@mnci/cli 1.12.2 → 1.14.0

package/README.md

@@ -38,6 +38,8 @@ mnci add node-app api --framework express  # ...or fastify | koa | nest
 mnci add node-function-app api # @nx/node + an Azure Functions v4 overlay
 mnci add npm-lib sdk           # @nx/js publishable lib -> packages/
 mnci add internal-lib utils    # @nx/js private lib -> libs/
+mnci add react-lib ui          # @nx/react publishable component lib -> packages/
+mnci add react-internal-lib design  # @nx/react private component lib -> libs/
 
 # Python (@mnci/nx-python-pip — pip + Ruff + pytest + PyPA build/twine, no uv)
 mnci add python-app svc            # app -> apps/ (wheel, zipped into the drop)
@@ -124,7 +126,7 @@ that would just fail felt worse than being upfront that it doesn't exist yet.
    is ever pushed to `main`; future runs resolve versions from tag names.
 3. Writes `eslint.config.mjs` (three lines importing `@mnci/eslint-config` —
    the whole linting opinion, in one root config), `.prettierrc.json` +
-   `.prettierignore`, `.npmrc` (comment-only — see **Known gaps** below),
+   `.prettierignore`, `.npmrc` (publish auth — see **Publish auth** below),
    `commitlint.config.mjs`, a husky `commit-msg` hook, the chosen CI provider's
    pipeline file(s)
    (`azure-pipelines.yml` and/or `.github/workflows/ci.yml`, `--ci`, default
@@ -402,6 +404,42 @@ lint,test,build`. Pushes to `main` then:
   _only_ configured provider, since that's the one case a `GITHUB_TOKEN` is
   guaranteed to exist.
 
+### Publish auth
+
+The generated `.npmrc` differs by registry kind, because the honest answer does.
+
+**`--registry azure-artifacts`** routes the workspace's own scope to the feed and
+supplies the feed's credentials:
+
+```ini
+@my:registry=https://pkgs.dev.azure.com/<org>/<proj>/_packaging/<feed>/npm/registry/
+//pkgs.dev.azure.com/.../npm/registry/:username=AzureArtifacts
+//pkgs.dev.azure.com/.../npm/registry/:_password=${PAT}
+```
+
+Scope routing is **real protection** here, not decoration: npm prefers a scope's
+registry over the global one when publishing a scoped package, so `@my/*` cannot
+reach npmjs.org by accident. Verified against a real registry — with only the
+scope line set, npm reports `Publishing to <feed>` — and again from a generated
+workspace, whose `npm publish --dry-run` targets the feed.
+
+Only the scope is routed, deliberately. A global `registry=` would push every
+install through the feed as well, so `npm ci` would need feed auth just to fetch
+public packages; as generated, public dependencies still come from npmjs.org and
+a developer with no `PAT` set can install normally.
+
+**`--registry npm`** gets the auth line and nothing else:
+
+```ini
+//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+```
+
+There is no `@scope:registry` line, and the generated file explains why: npmjs.org
+is already the default, so routing the scope there changes nothing — and calling
+it protection against an accidental public publish would be false, because the
+public registry is the intended target. Worth stating plainly because this file
+previously claimed exactly that protection while emitting no routing line at all.
+
 **npm auth** is the base64 `PAT`, read the same way on both providers but from
 a different place: on Azure Pipelines, a **variable group**
 (`--variable-group`, default `Build`) exposes it as `$(PAT)`; on GitHub
@@ -514,13 +552,10 @@ than a surprise:
 
 ## Known gaps (accepted for the experiment)
 
-- **The generated `.npmrc` is empty (comments only), so `npm publish` will not
-  authenticate.** This is a deliberate deferral, not an oversight: the previous
-  file claimed here that scope routing made accidental public publishes
-  impossible, when in fact no `@scope:registry` line was ever emitted. Rather
-  than ship half-wired auth, the CI token export (`NODE_AUTH_TOKEN`/`PAT`) is
-  left in place so wiring it later is one line, and the generated `.npmrc`
-  carries a comment saying so. Publish-path e2e assertions are relaxed to match.
+- **A scoped package on public npm has no accidental-publish protection**, and
+  cannot: npmjs.org is the intended target there, so no `.npmrc` line could
+  prevent it. Generate with `--registry azure-artifacts` if you need a scope kept
+  off the public registry — that variant routes it (see **Publish auth** above).
 - No `doctor`/`resurrect`/`spell` — out of scope until the model is proven.
 - **Flutter apps build for web only.** Android would require the Android SDK and
   NDK on every build agent; iOS is impossible on a Linux agent regardless. Add

package/dist/cli.js

@@ -38,8 +38,8 @@ module.exports = __toCommonJS(cli_exports);
 var import_commander = require("commander");
 
 // src/commands/add.ts
-var import_node_path9 = require("path");
-var import_prompts4 = require("@inquirer/prompts");
+var import_node_path10 = require("path");
+var import_prompts5 = require("@inquirer/prompts");
 
 // src/nx.ts
 var import_cross_spawn = __toESM(require("cross-spawn"));
@@ -192,6 +192,21 @@ function hasPlugin(workspaceRoot, packageName) {
   const installed = { ...manifest.dependencies, ...manifest.devDependencies };
   return Object.hasOwn(installed, packageName);
 }
+function ensurePlugin(workspaceRoot, packageName) {
+  if (hasPlugin(workspaceRoot, packageName)) {
+    return;
+  }
+  logger.step(`Installing Nx plugin ${packageName}`);
+  runNx(["add", packageName], workspaceRoot);
+}
+function markPrivate(manifestPath) {
+  const manifest = readJson(manifestPath);
+  writeFileEnsured(manifestPath, toJson({ ...manifest, private: true }));
+}
+function markPublic(manifestPath) {
+  const manifest = readJson(manifestPath);
+  writeFileEnsured(manifestPath, toJson({ ...manifest, publishConfig: { access: "public" } }));
+}
 function ensureAdmZip(workspaceRoot) {
   if (hasPlugin(workspaceRoot, "adm-zip")) {
     return;
@@ -525,7 +540,7 @@ function addGoInternalLib(workspaceRoot, name) {
 
 // src/commands/add/node.ts
 var import_node_path5 = require("path");
-function ensurePlugin(workspaceRoot, packageName) {
+function ensurePlugin2(workspaceRoot, packageName) {
   if (hasPlugin(workspaceRoot, packageName)) {
     return;
   }
@@ -533,7 +548,7 @@ function ensurePlugin(workspaceRoot, packageName) {
   runNx(["add", packageName], workspaceRoot);
 }
 function runNodeApp(workspaceRoot, name, stack, framework) {
-  ensurePlugin(workspaceRoot, "@nx/node");
+  ensurePlugin2(workspaceRoot, "@nx/node");
   runNx(
     [
       "g",
@@ -699,10 +714,6 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
-function markPublic(manifestPath) {
-  const manifest = readJson(manifestPath);
-  writeFileEnsured(manifestPath, toJson({ ...manifest, publishConfig: { access: "public" } }));
-}
 
 // src/commands/add/python.ts
 var import_node_fs4 = require("fs");
@@ -926,13 +937,6 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
 // src/commands/add/reactApp.ts
 var import_node_fs5 = require("fs");
 var import_node_path8 = require("path");
-function ensurePlugin2(workspaceRoot, packageName) {
-  if (hasPlugin(workspaceRoot, packageName)) {
-    return;
-  }
-  logger.step(`Installing Nx plugin ${packageName}`);
-  runNx(["add", packageName], workspaceRoot);
-}
 var REACT_ENVIRONMENTS = ["dev", "uat", "prod"];
 function reactEnvironmentFile(environment) {
   return `# Vite compiles VITE_-prefixed vars into the '${environment}' bundle at build time.
@@ -985,7 +989,7 @@ ${allow}
 `);
 }
 function addReactApp(workspaceRoot, name, stack) {
-  ensurePlugin2(workspaceRoot, "@nx/react");
+  ensurePlugin(workspaceRoot, "@nx/react");
   runNx(
     [
       "g",
@@ -1011,9 +1015,73 @@ function addReactApp(workspaceRoot, name, stack) {
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 
+// src/commands/add/reactLib.ts
+var import_node_path9 = require("path");
+var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
+var ACTUAL_TYPES_PATH = "./dist/index.d.ts";
+function repairTypesPath(manifestPath) {
+  const manifest = readJson(manifestPath);
+  if (manifest.types === WRONG_TYPES_PATH) {
+    manifest.types = ACTUAL_TYPES_PATH;
+  }
+  const dot = manifest.exports?.["."];
+  if (typeof dot === "object" && dot.types === WRONG_TYPES_PATH) {
+    dot.types = ACTUAL_TYPES_PATH;
+  }
+  writeFileEnsured(manifestPath, toJson(manifest));
+}
+var REACT_LIB_BUNDLER = "rollup";
+async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
+  ensurePlugin(workspaceRoot, "@nx/react");
+  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
+  runNx(
+    [
+      "g",
+      "@nx/react:library",
+      `packages/${name}`,
+      `--name=${name}`,
+      "--publishable",
+      `--importPath=${scope}/${name}`,
+      `--bundler=${REACT_LIB_BUNDLER}`,
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  const publishableManifest = (0, import_node_path9.join)(workspaceRoot, "packages", name, "package.json");
+  markPublic(publishableManifest);
+  repairTypesPath(publishableManifest);
+  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+function addReactInternalLib(workspaceRoot, name, stack) {
+  ensurePlugin(workspaceRoot, "@nx/react");
+  runNx(
+    [
+      "g",
+      "@nx/react:library",
+      `libs/${name}`,
+      `--name=${name}`,
+      `--bundler=${REACT_LIB_BUNDLER}`,
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  const privateManifest = (0, import_node_path9.join)(workspaceRoot, "libs", name, "package.json");
+  markPrivate(privateManifest);
+  repairTypesPath(privateManifest);
+  removeGeneratedEslintConfig(workspaceRoot, `libs/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+
 // src/commands/add.ts
 var PROJECT_KINDS = [
   "react-app",
+  "react-lib",
+  "react-internal-lib",
   "node-app",
   "node-function-app",
   "npm-lib",
@@ -1033,12 +1101,12 @@ var PROJECT_KINDS = [
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path9.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path10.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
   const kindProvided = kind !== void 0;
-  const resolvedKind = kind ?? await (0, import_prompts4.select)({
+  const resolvedKind = kind ?? await (0, import_prompts5.select)({
     message: "What kind of project?",
     choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
   });
@@ -1049,6 +1117,14 @@ async function runAdd(kind, name, options) {
       addReactApp(workspaceRoot, resolvedName, stack);
       break;
     }
+    case "react-lib": {
+      await addReactLib(workspaceRoot, resolvedName, options, kindProvided, stack);
+      break;
+    }
+    case "react-internal-lib": {
+      addReactInternalLib(workspaceRoot, resolvedName, stack);
+      break;
+    }
     case "node-app": {
       addNodeApp(workspaceRoot, resolvedName, stack, options.framework);
       break;
@@ -1074,7 +1150,7 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path9.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      markPrivate((0, import_node_path10.join)(workspaceRoot, "libs", resolvedName, "package.json"));
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -1150,43 +1226,73 @@ function syncProjectReferences(workspaceRoot) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path9.join)(workspaceRoot, "nx.json")
+    (0, import_node_path10.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
     testRunner: stack?.testRunner === "vitest" ? "vitest" : "jest"
   };
 }
-function markPrivate(manifestPath) {
-  const manifest = readJson(manifestPath);
-  writeFileEnsured(manifestPath, toJson({ ...manifest, private: true }));
-}
 
 // src/commands/interactive.ts
-var import_node_path13 = require("path");
-var import_prompts7 = require("@inquirer/prompts");
+var import_node_path14 = require("path");
+var import_prompts8 = require("@inquirer/prompts");
 
 // src/commands/new.ts
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 
 // src/overlay.ts
 var import_node_fs6 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var DEFAULT_STACK = { testRunner: "jest" };
 var PRETTIER_VERSION = "^3.8.1";
 var TS_COMPILER_DEPENDENCIES = {
   "@typescript/native": "npm:typescript@^7.0.2",
   typescript: "npm:@typescript/typescript6@^6.0.2"
 };
-function npmrcContent(_registry, _scope) {
-  return `; Intentionally empty.
+function registryUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/npm/registry/`;
+  }
+  return void 0;
+}
+function npmrcContent(registry, scope) {
+  if (registry.kind === "npm") {
+    return `; Publish authentication for the public npm registry.
 ;
-; Publish authentication is not configured yet. The generated CI exports a
-; token for the release step (NODE_AUTH_TOKEN for public npm, PAT for Azure
-; Artifacts), but nothing here consumes it, so 'npm publish' will not
-; authenticate until this is wired up.
+; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
+; is harmless locally, so no token is needed for day-to-day work.
+//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
+
+; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
+; the default registry, so routing the scope to it would change nothing \u2014 and
+; presenting that as protection against an accidental public publish would be
+; false, because the public registry is the intended target. (An earlier version
+; of this file made exactly that claim while emitting no routing line at all.)
+; To keep a scoped package off npmjs.org, use a private feed: generate with
+; --registry azure-artifacts, which does route the scope.
+`;
+  }
+  const feedUrl = registryUrl(registry);
+  const feedKey = feedUrl.replace(/^https:/, "");
+  return `; Publish + resolution routing for this workspace's own scope.
+;
+; '${scope}:registry' sends BOTH resolution and 'npm publish' of ${scope}/* to the
+; feed: npm prefers a scope's registry over the global one when publishing a
+; scoped package, so a ${scope}/* package cannot reach npmjs.org by accident.
 ;
-; See "Known gaps" in the @mnci/cli README.
+; Only the scope is routed, on purpose. A global 'registry=' would send every
+; install through the feed as well, so 'npm ci' would need feed auth just to fetch
+; public packages.
+${scope}:registry=${feedUrl}
+
+; Feed credentials. PAT is the BASE64 value Azure Artifacts' "Connect to feed"
+; instructions give you, which is exactly what _password expects, so it is used
+; as-is. (twine wants the RAW token; the CI release step decodes it there.)
+; Azure ignores the username, and npm requires an email it never uses.
+${feedKey}:username=AzureArtifacts
+${feedKey}:_password=\${PAT}
+${feedKey}:email=npm-requires-this-and-never-uses-it
 `;
 }
 function releaseConfig(ci) {
@@ -1378,7 +1484,7 @@ function mnciConfig(options) {
   };
 }
 function readMnciConfig(workspaceRoot) {
-  const nxJson = readJson((0, import_node_path10.join)(workspaceRoot, "nx.json"));
+  const nxJson = readJson((0, import_node_path11.join)(workspaceRoot, "nx.json"));
   return nxJson.mnci ?? {};
 }
 function pythonPublishUrl(registry) {
@@ -1430,9 +1536,18 @@ function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKin
 # runs unchanged on Linux, macOS and Windows agents.
 
 trigger:
+  # While a run is in progress, queue further pushes and run them together rather
+  # than concurrently. This is the closest thing Azure Pipelines YAML has to
+  # GitHub's concurrency group, and it is load-bearing on main for the same
+  # reason: two concurrent 'nx release' runs would race to create the same tag.
+  batch: true
   branches:
     include: [main]
 
+# Note: cancelling a superseded PR validation run is NOT a YAML setting on Azure
+# \u2014 it lives in the branch policy ("Build validation -> automatically cancel").
+# Nothing here can express it, so it is left to whoever configures the policy
+# rather than faked with a batch setting that would only delay PR runs.
 pr:
   branches:
     include: [main]
@@ -1445,6 +1560,12 @@ variables:
   # for an Azure Artifacts feed, or a raw npm automation token as \`NPM_TOKEN\`
   # for public npm. Mark it secret in Library. Add app build vars here too if needed.
   - group: ${variableGroup}
+  # Relocates npm's cache inside the pipeline workspace so Cache@2 can restore it
+  # (the default ~/.npm is outside the cacheable area on hosted agents). npm reads
+  # this as an ordinary env var, so it needs no config file and works on every
+  # agent OS.
+  - name: npm_config_cache
+    value: $(Pipeline.Workspace)/.npm
 
 steps:
   - checkout: self
@@ -1469,6 +1590,20 @@ steps:
     inputs:
       version: 24.x
 
+  # The Azure counterpart of \`cache: npm\` on actions/setup-node: restores npm's
+  # download cache so \`npm ci\` does not re-fetch every tarball on every run.
+  # Keyed on the lockfile, so a dependency change misses and anything else hits;
+  # restoreKeys falls back to the newest cache for this OS on a miss, which still
+  # avoids a fully cold install. Agent.OS is in the key because a cached native
+  # module built for one OS is not reusable on another.
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
   - script: npm ci
     displayName: Install dependencies
     env:
@@ -1626,6 +1761,19 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  # One run at a time per ref, but \`cancel-in-progress\` is an **expression** on
+  # purpose rather than a flat \`true\`.
+  #
+  # A superseded PR run is pure waste, so cancel it. A run on \`main\` must never
+  # be cancelled: it publishes packages and pushes release tags, and killing it
+  # part-way can leave a tag pushed with the publish only half done \u2014 a state no
+  # rerun repairs cleanly, because the version is then already tagged. Those runs
+  # queue instead, which also stops two \`nx release\` invocations racing to create
+  # the same tag when two commits land close together.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+
 permissions:
   # Lets the release step push the version tag nx release creates back to main,
   # and (github-only provider) create the GitHub Release itself.
@@ -1649,6 +1797,11 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          # Caches ~/.npm keyed on package-lock.json, so \`npm ci\` restores from
+          # the local cache instead of re-downloading every tarball on every run.
+          # Nothing to invalidate by hand: the action keys on the lockfile, so a
+          # dependency change misses the cache and a no-op change hits it.
+          cache: npm
 
       - run: npm ci
         name: Install dependencies
@@ -1828,7 +1981,7 @@ updates:
 var NX_SCAFFOLDING_TO_REMOVE = [".prettierrc", ".vscode"];
 function removeNxScaffolding(workspaceRoot) {
   for (const entry of NX_SCAFFOLDING_TO_REMOVE) {
-    (0, import_node_fs6.rmSync)((0, import_node_path10.join)(workspaceRoot, entry), { recursive: true, force: true });
+    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, entry), { recursive: true, force: true });
   }
   removeProjectEslintConfigs(workspaceRoot);
 }
@@ -1837,11 +1990,11 @@ function removeProjectEslintConfigs(workspaceRoot) {
     cwd: workspaceRoot
   });
   for (const match of matches) {
-    (0, import_node_fs6.rmSync)((0, import_node_path10.join)(workspaceRoot, match), { force: true });
+    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, match), { force: true });
   }
 }
 function applyOverlay(workspaceRoot, options) {
-  const nxJsonPath = (0, import_node_path10.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path11.join)(workspaceRoot, "nx.json");
   const nxJson = readJson(nxJsonPath);
   const generators = {
     ...nxJson.generators,
@@ -1851,7 +2004,7 @@ function applyOverlay(workspaceRoot, options) {
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
   const patched = withEslintPlugin(withReleaseConfig(nxJson, options.ci));
   writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
-  const manifestPath = (0, import_node_path10.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path11.join)(workspaceRoot, "package.json");
   const manifest = readJson(manifestPath);
   const scripts = {
     ...manifest.scripts,
@@ -1869,34 +2022,34 @@ function applyOverlay(workspaceRoot, options) {
     manifestPath,
     toJson({ ...manifest, name: `${options.scope}/source`, scripts, devDependencies: devDeps })
   );
-  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".npmrc"), npmrcContent(options.registry, options.scope));
-  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, "commitlint.config.mjs"), COMMITLINT_CONFIG);
-  const hookPath = (0, import_node_path10.join)(workspaceRoot, ".husky/commit-msg");
+  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".npmrc"), npmrcContent(options.registry, options.scope));
+  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, "commitlint.config.mjs"), COMMITLINT_CONFIG);
+  const hookPath = (0, import_node_path11.join)(workspaceRoot, ".husky/commit-msg");
   writeFileEnsured(hookPath, COMMIT_MSG_HOOK);
   markExecutable(hookPath);
-  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, "eslint.config.mjs"), ESLINT_CONFIG);
-  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".prettierrc.json"), PRETTIER_CONFIG);
-  writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".prettierignore"), PRETTIER_IGNORE);
+  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, "eslint.config.mjs"), ESLINT_CONFIG);
+  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".prettierrc.json"), PRETTIER_CONFIG);
+  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".prettierignore"), PRETTIER_IGNORE);
   removeNxScaffolding(workspaceRoot);
-  const codeWorkspacePath = (0, import_node_path10.join)(workspaceRoot, `${options.workspaceName}.code-workspace`);
+  const codeWorkspacePath = (0, import_node_path11.join)(workspaceRoot, `${options.workspaceName}.code-workspace`);
   const existing = readCodeWorkspace(codeWorkspacePath);
   writeFileEnsured(codeWorkspacePath, vscodeWorkspace(options.workspaceName, existing?.tasks));
   if (options.workspaceName !== "undefined") {
-    (0, import_node_fs6.rmSync)((0, import_node_path10.join)(workspaceRoot, "undefined.code-workspace"), { force: true });
+    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, "undefined.code-workspace"), { force: true });
   }
   const publishUrl = pythonPublishUrl(options.registry);
   if (options.ci === "azure" || options.ci === "both") {
     writeFileEnsured(
-      (0, import_node_path10.join)(workspaceRoot, "azure-pipelines.yml"),
+      (0, import_node_path11.join)(workspaceRoot, "azure-pipelines.yml"),
       azurePipelinesYaml(options.agent, options.variableGroup, publishUrl, options.registry.kind)
     );
   }
   if (options.ci === "github" || options.ci === "both") {
     writeFileEnsured(
-      (0, import_node_path10.join)(workspaceRoot, ".github/workflows/ci.yml"),
+      (0, import_node_path11.join)(workspaceRoot, ".github/workflows/ci.yml"),
       githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
     );
-    writeFileEnsured((0, import_node_path10.join)(workspaceRoot, ".github/dependabot.yml"), DEPENDABOT_CONFIG);
+    writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".github/dependabot.yml"), DEPENDABOT_CONFIG);
   }
 }
 
@@ -1965,7 +2118,7 @@ async function runNew(name, options) {
     ],
     process.cwd()
   );
-  const workspaceRoot = (0, import_node_path11.join)(process.cwd(), workspaceName);
+  const workspaceRoot = (0, import_node_path12.join)(process.cwd(), workspaceName);
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
@@ -1984,9 +2137,8 @@ async function runNew(name, options) {
   runPrettier(workspaceRoot);
   logger.success("Done. Next steps:");
   logger.info(`  cd ${workspaceName}`);
-  logger.info(
-    "  mnci add react-app web        # or: node-app, node-function-app, npm-lib, internal-lib,"
-  );
+  logger.info("  mnci add react-app web        # or: react-lib, react-internal-lib, node-app,");
+  logger.info("                                 #     node-function-app, npm-lib, internal-lib,");
   logger.info(
     "                                 #     python-app, python-function-app, python-lib, python-internal-lib,"
   );
@@ -2001,7 +2153,7 @@ async function runNew(name, options) {
 
 // src/commands/upgrade.ts
 var import_node_fs7 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -2038,7 +2190,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path12.basename)(workspaceRoot);
+  return (0, import_node_path13.basename)(workspaceRoot);
 }
 function resolveOverlayOptions(workspaceRoot, options, persisted) {
   const scope = options.scope ?? persisted.scope;
@@ -2076,7 +2228,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path12.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -2093,14 +2245,14 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/commands/interactive.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path13.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path14.join)(process.cwd(), "nx.json"));
   const newChoice = { name: "Create a new monorepo", value: "new" };
   const addChoice = { name: "Add a project to this workspace", value: "add" };
   const upgradeChoice = {
     name: "Upgrade this workspace (re-apply the latest overlay)",
     value: "upgrade"
   };
-  const action = await (0, import_prompts7.select)({
+  const action = await (0, import_prompts8.select)({
     message: "What would you like to do?",
     choices: inWorkspace ? [addChoice, upgradeChoice, newChoice] : [newChoice, addChoice, upgradeChoice]
   });
@@ -2115,7 +2267,7 @@ async function runInteractive() {
 
 // src/util/versionChecker.ts
 var import_node_fs8 = require("fs");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -2171,7 +2323,7 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path14.join)(packageDirectory, "..", "package.json");
+    const manifestPath = (0, import_node_path15.join)(packageDirectory, "..", "package.json");
     const manifest = JSON.parse((0, import_node_fs8.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {