_, i)=>parts.slice(0, i + 1).join('/'));
-    const linked = await Promise.all(prefixes.map(async (prefix)=>({
-            prefix,
-            link: await ops.isSymlink(node_path.join(root, ...prefix.split('/')))
-        })));
-    const hit = linked.find((entry)=>entry.link);
-    if (hit) throw new MfeflowError('E203', `"${change.path}" goes through a symlink at "${hit.prefix}", which third-party features may not write through`);
+async function assertTrustedRoute(ops, root, change, refuseAll) {
+    const thirdParty = 'third-party' === change.trust;
+    if (!thirdParty && !refuseAll) return;
+    if (thirdParty) assertWritable(change.path);
+    const hit = await symlinkedPrefix(ops, root, change.path);
+    if (hit && !thirdParty) throw new MfeflowError('E105', `"${change.path}" goes through a symlink at "${hit}", which is never written through`);
+    if (hit) throw new MfeflowError('E203', `"${change.path}" goes through a symlink at "${hit}", which third-party features may not write through`);
 }
 async function deepestRealpath(ops, target) {
     try {
@@ -1004,11 +1217,6 @@ function substitute(source, data, name = 'template') {
         return String(value);
     });
 }
-const RUNTIME_CONFIG_FILE = /^runtime-config(?:\.([a-z0-9-]+))?\.json$/;
-async function runtimeConfigFiles(folder) {
-    const names = await promises.readdir(folder).catch(()=>[]);
-    return names.filter((name)=>RUNTIME_CONFIG_FILE.test(name)).toSorted((a, b)=>a.localeCompare(b));
-}
 function applyEdits(source, edits) {
     return edits.toSorted((a, b)=>b.start - a.start).reduce((out, e)=>out.slice(0, e.start) + e.text + out.slice(e.end), source);
 }
@@ -1477,7 +1685,8 @@ function schemaKeys(source, file, scope, object = 'runtimeConfigSchema') {
         return [
             {
                 name,
-                optional: rawKey(p) !== name || acceptsMissing(p.value)
+                optional: rawKey(p) !== name || acceptsMissing(p.value),
+                schema: source.slice(p.value.start ?? 0, p.value.end ?? 0)
             }
         ];
     });
@@ -1697,139 +1906,6 @@ function applyTransform(source, file, op) {
             throw new MfeflowError('E204', JSON.stringify(Reflect.get(op, 'op')));
     }
 }
-const MAX_BYTES = 1000000;
-const TIMEOUT_MS = 10000;
-const MAX_REDIRECTS = 5;
-const realFetch = (url, init)=>fetch(url, init);
-function registryUrl(name, registries, version) {
-    const slash = name.indexOf('/');
-    const namespace = name.slice(0, slash);
-    const bare = name.slice(slash + 1);
-    const template = registries[namespace];
-    if (void 0 === template) throw new MfeflowError('E210', namespace);
-    const url = template.replaceAll('{name}', encodeURIComponent(bare)).replaceAll('{version}', encodeURIComponent(version ?? 'latest'));
-    let parsed;
-    try {
-        parsed = new URL(url);
-    } catch (error) {
-        throw new MfeflowError('E401', `${namespace} has an invalid URL (${url})`, {
-            cause: error
-        });
-    }
-    if (!isRegistryProtocol(parsed)) throw new MfeflowError('E401', `${url} is not https (plain http is for 127.0.0.1, localhost and [::1] only)`);
-    return parsed.href;
-}
-async function getHttps(url, fetchImpl, code, options = {}) {
-    const fail = (at, why, cause)=>{
-        throw new MfeflowError(code, `${at}: ${why}`, void 0 === cause ? {} : {
-            cause
-        });
-    };
-    const startsLoopback = true === options.loopback && isLoopbackHttp(new URL(url));
-    const permitted = (target)=>'https:' === target.protocol || startsLoopback && isLoopbackHttp(target);
-    const addressOk = (address)=>{
-        try {
-            return permitted(new URL(address));
-        } catch  {
-            return false;
-        }
-    };
-    let current = url;
-    for(let hop = 0; hop <= MAX_REDIRECTS; hop += 1){
-        let response;
-        try {
-            response = await fetchImpl(current, {
-                signal: AbortSignal.timeout(TIMEOUT_MS),
-                redirect: 'manual'
-            });
-        } catch (error) {
-            return fail(current, messageOf(error), error);
-        }
-        if (void 0 !== response.url && '' !== response.url && !addressOk(response.url)) fail(url, `ended up at ${response.url}, which is not https`);
-        if (response.status < 300 || response.status >= 400) return response;
-        const location = response.headers?.get('location');
-        await response.body?.cancel().catch(()=>void 0);
-        if (null == location || '' === location) fail(current, `redirected (${String(response.status)}) with no address`);
-        let next;
-        try {
-            next = new URL(location ?? '', current);
-        } catch (error) {
-            return fail(current, 'redirected to a bad address', error);
-        }
-        if (!permitted(next)) fail(url, `redirected to ${next.href}, which is not https`);
-        current = next.href;
-    }
-    return fail(url, 'redirected too many times');
-}
-async function fetchRemoteText(name, registries, fetchImpl = realFetch, version) {
-    const url = registryUrl(name, registries, version);
-    const response = await getHttps(url, fetchImpl, 'E401', {
-        loopback: true
-    });
-    if (!response.ok) {
-        const hint = 404 === response.status ? `${name} is not in that registry` : void 0;
-        throw new MfeflowError('E401', `${url} answered ${String(response.status)}${hint ? `: ${hint}` : ''}`);
-    }
-    return readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E402', `${url} is larger than 1 MB`));
-}
-async function readCappedText(response, maxBytes, tooBig) {
-    const declared = Number(response.headers?.get('content-length') ?? 0 / 0);
-    if (declared > maxBytes) {
-        await response.body?.cancel().catch(()=>void 0);
-        throw tooBig();
-    }
-    if (!response.body) {
-        const text = await response.text();
-        if (Buffer.byteLength(text, 'utf8') > maxBytes) throw tooBig();
-        return text;
-    }
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of response.body){
-        total += chunk.byteLength;
-        if (total > maxBytes) throw tooBig();
-        chunks.push(chunk);
-    }
-    return new TextDecoder().decode(Buffer.concat(chunks));
-}
-async function fetchFeatureIndex(namespace, registries, fetchImpl = realFetch) {
-    const template = registries[namespace];
-    if (void 0 === template) throw new MfeflowError('E210', namespace);
-    const problem = registryTemplateProblem(template);
-    if (void 0 !== problem) throw new MfeflowError('E401', `${namespace}: ${problem}`);
-    const url = registryIndexUrl(template);
-    const response = await getHttps(url, fetchImpl, 'E401', {
-        loopback: true
-    });
-    if (!response.ok) {
-        const hint = 404 === response.status ? ': this registry has no index.json' : '';
-        throw new MfeflowError('E401', `${url} answered ${String(response.status)}${hint}`);
-    }
-    const text = await readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E403', `${url} is larger than 1 MB`));
-    let value;
-    try {
-        value = JSON.parse(text);
-    } catch (error) {
-        const reason = messageOf(error).replaceAll(/\p{Cc}/gu, '?');
-        throw new MfeflowError('E403', `${url} is not JSON (${reason})`, {
-            cause: error
-        });
-    }
-    const issues = validateFeatureRegistryIndex(value);
-    if (issues.length > 0) {
-        const shown = issues.slice(0, 3).map((i)=>`${i.path || '(root)'} ${i.message}`);
-        const more = issues.length > 3 ? `; and ${String(issues.length - 3)} more` : '';
-        throw new MfeflowError('E403', `${url}: ${shown.join('; ')}${more}`);
-    }
-    return itemsOf(value);
-}
-function itemsOf(value) {
-    const holder = {
-        items: []
-    };
-    Object.assign(holder, value);
-    return holder.items;
-}
 const ROOTS = new Set([
     'z',
     'v',
@@ -1948,7 +2024,7 @@ function isModuleSpecifier(value) {
 }
 const DIST_TAG = /^[a-z][a-z0-9-]*$/;
 const TARBALL_NAME = /[.](?:tgz|tar\.gz|tar)$/i;
-function isRegistryRange(range) {
+function policy_isRegistryRange(range) {
     if ('' === range || range !== range.trim()) return false;
     if (range.includes('/') || range.includes('\\')) return false;
     if (range.split(/\s+|\|\|/).some((part)=>TARBALL_NAME.test(part))) return false;
@@ -1992,7 +2068,7 @@ function assertThirdPartyContent(manifest, label) {
     }
     for (const dep of manifest.dependencies ?? []){
         if (dep.name.includes('{{')) throw new MfeflowError('E203', `${label}: ${dep.name} names a package in the project's scope`);
-        if (!isRegistryRange(dep.range)) throw new MfeflowError('E203', `${label}: ${dep.name}@${dep.range} is not a registry version range`);
+        if (!policy_isRegistryRange(dep.range)) throw new MfeflowError('E203', `${label}: ${dep.name}@${dep.range} is not a registry version range`);
     }
     for (const t of manifest.transforms ?? [])assertThirdPartyTransform(t, label);
     for (const script of manifest.scripts ?? [])assertPlainScript(script.name, manifest.name, label);
@@ -2008,90 +2084,16 @@ function assertThirdPartyTransform(t, label) {
         for (const key of Object.keys(t.props ?? {}))if (!JSX_ATTRIBUTE.test(key)) deny(`has a prop "${key}" that is not a JSX attribute name`);
     }
 }
-function parseFeature(text, trust, label) {
-    let value;
-    try {
-        value = JSON.parse(text);
-    } catch (error) {
-        throw new MfeflowError('E202', `${label}: ${messageOf(error)}`, {
-            cause: error
-        });
-    }
-    if ('object' != typeof value || null === value || Array.isArray(value)) throw new MfeflowError('E202', `${label}: must be a JSON object`);
-    const record = Object.fromEntries(Object.entries(value));
-    if ('third-party' === trust) assertAllowedKeys(record, label);
-    assertKnownOps(record, label);
-    const issues = validateFeatureManifest(record);
-    if (issues.length > 0) {
-        const detail = issues.map((i)=>`${i.path || '(root)'} ${i.message}`).join('; ');
-        throw new MfeflowError('E202', `${label}: ${detail}`);
+const LETTERS = 'abcdefghijklmnopqrstuvwxyz';
+function shortHash(text) {
+    let hash = 0x811c9dc5;
+    for (const char of text)hash = Math.imul(hash ^ char.codePointAt(0), 0x01000193) >>> 0;
+    let out = '';
+    for(let i = 0; i < 4; i++){
+        out += LETTERS[hash % 26];
+        hash = Math.floor(hash / 26);
     }
-    const manifest = toManifest(record, label);
-    if ('third-party' === trust) assertThirdPartyContent(manifest, label);
-    return manifest;
-}
-function toManifest(record, label) {
-    const manifest = {
-        name: '',
-        version: ''
-    };
-    Object.assign(manifest, record);
-    if ('' === manifest.name) throw new MfeflowError('E202', `${label}: name is required`);
-    return manifest;
-}
-async function loadFeature(name, options) {
-    if (!FEATURE_NAME.test(name)) throw new MfeflowError('E201', `"${name}" is not a feature name`);
-    if (name.startsWith('@')) return loadRemote(name, options);
-    return loadLocal(name, options);
-}
-async function loadLocal(name, options) {
-    const ops = options.fs ?? realFs;
-    if (!options.featuresDir) throw new MfeflowError('E201', `"${name}" (no features folder configured)`);
-    const dir = node_path.join(options.featuresDir, name);
-    const text = await readIfExists(ops, node_path.join(dir, 'feature.json'));
-    if (void 0 === text) throw new MfeflowError('E201', `"${name}" (looked in ${options.featuresDir})`);
-    const manifest = parseFeature(text, 'first-party', `${name}/feature.json`);
-    if (manifest.name !== name) throw new MfeflowError('E202', `${name}/feature.json: name is "${manifest.name}", expected "${name}"`);
-    return {
-        manifest,
-        trust: 'first-party',
-        readAsset: async (relative)=>{
-            if (!isSafeRelativePath(relative)) throw new MfeflowError('E105', `"${relative}"`);
-            const content = await readIfExists(ops, node_path.join(dir, ...relative.split('/')));
-            if (void 0 === content) throw new MfeflowError('E201', `${name}: file "${relative}" is missing`);
-            return content;
-        }
-    };
-}
-async function loadRemote(name, options) {
-    const text = await fetchRemoteText(name, options.registries ?? {}, options.fetch, options.version);
-    const manifest = parseFeature(text, 'third-party', name);
-    if (manifest.name !== name) throw new MfeflowError('E402', `asked for ${name}, got ${manifest.name}`);
-    return {
-        manifest,
-        trust: 'third-party'
-    };
-}
-async function listLocalFeatures(featuresDir, ops = realFs) {
-    let dirs;
-    try {
-        dirs = await ops.listDirs(featuresDir);
-    } catch  {
-        return [];
-    }
-    const checked = await Promise.all(dirs.map(async (dir)=>await readIfExists(ops, node_path.join(featuresDir, dir, 'feature.json')) === void 0 ? void 0 : dir));
-    return checked.filter((d)=>void 0 !== d).toSorted((a, b)=>a.localeCompare(b));
-}
-const LETTERS = 'abcdefghijklmnopqrstuvwxyz';
-function shortHash(text) {
-    let hash = 0x811c9dc5;
-    for (const char of text)hash = Math.imul(hash ^ char.codePointAt(0), 0x01000193) >>> 0;
-    let out = '';
-    for(let i = 0; i < 4; i++){
-        out += LETTERS[hash % 26];
-        hash = Math.floor(hash / 26);
-    }
-    return out;
+    return out;
 }
 function tailwindPrefix(name) {
     if (/^[a-z]+$/.test(name)) return name;
@@ -2263,7 +2265,10 @@ async function resolveFeature(input) {
         version: manifest.version,
         ...Object.keys(options).length > 0 ? {
             options
-        } : {}
+        } : {},
+        ...void 0 === feature.integrity ? {} : {
+            integrity: feature.integrity
+        }
     });
 }
 async function editFile(builder, file, edit, op) {
@@ -2273,6 +2278,2109 @@ async function editFile(builder, file, edit, op) {
     if (isConfig && !await builder.exists(file)) return void await builder.create(file, edit('{}\n'));
     await builder.patch(file, edit);
 }
+const upgrade_WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const upgrade_TURBO_FILE = 'turbo.json';
+const upgrade_DEPENDENCY_SECTIONS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies'
+];
+const OWN_PREFIX = '@mfeflow/';
+const OWN_CLI = 'mfeflow';
+const PLACEHOLDER_RANGE = 'latest';
+const USER_DATA = /^registry\/envs\//;
+const ENV_KEY_FILES = /(^|\/)(env\.ts|src\/config\/schema\.ts|runtime-config(\.[^/]+)?\.json|\.env[^/]*)$/;
+const KEEP_RANGE = /^(workspace|link|file|portal):/;
+const byCodePoint = (a, b)=>a < b ? -1 : a > b ? 1 : 0;
+const isOwn = (name)=>name === OWN_CLI || name.startsWith(OWN_PREFIX);
+const isPackageFile = (file)=>'package.json' === file || file.endsWith('/package.json');
+const isStructured = (file)=>isPackageFile(file) || file === upgrade_WORKSPACE_FILE || file === upgrade_TURBO_FILE;
+const sameText = (a, b)=>normalizeEol(a) === normalizeEol(b);
+async function runtimeRange(pkgFile, read) {
+    const source = await read(pkgFile);
+    if (void 0 === source) return;
+    const pkg = parseJsonObject(pkgFile, source);
+    for (const section of upgrade_DEPENDENCY_SECTIONS){
+        const value = asRecord(pkg[section])['@mfeflow/runtime'];
+        if ('string' == typeof value) {
+            if (!value.startsWith('catalog:')) return {
+                range: value,
+                catalog: void 0
+            };
+            return {
+                range: value,
+                catalog: value.slice(8)
+            };
+        }
+    }
+}
+async function catalogRange(read, catalogName) {
+    const source = await read(upgrade_WORKSPACE_FILE);
+    if (void 0 === source) return;
+    const doc = parseDocument(source);
+    const where = '' === catalogName || 'default' === catalogName ? [
+        'catalog'
+    ] : [
+        'catalogs',
+        catalogName
+    ];
+    const value = doc.getIn([
+        ...where,
+        '@mfeflow/runtime'
+    ]);
+    return 'string' == typeof value ? value : void 0;
+}
+function resolveRange(found, read) {
+    return void 0 === found.catalog ? Promise.resolve(found.range) : catalogRange(read, found.catalog);
+}
+async function detectBaseline(project, read) {
+    if (void 0 !== project.cli) return {
+        version: project.cli,
+        source: 'mfeflow.json'
+    };
+    const apps = Object.values(project.apps).toSorted((a, b)=>Number('shell' === b.kind) - Number('shell' === a.kind));
+    for (const app of apps){
+        const file = '' === app.path ? 'package.json' : `${app.path}/package.json`;
+        const found = await runtimeRange(file, read);
+        if (void 0 === found) continue;
+        const range = await resolveRange(found, read);
+        const min = void 0 === range || KEEP_RANGE.test(range) ? void 0 : minimum(range);
+        if (void 0 === min) throw new MfeflowError('E601', `${file} has @mfeflow/runtime at ${JSON.stringify(found.range)}, which does not name a version`);
+        return {
+            version: min,
+            source: 'package.json'
+        };
+    }
+    throw new MfeflowError('E601', 'mfeflow.json has no "cli" and no app depends on @mfeflow/runtime');
+}
+function minimum(range) {
+    if (null === semver.validRange(range)) return;
+    const min = semver.minVersion(range)?.version;
+    return '0.0.0' === min ? void 0 : min;
+}
+function recordedOptions(feature, project, warnings) {
+    const recorded = project.features[feature.manifest.name]?.options ?? {};
+    const known = new Set((feature.manifest.prompts ?? []).map((p)=>p.name));
+    const kept = {};
+    for (const [key, value] of Object.entries(recorded))if (known.has(key)) kept[key] = value;
+    else warnings.push(`${feature.manifest.name} no longer has the option "${key}"; it was ignored`);
+    return kept;
+}
+const depKey = (file, name)=>`${file}\0${name}`;
+async function replay(project, input) {
+    const local = void 0 !== project.local;
+    const builder = new PlanBuilder(()=>Promise.resolve(void 0), {
+        catalog: true,
+        ...local ? {} : {
+            rewriteRange: (name, range)=>isOwn(name) && range === PLACEHOLDER_RANGE ? `^${input.toVersion}` : void 0
+        }
+    });
+    const warnings = [];
+    const names = [
+        ...input.features.map((f)=>f.manifest.name),
+        ...(input.skipped ?? []).map((s)=>s.name)
+    ];
+    const bare = {
+        ...project,
+        features: {}
+    };
+    const steps = [
+        ...input.features.map((feature)=>({
+                feature,
+                options: recordedOptions(feature, project, warnings)
+            })),
+        ...(input.glue ?? []).map((feature)=>({
+                feature,
+                options: {}
+            }))
+    ];
+    for (const step of steps)await resolveFeature({
+        ...step,
+        project: bare,
+        builder,
+        alsoAdding: names
+    });
+    const built = builder.build();
+    const files = new Map();
+    const tracked = new Set();
+    const thirdParty = new Set();
+    for (const change of built.changes){
+        if ('third-party' === change.trust) thirdParty.add(change.path);
+        if (null !== change.after) {
+            files.set(change.path, change.after);
+            if (change.track) tracked.add(change.path);
+        }
+    }
+    const thirdPartyDeps = new Set(built.dependencies.filter((d)=>true === d.thirdParty).map((d)=>depKey(d.file, d.name)));
+    const byName = new Map(built.features.map((f)=>[
+            f.name,
+            f
+        ]));
+    return {
+        files,
+        tracked,
+        thirdParty,
+        thirdPartyDeps,
+        features: [
+            ...byName.values()
+        ],
+        warnings
+    };
+}
+function keepLineEndings(change) {
+    if (null === change.after || !change.before?.includes('\r\n')) return change;
+    return {
+        ...change,
+        after: normalizeEol(change.after).replaceAll('\n', '\r\n')
+    };
+}
+function unifiedDiff(file, yours, incoming) {
+    return formatPatch(structuredPatch(`a/${file} (yours)`, `b/${file} (new)`, yours, incoming));
+}
+function entriesOf(file, source) {
+    const base = file.slice(file.lastIndexOf('/') + 1);
+    try {
+        if (base.endsWith('.json')) {
+            const json = parseJsonObject(file, source);
+            return new Map(Object.entries(json).map(([key, value])=>[
+                    key,
+                    JSON.stringify(value)
+                ]));
+        }
+        if (base.startsWith('.env')) {
+            const values = new Map();
+            for (const line of source.split('\n')){
+                const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(line);
+                if (match?.[1] !== void 0) values.set(match[1], (match[2] ?? '').trim());
+            }
+            return values;
+        }
+        const keys = schemaKeys(source, file, 'env.ts' === base ? 'server' : 'runtime');
+        return void 0 === keys ? void 0 : new Map(keys.map((k)=>[
+                k.name,
+                k.schema.replaceAll(/\s+/g, ' ')
+            ]));
+    } catch  {
+        return;
+    }
+}
+function lostKeys(file, disk, incoming) {
+    const yours = entriesOf(file, disk);
+    const wanted = entriesOf(file, incoming);
+    if (void 0 === yours || void 0 === wanted) return;
+    const missing = [
+        ...yours
+    ].filter(([key])=>!wanted.has(key)).map(([key])=>key);
+    const changed = [
+        ...yours
+    ].filter(([key, value])=>wanted.has(key) && wanted.get(key) !== value).map(([key])=>key);
+    return {
+        missing,
+        changed
+    };
+}
+const writes = (verdict)=>'create' === verdict || 'replace' === verdict || 'missing' !== verdict && 'matching' !== verdict && 'leave' !== verdict && 'symlink' !== verdict;
+function judge(file, disk, incoming, state) {
+    const { recorded, kept, anySkipped } = state;
+    if (void 0 === disk) {
+        if (void 0 !== recorded) return 'missing';
+        return USER_DATA.test(file) ? 'leave' : 'create';
+    }
+    if (sameText(disk, incoming)) return void 0 !== recorded && recorded !== hashContent(disk) ? 'matching' : 'leave';
+    if (USER_DATA.test(file)) return 'leave';
+    if (void 0 !== kept) return kept === hashContent(incoming) ? 'leave' : 'edited';
+    if (void 0 !== recorded && recorded === hashContent(incoming)) return 'leave';
+    if (void 0 === recorded) return 'untracked';
+    if (recorded !== hashContent(disk)) return 'edited';
+    if (ENV_KEY_FILES.test(file)) {
+        const lost = lostKeys(file, disk, incoming);
+        if (void 0 === lost || lost.missing.length > 0) return 'edited-by-cli';
+    }
+    return anySkipped ? 'skipped-feature' : 'replace';
+}
+async function compareFiles(project, fresh, read, builder, options) {
+    const out = {
+        diverged: [],
+        kept: [],
+        missing: [],
+        matching: [],
+        notes: []
+    };
+    const entries = [
+        ...fresh.files
+    ].toSorted(([a], [b])=>a < b ? -1 : 1);
+    for (const [file, incoming] of entries){
+        const disk = await read(file);
+        if (isStructured(file) && void 0 !== disk) continue;
+        let verdict = judge(file, disk, incoming, {
+            ...project.files?.[file] === void 0 ? {} : {
+                recorded: project.files[file]
+            },
+            ...project.kept?.[file] === void 0 ? {} : {
+                kept: project.kept[file]
+            },
+            anySkipped: options.anySkipped
+        });
+        if (writes(verdict) && await options.isSymlink?.(file)) verdict = 'symlink';
+        if ('missing' === verdict) out.missing.push(file);
+        else if ('matching' === verdict) out.matching.push(file);
+        else if ('create' === verdict) await builder.create(file, incoming, fresh.tracked.has(file));
+        else if ('replace' === verdict) {
+            const changed = ENV_KEY_FILES.test(file) ? lostKeys(file, disk ?? '', incoming)?.changed : [];
+            if (void 0 !== changed && changed.length > 0) out.notes.push(`${file}: the values of ${changed.join(', ')} change to the new version's; if you set them with mfeflow add env-key, set them again`);
+            await builder.replace(file, incoming);
+        } else if ('leave' !== verdict) {
+            const entry = diverge(file, verdict, disk ?? '', incoming);
+            const decision = 'symlink' === verdict ? void 0 : decide(file, options.decisions);
+            if (void 0 !== decision) entry.decision = decision;
+            out.diverged.push(entry);
+            if ('accept' === decision) await builder.replace(file, incoming);
+            else if ('keep' === decision) out.kept.push(entry);
+        }
+    }
+    return out;
+}
+function diverge(file, reason, yours, incoming) {
+    const entry = {
+        path: file,
+        reason,
+        yours,
+        incoming,
+        diff: unifiedDiff(file, yours, incoming)
+    };
+    const lost = ENV_KEY_FILES.test(file) ? lostKeys(file, yours, incoming) : void 0;
+    if (void 0 !== lost && lost.missing.length + lost.changed.length > 0) {
+        const all = new Set([
+            ...lost.missing,
+            ...lost.changed
+        ]);
+        entry.lostKeys = [
+            ...entriesOf(file, yours)?.keys() ?? []
+        ].filter((key)=>all.has(key));
+        if (lost.changed.length > 0) entry.changedValues = lost.changed;
+    }
+    return entry;
+}
+const upgrade_named = (set, file)=>'all' === set || set?.has(file) === true;
+function decide(file, decisions) {
+    const accept = upgrade_named(decisions.accept, file);
+    const keep = upgrade_named(decisions.keep, file);
+    if (accept && keep) return 'all' === decisions.accept && 'all' !== decisions.keep ? 'keep' : 'accept';
+    if (accept) return 'accept';
+    return keep ? 'keep' : void 0;
+}
+async function editWorkspace(fresh, read, builder, local) {
+    const incoming = fresh.files.get(upgrade_WORKSPACE_FILE);
+    const disk = await read(upgrade_WORKSPACE_FILE);
+    if (void 0 === incoming || void 0 === disk) return;
+    const wanted = asRecord(parseDocument(incoming).toJSON());
+    const doc = parseDocument(disk);
+    let changed = false;
+    for (const section of [
+        'catalog',
+        'allowBuilds'
+    ]){
+        const have = doc.get(section);
+        for (const [name, value] of Object.entries(asRecord(wanted[section])))if (!(isMap(have) && have.has(name) || local && isOwn(name))) {
+            doc.setIn([
+                section,
+                name
+            ], value);
+            changed = true;
+        }
+    }
+    if (changed) await builder.patch(upgrade_WORKSPACE_FILE, ()=>doc.toString());
+}
+async function editTurbo(fresh, read, builder) {
+    const incoming = fresh.files.get(upgrade_TURBO_FILE);
+    if (void 0 === incoming || await read(upgrade_TURBO_FILE) === void 0) return;
+    const wanted = asRecord(asRecord(parseJsonObject(upgrade_TURBO_FILE, incoming)).tasks);
+    await builder.patch(upgrade_TURBO_FILE, (source)=>editJsonObject(upgrade_TURBO_FILE, source, (turbo)=>{
+            const tasks = asRecord(turbo.tasks);
+            const missing = Object.entries(wanted).filter(([name])=>!(name in tasks));
+            if (0 === missing.length) return false;
+            turbo.tasks = {
+                ...tasks,
+                ...Object.fromEntries(missing)
+            };
+            return true;
+        }));
+}
+function upgrade_listed(pkg) {
+    return upgrade_DEPENDENCY_SECTIONS.flatMap((section)=>Object.entries(asRecord(pkg[section])).flatMap(([name, range])=>'string' == typeof range ? [
+                [
+                    name,
+                    range
+                ]
+            ] : []));
+}
+function upgrade_declared(pkg) {
+    const out = new Map();
+    for (const section of upgrade_DEPENDENCY_SECTIONS)for (const [name, range] of Object.entries(asRecord(pkg[section])))if ('string' == typeof range) out.set(name, range);
+    return out;
+}
+async function addMissing(file, pkg, wanted, local, builder) {
+    const have = upgrade_declared(pkg);
+    for (const [section, dev] of [
+        [
+            'dependencies',
+            false
+        ],
+        [
+            'devDependencies',
+            true
+        ]
+    ])for (const [name, range] of Object.entries(asRecord(wanted[section])))if (!(have.has(name) || 'string' != typeof range || local && isOwn(name))) await builder.addDependency(file, name, range, dev);
+    const scripts = asRecord(pkg.scripts);
+    for (const [name, command] of Object.entries(asRecord(wanted.scripts)))if (!(name in scripts) && 'string' == typeof command) await builder.addScript(file, name, command);
+}
+async function editPackage(file, fresh, toVersion, local, builder) {
+    const source = await builder.content(file);
+    if (void 0 === source) return;
+    const incoming = fresh.files.get(file);
+    if (void 0 !== incoming) await addMissing(file, parseJsonObject(file, source), parseJsonObject(file, incoming), local, builder);
+    if (local) return;
+    const target = `^${toVersion}`;
+    const current = parseJsonObject(file, await builder.content(file) ?? source);
+    for (const [name, range] of upgrade_listed(current))if (!(!isOwn(name) || range === target || KEEP_RANGE.test(range))) await builder.setRange(file, name, target);
+}
+function pendingMigrations(features, project) {
+    const pending = [];
+    for (const feature of features){
+        const { name, version, migrations } = feature.manifest;
+        const recorded = project.features[name]?.version;
+        if (void 0 !== recorded && null !== semver.valid(recorded)) {
+            if ('first-party' === feature.trust) {
+                for (const m of migrations ?? [])if (null !== semver.valid(m.to) && null !== semver.valid(version)) {
+                    if (semver.lt(recorded, m.to) && semver.lte(m.to, version)) pending.push({
+                        feature,
+                        ...m
+                    });
+                }
+            }
+        }
+    }
+    return pending.toSorted((a, b)=>semver.compare(a.to, b.to));
+}
+async function importDefault(file) {
+    return import(pathToFileURL(file).href);
+}
+async function loadMigration(step, importModule) {
+    const name = step.feature.manifest.name;
+    const label = `${name} ${step.from} to ${step.to} (${step.module})`;
+    const { dir } = step.feature;
+    if (void 0 === dir || !isSafeRelativePath(step.module)) throw new MfeflowError('E603', `${label}: cannot find ${step.module}`);
+    let loaded;
+    try {
+        loaded = await importModule(node_path.join(dir, ...step.module.split('/')));
+    } catch (error) {
+        throw new MfeflowError('E603', `${label}: ${messageOf(error)}`, {
+            cause: error
+        });
+    }
+    const exported = asRecord(loaded);
+    const fn = 'function' == typeof exported.default ? exported.default : exported.migrate;
+    if ('function' != typeof fn) throw new MfeflowError('E603', `${label}: ${step.module} exports no migration function`);
+    return async (builder, project)=>{
+        try {
+            await Reflect.apply(fn, void 0, [
+                builder,
+                project
+            ]);
+        } catch (error) {
+            throw new MfeflowError('E603', `${label}: ${messageOf(error)}`, {
+                cause: error
+            });
+        }
+    };
+}
+async function runMigrations(project, input, builder) {
+    const importModule = input.importModule ?? importDefault;
+    const ran = [];
+    for (const step of pendingMigrations(input.features, project)){
+        const migrate = await loadMigration(step, importModule);
+        await migrate(builder.scoped('first-party'), project);
+        ran.push({
+            feature: step.feature.manifest.name,
+            from: step.from,
+            to: step.to
+        });
+    }
+    return ran;
+}
+async function findRemoved(project, fresh, read) {
+    const removed = [];
+    for (const file of Object.keys(project.files ?? {}).toSorted(byCodePoint))if (!(fresh.files.has(file) || USER_DATA.test(file) || ENV_KEY_FILES.test(file))) {
+        if (await read(file) !== void 0) removed.push(file);
+    }
+    return removed;
+}
+async function planUpgrade(project, input) {
+    if (null === semver.valid(input.toVersion)) throw new MfeflowError('E601', `"${input.toVersion}" is not a version`);
+    const baseline = await detectBaseline(project, input.read);
+    if (null === semver.valid(baseline.version) || semver.gt(baseline.version, input.toVersion)) throw new MfeflowError('E602', `project is at ${baseline.version}, target is ${input.toVersion}`);
+    const fresh = await replay(project, input);
+    const builder = new PlanBuilder(input.read, {});
+    await builder.captureProject();
+    const compared = await compareFiles(project, fresh, input.read, builder, {
+        anySkipped: (input.skipped ?? []).length > 0,
+        decisions: input.decisions ?? {},
+        ...input.isSymlink ? {
+            isSymlink: input.isSymlink
+        } : {}
+    });
+    await editWorkspace(fresh, input.read, builder, void 0 !== project.local);
+    await editTurbo(fresh, input.read, builder);
+    const local = void 0 !== project.local;
+    const packageFiles = new Set([
+        ...fresh.files.keys(),
+        ...Object.values(project.apps).map((a)=>('' === a.path ? '' : `${a.path}/`) + 'package.json'),
+        'package.json'
+    ].filter(isPackageFile));
+    for (const file of [
+        ...packageFiles
+    ].toSorted(byCodePoint))if (await input.read(file)) await editPackage(file, fresh, input.toVersion, local, builder);
+    const migrations = await runMigrations(project, input, builder);
+    const skipped = input.skipped ?? [];
+    const planned = (file)=>builder.content(file);
+    const removed = 0 === skipped.length ? await findRemoved(project, fresh, planned) : [];
+    const built = builder.build();
+    const plan = {
+        ...built,
+        changes: built.changes.map((change)=>{
+            const kept = keepLineEndings(change);
+            kept.trust = fresh.thirdParty.has(kept.path) ? 'third-party' : kept.trust;
+            return kept;
+        }),
+        dependencies: built.dependencies.map((dep)=>{
+            if (fresh.thirdPartyDeps.has(depKey(dep.file, dep.name))) dep.thirdParty = true;
+            return dep;
+        }),
+        features: fresh.features,
+        warnings: [
+            ...fresh.warnings,
+            ...compared.notes,
+            ...built.warnings,
+            ...skipped.map(({ name, reason })=>`${name} was not replayed (${reason}); its files were left as they are`)
+        ]
+    };
+    const files = {
+        ...project.files
+    };
+    const kept = {
+        ...project.kept
+    };
+    for (const file of compared.matching)files[file] = hashContent(fresh.files.get(file) ?? '');
+    for (const entry of compared.diverged)if ('accept' === entry.decision) {
+        files[entry.path] = hashContent(entry.incoming);
+        delete kept[entry.path];
+    }
+    for (const entry of compared.kept){
+        files[entry.path] = hashContent(entry.yours);
+        kept[entry.path] = hashContent(entry.incoming);
+    }
+    const next = {
+        ...project,
+        cli: input.toVersion
+    };
+    if (Object.keys(files).length > 0) next.files = files;
+    if (Object.keys(kept).length > 0) next.kept = kept;
+    else delete next.kept;
+    return {
+        from: baseline.version,
+        fromSource: baseline.source,
+        to: input.toVersion,
+        plan,
+        project: next,
+        diverged: compared.diverged,
+        migrations,
+        removed,
+        missing: compared.missing
+    };
+}
+const RUNTIME_CONFIG_FILE = /^runtime-config(?:\.([a-z0-9-]+))?\.json$/;
+async function runtimeConfigFiles(folder) {
+    const names = await promises.readdir(folder).catch(()=>[]);
+    return names.filter((name)=>RUNTIME_CONFIG_FILE.test(name)).toSorted((a, b)=>a.localeCompare(b));
+}
+const ok = (value)=>({
+        ok: true,
+        value
+    });
+const evaluate_fail = (reason)=>({
+        ok: false,
+        reason
+    });
+function evaluate_unwrap(node) {
+    if (!node) return;
+    if (isTSAsExpression(node) || isTSSatisfiesExpression(node) || isTSNonNullExpression(node) || isTSTypeAssertion(node)) return evaluate_unwrap(node.expression);
+    return node;
+}
+function requireSource(node) {
+    const n = evaluate_unwrap(node);
+    if (isCallExpression(n) && isIdentifier(n.callee, {
+        name: 'require'
+    })) {
+        const arg = n.arguments[0];
+        return isStringLiteral(arg) ? {
+            source: arg.value,
+            path: []
+        } : void 0;
+    }
+    if (isMemberExpression(n) && !n.computed && isIdentifier(n.property)) {
+        const inner = requireSource(n.object);
+        return inner ? {
+            source: inner.source,
+            path: [
+                ...inner.path,
+                n.property.name
+            ]
+        } : void 0;
+    }
+}
+function evaluate_keyName(key) {
+    if (isIdentifier(key)) return key.name;
+    if (isStringLiteral(key)) return key.value;
+}
+function bindVariables(statement, bindings) {
+    if (!isVariableDeclaration(statement)) return;
+    for (const decl of statement.declarations){
+        const required = requireSource(decl.init);
+        if (isIdentifier(decl.id)) if (required) bindings.set(decl.id.name, {
+            kind: 'import',
+            source: required.source,
+            imported: required.path.at(-1) ?? 'default',
+            depth: required.path.length
+        });
+        else if ('const' === statement.kind && decl.init) bindings.set(decl.id.name, {
+            kind: 'const',
+            init: decl.init
+        });
+        else bindings.set(decl.id.name, {
+            kind: 'other',
+            what: `a ${statement.kind} variable`
+        });
+        else if (isObjectPattern(decl.id)) for (const prop of decl.id.properties){
+            if (!isObjectProperty(prop) || !isIdentifier(prop.value)) continue;
+            const imported = evaluate_keyName(prop.key);
+            if (required && imported) bindings.set(prop.value.name, {
+                kind: 'import',
+                source: required.source,
+                imported,
+                depth: required.path.length + 1
+            });
+            else bindings.set(prop.value.name, {
+                kind: 'other',
+                what: 'a destructured value'
+            });
+        }
+    }
+}
+function isModuleExports(node) {
+    return isMemberExpression(node) && isIdentifier(node.object, {
+        name: 'module'
+    }) && isIdentifier(node.property, {
+        name: 'exports'
+    });
+}
+const MUTATING_METHODS = new Set([
+    'push',
+    'pop',
+    'shift',
+    'unshift',
+    'splice',
+    'sort',
+    'reverse',
+    'fill',
+    'copyWithin',
+    'set',
+    'add',
+    'delete',
+    'clear',
+    'assign'
+]);
+const MUTATING_STATICS = new Set([
+    'assign',
+    'defineProperty',
+    'defineProperties',
+    'setPrototypeOf'
+]);
+function rootName(node) {
+    let n = evaluate_unwrap(node);
+    while(isMemberExpression(n) || n?.type === 'OptionalMemberExpression')n = evaluate_unwrap(n.object);
+    return isIdentifier(n) ? n.name : void 0;
+}
+function mutatedNames(ast) {
+    const names = new Set();
+    const add = (name)=>{
+        if (name) names.add(name);
+    };
+    for (const node of findAll(ast, (n)=>isAssignmentExpression(n) || 'UpdateExpression' === n.type || isUnaryExpression(n) || isCallExpression(n)))if (isAssignmentExpression(node)) add(rootName(node.left));
+    else if ('UpdateExpression' === node.type) add(rootName(node.argument));
+    else if (isUnaryExpression(node)) {
+        if ('delete' === node.operator) add(rootName(node.argument));
+    } else if (isCallExpression(node)) {
+        const callee = evaluate_unwrap(node.callee);
+        if (!isMemberExpression(callee) || callee.computed || !isIdentifier(callee.property)) continue;
+        if (isIdentifier(callee.object, {
+            name: 'Object'
+        }) && MUTATING_STATICS.has(callee.property.name)) add(rootName(node.arguments[0]));
+        else if (MUTATING_METHODS.has(callee.property.name)) add(rootName(callee.object));
+    }
+    return names;
+}
+function scopeOf(ast, file) {
+    const bindings = new Map();
+    const exports = new Map();
+    const exportedFrom = new Map();
+    const localExports = [];
+    for (const statement of ast.program.body)if (isImportDeclaration(statement)) for (const spec of statement.specifiers){
+        const imported = isImportDefaultSpecifier(spec) ? 'default' : isImportNamespaceSpecifier(spec) ? '*' : evaluate_keyName(spec.imported) ?? '*';
+        bindings.set(spec.local.name, {
+            kind: 'import',
+            source: statement.source.value,
+            imported
+        });
+    }
+    else if (isVariableDeclaration(statement)) bindVariables(statement, bindings);
+    else if (isFunctionDeclaration(statement) || isClassDeclaration(statement)) {
+        if (statement.id) bindings.set(statement.id.name, {
+            kind: 'other',
+            what: 'a function or class'
+        });
+    } else if (isExportNamedDeclaration(statement)) {
+        const decl = statement.declaration;
+        if (decl && isVariableDeclaration(decl)) {
+            bindVariables(decl, bindings);
+            for (const d of decl.declarations)if (isIdentifier(d.id) && d.init) {
+                exports.set(d.id.name, d.init);
+                exportedFrom.set(d.id.name, d.id.name);
+            }
+        }
+        if (!statement.source) for (const spec of statement.specifiers){
+            if (!isExportSpecifier(spec)) continue;
+            const exported = evaluate_keyName(spec.exported);
+            const local = evaluate_keyName(spec.local);
+            if (exported && local) localExports.push([
+                exported,
+                local
+            ]);
+        }
+    } else if (isExportDefaultDeclaration(statement)) exports.set('default', statement.declaration);
+    else if (isExpressionStatement(statement)) {
+        const expr = statement.expression;
+        if (isAssignmentExpression(expr) && isModuleExports(expr.left)) exports.set('default', expr.right);
+    }
+    for (const [exported, local] of localExports){
+        const binding = bindings.get(local);
+        if (binding?.kind === 'const') {
+            exports.set(exported, binding.init);
+            exportedFrom.set(exported, local);
+        }
+    }
+    return {
+        file,
+        bindings,
+        exports,
+        exportedFrom,
+        mutated: mutatedNames(ast)
+    };
+}
+function isEnvObject(n) {
+    if (!isMemberExpression(n) || n.computed || !isIdentifier(n.property, {
+        name: 'env'
+    })) return;
+    if (isIdentifier(n.object, {
+        name: 'process'
+    })) return 'process.env';
+    if (isMetaProperty(n.object)) return 'import.meta.env';
+}
+function envAccess(node) {
+    for (const found of findAll(node, (n)=>isMemberExpression(n) || isMetaProperty(n))){
+        if (isMemberExpression(found)) {
+            const base = isEnvObject(found.object);
+            if (base) {
+                const key = isIdentifier(found.property) ? found.property.name : isStringLiteral(found.property) ? found.property.value : void 0;
+                return key && (!found.computed || isStringLiteral(found.property)) ? `${base}.${key}` : base;
+            }
+        }
+        const whole = isEnvObject(found);
+        if (whole) return whole;
+    }
+}
+function calleeName(node) {
+    const n = evaluate_unwrap(node);
+    if (isIdentifier(n)) return n.name;
+    if (isMemberExpression(n) && isIdentifier(n.property)) return `${calleeName(n.object)}.${n.property.name}`;
+    return 'a function';
+}
+const CONVERSIONS = new Set([
+    'Number',
+    'String',
+    'Boolean',
+    'parseInt',
+    'parseFloat'
+]);
+function reasonFor(node) {
+    const call = 'CallExpression' !== node.type || CONVERSIONS.has(calleeName(node.callee)) ? void 0 : calleeName(node.callee);
+    if (call) return `comes from a function call (${call}())`;
+    const env = envAccess(node);
+    if (env) return `reads an env variable (${env})`;
+    if (isCallExpression(node)) return `comes from a function call (${calleeName(node.callee)}())`;
+    if (isNewExpression(node)) return `is built with new ${calleeName(node.callee)}()`;
+    if (isArrowFunctionExpression(node) || isFunctionExpression(node)) return 'is a function';
+    if (isMemberExpression(node)) return `is read from another value (${calleeName(node)})`;
+    if (isConditionalExpression(node)) return 'depends on a condition (a ? b : c)';
+    if (isLogicalExpression(node) || isBinaryExpression(node)) return `is computed with ${node.operator}`;
+    if (isTemplateLiteral(node)) return 'is a template string with ${} parts';
+    if (isAwaitExpression(node)) return 'is awaited';
+    return `is not a literal (${node.type})`;
+}
+function identifierReason(name, binding) {
+    if (!binding) return `refers to ${name}, which is not a const in this file`;
+    if ('import' === binding.kind) return `is imported (${name} from '${binding.source}')`;
+    return `refers to ${name}, which is ${'other' === binding.kind ? binding.what : 'not a const'}`;
+}
+function resolveNode(node, scope, seen = new Set()) {
+    const n = evaluate_unwrap(node);
+    if (!n) return evaluate_fail('is missing');
+    if (!isIdentifier(n)) return ok(n);
+    const binding = scope.bindings.get(n.name);
+    if (binding?.kind === 'const' && scope.mutated.has(n.name)) return evaluate_fail(`refers to ${n.name}, which is changed later in the file`);
+    if (binding?.kind !== 'const' || seen.has(n.name)) return evaluate_fail(seen.has(n.name) ? `refers to ${n.name}, which refers back to itself` : identifierReason(n.name, binding));
+    return resolveNode(binding.init, scope, new Set([
+        ...seen,
+        n.name
+    ]));
+}
+function evaluate_entriesOf(object, scope, seen = new Set()) {
+    const entries = [];
+    const problems = [];
+    for (const prop of object.properties){
+        if ('SpreadElement' === prop.type) {
+            const arg = evaluate_unwrap(prop.argument);
+            if (isIdentifier(arg)) {
+                const binding = scope.bindings.get(arg.name);
+                if (binding?.kind === 'import') {
+                    problems.push({
+                        reason: `spreads an imported object (${arg.name} from '${binding.source}')`
+                    });
+                    continue;
+                }
+            }
+            const target = resolveNode(arg, scope, seen);
+            if (target.ok) if ('ObjectExpression' === target.value.type) {
+                const name = isIdentifier(arg) ? arg.name : '';
+                const inner = evaluate_entriesOf(target.value, scope, new Set([
+                    ...seen,
+                    name
+                ]));
+                entries.push(...inner.entries);
+                problems.push(...inner.problems);
+            } else problems.push({
+                reason: `spreads a value that ${reasonFor(target.value)}`
+            });
+            else problems.push({
+                reason: `spreads a value that ${target.reason}`
+            });
+            continue;
+        }
+        const key = prop.computed ? void 0 : evaluate_keyName(prop.key);
+        if (void 0 === key) {
+            problems.push({
+                reason: 'has a computed key'
+            });
+            continue;
+        }
+        if ('ObjectMethod' === prop.type) {
+            problems.push({
+                key,
+                reason: 'is a method'
+            });
+            continue;
+        }
+        entries.push({
+            key,
+            value: prop.value
+        });
+    }
+    return {
+        entries,
+        problems
+    };
+}
+function evaluateArray(array, scope, seen) {
+    const out = [];
+    for (const element of array.elements){
+        if (!element) return evaluate_fail('has an empty slot');
+        if ('SpreadElement' === element.type) return evaluate_fail('spreads into an array');
+        const item = evaluate(element, scope, seen);
+        if (!item.ok) return item;
+        out.push(item.value);
+    }
+    return ok(out);
+}
+function evaluate(node, scope, seen = new Set()) {
+    const n = evaluate_unwrap(node);
+    if (!n) return evaluate_fail('is missing');
+    if (isStringLiteral(n) || isNumericLiteral(n) || isBooleanLiteral(n)) return ok(n.value);
+    if (isNullLiteral(n)) return ok(null);
+    if (isTemplateLiteral(n)) return 0 === n.expressions.length ? ok(n.quasis.map((q)=>q.value.cooked ?? q.value.raw).join('')) : evaluate_fail(reasonFor(n));
+    if (isUnaryExpression(n)) return '-' === n.operator && isNumericLiteral(n.argument) ? ok(-n.argument.value) : evaluate_fail(reasonFor(n));
+    if (isIdentifier(n)) {
+        const target = resolveNode(n, scope, seen);
+        return target.ok ? evaluate(target.value, scope, new Set([
+            ...seen,
+            n.name
+        ])) : target;
+    }
+    if (isObjectExpression(n)) {
+        const { entries, problems } = evaluate_entriesOf(n, scope, seen);
+        const problem = problems[0];
+        if (problem) return evaluate_fail(problem.key ? `${problem.key} ${problem.reason}` : problem.reason);
+        const out = {};
+        for (const entry of entries){
+            const value = evaluate(entry.value, scope, seen);
+            if (!value.ok) return evaluate_fail(`${entry.key} ${value.reason}`);
+            out[entry.key] = value.value;
+        }
+        return ok(out);
+    }
+    if (isArrayExpression(n)) return evaluateArray(n, scope, seen);
+    return evaluate_fail(reasonFor(n));
+}
+const MAX_FILE_BYTES = 1000000;
+function isInside(root, target) {
+    const rel = node_path.relative(root, target);
+    return '' === rel || '..' !== rel && !rel.startsWith(`..${node_path.sep}`) && !node_path.isAbsolute(rel);
+}
+const inNodeModules = (root, target)=>node_path.relative(root, target).split(node_path.sep).includes('node_modules');
+const isMissing = (error)=>hasErrno(error, 'ENOENT') || hasErrno(error, 'ENOTDIR');
+function codeOf(error) {
+    return 'object' == typeof error && null !== error && 'code' in error ? String(error.code) : 'unknown error';
+}
+function guardedDisk(root, refused) {
+    const shown = (file)=>node_path.relative(root, file).split(node_path.sep).join('/') || '.';
+    const refuse = (file, reason)=>{
+        if (!refused.some((r)=>r.file === shown(file) && r.reason === reason)) refused.push({
+            file: shown(file),
+            reason
+        });
+    };
+    let realRoot;
+    const rootReal = ()=>realRoot ??= promises.realpath(root);
+    async function allowed(file) {
+        if (inNodeModules(root, file)) return void refuse(file, 'is inside node_modules, which is never read');
+        try {
+            const [realFile, base] = await Promise.all([
+                promises.realpath(file),
+                rootReal()
+            ]);
+            if (!isInside(base, realFile)) return void refuse(file, 'is (or goes through) a link that leads outside the project');
+            if (inNodeModules(base, realFile)) return void refuse(file, 'is (or goes through) a link into node_modules');
+            return realFile;
+        } catch (error) {
+            if (!isMissing(error)) refuse(file, `could not be read (${codeOf(error)})`);
+            return;
+        }
+    }
+    return {
+        read: async (file)=>{
+            const real = await allowed(file);
+            if (void 0 === real) return;
+            try {
+                const { size } = await promises.stat(real);
+                if (size > MAX_FILE_BYTES) return void refuse(file, `is larger than ${String(MAX_FILE_BYTES / 1000000)} MB, so it is not read`);
+                return await promises.readFile(real, 'utf8');
+            } catch (error) {
+                if (!isMissing(error)) refuse(file, `could not be read (${codeOf(error)})`);
+                return;
+            }
+        },
+        listDirs: async (dir)=>{
+            const real = await allowed(dir);
+            if (void 0 === real) return [];
+            try {
+                return (await promises.readdir(real, {
+                    withFileTypes: true
+                })).filter((e)=>e.isDirectory()).map((e)=>e.name);
+            } catch (error) {
+                if (!isMissing(error)) refuse(dir, `could not be read (${codeOf(error)})`);
+                return [];
+            }
+        }
+    };
+}
+const fieldOf = (base, key)=>/^[A-Za-z_$][\w$]*$/.test(key) ? `${base}.${key}` : `${base}['${key}']`;
+const isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+function parseRemote(value) {
+    if (value.startsWith('promise ')) return evaluate_fail('is loaded by inline code (promise …)');
+    const match = /^([^@/:\s]+)@(.+)$/.exec(value);
+    const entry = match?.[2] ?? value;
+    if (!entry.includes('/')) return evaluate_fail(`has no URL ("${value}")`);
+    const type = /\.json([?#]|$)/.test(entry) ? 'manifest' : "script";
+    return ok(match?.[1] ? {
+        name: match[1],
+        entry,
+        type
+    } : {
+        entry,
+        type
+    });
+}
+function objectAt(value, scope, field, report) {
+    const target = resolveNode(value, scope);
+    if (!target.ok) return void report(field, target.reason);
+    if ('ObjectExpression' !== target.value.type) {
+        const evaluated = evaluate(target.value, scope);
+        report(field, evaluated.ok ? 'is not an object' : evaluated.reason);
+        return;
+    }
+    const { entries, problems } = evaluate_entriesOf(target.value, scope);
+    for (const problem of problems)report(problem.key ? fieldOf(field, problem.key) : field, problem.reason);
+    return entries;
+}
+function readRemotes(value, scope, report) {
+    const remotes = {};
+    for (const { key, value: node } of objectAt(value, scope, 'remotes', report) ?? []){
+        const field = fieldOf('remotes', key);
+        const evaluated = evaluate(node, scope);
+        if (!evaluated.ok) {
+            report(field, evaluated.reason);
+            continue;
+        }
+        const raw = evaluated.value;
+        const text = isRecord(raw) ? raw['external'] : raw;
+        if ('string' != typeof text) {
+            report(field, isRecord(raw) ? 'has no string external' : 'is not a string');
+            continue;
+        }
+        const remote = parseRemote(text);
+        if (remote.ok) remotes[key] = remote.value;
+        else report(field, remote.reason);
+    }
+    return remotes;
+}
+function readExposes(value, scope, report) {
+    const exposes = {};
+    const target = resolveNode(value, scope);
+    if (target.ok && 'ArrayExpression' === target.value.type) {
+        const evaluated = evaluate(target.value, scope);
+        if (evaluated.ok) if (Array.isArray(evaluated.value)) for (const item of evaluated.value)if ('string' == typeof item) exposes[item] = item;
+        else report('exposes', 'is an array with items that are not strings');
+        else report('exposes', 'is not a list');
+        else report('exposes', evaluated.reason);
+        return exposes;
+    }
+    for (const { key, value: node } of objectAt(value, scope, 'exposes', report) ?? []){
+        const field = fieldOf('exposes', key);
+        const evaluated = evaluate(node, scope);
+        if (!evaluated.ok) {
+            report(field, evaluated.reason);
+            continue;
+        }
+        const raw = evaluated.value;
+        const path = isRecord(raw) ? raw['import'] : raw;
+        if ('string' == typeof path) exposes[key] = path;
+        else report(field, 'is not a module path');
+    }
+    return exposes;
+}
+const NOT_CARRIED = 'is set in the config but adopt does not carry it over';
+const NOT_CARRIED_SHARED = new Set([
+    'eager',
+    'strictVersion',
+    'import'
+]);
+const NOT_CARRIED_OPTIONS = new Set([
+    'filename',
+    'shareStrategy',
+    'runtimePlugins'
+]);
+function readSharedEntry(key, node, scope, report) {
+    const field = fieldOf('shared', key);
+    const target = resolveNode(node, scope);
+    if (!target.ok) return void report(field, target.reason);
+    if ('ObjectExpression' !== target.value.type) {
+        const evaluated = evaluate(target.value, scope);
+        if (evaluated.ok) {
+            if ('string' == typeof evaluated.value) return {
+                requiredVersion: evaluated.value
+            };
+            report(field, 'is not a version range or an options object');
+        } else report(field, evaluated.reason);
+        return;
+    }
+    const shared = {};
+    const { entries, problems } = evaluate_entriesOf(target.value, scope);
+    for (const problem of problems)report(problem.key ? fieldOf(field, problem.key) : field, problem.reason);
+    for (const entry of entries){
+        const at = fieldOf(field, entry.key);
+        if (NOT_CARRIED_SHARED.has(entry.key)) {
+            const evaluated = evaluate(entry.value, scope);
+            const plainlyOff = 'import' !== entry.key && evaluated.ok && false === evaluated.value;
+            if (!plainlyOff) report(at, NOT_CARRIED);
+            continue;
+        }
+        if ('singleton' !== entry.key && 'requiredVersion' !== entry.key) continue;
+        const evaluated = evaluate(entry.value, scope);
+        if (evaluated.ok) if ('singleton' === entry.key && 'boolean' == typeof evaluated.value) shared.singleton = evaluated.value;
+        else if ('requiredVersion' === entry.key && ('string' == typeof evaluated.value || false === evaluated.value)) shared.requiredVersion = evaluated.value;
+        else report(at, 'singleton' === entry.key ? 'is not true or false' : 'is not a version range');
+        else report(at, evaluated.reason);
+    }
+    return shared;
+}
+function readShared(value, scope, report) {
+    const shared = {};
+    const target = resolveNode(value, scope);
+    if (target.ok && 'ArrayExpression' === target.value.type) {
+        for (const [index, element] of target.value.elements.entries()){
+            const evaluated = evaluate(element, scope);
+            if (evaluated.ok && 'string' == typeof evaluated.value) shared[evaluated.value] = {};
+            else report(`shared[${String(index)}]`, evaluated.ok ? 'is not a package name' : evaluated.reason);
+        }
+        return shared;
+    }
+    for (const { key, value: node } of objectAt(value, scope, 'shared', report) ?? []){
+        const entry = readSharedEntry(key, node, scope, report);
+        if (entry) shared[key] = entry;
+    }
+    return shared;
+}
+function readFederationOptions(options, scope, report) {
+    const result = {
+        remotes: {},
+        exposes: {},
+        shared: {},
+        exposing: false
+    };
+    const { entries, problems } = evaluate_entriesOf(options, scope);
+    for (const problem of problems)report(problem.key ?? 'options', problem.reason);
+    for (const { key, value } of entries)switch(key){
+        case 'name':
+            {
+                const evaluated = evaluate(value, scope);
+                if (evaluated.ok && 'string' == typeof evaluated.value) result.name = evaluated.value;
+                else report('name', evaluated.ok ? 'is not a string' : evaluated.reason);
+                break;
+            }
+        case 'remotes':
+            result.remotes = readRemotes(value, scope, report);
+            break;
+        case 'exposes':
+            {
+                let unread = false;
+                result.exposes = readExposes(value, scope, (field, reason)=>{
+                    unread = true;
+                    report(field, reason);
+                });
+                result.exposing = unread || Object.keys(result.exposes).length > 0;
+                break;
+            }
+        case 'shared':
+            result.shared = readShared(value, scope, report);
+            break;
+        default:
+            if (NOT_CARRIED_OPTIONS.has(key)) report(key, NOT_CARRIED);
+            break;
+    }
+    return result;
+}
+const SKIPPED_DIRS = new Set([
+    'node_modules',
+    'dist',
+    'build',
+    'out',
+    'output',
+    'coverage',
+    'doc_build',
+    'storybook-static'
+]);
+const workspace_MAX_DEPTH = 8;
+const MAX_VISITED = 5000;
+const workspace_skipped = (name)=>name.startsWith('.') || SKIPPED_DIRS.has(name) || name.startsWith('dist-');
+function toRegExp(segment) {
+    const escaped = segment.replace(/[.+^${}()|[\]\\?]/g, String.raw`\$&`).replaceAll('*', '[^/]*');
+    return new RegExp(`^${escaped}$`);
+}
+function globToRegExp(pattern) {
+    const body = pattern.split('/').map((segment)=>'**' === segment ? '\0' : toRegExp(segment).source.slice(1, -1)).join('/').replaceAll('\0/', '(?:[^/]+/)*').replaceAll('/\0', '(?:/[^/]+)*').replaceAll('\0', '.*');
+    return new RegExp(`^${body}$`);
+}
+function normalize(pattern) {
+    const clean = pattern.replaceAll('\\', '/').replace(/^\.\//, '').replace(/\/+$/, '');
+    if ('' === clean || clean.startsWith('/') || clean.split('/').includes('..')) return;
+    return clean;
+}
+function eachInSequence(items, fn) {
+    return items.reduce((done, item)=>done.then(()=>fn(item)), Promise.resolve());
+}
+const collapse = (segments)=>segments.filter((segment, i)=>!('**' === segment && '**' === segments[i - 1]));
+async function childrenOf(walk, at) {
+    walk.visited += 1;
+    if (walk.visited > MAX_VISITED) return [];
+    try {
+        return (await walk.listDirs(node_path.join(walk.root, ...at))).filter((name)=>!workspace_skipped(name)).toSorted((a, b)=>a.localeCompare(b));
+    } catch (error) {
+        walk.problems.push({
+            file: at.join('/') || '.',
+            reason: `could not be listed (${messageOf(error)})`
+        });
+        return [];
+    }
+}
+async function expand(walk, segments, at = []) {
+    const state = `${at.join('/')}|${segments.join('/')}`;
+    if (walk.seen.has(state)) return;
+    walk.seen.add(state);
+    if (0 === segments.length) return void walk.found.add(at.join('/'));
+    if (at.length > workspace_MAX_DEPTH) return;
+    const [segment = '', ...rest] = segments;
+    if (!segment.includes('*')) {
+        if (!workspace_skipped(segment)) await expand(walk, rest, [
+            ...at,
+            segment
+        ]);
+        return;
+    }
+    const children = await childrenOf(walk, at);
+    if ('**' === segment) {
+        await expand(walk, rest, at);
+        await eachInSequence(children, (child)=>expand(walk, segments, [
+                ...at,
+                child
+            ]));
+        return;
+    }
+    const match = toRegExp(segment);
+    await eachInSequence(children.filter((c)=>match.test(c)), (child)=>expand(walk, rest, [
+            ...at,
+            child
+        ]));
+}
+function stringList(value) {
+    return Array.isArray(value) && value.every((v)=>'string' == typeof v) ? value : void 0;
+}
+async function safeRead(read, file, problems) {
+    try {
+        return await read(file);
+    } catch (error) {
+        problems.push({
+            file: node_path.basename(file),
+            reason: `could not be read (${messageOf(error)})`
+        });
+        return;
+    }
+}
+async function workspacePatterns(root, read, problems) {
+    const patterns = [];
+    const yamlText = await safeRead(read, node_path.join(root, 'pnpm-workspace.yaml'), problems);
+    if (void 0 !== yamlText) try {
+        const doc = external_yaml_parse(yamlText);
+        const list = 'object' == typeof doc && null !== doc && 'packages' in doc ? stringList(doc.packages) : [];
+        if (list) patterns.push(...list);
+        else problems.push({
+            file: 'pnpm-workspace.yaml',
+            reason: 'packages is not a list'
+        });
+    } catch  {
+        problems.push({
+            file: 'pnpm-workspace.yaml',
+            reason: 'could not be parsed'
+        });
+    }
+    const pkgText = await safeRead(read, node_path.join(root, 'package.json'), problems);
+    if (void 0 !== pkgText) try {
+        const pkg = JSON.parse(pkgText);
+        const workspaces = 'object' == typeof pkg && null !== pkg && 'workspaces' in pkg ? pkg.workspaces : void 0;
+        const list = void 0 === workspaces ? [] : stringList(workspaces) ?? ('object' == typeof workspaces && null !== workspaces && 'packages' in workspaces ? stringList(workspaces.packages) : void 0);
+        if (list) patterns.push(...list);
+        else problems.push({
+            file: 'package.json',
+            reason: 'workspaces is not a list'
+        });
+    } catch  {
+        problems.push({
+            file: 'package.json',
+            reason: 'could not be parsed'
+        });
+    }
+    return patterns;
+}
+async function findAppDirs(root, read, listDirs, problems = []) {
+    const patterns = await workspacePatterns(root, read, problems);
+    const include = patterns.filter((p)=>!p.startsWith('!')).map(normalize);
+    const exclude = patterns.filter((p)=>p.startsWith('!')).map((p)=>normalize(p.slice(1))).filter((p)=>void 0 !== p).map(globToRegExp);
+    const walk = {
+        root,
+        listDirs,
+        problems,
+        visited: 0,
+        seen: new Set(),
+        found: new Set()
+    };
+    await eachInSequence(include, async (pattern)=>{
+        if (void 0 !== pattern) await expand(walk, collapse(pattern.split('/')));
+    });
+    if (walk.visited > MAX_VISITED) problems.push({
+        file: '.',
+        reason: `has more than ${String(MAX_VISITED)} folders to search, so the workspace globs were cut short`
+    });
+    const candidates = [
+        ...walk.found
+    ].filter((dir)=>'' !== dir && !exclude.some((re)=>re.test(dir)));
+    const withPackage = [];
+    await eachInSequence(candidates, async (dir)=>{
+        const file = node_path.join(root, ...dir.split('/'), 'package.json');
+        withPackage.push(await safeRead(read, file, problems) === void 0 ? void 0 : dir);
+    });
+    const dirs = withPackage.filter((d)=>void 0 !== d);
+    return [
+        '.',
+        ...dirs.toSorted((a, b)=>a.localeCompare(b))
+    ];
+}
+const EXTENSIONS = [
+    '.ts',
+    '.mts',
+    '.cts',
+    '.js',
+    '.mjs',
+    '.cjs'
+];
+const BUILD_TOOLS = [
+    'rsbuild',
+    'rspack',
+    'webpack'
+];
+const FEDERATION_CONFIG = 'module-federation.config';
+const MAX_IMPORT_HOPS = 3;
+const detect_relative = (root, file)=>node_path.relative(root, file).split(node_path.sep).join('/') || '.';
+function detect_report(ctx, file, field, reason) {
+    ctx.notAdopted.push({
+        dir: ctx.dir,
+        file: detect_relative(ctx.root, file),
+        field,
+        reason
+    });
+}
+async function firstExisting(read, candidates) {
+    const sources = await Promise.all(candidates.map((file)=>read(file)));
+    const index = sources.findIndex((s)=>void 0 !== s);
+    const source = sources[index];
+    const file = candidates[index];
+    return void 0 === source || void 0 === file ? void 0 : {
+        file,
+        source
+    };
+}
+function load(ctx, file, source) {
+    try {
+        const ast = parseSource(source, file);
+        return {
+            ast,
+            scope: scopeOf(ast, file)
+        };
+    } catch  {
+        detect_report(ctx, file, 'file', 'could not be parsed');
+        return;
+    }
+}
+function namesFor(scope, canonical) {
+    const names = new Set([
+        canonical
+    ]);
+    for (const [local, binding] of scope.bindings)if ('import' === binding.kind && binding.imported === canonical) names.add(local);
+    return names;
+}
+function patternNames(node, out) {
+    if (!node) return;
+    if (isIdentifier(node)) out.add(node.name);
+    else if ('ObjectPattern' === node.type) for (const prop of node.properties)patternNames('RestElement' === prop.type ? prop.argument : prop.value, out);
+    else if ('ArrayPattern' === node.type) for (const element of node.elements)patternNames(element, out);
+    else if ('RestElement' === node.type) patternNames(node.argument, out);
+    else if ('AssignmentPattern' === node.type) patternNames(node.left, out);
+}
+const isFunction = (n)=>'FunctionDeclaration' === n.type || 'FunctionExpression' === n.type || 'ArrowFunctionExpression' === n.type || 'ObjectMethod' === n.type || 'ClassMethod' === n.type;
+const isLocalScope = (n)=>isFunction(n) || 'BlockStatement' === n.type || 'CatchClause' === n.type || 'ForStatement' === n.type || 'ForInStatement' === n.type || 'ForOfStatement' === n.type || 'SwitchStatement' === n.type;
+function declaredInside(scope) {
+    const names = new Set();
+    if ('params' in scope) for (const param of scope.params)patternNames(param, names);
+    if ('CatchClause' === scope.type) patternNames(scope.param, names);
+    for (const node of findAll(scope, (n)=>'VariableDeclarator' === n.type || 'FunctionDeclaration' === n.type || 'ClassDeclaration' === n.type))if ('VariableDeclarator' === node.type) patternNames(node.id, names);
+    else if ('id' in node) patternNames(node.id, names);
+    return names;
+}
+function federationCalls(ast, scope) {
+    const plugin = namesFor(scope, 'pluginModuleFederation');
+    const webpack = namesFor(scope, 'ModuleFederationPlugin');
+    const found = [];
+    const matches = (n, shadowed)=>{
+        if (isCallExpression(n)) {
+            const callee = n.callee;
+            if (isIdentifier(callee)) return plugin.has(callee.name) && !shadowed.has(callee.name);
+            return isMemberExpression(callee) && isIdentifier(callee.property, {
+                name: 'pluginModuleFederation'
+            });
+        }
+        if (!isNewExpression(n)) return false;
+        const callee = n.callee;
+        if (isIdentifier(callee)) return webpack.has(callee.name) && !shadowed.has(callee.name);
+        return isMemberExpression(callee) && isIdentifier(callee.property, {
+            name: 'ModuleFederationPlugin'
+        });
+    };
+    const visit = (value, shadowed)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, shadowed);
+            return;
+        }
+        if (!isNode(value)) return;
+        if (matches(value, shadowed) && (isCallExpression(value) || isNewExpression(value))) found.push({
+            node: value,
+            shadowed
+        });
+        const inner = 'Program' !== value.type && isLocalScope(value) ? new Set([
+            ...shadowed,
+            ...declaredInside(value)
+        ]) : shadowed;
+        for (const [key, child] of Object.entries(value))if (!SKIP_KEYS.has(key)) visit(child, inner);
+    };
+    visit(ast.program, new Set());
+    return found;
+}
+function scopeAt(scope, shadowed) {
+    if (![
+        ...shadowed
+    ].some((name)=>scope.bindings.has(name))) return scope;
+    const bindings = new Map(scope.bindings);
+    for (const name of shadowed)if (bindings.has(name)) bindings.set(name, {
+        kind: 'other',
+        what: 'declared again inside a function around the call'
+    });
+    return {
+        ...scope,
+        bindings
+    };
+}
+const isRelative = (source)=>'.' === source || '..' === source || source.startsWith('./') || source.startsWith('../');
+function candidatesFor(target) {
+    const ext = node_path.extname(target);
+    if (EXTENSIONS.includes(ext)) {
+        const stem = target.slice(0, -ext.length);
+        return [
+            target,
+            ...'.js' === ext ? [
+                `${stem}.ts`
+            ] : '.mjs' === ext ? [
+                `${stem}.mts`
+            ] : []
+        ];
+    }
+    return [
+        ...EXTENSIONS.map((e)=>`${target}${e}`),
+        ...EXTENSIONS.map((e)=>node_path.join(target, `index${e}`))
+    ];
+}
+async function detect_resolveOptions(ctx, node, scope, hops = 0, seen = new Set()) {
+    const n = evaluate_unwrap(node);
+    if (!n) return evaluate_fail('are missing');
+    if ('ObjectExpression' === n.type) return ok({
+        object: n,
+        scope
+    });
+    if (isCallExpression(n)) {
+        const wrapper = namesFor(scope, 'createModuleFederationConfig');
+        if (isIdentifier(n.callee) && wrapper.has(n.callee.name)) return detect_resolveOptions(ctx, n.arguments[0], scope, hops, seen);
+        return evaluate_fail(reasonFor(n));
+    }
+    if (!isIdentifier(n)) {
+        const evaluated = evaluate(n, scope);
+        return evaluate_fail(evaluated.ok ? 'are not an object' : evaluated.reason);
+    }
+    const binding = scope.bindings.get(n.name);
+    if (binding?.kind === 'const' && !seen.has(n.name)) {
+        if (scope.mutated.has(n.name)) return evaluate_fail(`refers to ${n.name}, which is changed later in the file`);
+        return detect_resolveOptions(ctx, binding.init, scope, hops, new Set([
+            ...seen,
+            n.name
+        ]));
+    }
+    if (binding?.kind !== 'import') {
+        const evaluated = evaluate(n, scope);
+        return evaluate_fail(evaluated.ok ? 'are not an object' : evaluated.reason);
+    }
+    if (!isRelative(binding.source)) return evaluate_fail(`are imported from a package (${n.name} from '${binding.source}')`);
+    if ((binding.depth ?? 0) > 1) return evaluate_fail(`are read from deep inside what '${binding.source}' exports`);
+    if (hops >= MAX_IMPORT_HOPS) return evaluate_fail(`are imported through more than ${String(MAX_IMPORT_HOPS)} files`);
+    const target = node_path.resolve(node_path.dirname(scope.file), binding.source);
+    if (!isInside(ctx.root, target)) return evaluate_fail(`are imported from outside the project ('${binding.source}')`);
+    if (node_path.relative(ctx.root, target).split(node_path.sep).includes('node_modules')) return evaluate_fail(`are imported from node_modules ('${binding.source}')`);
+    const found = await firstExisting(ctx.read, candidatesFor(target));
+    if (!found) return evaluate_fail(`are imported from '${binding.source}', which was not found`);
+    const imported = load(ctx, found.file, found.source)?.scope;
+    if (!imported) return evaluate_fail(`are imported from '${binding.source}', which could not be parsed`);
+    const exported = '*' === binding.imported ? void 0 : imported.exports.get(binding.imported);
+    if (!exported) return evaluate_fail('default' === binding.imported ? `are imported from '${binding.source}', which has no default export` : `are imported from '${binding.source}', which has no export ${binding.imported}`);
+    const local = imported.exportedFrom.get(binding.imported);
+    if (local && imported.mutated.has(local)) return evaluate_fail(`are imported from '${binding.source}', where ${local} is changed later in the file`);
+    return detect_resolveOptions(ctx, exported, imported, hops + 1);
+}
+function readPort(ctx, ast, scope, tool) {
+    const key = 'rsbuild' === tool ? 'server' : 'devServer';
+    const ports = [];
+    for (const prop of findAll(ast, (n)=>isObjectProperty(n))){
+        if (!isObjectProperty(prop) || prop.computed || !isIdentifier(prop.key, {
+            name: key
+        })) continue;
+        const value = evaluate_unwrap(prop.value);
+        if (value?.type !== 'ObjectExpression') continue;
+        const port = evaluate_entriesOf(value, scope).entries.findLast((e)=>'port' === e.key);
+        if (port) ports.push(port.value);
+    }
+    const [first, ...others] = ports;
+    if (!first) return;
+    if (others.length > 0) return void detect_report(ctx, scope.file, 'port', 'is set in more than one place');
+    const evaluated = evaluate(first, scope);
+    if (evaluated.ok && 'number' == typeof evaluated.value) return evaluated.value;
+    detect_report(ctx, scope.file, 'port', evaluated.ok ? 'is not a number' : evaluated.reason);
+}
+async function packageName(read, dir) {
+    const text = await read(node_path.join(dir, 'package.json'));
+    if (void 0 === text) return;
+    try {
+        const pkg = JSON.parse(text);
+        return 'object' == typeof pkg && null !== pkg && 'name' in pkg && 'string' == typeof pkg.name ? pkg.name : void 0;
+    } catch  {
+        return;
+    }
+}
+async function detectApp(ctx) {
+    const abs = node_path.join(ctx.root, ...ctx.dir.split('/'));
+    const builds = BUILD_TOOLS.flatMap((tool)=>EXTENSIONS.map((ext)=>({
+                tool,
+                file: node_path.join(abs, `${tool}.config${ext}`)
+            })));
+    const [build, federation] = await Promise.all([
+        firstExisting(ctx.read, builds.map((b)=>b.file)),
+        firstExisting(ctx.read, EXTENSIONS.map((ext)=>node_path.join(abs, `${FEDERATION_CONFIG}${ext}`)))
+    ]);
+    if (!build) {
+        if (federation) detect_report(ctx, federation.file, 'buildTool', 'has no rsbuild, rspack or webpack config next to it');
+        return;
+    }
+    const tool = builds.find((b)=>b.file === build.file)?.tool ?? 'rsbuild';
+    const parsed = load(ctx, build.file, build.source);
+    if (!parsed) return;
+    const { ast, scope } = parsed;
+    const calls = federationCalls(ast, scope);
+    if (calls.length > 1) return void detect_report(ctx, build.file, 'options', `has ${String(calls.length)} Module Federation plugins in one config, so none of them is read`);
+    let options;
+    const [call] = calls;
+    if (call) options = await detect_resolveOptions(ctx, call.node.arguments[0], scopeAt(scope, call.shadowed));
+    else {
+        if (!federation) return;
+        const mfScope = load(ctx, federation.file, federation.source)?.scope;
+        if (!mfScope) return;
+        options = await detect_resolveOptions(ctx, mfScope.exports.get('default'), mfScope);
+    }
+    if (!options.ok) return void detect_report(ctx, build.file, 'options', options.reason);
+    const optionsFile = options.value.scope.file;
+    const read = readFederationOptions(options.value.object, options.value.scope, (field, reason)=>{
+        detect_report(ctx, optionsFile, field, reason);
+    });
+    const port = readPort(ctx, ast, scope, tool);
+    const pkgName = await packageName(ctx.read, abs);
+    return {
+        dir: ctx.dir,
+        ...void 0 === read.name ? {} : {
+            name: read.name
+        },
+        ...void 0 === pkgName ? {} : {
+            packageName: pkgName
+        },
+        role: read.exposing ? 'remote' : 'shell',
+        buildTool: tool,
+        configFile: detect_relative(ctx.root, build.file),
+        ...optionsFile === build.file ? {} : {
+            federationFile: detect_relative(ctx.root, optionsFile)
+        },
+        remotes: read.remotes,
+        exposes: read.exposes,
+        shared: read.shared,
+        ...void 0 === port ? {} : {
+            port
+        }
+    };
+}
+async function detectFederation(dir, options = {}) {
+    const root = node_path.resolve(dir);
+    const refused = [];
+    const disk = guardedDisk(root, refused);
+    const read = options.read ?? disk.read;
+    const listDirs = options.listDirs ?? disk.listDirs;
+    const notAdopted = [];
+    const problems = [];
+    const dirs = await findAppDirs(root, read, listDirs, problems);
+    for (const problem of problems)notAdopted.push({
+        dir: '.',
+        file: problem.file,
+        field: 'workspaces',
+        reason: problem.reason
+    });
+    const apps = [];
+    await eachInSequence(dirs, async (appDir)=>{
+        const ctx = {
+            root,
+            read,
+            dir: appDir,
+            notAdopted: []
+        };
+        try {
+            const app = await detectApp(ctx);
+            if (app) apps.push(app);
+        } catch (error) {
+            detect_report(ctx, node_path.join(root, ...appDir.split('/')), 'file', `could not be read (${messageOf(error)})`);
+        }
+        notAdopted.push(...ctx.notAdopted);
+    });
+    for (const refusal of refused)notAdopted.push({
+        dir: '.',
+        file: refusal.file,
+        field: 'file',
+        reason: refusal.reason
+    });
+    return {
+        apps,
+        notAdopted
+    };
+}
+const RESERVED = new Set([
+    'root',
+    'remotes'
+]);
+const DEV_PORT_START = 4311;
+const OWNER_PLACEHOLDER = 'unassigned';
+const CONTROL = new RegExp(String.raw`[\u0000-\u001f\u007f-\u009f]`, 'g');
+const printable = (text)=>text.replaceAll(CONTROL, '?');
+const join = (dir, file)=>'.' === dir ? file : `${dir}/${file}`;
+function localPort(entry) {
+    try {
+        const url = new URL(entry);
+        const local = 'localhost' === url.hostname || '127.0.0.1' === url.hostname;
+        const port = Number(url.port);
+        return local && Number.isInteger(port) && port > 0 ? port : void 0;
+    } catch  {
+        return;
+    }
+}
+function skip(app, field, reason) {
+    return {
+        dir: app.dir,
+        file: app.federationFile ?? app.configFile,
+        field,
+        reason
+    };
+}
+function nameApps(apps, notAdopted) {
+    const taken = new Set();
+    const named = [];
+    for (const app of apps){
+        const { name } = app;
+        let problem;
+        if (void 0 === name) problem = 'has no literal name, so there is nothing to call this app';
+        else if (MFE_NAME.test(name)) {
+            if (RESERVED.has(name) || 'remote' === app.role && 'shell' === name) problem = `"${name}" is a name mfeflow keeps for itself`;
+            else if (taken.has(name)) problem = `"${name}" is already used by another app`;
+        } else problem = `"${name}" is not a name mfeflow accepts (lowercase letters, digits and single _)`;
+        if (void 0 === name || void 0 !== problem) {
+            notAdopted.push(skip(app, 'name', `${problem ?? ''}; the app was left out`));
+            continue;
+        }
+        taken.add(name);
+        named.push({
+            app,
+            name
+        });
+    }
+    return named;
+}
+function exposesOf(app, notAdopted) {
+    const kept = [];
+    for (const key of Object.keys(app.exposes))if (EXPOSE.test(key)) kept.push(key);
+    else notAdopted.push(skip(app, `exposes['${key}']`, 'is not a ./Name path, which mfeflow.app.json requires'));
+    return kept;
+}
+function platformOf(app) {
+    const platform = {};
+    for (const [pkg, shared] of Object.entries(app.shared))if ('string' == typeof shared.requiredVersion) platform[pkg] = shared.requiredVersion;
+    return platform;
+}
+function shellsLoading(name, shells) {
+    return shells.filter(({ app })=>Object.entries(app.remotes).some(([alias, remote])=>(remote.name ?? alias) === name)).map((shell)=>shell.name);
+}
+function portFromShells(name, shells) {
+    return shells.flatMap((shell)=>Object.entries(shell.app.remotes)).filter(([alias, r])=>(r.name ?? alias) === name).map(([, r])=>localPort(r.entry)).find((port)=>void 0 !== port);
+}
+function assignPorts(named, shells, warnings) {
+    const claims = new Map();
+    const claim = (port, name)=>{
+        claims.set(port, [
+            ...claims.get(port) ?? [],
+            name
+        ]);
+    };
+    const ports = new Map();
+    const portless = [];
+    for (const { app, name } of named){
+        const port = app.port ?? ('remote' === app.role ? portFromShells(name, shells) : void 0);
+        if (void 0 === port) {
+            if ('remote' === app.role) portless.push(name);
+            continue;
+        }
+        claim(port, name);
+        if ('remote' === app.role) ports.set(name, port);
+    }
+    for (const [port, names] of claims)if (names.length > 1) warnings.push(`${names.join(', ')} are all on port ${String(port)}; give each app its own`);
+    let next = DEV_PORT_START;
+    for (const name of portless){
+        while(claims.has(next))next += 1;
+        claim(next, name);
+        ports.set(name, next);
+        warnings.push(`${name}: no dev port found in its config, so its dev registry entry uses ${String(next)}; change it if the app runs elsewhere`);
+    }
+    return ports;
+}
+function planAdoption(input) {
+    const notAdopted = [
+        ...input.report.notAdopted
+    ];
+    const warnings = [];
+    const named = nameApps(input.report.apps, notAdopted);
+    const shells = named.filter(({ app })=>'shell' === app.role);
+    const remotes = named.filter(({ app })=>'remote' === app.role);
+    if (0 === shells.length) {
+        const found = 0 === input.report.apps.length ? 'no Module Federation config was found' : remotes.length > 0 ? `only remotes were found (${remotes.map((r)=>r.name).join(', ')}), and no shell that loads them` : 'no app had a usable name';
+        throw new MfeflowError('E124', found);
+    }
+    const apps = {};
+    const ports = assignPorts(named, shells, warnings);
+    const appFiles = [];
+    const adoptedRemotes = [];
+    for (const { app, name } of named){
+        apps[name] = {
+            kind: app.role,
+            path: app.dir,
+            ...void 0 === app.port ? {} : {
+                port: app.port
+            }
+        };
+        const platform = platformOf(app);
+        appFiles.push({
+            name,
+            dir: app.dir,
+            role: app.role,
+            content: {
+                $schema: SCHEMA_URLS.mfe,
+                name,
+                owner: OWNER_PLACEHOLDER,
+                shells: 'remote' === app.role ? shellsLoading(name, shells) : [],
+                routes: [],
+                exposes: exposesOf(app, notAdopted),
+                ...Object.keys(platform).length > 0 ? {
+                    platform
+                } : {}
+            }
+        });
+        const port = ports.get(name);
+        if ('remote' === app.role && void 0 !== port) adoptedRemotes.push({
+            name,
+            port
+        });
+    }
+    warnings.unshift(`routes are empty (mfeflow cannot read them from a build config); add the paths each app serves to ${appFiles.map((f)=>printable(join(f.dir, 'mfeflow.app.json'))).join(', ')}`);
+    const scriptOnly = remotes.flatMap(({ name })=>shells.flatMap(({ app })=>Object.entries(app.remotes)).filter(([alias, r])=>(r.name ?? alias) === name && "script" === r.type)).map(([alias])=>printable(alias));
+    if (scriptOnly.length > 0) warnings.push(`${[
+        ...new Set(scriptOnly)
+    ].join(', ')}: loaded from a remoteEntry.js, but the registry entries point at mf-manifest.json; check that the remote builds one`);
+    const fromElsewhere = shells.flatMap(({ app })=>Object.entries(app.remotes)).filter(([alias, r])=>!named.some((n)=>n.name === (r.name ?? alias))).map(([alias])=>printable(alias));
+    if (fromElsewhere.length > 0) warnings.push(`${[
+        ...new Set(fromElsewhere)
+    ].join(', ')}: loaded by a shell but not found in this folder, so no app or registry entry was written`);
+    if (adoptedRemotes.length > 0) warnings.push('registry entries for staging and prod point at example.com; set the real addresses before you deploy');
+    return {
+        project: {
+            version: 1,
+            topology: 'monorepo',
+            packageManager: input.packageManager,
+            scope: input.scope,
+            apps,
+            features: {}
+        },
+        appFiles,
+        remotes: adoptedRemotes,
+        shellDirs: shells.map(({ app })=>app.dir),
+        notAdopted: notAdopted.map((item)=>({
+                dir: printable(item.dir),
+                file: printable(item.file),
+                field: printable(item.field),
+                reason: printable(item.reason)
+            })),
+        warnings
+    };
+}
+const MAX_BYTES = 1000000;
+const TIMEOUT_MS = 10000;
+const MAX_REDIRECTS = 5;
+const realFetch = (url, init)=>fetch(url, init);
+function registryUrl(name, registries, version) {
+    const slash = name.indexOf('/');
+    const namespace = name.slice(0, slash);
+    const bare = name.slice(slash + 1);
+    const template = registries[namespace];
+    if (void 0 === template) throw new MfeflowError('E210', namespace);
+    const url = template.replaceAll('{name}', encodeURIComponent(bare)).replaceAll('{version}', encodeURIComponent(version ?? 'latest'));
+    let parsed;
+    try {
+        parsed = new URL(url);
+    } catch (error) {
+        throw new MfeflowError('E401', `${namespace} has an invalid URL (${redactUrl(url)})`, {
+            cause: error
+        });
+    }
+    if (!isRegistryProtocol(parsed)) throw new MfeflowError('E401', `${redactUrl(url)} is not https (plain http is for 127.0.0.1, localhost and [::1] only)`);
+    return parsed.href;
+}
+async function getHttps(url, fetchImpl, code, options = {}) {
+    const fail = (at, why, cause)=>{
+        throw new MfeflowError(code, redactUrlsIn(`${at}: ${why}`), void 0 === cause ? {} : {
+            cause
+        });
+    };
+    const startsPrivate = isPrivateHost(new URL(url).hostname);
+    const refusePrivate = (target)=>{
+        if (void 0 === options.blockPrivate || !isPrivateHost(target.hostname)) return;
+        if (!options.blockPrivate && startsPrivate) return;
+        const why = options.blockPrivate ? 'those are only requested from a trusted registry' : 'a public registry may not send you to one';
+        throw new MfeflowError('E405', `${redactUrl(target.href)} is a loopback or private address; ${why}`);
+    };
+    refusePrivate(new URL(url));
+    const startsLoopback = true === options.loopback && isLoopbackHttp(new URL(url));
+    const permitted = (target)=>'https:' === target.protocol || startsLoopback && isLoopbackHttp(target);
+    const addressOk = (address)=>{
+        try {
+            return permitted(new URL(address));
+        } catch  {
+            return false;
+        }
+    };
+    let current = url;
+    for(let hop = 0; hop <= MAX_REDIRECTS; hop += 1){
+        let response;
+        try {
+            response = await fetchImpl(current, {
+                signal: AbortSignal.timeout(TIMEOUT_MS),
+                redirect: 'manual'
+            });
+        } catch (error) {
+            return fail(current, messageOf(error), error);
+        }
+        if (void 0 !== response.url && '' !== response.url && !addressOk(response.url)) fail(url, `ended up at ${response.url}, which is not https`);
+        if (void 0 !== response.url && '' !== response.url) refusePrivate(new URL(response.url));
+        if (response.status < 300 || response.status >= 400) return response;
+        const location = response.headers?.get('location');
+        await response.body?.cancel().catch(()=>void 0);
+        if (null == location || '' === location) fail(current, `redirected (${String(response.status)}) with no address`);
+        let next;
+        try {
+            next = new URL(location ?? '', current);
+        } catch (error) {
+            return fail(current, 'redirected to a bad address', error);
+        }
+        if (!permitted(next)) fail(url, `redirected to ${next.href}, which is not https`);
+        refusePrivate(next);
+        current = next.href;
+    }
+    return fail(url, 'redirected too many times');
+}
+async function fetchRemoteText(name, registries, fetchImpl = realFetch, version, trusted = false) {
+    const url = registryUrl(name, registries, version);
+    const shown = redactUrl(url);
+    const response = await getHttps(url, fetchImpl, 'E401', {
+        loopback: true,
+        blockPrivate: !trusted
+    });
+    if (!response.ok) {
+        const hint = 404 === response.status ? `${name} is not in that registry` : void 0;
+        throw new MfeflowError('E401', `${shown} answered ${String(response.status)}${hint ? `: ${hint}` : ''}`);
+    }
+    return readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E402', `${shown} is larger than 1 MB`));
+}
+function checkIntegrity(name, recorded, served, accept) {
+    if (recorded === served) return false;
+    if (!accept) throw new MfeflowError('E406', `${name} was ${recorded} when you added it and is now ${served}`);
+    return true;
+}
+function integrityOf(text) {
+    return `sha256-${createHash('sha256').update(text, 'utf8').digest('hex')}`;
+}
+async function readCappedText(response, maxBytes, tooBig) {
+    const declared = Number(response.headers?.get('content-length') ?? 0 / 0);
+    if (declared > maxBytes) {
+        await response.body?.cancel().catch(()=>void 0);
+        throw tooBig();
+    }
+    if (!response.body) {
+        const text = await response.text();
+        if (Buffer.byteLength(text, 'utf8') > maxBytes) throw tooBig();
+        return text;
+    }
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of response.body){
+        total += chunk.byteLength;
+        if (total > maxBytes) throw tooBig();
+        chunks.push(chunk);
+    }
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+async function fetchFeatureIndex(namespace, registries, fetchImpl = realFetch, trusted = false) {
+    const items = await readIndex(namespace, registries, fetchImpl, trusted, false);
+    return items ?? [];
+}
+async function indexedVersion(namespace, name, registries, fetchImpl = realFetch, trusted = false) {
+    const items = await readIndex(namespace, registries, fetchImpl, trusted, true);
+    return items?.find((item)=>item.name === name)?.version;
+}
+async function readIndex(namespace, registries, fetchImpl, trusted, missingOk) {
+    const template = registries[namespace];
+    if (void 0 === template) throw new MfeflowError('E210', namespace);
+    const problem = registryTemplateProblem(template);
+    if (void 0 !== problem) throw new MfeflowError('E401', `${namespace}: ${problem}`);
+    const url = registryIndexUrl(template);
+    const shown = redactUrl(url);
+    const response = await getHttps(url, fetchImpl, 'E401', {
+        loopback: true,
+        blockPrivate: !trusted
+    });
+    if (!response.ok) {
+        if (missingOk && 404 === response.status) return;
+        const hint = 404 === response.status ? ': this registry has no index.json' : '';
+        throw new MfeflowError('E401', `${shown} answered ${String(response.status)}${hint}`);
+    }
+    const text = await readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E403', `${shown} is larger than 1 MB`));
+    let value;
+    try {
+        value = JSON.parse(text);
+    } catch (error) {
+        const reason = messageOf(error).replaceAll(/\p{Cc}/gu, '?');
+        throw new MfeflowError('E403', `${shown} is not JSON (${reason})`, {
+            cause: error
+        });
+    }
+    const issues = validateFeatureRegistryIndex(value);
+    if (issues.length > 0) {
+        const first = issues.slice(0, 3).map((i)=>`${i.path || '(root)'} ${i.message}`);
+        const more = issues.length > 3 ? `; and ${String(issues.length - 3)} more` : '';
+        throw new MfeflowError('E403', `${shown}: ${first.join('; ')}${more}`);
+    }
+    return itemsOf(value);
+}
+function itemsOf(value) {
+    const holder = {
+        items: []
+    };
+    Object.assign(holder, value);
+    return holder.items;
+}
+function parseFeature(text, trust, label) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    } catch (error) {
+        throw new MfeflowError('E202', `${label}: ${messageOf(error)}`, {
+            cause: error
+        });
+    }
+    if ('object' != typeof value || null === value || Array.isArray(value)) throw new MfeflowError('E202', `${label}: must be a JSON object`);
+    const record = Object.fromEntries(Object.entries(value));
+    if ('third-party' === trust) assertAllowedKeys(record, label);
+    assertKnownOps(record, label);
+    const issues = validateFeatureManifest(record);
+    if (issues.length > 0) {
+        const detail = issues.map((i)=>`${i.path || '(root)'} ${i.message}`).join('; ');
+        throw new MfeflowError('E202', `${label}: ${detail}`);
+    }
+    const manifest = toManifest(record, label);
+    if ('third-party' === trust) assertThirdPartyContent(manifest, label);
+    return manifest;
+}
+function toManifest(record, label) {
+    const manifest = {
+        name: '',
+        version: ''
+    };
+    Object.assign(manifest, record);
+    if ('' === manifest.name) throw new MfeflowError('E202', `${label}: name is required`);
+    return manifest;
+}
+async function loadFeature(name, options) {
+    if (!FEATURE_NAME.test(name)) throw new MfeflowError('E201', `"${name}" is not a feature name`);
+    if (name.startsWith('@')) return loadRemote(name, options);
+    return loadLocal(name, options);
+}
+async function loadLocal(name, options) {
+    const ops = options.fs ?? realFs;
+    if (!options.featuresDir) throw new MfeflowError('E201', `"${name}" (no features folder configured)`);
+    const dir = node_path.join(options.featuresDir, name);
+    const text = await readIfExists(ops, node_path.join(dir, 'feature.json'));
+    if (void 0 === text) throw new MfeflowError('E201', `"${name}" (looked in ${options.featuresDir})`);
+    const manifest = parseFeature(text, 'first-party', `${name}/feature.json`);
+    if (manifest.name !== name) throw new MfeflowError('E202', `${name}/feature.json: name is "${manifest.name}", expected "${name}"`);
+    return {
+        manifest,
+        trust: 'first-party',
+        dir,
+        readAsset: async (relative)=>{
+            if (!isSafeRelativePath(relative)) throw new MfeflowError('E105', `"${relative}"`);
+            const content = await readIfExists(ops, node_path.join(dir, ...relative.split('/')));
+            if (void 0 === content) throw new MfeflowError('E201', `${name}: file "${relative}" is missing`);
+            return content;
+        }
+    };
+}
+async function loadRemote(name, options) {
+    const registries = options.registries ?? {};
+    const text = await fetchRemoteText(name, registries, options.fetch, options.version, true === options.trusted);
+    const manifest = parseFeature(text, 'third-party', name);
+    if (manifest.name !== name) throw new MfeflowError('E402', `asked for ${name}, got ${manifest.name}`);
+    if (true === options.checkIndex) await assertIndexAgrees(name, manifest.version, registries, options);
+    return {
+        manifest,
+        trust: 'third-party',
+        integrity: integrityOf(text)
+    };
+}
+async function assertIndexAgrees(name, version, registries, options) {
+    const slash = name.indexOf('/');
+    let listed;
+    try {
+        listed = await indexedVersion(name.slice(0, slash), name.slice(slash + 1), registries, options.fetch, true === options.trusted);
+    } catch (error) {
+        if (error instanceof MfeflowError && 'MFEFLOW_E401' === error.code) return;
+        throw error;
+    }
+    if (void 0 !== listed && listed !== version) throw new MfeflowError('E402', `the index lists ${name} at ${listed} but its feature.json is ${version}`);
+}
+async function listLocalFeatures(featuresDir, ops = realFs) {
+    let dirs;
+    try {
+        dirs = await ops.listDirs(featuresDir);
+    } catch  {
+        return [];
+    }
+    const checked = await Promise.all(dirs.map(async (dir)=>await readIfExists(ops, node_path.join(featuresDir, dir, 'feature.json')) === void 0 ? void 0 : dir));
+    return checked.filter((d)=>void 0 !== d).toSorted((a, b)=>a.localeCompare(b));
+}
+const TRUST_FILE = 'trusted-registries.json';
+const TRUST_ENV = 'MFEFLOW_TRUST_REGISTRIES';
+const trust_set = (value)=>void 0 === value || '' === value ? void 0 : value;
+function configDirOf(env, platform = process.platform, home = node_os.homedir()) {
+    const override = trust_set(env.MFEFLOW_CONFIG_DIR);
+    if (void 0 !== override) return override;
+    const xdg = trust_set(env.XDG_CONFIG_HOME);
+    if (void 0 !== xdg) return node_path.join(xdg, 'mfeflow');
+    const appData = trust_set(env.APPDATA);
+    if ('win32' === platform && void 0 !== appData) return node_path.join(appData, 'mfeflow');
+    return node_path.join(home, '.config', 'mfeflow');
+}
+function trustFileIn(configDir) {
+    return node_path.join(configDir, TRUST_FILE);
+}
+function isEntry(value) {
+    if ('object' != typeof value || null === value) return false;
+    const { namespace, template } = Object.fromEntries(Object.entries(value));
+    return 'string' == typeof namespace && REGISTRY_NAMESPACE.test(namespace) && 'string' == typeof template && void 0 === registryTemplateProblem(template);
+}
+async function readTrusted(configDir, ops = realFs) {
+    let text;
+    try {
+        text = await readIfExists(ops, trustFileIn(configDir));
+    } catch  {
+        return [];
+    }
+    if (void 0 === text) return [];
+    try {
+        const value = JSON.parse(text);
+        if ('object' != typeof value || null === value) return [];
+        const { registries } = Object.fromEntries(Object.entries(value));
+        return Array.isArray(registries) ? registries.filter(isEntry) : [];
+    } catch  {
+        return [];
+    }
+}
+async function save(configDir, entries, ops) {
+    const sorted = entries.toSorted((a, b)=>a.namespace.localeCompare(b.namespace) || a.template.localeCompare(b.template));
+    const body = `${JSON.stringify({
+        version: 1,
+        registries: sorted
+    }, null, 2)}\n`;
+    try {
+        await writeFileAtomic(ops, trustFileIn(configDir), body);
+    } catch (error) {
+        throw new MfeflowError('E106', trustFileIn(configDir), {
+            cause: error
+        });
+    }
+}
+async function addTrusted(configDir, entry, ops = realFs) {
+    const current = await readTrusted(configDir, ops);
+    if (current.some((e)=>e.namespace === entry.namespace && e.template === entry.template)) return false;
+    await save(configDir, [
+        ...current,
+        entry
+    ], ops);
+    return true;
+}
+async function removeTrusted(configDir, namespace, ops = realFs) {
+    const current = await readTrusted(configDir, ops);
+    const kept = current.filter((e)=>e.namespace !== namespace);
+    if (kept.length === current.length) return 0;
+    await save(configDir, kept, ops);
+    return current.length - kept.length;
+}
+function parseTrustEnv(value) {
+    return (value ?? '').split(',').map((part)=>part.trim()).flatMap((part)=>{
+        const eq = part.indexOf('=');
+        const namespace = -1 === eq ? part : part.slice(0, eq).trim();
+        if (!REGISTRY_NAMESPACE.test(namespace)) return [];
+        const template = -1 === eq ? '' : part.slice(eq + 1).trim();
+        return [
+            '' === template ? {
+                namespace
+            } : {
+                namespace,
+                template
+            }
+        ];
+    });
+}
+function trustedNamespaces(registries, recorded, fromEnv = []) {
+    const fetch1 = new Set();
+    const privateOk = new Set();
+    for (const [namespace, template] of Object.entries(registries)){
+        const inFile = recorded.some((e)=>e.namespace === namespace && e.template === template);
+        const items = fromEnv.filter((e)=>e.namespace === namespace);
+        const pinned = items.some((e)=>e.template === template);
+        if (inFile || pinned) privateOk.add(namespace);
+        if (inFile || items.some((e)=>void 0 === e.template || e.template === template)) fetch1.add(namespace);
+    }
+    return {
+        fetch: fetch1,
+        privateOk
+    };
+}
 const registry_build_text = (value)=>`${JSON.stringify(value, null, 2)}\n`;
 async function buildRegistry(dir, ops = realFs) {
     let folders;
@@ -2386,4 +4494,4 @@ function packageInfo() {
         version
     };
 }
-export { ERROR_CATALOGUE, MfeflowError, PROJECT_FILE, PlanBuilder, RUNTIME_CONFIG_FILE, applyPlan, applyTransform, buildRegistry, dotenvKeys, emptyPlan, fetchFeatureIndex, fetchRemoteText, findDiverged, findProjectRoot, getHttps, hasErrno, hashContent, inOrder, isMfeflowError, isProtectedPath, listLocalFeatures, loadFeature, loadProject, messageOf, packageInfo, parseFeature, parseProject, readCappedText, realFs, recordPlan, registryUrl, renderDiff, renderTemplate, resolveFeature, resolveOptions, runtimeConfigFiles, saveProject, schemaKeys, serializeProject, substitute, summarize, writeFileAtomic };
+export { APP_FILE, ERROR_CATALOGUE, LEGACY_APP_FILE, MfeflowError, PROJECT_FILE, PlanBuilder, RUNTIME_CONFIG_FILE, TRUST_ENV, addTrusted, applyPlan, applyTransform, buildRegistry, checkIntegrity, configDirOf, detectBaseline, detectFederation, dotenvKeys, emptyPlan, fetchFeatureIndex, fetchRemoteText, findDiverged, findProjectRoot, getHttps, hasErrno, hashContent, inOrder, indexedVersion, integrityOf, isMfeflowError, isProtectedPath, legacyAppFileNotice, listLocalFeatures, loadFeature, loadProject, messageOf, packageInfo, parseFeature, parseProject, parseTrustEnv, planAdoption, planUpgrade, readAppFile, readCappedText, readTrusted, realFs, recordPlan, registryUrl, removeTrusted, renderDiff, renderTemplate, resolveFeature, resolveOptions, runtimeConfigFiles, saveProject, schemaKeys, serializeProject, substitute, summarize, symlinkedPrefix, trustFileIn, trustedNamespaces, writeFileAtomic };