@mnci/cli 4.0.5 → 4.0.7

package/dist/cli.js

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(cli_exports);
 var import_commander = require("commander");
 
 // src/commands/add.ts
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var import_prompts5 = require("@inquirer/prompts");
 
 // src/nx.ts
@@ -192,2167 +192,2206 @@ function assertValidProjectName(name, label) {
 }
 
 // src/commands/add/flutter.ts
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 
 // src/commands/add/shared.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+
+// src/overlay.ts
 var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
-function hasPlugin(workspaceRoot, packageName) {
-  const manifest = readJson((0, import_node_path2.join)(workspaceRoot, "package.json"));
-  const installed = { ...manifest.dependencies, ...manifest.devDependencies };
-  return Object.hasOwn(installed, packageName);
-}
-function ensurePlugin(workspaceRoot, packageName) {
-  if (hasPlugin(workspaceRoot, packageName)) {
-    return;
+var DEFAULT_STACK = { testRunner: "jest" };
+var TS_COMPILER_DEPENDENCIES = {
+  "@typescript/native": "npm:typescript@^7.0.2",
+  typescript: "npm:@typescript/typescript6@^6.0.2"
+};
+function registryUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/npm/registry/`;
   }
-  logger.step(`Installing Nx plugin ${packageName}`);
-  runNx(["add", packageName], workspaceRoot);
-}
-function markPrivate(manifestPath) {
-  const manifest = readJson(manifestPath);
-  writeFileEnsured(manifestPath, toJson({ ...manifest, private: true }));
-}
-function markPublic(manifestPath) {
-  const manifest = readJson(manifestPath);
-  writeFileEnsured(manifestPath, toJson({ ...manifest, publishConfig: { access: "public" } }));
+  return void 0;
 }
-var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
-var ACTUAL_TYPES_PATH = "./dist/src/index.d.ts";
-var DECLARATION_MAP_EXCLUSION = "!**/*.d.ts.map";
-function repairPublishableManifest(manifestPath) {
-  const manifest = readJson(manifestPath);
-  if (manifest.types === WRONG_TYPES_PATH) {
-    manifest.types = ACTUAL_TYPES_PATH;
-  }
-  const dot = manifest.exports?.["."];
-  if (typeof dot === "object" && dot.types === WRONG_TYPES_PATH) {
-    dot.types = ACTUAL_TYPES_PATH;
-  }
-  if (manifest.files && !manifest.files.includes(DECLARATION_MAP_EXCLUSION)) {
-    manifest.files.push(DECLARATION_MAP_EXCLUSION);
+function npmrcContent(registry, scope) {
+  if (registry.kind === "npm") {
+    return `; Publish authentication for the public npm registry.
+;
+; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
+; is harmless locally, so no token is needed for day-to-day work.
+//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
+
+; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
+; the default registry, so routing the scope to it would change nothing \u2014 and
+; presenting that as protection against an accidental public publish would be
+; false, because the public registry is the intended target. (An earlier version
+; of this file made exactly that claim while emitting no routing line at all.)
+; To keep a scoped package off npmjs.org, use a private feed: generate with
+; --registry azure-artifacts, which does route the scope.
+`;
   }
-  writeFileEnsured(manifestPath, toJson(manifest));
+  const feedUrl = registryUrl(registry);
+  const feedKey = feedUrl.replace(/^https:/, "");
+  const feedShortKey = feedKey.replace("npm/registry/", "npm/");
+  return `; Publish + resolution routing for this workspace's own scope.
+;
+; '${scope}:registry' sends BOTH resolution and 'npm publish' of ${scope}/* to the
+; feed: npm prefers a scope's registry over the global one when publishing a
+; scoped package, so a ${scope}/* package cannot reach npmjs.org by accident.
+;
+; Only the scope is routed, on purpose. A global 'registry=' would send every
+; install through the feed as well, so 'npm ci' would need feed auth just to fetch
+; public packages.
+${scope}:registry=${feedUrl}
+
+; Feed credentials. PAT is the BASE64 value Azure Artifacts' "Connect to feed"
+; instructions give you, which is exactly what _password expects, so it is used
+; as-is. (twine wants the RAW token; the CI release step decodes it there.)
+; Azure ignores the username, and npm requires an email it never uses.
+;
+; NOT _authToken, and that is measured rather than assumed. The feed answers an
+; unauthenticated PUT to the publish endpoint with:
+;   www-authenticate: Bearer authorization_uri=https://login.windows.net/<tenant>,
+;                     Basic realm="...", TFS-Federated
+; so its Bearer scheme wants an Entra ID access token, NOT a PAT. npm sends
+; _authToken verbatim as a Bearer header, so a PAT there is rejected with
+; "Unable to authenticate, your authentication token seems to be invalid". A PAT
+; authenticates through the Basic scheme, which is username/_password. Note the
+; Packaging REST API DOES accept a PAT as Bearer - do not generalise from it.
+;
+; Both path forms are keyed because npm walks only UP a URL when matching.
+${feedKey}:username=AzureArtifacts
+${feedKey}:_password=\${PAT}
+${feedKey}:email=npm-requires-this-and-never-uses-it
+${feedShortKey}:username=AzureArtifacts
+${feedShortKey}:_password=\${PAT}
+${feedShortKey}:email=npm-requires-this-and-never-uses-it
+`;
 }
-function ensureAdmZip(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "adm-zip")) {
-    return;
-  }
-  logger.step("Installing the app packager (adm-zip)");
-  if (runShell(
-    "npm",
-    ["install", "--save-dev", "adm-zip", "--no-audit", "--no-fund"],
-    workspaceRoot
-  ) !== 0) {
-    throw new Error("npm install of adm-zip failed");
-  }
+function releaseConfig(ci) {
+  const githubReleases = ci === "github";
+  return {
+    projectsRelationship: "independent",
+    projects: ["packages/*", "python-packages/*", "!tag:type:go-lib"],
+    releaseTag: { pattern: "{projectName}@{version}" },
+    git: { commit: false, tag: true, push: githubReleases },
+    version: {
+      conventionalCommits: true,
+      fallbackCurrentVersionResolver: "disk",
+      // Build only what is being released. Without this, @nx/js:lib's generator
+      // defaults the pre-version command to building EVERY project, so a broken
+      // (or merely slow) app build would block releasing unrelated packages.
+      // Set here at `new` time it wins: the generator only fills this in when
+      // absent (it spreads the existing release.version over its default). Both
+      // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
+      preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
+    },
+    changelog: githubReleases ? {
+      workspaceChangelog: false,
+      projectChangelogs: { createRelease: "github", file: false }
+    } : { workspaceChangelog: false }
+  };
 }
-function defaultScope(workspaceRoot) {
-  const { name } = readJson((0, import_node_path2.join)(workspaceRoot, "package.json"));
-  const base = (name.startsWith("@") ? name.slice(1) : name).split("/", 1)[0];
-  return `@${base}`;
+var SYNC_CONFIG = { applyChanges: true };
+var ESLINT_PLUGIN_CONFIG = {
+  plugin: "@nx/eslint/plugin",
+  options: { targetName: "lint" }
+};
+function pluginName(entry) {
+  return typeof entry === "string" ? entry : entry.plugin;
 }
-function addNxTargets(manifestPath, newTargets) {
-  const manifest = fileExists(manifestPath) ? readJson(manifestPath) : {};
-  const nx = manifest.nx ?? {};
-  const targets = nx.targets ?? {};
-  writeFileEnsured(
-    manifestPath,
-    toJson({ ...manifest, nx: { ...nx, targets: { ...targets, ...newTargets } } })
-  );
+function withEslintPlugin(nxJson) {
+  const plugins = nxJson.plugins ?? [];
+  const registered = plugins.some((entry) => pluginName(entry) === ESLINT_PLUGIN_CONFIG.plugin);
+  return registered ? { ...nxJson, plugins } : { ...nxJson, plugins: [...plugins, ESLINT_PLUGIN_CONFIG] };
 }
-var ESLINT_CONFIG_FILENAMES = [
-  "eslint.config.js",
-  "eslint.config.mjs",
-  "eslint.config.cjs",
-  "eslint.config.ts",
-  "eslint.config.mts",
-  "eslint.config.cts"
+var SHARED_GLOBAL_INPUTS = [
+  "{workspaceRoot}/eslint.config.mjs",
+  "{workspaceRoot}/tsconfig.base.json",
+  "{workspaceRoot}/package.json"
 ];
-function removeGeneratedEslintConfig(workspaceRoot, projectRoot) {
-  for (const filename of ESLINT_CONFIG_FILENAMES) {
-    (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, projectRoot, filename), { force: true });
-  }
-  (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, ".vscode"), { recursive: true, force: true });
-}
-function findCodeWorkspaceFile(workspaceRoot) {
-  try {
-    const entry = (0, import_node_fs2.readdirSync)(workspaceRoot).find((file) => file.endsWith(".code-workspace"));
-    return entry ? (0, import_node_path2.join)(workspaceRoot, entry) : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function projectTask(name, kind) {
-  const script = `${name}:${kind}`;
-  const base = { label: `${name}: ${kind}`, type: "npm", script, problemMatcher: [] };
-  return kind === "start" ? { ...base, isBackground: true } : { ...base, group: kind };
-}
-function registerProjectCommands(workspaceRoot, name, commands) {
-  const scripts = {
-    [`${name}:qa`]: `nx run ${name}:lint && nx run ${name}:test`
-  };
-  if (commands.build) {
-    scripts[`${name}:build`] = `nx run ${name}:build`;
-  }
-  if (commands.start) {
-    scripts[`${name}:start`] = commands.start;
-  }
-  const manifestPath = (0, import_node_path2.join)(workspaceRoot, "package.json");
-  const manifest = readJson(manifestPath);
-  const existingScripts = manifest.scripts ?? {};
-  writeFileEnsured(
-    manifestPath,
-    toJson({ ...manifest, scripts: { ...existingScripts, ...scripts } })
-  );
-  const codeWorkspacePath = findCodeWorkspaceFile(workspaceRoot);
-  if (!codeWorkspacePath) {
-    return;
-  }
-  const workspaceFile = readCodeWorkspace(codeWorkspacePath) ?? {};
-  const label = (task) => task.label ?? "";
-  const existingTasks = (workspaceFile.tasks?.tasks ?? []).filter(
-    (task) => !label(task).startsWith(`${name}: `)
-  );
-  const newTasks = [
-    projectTask(name, "qa"),
-    ...commands.build ? [projectTask(name, "build")] : [],
-    ...commands.start ? [projectTask(name, "start")] : []
-  ];
-  writeFileEnsured(
-    codeWorkspacePath,
-    toJson({
-      ...workspaceFile,
-      tasks: {
-        version: workspaceFile.tasks?.version ?? "2.0.0",
-        tasks: [...existingTasks, ...newTasks]
-      }
-    })
-  );
-}
-
-// src/commands/add/flutter.ts
-function addProjectJsonTargets(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
-}
-function flutterAppStartTarget(name) {
+function withSharedGlobals(nxJson) {
+  const namedInputs = nxJson.namedInputs ?? {};
+  const existing = namedInputs.sharedGlobals ?? [];
+  const missing = SHARED_GLOBAL_INPUTS.filter((entry) => !existing.includes(entry));
   return {
-    executor: "nx:run-commands",
-    continuous: true,
-    options: { command: "flutter run -d chrome", cwd: `apps/${name}` }
+    ...nxJson,
+    namedInputs: { ...namedInputs, sharedGlobals: [...existing, ...missing] }
   };
 }
-function ensureFlutter(workspaceRoot) {
-  if (runShell("flutter", ["--version"], workspaceRoot) !== 0) {
-    throw new Error(
-      "Flutter not found. Install the Flutter SDK first (3.27+, for Dart 3.6+ pub workspaces): https://docs.flutter.dev/get-started/install"
-    );
-  }
-}
-function nxFlutterPluginSpec() {
-  return process.env.MNCI_NX_FLUTTER_SPEC ?? "@mnci/nx-flutter";
+function withReleaseConfig(nxJson, ci) {
+  return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
-function ensureNxFlutterPlugin(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@mnci/nx-flutter")) {
-    return;
-  }
-  const spec = nxFlutterPluginSpec();
-  logger.step(`Installing the Flutter toolchain plugin (${spec})`);
-  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @mnci/nx-flutter failed");
-  }
-}
-function prepareFlutter(workspaceRoot) {
-  ensureFlutter(workspaceRoot);
-  ensureNxFlutterPlugin(workspaceRoot);
-}
-function addFlutterApp(workspaceRoot, name) {
-  prepareFlutter(workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  runNx(["g", "@mnci/nx-flutter:application", name, "--no-interactive"], workspaceRoot);
-  addProjectJsonTargets((0, import_node_path3.join)(workspaceRoot, "apps", name, "project.json"), {
-    start: flutterAppStartTarget(name)
-  });
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
-}
-function addFlutterLib(workspaceRoot, name) {
-  prepareFlutter(workspaceRoot);
-  runNx(["g", "@mnci/nx-flutter:library", name, "--no-interactive"], workspaceRoot);
-  registerProjectCommands(workspaceRoot, name, { build: false });
-}
-function addFlutterInternalLib(workspaceRoot, name) {
-  prepareFlutter(workspaceRoot);
-  runNx(["g", "@mnci/nx-flutter:internal-library", name, "--no-interactive"], workspaceRoot);
-  registerProjectCommands(workspaceRoot, name, { build: false });
-}
-
-// src/commands/add/go.ts
-var import_node_fs3 = require("fs");
-var import_node_path4 = require("path");
-function ensureGo(workspaceRoot) {
-  if (runShell("go", ["version"], workspaceRoot) !== 0) {
-    throw new Error("Go not found. Install Go 1.21+ first: https://go.dev/dl/");
-  }
-}
-function warnIfNoGolangciLint(workspaceRoot) {
-  if (runShell("golangci-lint", ["--version"], workspaceRoot) !== 0) {
-    logger.warn(
-      "golangci-lint not found \u2014 the generated lint target needs it. Install: https://golangci-lint.run/welcome/install/"
-    );
-  }
-}
-function nxGoPluginSpec() {
-  return process.env.MNCI_NX_GO_SPEC ?? "@nx-go/nx-go";
-}
-function ensureNxGoPlugin(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@nx-go/nx-go")) {
-    return;
-  }
-  const spec = nxGoPluginSpec();
-  logger.step(`Installing the Go toolchain plugin (${spec})`);
-  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @nx-go/nx-go failed");
-  }
+var COMMITLINT_CONFIG = `export default { extends: ['@commitlint/config-conventional'] }
+`;
+var COMMIT_MSG_HOOK = `npx --no -- commitlint --edit "$1"
+`;
+var ESLINT_CONFIG_VERSION = "^0.1.0";
+function eslintConfigSpec() {
+  return process.env.MNCI_ESLINT_CONFIG_SPEC ?? ESLINT_CONFIG_VERSION;
 }
-function ensureGoModule(workspaceRoot) {
-  if (fileExists((0, import_node_path4.join)(workspaceRoot, "go.mod"))) {
-    return;
-  }
-  logger.step("Bootstrapping the workspace Go module (single root go.mod)");
-  runNx(["g", "@nx-go/nx-go:init", "--no-interactive"], workspaceRoot);
-  runNx(["g", "@nx-go/nx-go:convert-to-one-mod", "--no-interactive"], workspaceRoot);
+var ESLINT_VERSION = "^10.8.0";
+function devcontainerJson(workspaceName) {
+  return `${toJson({
+    name: workspaceName,
+    image: `mcr.microsoft.com/devcontainers/typescript-node:${NODE_VERSION}-bookworm`,
+    features: {
+      "ghcr.io/devcontainers/features/python:1": { version: "3.12" },
+      "ghcr.io/devcontainers/features/go:1": { version: "latest" }
+    },
+    // `npm ci` first: every guard after it runs through the workspace's own
+    // scripts and Nx, which do not exist until the install completes.
+    postCreateCommand: [
+      // Same pin the workflow applies, for the same reason — a container whose
+      // npm major differs from CI's resolves dependencies differently, which is
+      // precisely the drift this file exists to remove.
+      `npm install -g npm@${NPM_VERSION}`,
+      "npm ci",
+      "npm run python:install",
+      GOLANGCI_LINT_INSTALL_GUARD,
+      FLUTTER_SDK_INSTALL_GUARD
+    ].join(" && "),
+    // The same recommendations the `.code-workspace` file carries, so opening
+    // the folder in a container suggests the identical toolset.
+    customizations: {
+      vscode: { extensions: VSCODE_RECOMMENDED_EXTENSIONS }
+    }
+  })}
+`;
 }
-function goModulePath(workspaceRoot) {
-  try {
-    const contents = (0, import_node_fs3.readFileSync)((0, import_node_path4.join)(workspaceRoot, "go.mod"), "utf8");
-    return /^module\s+(\S+)/m.exec(contents)?.[1];
-  } catch {
-    return void 0;
+var ROOT_LINT_TARGET = {
+  executor: "nx:run-commands",
+  cache: true,
+  options: {
+    command: [
+      // `--cache` is the one ESLint speed option that actually pays here:
+      // measured best-of-3 on this repo, an unchanged re-run drops from 9,546ms
+      // to 2,835ms (3.4x). `--concurrency=auto` was measured too and REJECTED —
+      // it came out 8% SLOWER, because per-worker TypeScript type-service
+      // startup costs more than the parallelism saves. The cache file is
+      // per-machine and gitignored.
+      "eslint . --cache",
+      '--ignore-pattern "apps/**"',
+      '--ignore-pattern "libs/**"',
+      '--ignore-pattern "packages/**"',
+      '--ignore-pattern "python-packages/**"',
+      "--ignore-pattern package-lock.json"
+    ].join(" "),
+    cwd: "."
   }
-}
-function addProjectJsonTargets2(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
-}
-function goTestTarget() {
-  return { executor: "@nx-go/nx-go:test" };
-}
-function goLintTarget() {
-  return {
-    executor: "@nx-go/nx-go:lint",
-    parallelism: false,
-    options: { linter: "golangci-lint", args: ["run"] }
-  };
-}
-function goBuildTarget(name) {
-  return {
-    executor: "@nx-go/nx-go:build",
-    outputs: [`{workspaceRoot}/dist/apps/${name}`],
-    options: { outputPath: `../../dist/apps/${name}/${name}` }
-  };
-}
-function goPackageTarget(tag, name) {
-  const zip = `dist/drop/${tag}-${name}.zip`;
-  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('dist/apps/${name}');z.writeZip('${zip}')"`;
-  return {
-    executor: "nx:run-commands",
-    dependsOn: ["build"],
-    outputs: [`{workspaceRoot}/${zip}`],
-    options: { command }
+};
+function reactExpressPeerOverride(manifest) {
+  const declared = {
+    ...manifest.dependencies,
+    ...manifest.devDependencies
   };
+  return declared.express === void 0 ? {} : { "@nx/react": { express: "$express" } };
 }
-function goStartTarget(name) {
+var ESLINT_PEER_OVERRIDES = {
+  "eslint-plugin-jsx-a11y": { eslint: "$eslint" },
+  // Scoped to EACH named parent, not top-level and not `nx` alone.
+  //
+  // `nx` alone was the first attempt and it did not work: the e2e's audit step
+  // still reported all six advisories in a freshly generated workspace, because
+  // `@nx/js`, `@nx/eslint`, `@nx/eslint-plugin` and `@nx/workspace` are their own
+  // dependents there, and an override scoped to `nx` never reaches a sibling's
+  // dependencies. Those four are exactly the packages npm audit named.
+  //
+  // Top-level would be worse than wrong. A tree with `minimatch@3` legitimately
+  // carries `brace-expansion@1.1.18` (and `@2.1.4` elsewhere) — this repo has
+  // both — and forcing those to v5 breaks them. So the blast radius is one
+  // dependency edge per named parent, and a test asserts there is no top-level
+  // entry.
+  nx: { "brace-expansion": "^5.0.9" },
+  "@nx/js": { "brace-expansion": "^5.0.9" },
+  "@nx/eslint": { "brace-expansion": "^5.0.9" },
+  "@nx/eslint-plugin": { "brace-expansion": "^5.0.9" },
+  "@nx/workspace": { "brace-expansion": "^5.0.9" },
+  // `postcss` → `nanoid` reaches a generated workspace through `@nx/rollup`,
+  // which every publishable `npm-lib` gets. GHSA-2v37-7h3g-55p8 is high, fixed in
+  // 3.3.18, and the fix is a patch — so unlike the entry above this one is not
+  // even a trade, just a version nobody had bumped yet.
+  postcss: { nanoid: "^3.3.18" }
+};
+var SECURITY_OVERRIDES = {
+  "brace-expansion@4.0.0 - 5.0.8": "^5.0.9"
+};
+function eslintToolchainDependencies(nxVersion) {
   return {
-    executor: "nx:run-commands",
-    continuous: true,
-    options: { command: "go run .", cwd: `apps/${name}` }
+    eslint: ESLINT_VERSION,
+    "@nx/eslint": nxVersion,
+    "@nx/eslint-plugin": nxVersion,
+    "@mnci/eslint-config": eslintConfigSpec()
   };
 }
-function prepareGo(workspaceRoot) {
-  ensureGo(workspaceRoot);
-  warnIfNoGolangciLint(workspaceRoot);
-  ensureNxGoPlugin(workspaceRoot);
-  ensureGoModule(workspaceRoot);
-}
-function addGoApp(workspaceRoot, name) {
-  prepareGo(workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@nx-go/nx-go:application",
-      `apps/${name}`,
-      `--name=${name}`,
-      "--tags=type:go-app",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  addProjectJsonTargets2((0, import_node_path4.join)(workspaceRoot, "apps", name, "project.json"), {
-    build: goBuildTarget(name),
-    test: goTestTarget(),
-    lint: goLintTarget(),
-    package: goPackageTarget("go-app", name),
-    start: goStartTarget(name)
-  });
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+var RETIRED_FORMATTER_FILES = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.mjs",
+  ".prettierignore",
+  "oxlint.config.ts",
+  ".oxfmtrc.json"
+];
+function withoutRetiredFormatterDependencies(devDeps) {
+  const retired = /* @__PURE__ */ new Set([
+    "prettier",
+    "eslint-config-prettier",
+    "oxlint",
+    "oxfmt",
+    "@mnci/oxlint-config"
+  ]);
+  return Object.fromEntries(Object.entries(devDeps).filter(([name]) => !retired.has(name)));
 }
-function addGoFunctionApp(workspaceRoot, name) {
-  prepareGo(workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@nx-go/nx-go:application",
-      `apps/${name}`,
-      `--name=${name}`,
-      "--tags=type:go-function-app",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  addProjectJsonTargets2((0, import_node_path4.join)(workspaceRoot, "apps", name, "project.json"), {
-    build: goBuildTarget(name),
-    test: goTestTarget(),
-    lint: goLintTarget(),
-    package: goPackageTarget("go-function-app", name)
-  });
-  registerProjectCommands(workspaceRoot, name, { build: true });
+var ESLINT_BLOCK_INVENTORY = `// WHAT IS IN HERE. Each line is one config block, by the \`name\` it carries.
+//
+//   mnci/ignores                  paths never linted (dist, coverage, .venv, \u2026)
+//   mnci/base                     JS/TS correctness \u2014 @eslint/js, eslint-plugin-unicorn,
+//                                 -promise, -n, -unused-imports
+//   typescript-eslint/*           typescript-eslint's own recommended blocks
+//   mnci/typescript*              TS rules on top of them, no type information needed
+//   mnci/type-aware*              the rules that DO read types (no-floating-promises and
+//                                 friends), scoped to {apps,libs,packages}/*/src
+//   mnci/import-graph             import cycles \u2014 eslint-plugin-import-x
+//   mnci/react                    JSX/TSX \u2014 @eslint-react/eslint-plugin,
+//                                 eslint-plugin-react-hooks, -react-refresh, -jsx-a11y
+//   mnci/regexp*                  regex correctness \u2014 eslint-plugin-regexp
+//   mnci/json  mnci/jsonc  mnci/json5
+//                                 eslint-plugin-jsonc \u2014 comments are allowed in .jsonc
+//                                 and tsconfig.json, forbidden in plain .json
+//   mnci/yaml*                    eslint-plugin-yml \u2014 your CI pipeline files
+//   mnci/toml/base*               eslint-plugin-toml, PARSER ONLY: a malformed
+//                                 pyproject.toml is a syntax error, nothing is styled
+//   mnci/markdown                 @eslint/markdown
+//   mnci/css                      @eslint/css
+//   mnci/html                     @html-eslint/eslint-plugin
+//   mnci/tests                    *.spec/*.test relaxations \u2014 eslint-plugin-jest
+//                                 (Vitest's globals too; the two stacks share them)
+//   mnci/nx-dependency-checks     @nx/eslint-plugin, on publishable packages' manifests
+//   mnci/standard                 JavaScript Standard Style as ESLint rules \u2014 the
+//                                 whole formatting opinion. Composed LAST, on
+//                                 purpose: nothing may follow that disables it.
+//
+// To list them as ESLint actually resolves them:  npx eslint --inspect-config
+`;
+var ESLINT_CONFIG = `import mnci from '@mnci/eslint-config'
+
+${ESLINT_BLOCK_INVENTORY}//
+// TO OVERRIDE a rule, append a block AFTER the spread \u2014 later blocks win, so one
+// of your own beats anything above it. Give it a name, so the inspector shows
+// where the change came from:
+//
+//   export default [
+//     ...mnci({ workspaceRoot: import.meta.dirname }),
+//     {
+//       name: 'local/legacy-app-allows-any',
+//       files: ['apps/legacy/**/*.ts'],
+//       rules: { '@typescript-eslint/no-explicit-any': 'off' }
+//     }
+//   ]
+//
+// Do NOT edit @mnci/eslint-config inside node_modules, and do not fork it: it is
+// a dependency, so \`npm update\` brings rule fixes in the way it brings any
+// other. An override here survives that; an edit to the package does not.
+//
+// FORMATTING IS LINTING HERE. There is no Prettier, no oxfmt and no
+// \`format:check\` \u2014 \`npm run lint\` reports indentation, quotes and spacing as
+// ordinary errors, and \`npm run format\` is \`eslint . --fix\`. So do not add a
+// formatter: whichever one you pick will disagree with the \`mnci/standard\`
+// block above, and because a formatter runs on save it wins silently, leaving
+// \`lint\` to fail on files you never edited by hand.
+//
+// That also applies to the editor. Installing a Prettier or oxfmt extension is
+// enough on its own \u2014 neither needs a config file, and with none present they
+// format against their own defaults (semicolons, double quotes), which is the
+// inverse of Standard.
+export default mnci({ workspaceRoot: import.meta.dirname })
+`;
+var VSCODE_RECOMMENDED_EXTENSIONS = [
+  "dbaeumer.vscode-eslint",
+  "nrwl.angular-console",
+  "firsttris.vscode-jest-runner"
+];
+var FORMATTED_LANGUAGES = [
+  "javascript",
+  "javascriptreact",
+  "typescript",
+  "typescriptreact",
+  "json",
+  "jsonc",
+  "yaml",
+  "markdown",
+  "css",
+  "html",
+  // TOML is here for PARSING, not formatting, and the distinction is measured
+  // rather than assumed: `eslint --fix` leaves a badly-laid-out `.toml`
+  // byte-identical (the TOML block is `flat/base`, parser only — `flat/standard`
+  // reported six errors on the `pyproject.toml` mnci itself generates), but it
+  // DOES report `Parsing error: ...` on a malformed one.
+  //
+  // So the entry buys two things. `eslint.validate` gains toml, so a broken
+  // `pyproject.toml` is flagged in the editor rather than at the next CI run.
+  // And pinning the formatter to ESLint means format-on-save does nothing to the
+  // file instead of handing it to whichever TOML formatter the user happens to
+  // have installed — the same reasoning as every other entry here: nothing
+  // reformats against an opinion no gate checks.
+  //
+  // Impossible under the Prettier stack, which is why it is only here now:
+  // `npx prettier` on a `.toml` exits with "No parser could be inferred".
+  "toml"
+];
+function vscodeSettings() {
+  const formatter = "dbaeumer.vscode-eslint";
+  const eslintLanguages = [...FORMATTED_LANGUAGES];
+  return {
+    "eslint.validate": eslintLanguages,
+    "editor.codeActionsOnSave": {
+      "source.fixAll.eslint": "explicit"
+    },
+    "editor.defaultFormatter": formatter,
+    "editor.formatOnSave": true,
+    // Every language spelled out, and the global default above is NOT enough on
+    // its own — which is the bug this fixes rather than a belt-and-braces habit.
+    //
+    // VS Code resolves a language-specific setting ahead of a general one, and it
+    // does that comparison BEFORE scope. So a `[typescript]` block in someone's
+    // USER settings — left over from any other project — outranks this file's
+    // workspace-level `editor.defaultFormatter`, and format-on-save quietly uses
+    // that other formatter instead — and nothing reports it, because the gate
+    // and the editor are looking at different tools. That is how it was found:
+    // reported from a real workspace, not deduced from the docs.
+    //
+    // Reported from a real workspace where `.ts` files were not being formatted
+    // while `.json`/`.jsonc`/`.yaml` were — exactly the three that had explicit
+    // entries here and nothing else did.
+    ...Object.fromEntries(
+      FORMATTED_LANGUAGES.map((language) => [
+        `[${language}]`,
+        { "editor.defaultFormatter": formatter }
+      ])
+    )
+  };
 }
-function addGoLib(workspaceRoot, name) {
-  prepareGo(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@nx-go/nx-go:library",
-      `packages/${name}`,
-      `--name=${name}`,
-      "--tags=type:go-lib",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  addProjectJsonTargets2((0, import_node_path4.join)(workspaceRoot, "packages", name, "project.json"), {
-    test: goTestTarget(),
-    lint: goLintTarget()
-  });
-  registerProjectCommands(workspaceRoot, name, { build: false });
-  const module2 = goModulePath(workspaceRoot);
-  if (module2) {
-    logger.step(`Import it as ${module2}/packages/${name}`);
-  }
+var LAUNCH_CONFIG_PREFIX = "mnci: ";
+var LAUNCH_CONFIGURATIONS = ["build", "test", "lint", "typecheck"];
+function launchConfigurations(workspaceName) {
+  return LAUNCH_CONFIGURATIONS.map((script, index) => ({
+    type: "node-terminal",
+    request: "launch",
+    name: `${LAUNCH_CONFIG_PREFIX}${script}`,
+    command: `npm run ${script}`,
+    // Scoped by folder name rather than a bare ${workspaceFolder}: that variable is
+    // ambiguous once a second folder is added to the workspace, and VS Code then
+    // refuses to resolve it.
+    cwd: `\${workspaceFolder:${workspaceName}}`,
+    // One shared group keeps the four together in the dropdown; a per-entry group
+    // would make four groups of one. `order` holds them in verify order.
+    presentation: { group: "mnci", order: index + 1 }
+  }));
 }
-function addGoInternalLib(workspaceRoot, name) {
-  prepareGo(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@nx-go/nx-go:library",
-      `libs/${name}`,
-      `--name=${name}`,
-      "--tags=type:go-internal-lib",
-      "--no-interactive"
-    ],
-    workspaceRoot
+function vscodeWorkspace(workspaceName, existingTasks, existingLaunch, existingSettings) {
+  const userConfigurations = (existingLaunch?.configurations ?? []).filter(
+    (configuration) => !String(configuration.name ?? "").startsWith(LAUNCH_CONFIG_PREFIX)
   );
-  addProjectJsonTargets2((0, import_node_path4.join)(workspaceRoot, "libs", name, "project.json"), {
-    test: goTestTarget(),
-    lint: goLintTarget()
-  });
-  registerProjectCommands(workspaceRoot, name, { build: false });
-  const module2 = goModulePath(workspaceRoot);
-  if (module2) {
-    logger.step(`Import it as ${module2}/libs/${name}`);
-  }
-}
-
-// src/commands/add/node.ts
-var import_node_path5 = require("path");
-function ensurePlugin2(workspaceRoot, packageName) {
-  if (hasPlugin(workspaceRoot, packageName)) {
-    return;
-  }
-  logger.step(`Installing Nx plugin ${packageName}`);
-  runNx(["add", packageName], workspaceRoot);
-}
-function runNodeApp(workspaceRoot, name, stack, framework) {
-  ensurePlugin2(workspaceRoot, "@nx/node");
-  runNx(
-    [
-      "g",
-      "@nx/node:application",
-      `apps/${name}`,
-      "--bundler=esbuild",
-      `--unitTestRunner=${stack.testRunner}`,
-      "--linter=none",
-      "--e2eTestRunner=none",
-      `--framework=${framework}`,
-      "--no-interactive"
-    ],
-    workspaceRoot
+  const settings = { ...existingSettings, ...vscodeSettings() };
+  return JSON.stringify(
+    {
+      folders: [{ path: ".", name: workspaceName }],
+      settings,
+      extensions: { recommendations: VSCODE_RECOMMENDED_EXTENSIONS },
+      tasks: {
+        version: existingTasks?.version ?? "2.0.0",
+        tasks: existingTasks?.tasks ?? []
+      },
+      launch: {
+        version: existingLaunch?.version ?? "0.2.0",
+        configurations: [...launchConfigurations(workspaceName), ...userConfigurations]
+      }
+    },
+    null,
+    2
   );
 }
-function nodeAppPackageTarget(name) {
-  const zip = `dist/drop/node-app-${name}.zip`;
-  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('apps/${name}/dist');z.writeZip('${zip}')"`;
+var ROOT_SCRIPTS = {
+  build: "nx run-many -t build",
+  lint: "nx run-many -t lint",
+  test: "nx run-many -t test",
+  typecheck: "nx run-many -t typecheck",
+  affected: "nx affected -t lint,typecheck,test,build",
+  graph: "nx graph",
+  "release:preview": "nx release --dry-run",
+  prepare: "husky"
+};
+function rootScripts() {
   return {
-    executor: "nx:run-commands",
-    dependsOn: ["build"],
-    outputs: [`{workspaceRoot}/${zip}`],
-    options: { command }
-  };
-}
-function addNodeApp(workspaceRoot, name, stack, framework = "none") {
-  runNodeApp(workspaceRoot, name, stack, framework);
-  ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path5.join)(workspaceRoot, "apps", name, "package.json"), {
-    package: nodeAppPackageTarget(name)
-  });
-  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
-}
-function ensureAzureFunctionsPackage(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@azure/functions")) {
-    return;
-  }
-  logger.step("Installing @azure/functions");
-  if (runShell("npm", ["install", "@azure/functions", "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @azure/functions failed");
-  }
-}
-var NODE_FUNCTION_APP_MAIN = `// esbuild only includes what is reachable from here, so add one import per
-// function file you create under src/functions/.
-import './functions/hello'
-`;
-var NODE_FUNCTION_APP_HOST_JSON = `{
-  "version": "2.0",
-  "extensionBundle": {
-    "id": "Microsoft.Azure.Functions.ExtensionBundle",
-    "version": "[4.*, 5.0.0)"
-  }
-}
-`;
-var NODE_FUNCTION_APP_HELLO = `import { app } from '@azure/functions'
-import type { HttpRequest, HttpResponseInit } from '@azure/functions'
-import { buildGreeting } from './greeting'
-
-async function hello(request: HttpRequest): Promise<HttpResponseInit> {
-  const name = request.query.get('name') ?? 'world'
-  return { body: buildGreeting(name) }
-}
-
-app.http('hello', {
-  methods: ['GET'],
-  authLevel: 'anonymous',
-  route: 'hello',
-  handler: hello,
-})
-`;
-var NODE_FUNCTION_APP_GREETING = `export function buildGreeting (name: string): string {
-  return 'Hello, ' + name + '!'
-}
-`;
-var NODE_FUNCTION_APP_GREETING_SPEC = `import { buildGreeting } from './greeting'
-
-describe('buildGreeting', () => {
-  it('greets a name', () => {
-    expect(buildGreeting('world')).toBe('Hello, world!')
-  })
-})
-`;
-function repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot) {
-  const manifestPath = (0, import_node_path5.join)(nodeFunctionAppRoot, "package.json");
-  const manifest = readJson(manifestPath);
-  const azureFunctionsVersion = readJson(
-    (0, import_node_path5.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
-  ).version;
-  const dependencies = manifest.dependencies ?? {};
-  writeFileEnsured(
-    manifestPath,
-    toJson({
-      ...manifest,
-      main: "dist/main.js",
-      dependencies: { ...dependencies, "@azure/functions": `^${azureFunctionsVersion}` }
-    })
-  );
+    ...ROOT_SCRIPTS,
+    // ESLint is the formatter, so `format` is `--fix` and there is no separate
+    // `format:check`: `lint` already reports formatting as ordinary errors.
+    // Carrying a second script that ran the same tool twice would just make a
+    // CI run slower for no extra coverage.
+    format: "eslint . --fix --cache",
+    "python:install": `${PYTHON_INSTALL_GUARD} && ${PYTHON_WORKSPACE_INSTALL_GUARD}`
+  };
 }
-function nodeFunctionAppPackageTarget(name) {
-  const zip = `dist/drop/node-function-app-${name}.zip`;
-  const root = `apps/${name}`;
-  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('${root}/dist','dist');z.addLocalFile('${root}/host.json');z.addLocalFile('${root}/package.json');z.writeZip('${zip}')"`;
+function generatorDefaults(stack) {
+  const shared = {
+    // `none`, not `eslint`, and the workspace is still fully linted. The root
+    // config plus `@nx/eslint/plugin` ({@link ESLINT_PLUGIN_CONFIG}) give every
+    // project its `lint` target; `eslint` here would only make the generator
+    // scaffold a per-project config mnci deletes anyway — and drag in
+    // `eslint-plugin-import@2.31.0`, which peer-caps at ESLint 9 and breaks the
+    // install outright on this workspace's ESLint 10.
+    linter: "none",
+    unitTestRunner: stack.testRunner
+  };
   return {
-    executor: "nx:run-commands",
-    dependsOn: ["build"],
-    outputs: [`{workspaceRoot}/${zip}`],
-    options: { command }
+    "@nx/react:application": shared,
+    "@nx/react:library": shared,
+    "@nx/js:library": shared
   };
 }
-function nodeFunctionAppStartTarget(name) {
+function mnciConfig(options) {
   return {
-    executor: "nx:run-commands",
-    dependsOn: ["build"],
-    continuous: true,
-    options: { command: "func start", cwd: `apps/${name}` }
+    // Persisted so `mnci upgrade` can name the `<name>.code-workspace` file it
+    // rewrites. Its absence is why upgrade used to write a file literally called
+    // `undefined.code-workspace` and therefore never refreshed the real one —
+    // see `resolveWorkspaceName` in `commands/upgrade.ts`, which still needs a
+    // fallback chain for workspaces generated before this field existed.
+    workspaceName: options.workspaceName,
+    scope: options.scope,
+    registry: options.registry,
+    agent: options.agent,
+    variableGroup: options.variableGroup,
+    ci: options.ci,
+    stack: { testRunner: options.stack.testRunner }
   };
 }
-function addNodeFunctionApp(workspaceRoot, name, stack) {
-  runNodeApp(workspaceRoot, name, stack, "none");
-  ensureAzureFunctionsPackage(workspaceRoot);
-  const nodeFunctionAppRoot = (0, import_node_path5.join)(workspaceRoot, "apps", name);
-  writeFileEnsured((0, import_node_path5.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
-  writeFileEnsured((0, import_node_path5.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
-  writeFileEnsured(
-    (0, import_node_path5.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
-    NODE_FUNCTION_APP_GREETING
-  );
-  writeFileEnsured(
-    (0, import_node_path5.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
-    NODE_FUNCTION_APP_GREETING_SPEC
-  );
-  writeFileEnsured((0, import_node_path5.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
-  repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path5.join)(nodeFunctionAppRoot, "package.json"), {
-    package: nodeFunctionAppPackageTarget(name),
-    start: nodeFunctionAppStartTarget(name)
-  });
-  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
-}
-
-// src/commands/add/npmLib.ts
-var import_node_path6 = require("path");
-async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
-  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  runNx(
-    [
-      "g",
-      "@nx/js:lib",
-      `packages/${name}`,
-      "--publishable",
-      `--importPath=${scope}/${name}`,
-      "--bundler=rollup",
-      `--unitTestRunner=${stack.testRunner}`,
-      "--linter=none",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  const manifestPath = (0, import_node_path6.join)(workspaceRoot, "packages", name, "package.json");
-  markPublic(manifestPath);
-  repairPublishableManifest(manifestPath);
-  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true });
+function readMnciConfig(workspaceRoot) {
+  const nxJson = readJson((0, import_node_path2.join)(workspaceRoot, "nx.json"));
+  return nxJson.mnci ?? {};
 }
-
-// src/commands/add/python.ts
-var import_node_fs4 = require("fs");
-var import_node_path7 = require("path");
-function ensurePython(workspaceRoot) {
-  const hasPython = runShell("python3", ["--version"], workspaceRoot) === 0 || runShell("python", ["--version"], workspaceRoot) === 0;
-  if (!hasPython) {
-    throw new Error(
-      "Python not found. Install Python 3.9+ first: https://www.python.org/downloads/"
-    );
+function pythonPublishUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/pypi/upload/`;
   }
+  return void 0;
 }
-function pythonPipPluginSpec() {
-  return process.env.MNCI2_PYTHON_PIP_SPEC ?? "@mnci/nx-python-pip";
-}
-function ensurePythonPipPlugin(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
-    return;
-  }
-  const spec = pythonPipPluginSpec();
-  logger.step(`Installing the Python toolchain plugin (${spec})`);
-  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @mnci/nx-python-pip failed");
-  }
+var PYTHON_INSTALL_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py+' -m pip install -r requirements-dev.txt',{stdio:'inherit',shell:true}).status ?? 1)"`;
+var PYTHON_WORKSPACE_INSTALL_GUARD = `node -e "const fs=require('node:fs'),path=require('node:path');const editableDirs=[...fs.globSync('apps/*/pyproject.toml'),...fs.globSync('python-packages/*/pyproject.toml'),...fs.globSync('libs/*/pyproject.toml')].map((p)=>path.dirname(p));const requirementsFiles=fs.globSync('apps/*/requirements.txt');if(editableDirs.length===0&&requirementsFiles.length===0){console.log('No Python projects - skipping.');process.exit(0)}const args=['-m','pip','install','--quiet',...editableDirs.flatMap((d)=>['-e',d]),...requirementsFiles.flatMap((f)=>['-r',f])];const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py,args,{stdio:'inherit'}).status ?? 1)"`;
+var PIP_AUDIT_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';require('node:child_process').spawnSync(py,['-m','pip_audit'],{stdio:'inherit'});process.exit(0)"`;
+var GO_MODULE_DOWNLOAD_GUARD = `node -e "if(!require('node:fs').existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('go',['mod','download'],{stdio:'inherit'}).status ?? 1)"`;
+var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}if(cp.spawnSync('golangci-lint',['--version'],{stdio:'ignore'}).status===0){console.log('golangci-lint already installed - skipping.');process.exit(0)}process.exit(cp.spawnSync('go',['install','github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest'],{stdio:'inherit'}).status ?? 1)"`;
+var GO_TOOL_PATH_PRELUDE = "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}const r=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(r.status!==0){console.log('Could not resolve GOPATH - skipping.');process.exit(0)}const bin=require('node:path').join(r.stdout.trim(),'bin');";
+var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
+var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
+var FLUTTER_SDK_VERSION = "3.44.8";
+var NODE_VERSION = "24";
+var NPM_VERSION = "11";
+var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
+var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
+var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
+var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
+var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
+var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
+var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(v.fixAvailable?' - fix available, below the blocking threshold':' - NO fix available upstream, nothing to do here'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available'+(v.fixAvailable&&v.fixAvailable.isSemVerMajor?' (semver-major)':''));console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
+var VERIFY_TARGETS = "lint,typecheck,test,build";
+var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
+var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});if(fs.globSync('apps/*/project.json').length===0){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
+function releaseGuard(pythonPublishEnv) {
+  return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;if(!hasNpm&&!hasPython){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
-var PYTHON_REQUIREMENTS_DEV = `build
-twine
-ruff
-pytest
-pip-audit
-`;
-function ensureRequirementsDev(workspaceRoot) {
-  const requirementsDevPath = (0, import_node_path7.join)(workspaceRoot, "requirements-dev.txt");
-  if (!fileExists(requirementsDevPath)) {
-    writeFileEnsured(requirementsDevPath, PYTHON_REQUIREMENTS_DEV);
-  }
+function pythonPublishEnvFragment(pythonPublishUrl2) {
+  return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
 }
-function pythonModuleDirectory(name) {
-  return name.replaceAll("-", "_");
+function npmAuthEnvVariable(registryKind, variableReference) {
+  return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : ["PAT", variableReference("PAT")];
 }
-function addProjectJsonTargets3(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
+function poolBlock(agent) {
+  return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
 }
-function pythonAppMain(name) {
-  return `def main() -> None:
-    print('${name} is running')
+function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts") {
+  const onMain = "and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI'), eq(variables['Build.SourceBranchName'], 'main'))";
+  const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(registryKind, (name) => `$(${name})`);
+  return `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
 
+# Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
+# versions from conventional commits and pushes ONLY a tag to main, and each
+# app is packed into dist/drop/<type>-<name>.zip by its own 'package' target.
+#
+# Cross-platform by construction: no bash, no PowerShell. Every step is a
+# built-in task or a single-line git/npm/npx/node command, so the pipeline
+# runs unchanged on Linux, macOS and Windows agents.
 
-if __name__ == '__main__':
-    main()
-`;
-}
-function pythonAppStartTarget(name) {
-  return {
-    executor: "nx:run-commands",
-    continuous: true,
-    options: { command: "python3 main.py", cwd: `apps/${name}` }
-  };
-}
-function pythonFunctionAppStartTarget(name) {
-  return {
-    executor: "nx:run-commands",
-    continuous: true,
-    options: { command: "func start", cwd: `apps/${name}` }
-  };
-}
-function pythonAppPackageTarget(name) {
-  const zip = `dist/drop/python-app-${name}.zip`;
-  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('apps/${name}/dist');z.writeZip('${zip}')"`;
-  return {
-    executor: "nx:run-commands",
-    dependsOn: ["build"],
-    outputs: [`{workspaceRoot}/${zip}`],
-    options: { command }
-  };
-}
-function pythonFunctionAppPackageTarget(name, moduleDirectory) {
-  const zip = `dist/drop/python-function-app-${name}.zip`;
-  const root = `apps/${name}`;
-  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFile('${root}/function_app.py');z.addLocalFile('${root}/host.json');z.addLocalFile('${root}/requirements.txt');z.addLocalFolder('${root}/${moduleDirectory}','${moduleDirectory}');z.writeZip('${zip}')"`;
-  return {
-    executor: "nx:run-commands",
-    outputs: [`{workspaceRoot}/${zip}`],
-    options: { command }
-  };
-}
-function addPythonApp(workspaceRoot, name) {
-  ensurePython(workspaceRoot);
-  ensurePythonPipPlugin(workspaceRoot);
-  ensureRequirementsDev(workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  runNx(
-    ["g", "@mnci/nx-python-pip:application", name, `--directory=apps/${name}`, "--no-interactive"],
-    workspaceRoot
-  );
-  writeFileEnsured((0, import_node_path7.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
-  addProjectJsonTargets3((0, import_node_path7.join)(workspaceRoot, "apps", name, "project.json"), {
-    package: pythonAppPackageTarget(name),
-    start: pythonAppStartTarget(name)
-  });
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
-}
-function addPythonFunctionApp(workspaceRoot, name) {
-  ensurePython(workspaceRoot);
-  ensurePythonPipPlugin(workspaceRoot);
-  ensureRequirementsDev(workspaceRoot);
-  ensureAdmZip(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@mnci/nx-python-pip:function-application",
-      name,
-      `--directory=apps/${name}`,
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  const moduleDirectory = pythonModuleDirectory(name);
-  addProjectJsonTargets3((0, import_node_path7.join)(workspaceRoot, "apps", name, "project.json"), {
-    package: pythonFunctionAppPackageTarget(name, moduleDirectory),
-    start: pythonFunctionAppStartTarget(name)
-  });
-  registerProjectCommands(workspaceRoot, name, { build: false, start: `nx run ${name}:start` });
-}
-function addPythonLib(workspaceRoot, name) {
-  ensurePython(workspaceRoot);
-  ensurePythonPipPlugin(workspaceRoot);
-  ensureRequirementsDev(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@mnci/nx-python-pip:library",
-      name,
-      `--directory=python-packages/${name}`,
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  registerProjectCommands(workspaceRoot, name, { build: true });
-}
-function addPythonInternalLib(workspaceRoot, name) {
-  ensurePython(workspaceRoot);
-  ensurePythonPipPlugin(workspaceRoot);
-  ensureRequirementsDev(workspaceRoot);
-  runNx(
-    [
-      "g",
-      "@mnci/nx-python-pip:internal-library",
-      name,
-      `--directory=libs/${name}`,
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  registerProjectCommands(workspaceRoot, name, { build: false });
-}
-var PYTHON_PROJECT_DIRS = ["apps", "python-packages", "libs"];
-function findPythonProjectDirectory(workspaceRoot, name) {
-  return PYTHON_PROJECT_DIRS.find(
-    (directory) => fileExists((0, import_node_path7.join)(workspaceRoot, directory, name, "pyproject.toml"))
-  );
-}
-function parseVendorEntries(pyprojectToml) {
-  const match = /^\s*vendor\s*=\s*\[([^\]]*)\]/m.exec(pyprojectToml);
-  if (!match) {
-    return [];
-  }
-  return match[1].split(",").map((entry) => entry.trim().replaceAll(/^["']|["']$/g, "")).filter(Boolean);
-}
-function addVendorEntry(pyprojectToml, lib) {
-  const existing = parseVendorEntries(pyprojectToml);
-  if (existing.length > 0) {
-    const merged = [...existing, lib].map((name) => `"${name}"`).join(", ");
-    return pyprojectToml.replace(
-      /^(\s*vendor\s*=\s*)\[[^\]]*\]/m,
-      (_match, prefix) => `${prefix}[${merged}]`
-    );
-  }
-  const table = `[tool.mnci-python-pip]
-vendor = ["${lib}"]
+trigger:
+  # While a run is in progress, queue further pushes and run them together rather
+  # than concurrently. This is the closest thing Azure Pipelines YAML has to
+  # GitHub's concurrency group, and it is load-bearing on main for the same
+  # reason: two concurrent 'nx release' runs would race to create the same tag.
+  batch: true
+  branches:
+    include:
+      - main
+      # EVERY other branch too, and that breadth is a correction rather than
+      # generosity. On Azure Repos Git a YAML 'pr:' block does nothing at all
+      # (see the note below), so a CI trigger is the only pre-merge
+      # verification this file can switch on by itself. Listing main alone \u2014
+      # which is what this pipeline used to do, next to a 'pr:' block that
+      # looked like it covered the rest \u2014 means a workspace verifies NOTHING
+      # until a change has already reached the branch it was supposed to
+      # protect.
+      #
+      # Release stays gated on main (the 'condition:' on every release step
+      # below), so a topic-branch run installs, audits, syncs, formats,
+      # verifies and packs, and publishes nothing.
+      - '*'
 
-`;
-  return pyprojectToml.includes("[tool.pytest.ini_options]") ? pyprojectToml.replace("[tool.pytest.ini_options]", () => `${table}[tool.pytest.ini_options]`) : `${pyprojectToml}
-${table}`;
-}
-async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
-  const lib = options.lib ?? (kindProvided ? void 0 : await promptText("Internal Python library to vendor (an existing libs/<name>)"));
-  if (!lib) {
-    throw new Error(
-      "`add python-vendor` needs the library to vendor: pass --lib <name> (an existing libs/<name> internal library)."
-    );
-  }
-  const consumerDirectory = findPythonProjectDirectory(workspaceRoot, consumer);
-  if (!consumerDirectory) {
-    throw new Error(
-      `No Python project named '${consumer}' with a pyproject.toml found (checked apps/, python-packages/, libs/). A Python function app has no pyproject.toml \u2014 there is nothing to vendor into.`
-    );
-  }
-  if (!fileExists((0, import_node_path7.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
-    throw new Error(
-      `No internal Python library named '${lib}' found at libs/${lib}/pyproject.toml. Only an internal library (added via 'mnci add python-internal-lib') can be vendored.`
-    );
-  }
-  if (consumerDirectory === "libs" && consumer === lib) {
-    throw new Error(`'${consumer}' cannot vendor itself.`);
-  }
-  const pyprojectPath = (0, import_node_path7.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
-  const pyprojectToml = (0, import_node_fs4.readFileSync)(pyprojectPath, "utf8");
-  if (parseVendorEntries(pyprojectToml).includes(lib)) {
-    logger.info(`'${consumer}' already vendors '${lib}' \u2014 nothing to do.`);
-    return;
-  }
-  writeFileEnsured(pyprojectPath, addVendorEntry(pyprojectToml, lib));
-  logger.success(
-    `'${consumer}' now vendors '${lib}' \u2014 its wheel will include '${lib}''s module on the next build.`
-  );
-}
+# PR validation is deliberately NOT configured here, because on Azure Repos Git
+# it CANNOT be: "For an Azure Repos Git repo, you cannot configure a PR trigger
+# in the YAML file. You need to use branch policies." A 'pr:' block here is not
+# an error \u2014 it is silently ignored, which is worse, because the file then
+# documents a gate that does not exist. (The same block IS honoured for GitHub
+# and Bitbucket repos, which is why .github/workflows/ci.yml keeps its
+# 'pull_request:' trigger.)
+#
+# To get PR validation, configure it once in the UI: Project Settings ->
+# Repositories -> <repo> -> Policies -> <branch> -> Build Validation, pointing
+# at this pipeline. That is also the only thing that sets
+# System.PullRequest.TargetBranch, which the verify step below reads to scope
+# itself to affected projects \u2014 without a policy that variable is never set and
+# the step verifies every project instead. Correct either way, just slower.
+#
+# Cancelling a superseded PR run lives in that same policy ("automatically
+# cancel"), and likewise has no YAML expression.
+pr: none
+
+pool:
+${poolBlock(agent)}
+
+variables:
+  # Holds the npm auth secret the root .npmrc reads: the base64-encoded \`PAT\`
+  # for an Azure Artifacts feed, or a raw npm automation token as \`NPM_TOKEN\`
+  # for public npm. Mark it secret in Library. Add app build vars here too if needed.
+  - group: ${variableGroup}
+  # Relocates npm's cache inside the pipeline workspace so Cache@2 can restore it
+  # (the default ~/.npm is outside the cacheable area on hosted agents). npm reads
+  # this as an ordinary env var, so it needs no config file and works on every
+  # agent OS.
+  - name: npm_config_cache
+    value: $(Pipeline.Workspace)/.npm
+
+steps:
+  - checkout: self
+    # Lets later steps push release tags back to the repo. The Project
+    # Collection Build Service account needs Contribute permission on this
+    # repo (Project Settings -> Repositories -> Security) \u2014 one-time grant.
+    persistCredentials: true
+    fetchDepth: 0
+
+  # checkout leaves a detached HEAD; nx release needs a real branch.
+  - script: git checkout -B $(Build.SourceBranchName)
+    displayName: Attach HEAD to the source branch
+
+  # Version resolution needs the release tags.
+  - script: git fetch --all --prune --tags
+    displayName: Fetch branches and release tags
+
+  - script: git config user.name "Azure Pipelines" && git config user.email "pipeline@dev.azure.com"
+    displayName: Set the git identity used for release tags
+
+  - task: UseNode@1
+    inputs:
+      version: 24.x
+
+  # The Azure counterpart of \`cache: npm\` on actions/setup-node: restores npm's
+  # download cache so \`npm ci\` does not re-fetch every tarball on every run.
+  # Keyed on the lockfile, so a dependency change misses and anything else hits;
+  # restoreKeys falls back to the newest cache for this OS on a miss, which still
+  # avoids a fully cold install. Agent.OS is in the key because a cached native
+  # module built for one OS is not reusable on another.
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
+  - script: npm ci
+    displayName: Install dependencies
+    env:
+      ${npmAuthName}: ${npmAuthValue}
+
+  # Fails ONLY on an advisory that has a published fix, at moderate or above;
+  # anything upstream has not fixed is printed and passes. See NPM_AUDIT_STEP's
+  # remarks for why that split replaced a warn-only step.
+  - script: ${NPM_AUDIT_STEP}
+    displayName: npm audit (fails on an actionable advisory)
+
+  # Installs the fixed Python toolchain (ruff, pytest, build, twine, pip-audit)
+  # \u2014 written by 'mnci add' to requirements-dev.txt on the first Python
+  # project. Plain pip, no uv/Poetry: portable guard skips cleanly on a
+  # workspace with none.
+  - script: ${PYTHON_INSTALL_GUARD}
+    displayName: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
+
+  # Editable-installs every Python project into one shared environment, the
+  # pip-world counterpart of 'npm install' hoisting every workspace package
+  # into one root node_modules \u2014 so a project that imports an internal lib
+  # (normally vendored only at build time) can resolve that import at
+  # lint/test time too. Portable guard skips cleanly on a workspace with none.
+  - script: ${PYTHON_WORKSPACE_INSTALL_GUARD}
+    displayName: Install Python project dependencies (editable, workspace-wide)
+
+  # Non-blocking, same reasoning as the npm audit step above. Runs after the
+  # workspace-wide install so it scans the workspace's actual dependency set,
+  # not just the fixed toolchain.
+  - script: ${PIP_AUDIT_GUARD}
+    displayName: pip-audit (non-blocking)
+
+  # Go, if the workspace has any: hosted agents ship the toolchain, so only
+  # the module cache and the linter need seeding. Both guards skip cleanly on
+  # a workspace with no root go.mod.
+  - script: ${GO_MODULE_DOWNLOAD_GUARD}
+    displayName: Download Go module dependencies
+
+  # golangci-lint is what the generated Go lint target actually runs (the
+  # plugin's own default is 'go fmt', which only reformats). 'go install'
+  # drops it in GOPATH/bin, which is not on PATH by default on a hosted
+  # agent \u2014 so prepend it for every later step in the job.
+  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
+    displayName: Install golangci-lint
+
+  - script: ${GO_TOOL_PATH_AZURE}
+    displayName: Add Go tool bin to PATH
+
+  # Flutter, if the workspace has any. Unlike Python and Go, hosted agents do
+  # NOT ship the Flutter SDK, so this installs it (shallow git clone at a
+  # pinned tag) and puts it on PATH. All three guards skip cleanly on a
+  # workspace with no root pubspec.yaml, and the install also skips when an
+  # SDK is already on PATH.
+  - script: ${FLUTTER_SDK_INSTALL_GUARD}
+    displayName: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
+
+  - script: ${FLUTTER_TOOL_PATH_AZURE}
+    displayName: Add the Flutter SDK to PATH
+
+  # One command resolves EVERY Dart dependency, internal and external, for the
+  # whole workspace: the projects are pub workspace members, so this writes a
+  # single root pubspec.lock they all share.
+  - script: ${FLUTTER_PUB_GET_GUARD}
+    displayName: Resolve Dart dependencies (one pub get for the whole workspace)
+
+  # Fails fast, with an unambiguous message, when a stale TypeScript project
+  # reference (or another sync generator's drift) was never synced+committed
+  # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
+  # CI still needs its own explicit, early check rather than surfacing this as
+  # a confusing failure buried inside the build step below.
+  - script: npx nx sync:check
+    displayName: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
+
+  # The one verify step, and deliberately the only one: affected projects on a
+  # pull request, EVERY project on anything else (a push to main included, so a
+  # release is always verified in full). Every fallback \u2014 no target branch, an
+  # unresolvable merge-base \u2014 takes the full path, because a run that verifies
+  # too little still reports green.
+  #
+  # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
+  # below, so adding it back as its own step would only duplicate work \u2014 and on
+  # a pull request it would re-lint every project, discarding the point of this.
+  - script: ${AFFECTED_OR_ALL_GUARD}
+    displayName: Verify (affected on a PR, every project on main)
+
+  # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
+  # target. Portable guard: skip cleanly when the workspace has no apps yet.
+  - script: ${PACK_APPS_GUARD}
+    displayName: Pack all apps (one zip per app -> dist/drop)
+    condition: ${onMain}
+
+  - task: PublishBuildArtifacts@1
+    displayName: Publish the drop (one zip per app)
+    condition: ${onMain}
+    inputs:
+      PathtoPublish: $(Build.SourcesDirectory)/dist/drop
+      ArtifactName: drop
+
+  # One build tag per packed app, EXACTLY the zip name (type-name), so the
+  # classic release pipeline knows which app to run for. Derived from the zip
+  # filenames so the tag can never drift from the artifact.
+  - script: node -e "const fs=require('node:fs');const path=require('node:path');for(const f of fs.globSync('dist/drop/*.zip')){console.log('##vso[build.addbuildtag]'+path.basename(f,'.zip'))}"
+    displayName: Tag the run per app (type-name)
+    condition: ${onMain}
+
+  # Version + tag + publish, in one release, for npm (packages/*) AND Python
+  # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
+  # nx release errors on an empty scope, so skip cleanly when there is nothing
+  # to release. When there are Python packages and an Azure feed, twine
+  # publish credentials are exported (raw PAT, decoded from the base64 variable).
+  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
+    displayName: Release \u2014 version, tag and publish (npm + Python)
+    condition: ${onMain}
+    env:
+      ${npmAuthName}: ${npmAuthValue}
 
-// src/commands/add/reactApp.ts
-var import_node_fs5 = require("fs");
-var import_node_path8 = require("path");
-var REACT_ENVIRONMENTS = ["dev", "uat", "prod"];
-function reactEnvironmentFile(environment) {
-  return `# Vite compiles VITE_-prefixed vars into the '${environment}' bundle at build time.
-# They ship to the browser, so keep only PUBLIC config here \u2014 never secrets.
-VITE_ENVIRONMENT=${environment}
-VITE_API_URL=https://api.${environment}.example.com
+  # nx release's own git push (release.git.push) is deliberately left off: it
+  # only runs when a remote GitHub/GitLab Release is configured, which this
+  # pipeline never does, so it would never push the tag the step above just
+  # created. Pushed explicitly, unconditionally (a no-op when nothing released)
+  # once tagging is guaranteed to have already happened.
+  - script: git push origin --tags
+    displayName: Push release tags (nx release's own push never runs without a remote Release configured)
+    condition: ${onMain}
 `;
 }
-function reactAppTargets(name) {
-  const targets = {};
-  for (const environment of REACT_ENVIRONMENTS) {
-    targets[`build-${environment}`] = {
-      executor: "nx:run-commands",
-      outputs: [`{workspaceRoot}/apps/${name}/dist-${environment}`],
-      options: {
-        command: `vite build --mode ${environment} --outDir dist-${environment}`,
-        cwd: `apps/${name}`
-      }
-    };
-  }
-  const zipStatements = REACT_ENVIRONMENTS.map(
-    (environment) => `z=new A();z.addLocalFolder('apps/${name}/dist-${environment}');z.writeZip('dist/drop/react-app-${name}-${environment}.zip')`
-  ).join(";");
-  targets.package = {
-    executor: "nx:run-commands",
-    dependsOn: REACT_ENVIRONMENTS.map((environment) => `build-${environment}`),
-    outputs: REACT_ENVIRONMENTS.map(
-      (environment) => `{workspaceRoot}/dist/drop/react-app-${name}-${environment}.zip`
-    ),
-    options: {
-      command: `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');let z;${zipStatements}"`
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github") {
+  const onMain = "github.event_name == 'push' && github.ref_name == 'main'";
+  const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
+    registryKind,
+    (name) => `\${{ secrets.${name} }}`
+  );
+  const githubReleases = ci === "github";
+  return `name: CI
+
+# Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
+# versions from conventional commits and pushes ONLY a tag to main, and each
+# app is packed into dist/drop/<type>-<name>.zip by its own 'package' target.
+# The GitHub Actions equivalent of azure-pipelines.yml \u2014 see there for the
+# fuller rationale; both stay hand-kept in lockstep, there is no shared template.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  # One run at a time per ref, but \`cancel-in-progress\` is an **expression** on
+  # purpose rather than a flat \`true\`.
+  #
+  # A superseded PR run is pure waste, so cancel it. A run on \`main\` must never
+  # be cancelled: it publishes packages and pushes release tags, and killing it
+  # part-way can leave a tag pushed with the publish only half done \u2014 a state no
+  # rerun repairs cleanly, because the version is then already tagged. Those runs
+  # queue instead, which also stops two \`nx release\` invocations racing to create
+  # the same tag when two commits land close together.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+
+permissions:
+  # Lets the release step push the version tag nx release creates back to main,
+  # and (github-only provider) create the GitHub Release itself.
+  contents: write
+
+jobs:
+  ci:
+    runs-on: ${agent}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Version resolution needs the release tags.
+      - run: git fetch --all --prune --tags
+        name: Fetch branches and release tags
+
+      - run: git config user.name "github-actions[bot]" && git config user.email "github-actions[bot]@users.noreply.github.com"
+        name: Set the git identity used for release tags
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${NODE_VERSION}
+          # Caches ~/.npm keyed on package-lock.json, so \`npm ci\` restores from
+          # the local cache instead of re-downloading every tarball on every run.
+          # Nothing to invalidate by hand: the action keys on the lockfile, so a
+          # dependency change misses the cache and a no-op change hits it.
+          cache: npm
+
+      # setup-node installs whatever npm the Node image bundles, and npm's major
+      # is part of the contract: npm 11 reuses an already-installed tree instead
+      # of re-resolving, so it applies \`overrides\` differently from npm 10. See
+      # NPM_VERSION's remarks for the measurement.
+      - run: npm install -g npm@${NPM_VERSION}
+        name: Pin npm to the major mnci verifies against
+
+      - run: npm ci
+        name: Install dependencies
+        env:
+          ${npmAuthName}: ${npmAuthValue}
+
+      # Fails ONLY on an advisory that has a published fix, at moderate or
+      # above; anything upstream has not fixed is printed and passes. See
+      # NPM_AUDIT_STEP's remarks for why that split replaced a warn-only step.
+      - run: ${NPM_AUDIT_STEP}
+        name: npm audit (fails on an actionable advisory)
+
+      # Installs the fixed Python toolchain (ruff, pytest, build, twine,
+      # pip-audit) \u2014 written by 'mnci add' to requirements-dev.txt on the
+      # first Python project. Plain pip, no uv/Poetry: portable guard skips
+      # cleanly on a workspace with none.
+      - run: ${PYTHON_INSTALL_GUARD}
+        name: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
+
+      # Editable-installs every Python project into one shared environment, the
+      # pip-world counterpart of 'npm install' hoisting every workspace package
+      # into one root node_modules \u2014 so a project that imports an internal lib
+      # (normally vendored only at build time) can resolve that import at
+      # lint/test time too. Portable guard skips cleanly on a workspace with none.
+      - run: ${PYTHON_WORKSPACE_INSTALL_GUARD}
+        name: Install Python project dependencies (editable, workspace-wide)
+
+      # Non-blocking, same reasoning as the npm audit step above. Runs after
+      # the workspace-wide install so it scans the workspace's actual
+      # dependency set, not just the fixed toolchain.
+      - run: ${PIP_AUDIT_GUARD}
+        name: pip-audit (non-blocking)
+
+      # Go, if the workspace has any: hosted runners ship the toolchain, so
+      # only the module cache and the linter need seeding. Both guards skip
+      # cleanly on a workspace with no root go.mod.
+      - run: ${GO_MODULE_DOWNLOAD_GUARD}
+        name: Download Go module dependencies
+
+      # golangci-lint is what the generated Go lint target actually runs (the
+      # plugin's own default is 'go fmt', which only reformats). 'go install'
+      # drops it in GOPATH/bin, which is not on PATH by default on a hosted
+      # runner \u2014 so publish it for every later step in the job.
+      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
+        name: Install golangci-lint
+
+      - run: ${GO_TOOL_PATH_GITHUB}
+        name: Add Go tool bin to PATH
+
+      # Flutter, if the workspace has any. Unlike Python and Go, hosted runners
+      # do NOT ship the Flutter SDK, so this installs it (shallow git clone at
+      # a pinned tag) and puts it on PATH. All three guards skip cleanly on a
+      # workspace with no root pubspec.yaml, and the install also skips when an
+      # SDK is already on PATH.
+      - run: ${FLUTTER_SDK_INSTALL_GUARD}
+        name: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
+
+      - run: ${FLUTTER_TOOL_PATH_GITHUB}
+        name: Add the Flutter SDK to PATH
+
+      # One command resolves EVERY Dart dependency, internal and external, for
+      # the whole workspace: the projects are pub workspace members, so this
+      # writes a single root pubspec.lock they all share.
+      - run: ${FLUTTER_PUB_GET_GUARD}
+        name: Resolve Dart dependencies (one pub get for the whole workspace)
+
+      # Fails fast, with an unambiguous message, when a stale TypeScript project
+      # reference (or another sync generator's drift) was never synced+committed
+      # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
+      # CI still needs its own explicit, early check rather than surfacing this as
+      # a confusing failure buried inside the build step below.
+      - run: npx nx sync:check
+        name: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
+
+      # The one verify step, and deliberately the only one: affected projects on
+      # a pull request, EVERY project on anything else (a push to main included,
+      # so a release is always verified in full). Every fallback \u2014 no target
+      # branch, an unresolvable merge-base \u2014 takes the full path, because a run
+      # that verifies too little still reports green.
+      #
+      # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
+      # below, so adding it back as its own step would only duplicate work \u2014 and
+      # on a pull request it would re-lint every project, discarding the point
+      # of this.
+      - run: ${AFFECTED_OR_ALL_GUARD}
+        name: Verify (affected on a PR, every project on main)
+
+      # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
+      # target. Portable guard: skip cleanly when the workspace has no apps yet.
+      - run: ${PACK_APPS_GUARD}
+        name: Pack all apps (one zip per app -> dist/drop)
+        if: \${{ ${onMain} }}
+
+      - uses: actions/upload-artifact@v4
+        if: \${{ ${onMain} }}
+        with:
+          name: drop
+          path: dist/drop
+          if-no-files-found: ignore
+
+      # Version + tag + publish, in one release, for npm (packages/*) AND Python
+      # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
+      # nx release errors on an empty scope, so skip cleanly when there is nothing
+      # to release. When there are Python packages and an Azure feed, twine
+      # publish credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
+      # This provider also creates a per-project GitHub Release (changelog
+      # generated from conventional commits since that project's last tag),
+      # which is why 'nx release' pushes the tag itself here \u2014 see
+      # releaseConfig's remarks for why that is safe on this Nx version and
+      # why every other provider combination keeps the explicit push step below.` : ""}
+      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
+        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python)
+        if: \${{ ${onMain} }}
+        env:
+          ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
+${githubReleases ? "" : `
+      # nx release's own git push (release.git.push) is deliberately left off: it
+      # only runs when a remote GitHub/GitLab Release is configured, which this
+      # workflow never does, so it would never push the tag the step above just
+      # created. Pushed explicitly, unconditionally (a no-op when nothing released)
+      # once tagging is guaranteed to have already happened.
+      - run: git push origin --tags
+        name: Push release tags (nx release's own push never runs without a remote Release configured)
+        if: \${{ ${onMain} }}
+`}`;
+}
+var PIP_PROJECT_GLOBS = ["apps", "python-packages", "libs"];
+var PUB_PROJECT_GLOBS = ["apps", "packages", "libs"];
+var ECOSYSTEM_MANIFESTS = {
+  pip: ["pyproject.toml", "requirements.txt"],
+  pub: ["pubspec.yaml"]
+};
+function hasEcosystemProject(workspaceRoot, roots, manifests) {
+  return roots.some((root) => {
+    const base = (0, import_node_path2.join)(workspaceRoot, root);
+    if (!(0, import_node_fs2.existsSync)(base)) {
+      return false;
     }
-  };
-  return targets;
+    return (0, import_node_fs2.readdirSync)(base, { withFileTypes: true }).some(
+      (entry) => entry.isDirectory() && manifests.some((manifest) => (0, import_node_fs2.existsSync)((0, import_node_path2.join)(base, entry.name, manifest)))
+    );
+  });
 }
-function allowEnvFiles(workspaceRoot) {
-  const gitignorePath = (0, import_node_path8.join)(workspaceRoot, ".gitignore");
-  if (!fileExists(gitignorePath)) {
-    return;
+function dependabotBlock(ecosystem, roots) {
+  return `
+  - package-ecosystem: ${ecosystem}
+    directories:
+` + roots.map((root) => `      - "/${root}/*"
+`).join("") + "    schedule:\n      interval: weekly\n";
+}
+function dependabotConfig(workspaceRoot) {
+  let config = `# Generated by MoNecromanCI. Weekly dependency-update PRs so vulnerable or
+# stale dependencies surface as a reviewable PR instead of only a push-time
+# warning.
+#
+# pip and pub appear here only once the workspace HAS a Python or Dart project.
+# An ecosystem entry whose directories match no manifest is a hard Dependabot
+# failure, not a no-op, so emitting them unconditionally cost every workspace
+# two red runs a week over projects it does not have.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+`;
+  if (hasEcosystemProject(workspaceRoot, PIP_PROJECT_GLOBS, ECOSYSTEM_MANIFESTS.pip)) {
+    config += dependabotBlock("pip", PIP_PROJECT_GLOBS);
   }
-  const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
-  const current = (0, import_node_fs5.readFileSync)(gitignorePath, "utf8");
-  if (current.includes(marker)) {
-    return;
+  if (hasEcosystemProject(workspaceRoot, PUB_PROJECT_GLOBS, ECOSYSTEM_MANIFESTS.pub)) {
+    config += dependabotBlock("pub", PUB_PROJECT_GLOBS);
   }
-  const allow = REACT_ENVIRONMENTS.map((environment) => `!apps/*/.env.${environment}`).join("\n");
-  writeFileEnsured(gitignorePath, `${current.replace(/\n*$/, "\n")}
-${marker}
-${allow}
-`);
+  return config;
 }
-function addReactApp(workspaceRoot, name, stack) {
-  ensurePlugin(workspaceRoot, "@nx/react");
-  runNx(
-    [
-      "g",
-      "@nx/react:app",
-      `apps/${name}`,
-      "--bundler=vite",
-      `--unitTestRunner=${stack.testRunner}`,
-      "--linter=none",
-      "--style=css",
-      "--e2eTestRunner=none",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  ensureAdmZip(workspaceRoot);
-  const reactAppRoot = (0, import_node_path8.join)(workspaceRoot, "apps", name);
-  for (const environment of REACT_ENVIRONMENTS) {
-    writeFileEnsured((0, import_node_path8.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+var NX_SCAFFOLDING_TO_REMOVE = [".prettierrc", ".prettierrc.json", ".vscode"];
+function removeNxScaffolding(workspaceRoot) {
+  for (const entry of NX_SCAFFOLDING_TO_REMOVE) {
+    (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, entry), { recursive: true, force: true });
   }
-  allowEnvFiles(workspaceRoot);
-  addNxTargets((0, import_node_path8.join)(reactAppRoot, "package.json"), reactAppTargets(name));
-  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
-}
-
-// src/commands/add/reactLib.ts
-var import_node_path9 = require("path");
-var REACT_LIB_BUNDLER = "rollup";
-async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
-  ensurePlugin(workspaceRoot, "@nx/react");
-  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  runNx(
-    [
-      "g",
-      "@nx/react:library",
-      `packages/${name}`,
-      `--name=${name}`,
-      "--publishable",
-      `--importPath=${scope}/${name}`,
-      `--bundler=${REACT_LIB_BUNDLER}`,
-      `--unitTestRunner=${stack.testRunner}`,
-      "--linter=none",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  const publishableManifest = (0, import_node_path9.join)(workspaceRoot, "packages", name, "package.json");
-  markPublic(publishableManifest);
-  repairPublishableManifest(publishableManifest);
-  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true });
+  removeProjectEslintConfigs(workspaceRoot);
 }
-function addReactInternalLib(workspaceRoot, name, stack) {
-  ensurePlugin(workspaceRoot, "@nx/react");
-  runNx(
-    [
-      "g",
-      "@nx/react:library",
-      `libs/${name}`,
-      `--name=${name}`,
-      `--bundler=${REACT_LIB_BUNDLER}`,
-      `--unitTestRunner=${stack.testRunner}`,
-      "--linter=none",
-      "--no-interactive"
-    ],
-    workspaceRoot
-  );
-  const privateManifest = (0, import_node_path9.join)(workspaceRoot, "libs", name, "package.json");
-  markPrivate(privateManifest);
-  repairPublishableManifest(privateManifest);
-  removeGeneratedEslintConfig(workspaceRoot, `libs/${name}`);
-  registerProjectCommands(workspaceRoot, name, { build: true });
+function removeIfPresent(path) {
+  (0, import_node_fs2.rmSync)(path, { recursive: true, force: true });
 }
-
-// src/commands/add.ts
-var PROJECT_KINDS = [
-  "react-app",
-  "react-lib",
-  "react-internal-lib",
-  "node-app",
-  "node-function-app",
-  "npm-lib",
-  "internal-lib",
-  "python-app",
-  "python-function-app",
-  "python-lib",
-  "python-internal-lib",
-  "python-vendor",
-  "go-app",
-  "go-function-app",
-  "go-lib",
-  "go-internal-lib",
-  "flutter-app",
-  "flutter-lib",
-  "flutter-internal-lib"
-];
-async function runAdd(kind, name, options) {
-  const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path10.join)(workspaceRoot, "nx.json"))) {
-    throw new Error("No nx.json found here. Run `add` from the workspace root.");
+function removeProjectEslintConfigs(workspaceRoot) {
+  const matches = (0, import_node_fs2.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+    cwd: workspaceRoot
+  });
+  for (const match of matches) {
+    (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, match), { force: true });
   }
-  const stack = readWorkspaceStack(workspaceRoot);
-  const kindProvided = kind !== void 0;
-  const resolvedKind = kind ?? await (0, import_prompts5.select)({
-    message: "What kind of project?",
-    choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
+}
+function applyOverlay(workspaceRoot, options, onProgress = () => {
+}) {
+  const nxJsonPath = (0, import_node_path2.join)(workspaceRoot, "nx.json");
+  const nxJson = readJson(nxJsonPath);
+  const generators = {
+    ...nxJson.generators,
+    ...generatorDefaults(options.stack)
+  };
+  const sync = { ...nxJson.sync, ...SYNC_CONFIG };
+  const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
+  const patched = withSharedGlobals(withEslintPlugin(withReleaseConfig(nxJson, options.ci)));
+  onProgress("nx.json \u2014 release, sync, generators, shared inputs, mnci block");
+  writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
+  onProgress("package.json \u2014 root scripts, TS compilers, ESLint toolchain, overrides");
+  const manifestPath = (0, import_node_path2.join)(workspaceRoot, "package.json");
+  const manifest = readJson(manifestPath);
+  const scripts = {
+    ...manifest.scripts,
+    ...rootScripts()
+  };
+  const existingDevDeps = manifest.devDependencies;
+  const devDeps = withoutRetiredFormatterDependencies({
+    ...existingDevDeps,
+    ...TS_COMPILER_DEPENDENCIES,
+    // The preset pins `nx` itself; the ESLint plugins must match it exactly.
+    ...eslintToolchainDependencies(existingDevDeps?.nx ?? "latest")
   });
-  const resolvedName = name ?? await promptText("Project name");
-  assertValidProjectName(resolvedName, "Project name");
-  switch (resolvedKind) {
-    case "react-app": {
-      addReactApp(workspaceRoot, resolvedName, stack);
-      break;
-    }
-    case "react-lib": {
-      await addReactLib(workspaceRoot, resolvedName, options, kindProvided, stack);
-      break;
-    }
-    case "react-internal-lib": {
-      addReactInternalLib(workspaceRoot, resolvedName, stack);
-      break;
-    }
-    case "node-app": {
-      addNodeApp(workspaceRoot, resolvedName, stack, options.framework);
-      break;
-    }
-    case "node-function-app": {
-      addNodeFunctionApp(workspaceRoot, resolvedName, stack);
-      break;
-    }
-    case "npm-lib": {
-      await addNpmLib(workspaceRoot, resolvedName, options, kindProvided, stack);
-      break;
-    }
-    case "internal-lib": {
-      runNx(
-        [
-          "g",
-          "@nx/js:lib",
-          `libs/${resolvedName}`,
-          "--bundler=tsc",
-          `--unitTestRunner=${stack.testRunner}`,
-          "--linter=none",
-          "--no-interactive"
-        ],
-        workspaceRoot
-      );
-      markPrivate((0, import_node_path10.join)(workspaceRoot, "libs", resolvedName, "package.json"));
-      removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
-      registerProjectCommands(workspaceRoot, resolvedName, { build: true });
-      break;
-    }
-    case "python-app": {
-      addPythonApp(workspaceRoot, resolvedName);
-      break;
-    }
-    case "python-function-app": {
-      addPythonFunctionApp(workspaceRoot, resolvedName);
-      break;
-    }
-    case "python-lib": {
-      addPythonLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "python-internal-lib": {
-      addPythonInternalLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "go-app": {
-      addGoApp(workspaceRoot, resolvedName);
-      break;
-    }
-    case "go-function-app": {
-      addGoFunctionApp(workspaceRoot, resolvedName);
-      break;
-    }
-    case "go-lib": {
-      addGoLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "go-internal-lib": {
-      addGoInternalLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "flutter-app": {
-      addFlutterApp(workspaceRoot, resolvedName);
-      break;
-    }
-    case "flutter-lib": {
-      addFlutterLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "flutter-internal-lib": {
-      addFlutterInternalLib(workspaceRoot, resolvedName);
-      break;
-    }
-    case "python-vendor": {
-      await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
-      syncProjectReferences(workspaceRoot);
-      runFormatter(workspaceRoot);
-      return;
-    }
-    default: {
-      const exhaustive = resolvedKind;
-      throw new Error(
-        `Unknown project kind '${exhaustive}'. Expected one of: ${PROJECT_KINDS.join(", ")}.`
-      );
+  const overrides = {
+    ...manifest.overrides,
+    ...ESLINT_PEER_OVERRIDES,
+    ...SECURITY_OVERRIDES,
+    // Last, and conditional — see reactExpressPeerOverride. At `mnci new` there
+    // is no express yet, so this is a no-op; `mnci add node-app --framework
+    // express` is what puts express in the root manifest, and syncs the override
+    // itself. This line is what carries it across an `mnci upgrade`.
+    ...reactExpressPeerOverride(manifest)
+  };
+  const existingNx = manifest.nx;
+  const nx = {
+    ...existingNx,
+    includedScripts: existingNx?.includedScripts ?? [],
+    targets: {
+      ...existingNx?.targets,
+      lint: ROOT_LINT_TARGET
     }
+  };
+  writeFileEnsured(
+    manifestPath,
+    toJson({
+      ...manifest,
+      name: `${options.scope}/source`,
+      scripts,
+      devDependencies: devDeps,
+      overrides,
+      nx
+    })
+  );
+  onProgress(
+    `.npmrc \u2014 ${options.registry.kind === "azure-artifacts" ? "Azure Artifacts feed routing and credentials" : "public npm registry auth"}`
+  );
+  writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ".npmrc"), npmrcContent(options.registry, options.scope));
+  onProgress("commitlint.config.mjs and .husky/commit-msg \u2014 conventional commit enforcement");
+  writeFileEnsured((0, import_node_path2.join)(workspaceRoot, "commitlint.config.mjs"), COMMITLINT_CONFIG);
+  const hookPath = (0, import_node_path2.join)(workspaceRoot, ".husky/commit-msg");
+  writeFileEnsured(hookPath, COMMIT_MSG_HOOK);
+  markExecutable(hookPath);
+  onProgress("eslint.config.mjs \u2014 the shared lint AND formatting opinion");
+  writeFileEnsured((0, import_node_path2.join)(workspaceRoot, "eslint.config.mjs"), ESLINT_CONFIG);
+  for (const retired of RETIRED_FORMATTER_FILES) {
+    removeIfPresent((0, import_node_path2.join)(workspaceRoot, retired));
   }
-  syncProjectReferences(workspaceRoot);
-  runFormatter(workspaceRoot);
-  logger.success(`Added ${resolvedKind} '${resolvedName}'.`);
-}
-function syncProjectReferences(workspaceRoot) {
-  logger.step("Syncing TypeScript project references (nx sync)");
-  if (runShell("npx", ["nx", "sync"], workspaceRoot) !== 0) {
-    logger.warn(
-      "nx sync did not complete \u2014 run `npx nx sync` yourself so cross-project imports resolve in your editor."
+  onProgress(".devcontainer/devcontainer.json \u2014 a local toolchain matching CI");
+  writeFileEnsured(
+    (0, import_node_path2.join)(workspaceRoot, ".devcontainer/devcontainer.json"),
+    devcontainerJson(options.workspaceName)
+  );
+  removeNxScaffolding(workspaceRoot);
+  onProgress(
+    `${options.workspaceName}.code-workspace \u2014 settings, extensions, launch configs`
+  );
+  const codeWorkspacePath = (0, import_node_path2.join)(workspaceRoot, `${options.workspaceName}.code-workspace`);
+  const existing = readCodeWorkspace(codeWorkspacePath);
+  writeFileEnsured(
+    codeWorkspacePath,
+    vscodeWorkspace(
+      options.workspaceName,
+      existing?.tasks,
+      existing?.launch,
+      existing?.settings
+    )
+  );
+  if (options.workspaceName !== "undefined") {
+    (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, "undefined.code-workspace"), { force: true });
+  }
+  const publishUrl = pythonPublishUrl(options.registry);
+  if (options.ci === "azure" || options.ci === "both") {
+    onProgress("azure-pipelines.yml \u2014 build, verify, pack and release");
+    writeFileEnsured(
+      (0, import_node_path2.join)(workspaceRoot, "azure-pipelines.yml"),
+      azurePipelinesYaml(options.agent, options.variableGroup, publishUrl, options.registry.kind)
     );
   }
-}
-function readWorkspaceStack(workspaceRoot) {
-  const nxJson = readJson(
-    (0, import_node_path10.join)(workspaceRoot, "nx.json")
-  );
-  const stack = nxJson.mnci?.stack;
-  return {
-    testRunner: stack?.testRunner === "vitest" ? "vitest" : "jest"
-  };
-}
-
-// src/commands/doctor.ts
-var import_node_fs7 = require("fs");
-var import_node_path12 = require("path");
-
-// src/overlay.ts
-var import_node_fs6 = require("fs");
-var import_node_path11 = require("path");
-var DEFAULT_STACK = { testRunner: "jest" };
-var TS_COMPILER_DEPENDENCIES = {
-  "@typescript/native": "npm:typescript@^7.0.2",
-  typescript: "npm:@typescript/typescript6@^6.0.2"
-};
-function registryUrl(registry) {
-  if (registry.kind === "azure-artifacts") {
-    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/npm/registry/`;
+  if (options.ci === "github" || options.ci === "both") {
+    onProgress(".github/workflows/ci.yml and dependabot.yml");
+    writeFileEnsured(
+      (0, import_node_path2.join)(workspaceRoot, ".github/workflows/ci.yml"),
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
+    );
+    writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ".github/dependabot.yml"), dependabotConfig(workspaceRoot));
   }
-  return void 0;
 }
-function npmrcContent(registry, scope) {
-  if (registry.kind === "npm") {
-    return `; Publish authentication for the public npm registry.
-;
-; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
-; is harmless locally, so no token is needed for day-to-day work.
-//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
-
-; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
-; the default registry, so routing the scope to it would change nothing \u2014 and
-; presenting that as protection against an accidental public publish would be
-; false, because the public registry is the intended target. (An earlier version
-; of this file made exactly that claim while emitting no routing line at all.)
-; To keep a scoped package off npmjs.org, use a private feed: generate with
-; --registry azure-artifacts, which does route the scope.
-`;
-  }
-  const feedUrl = registryUrl(registry);
-  const feedKey = feedUrl.replace(/^https:/, "");
-  const feedShortKey = feedKey.replace("npm/registry/", "npm/");
-  return `; Publish + resolution routing for this workspace's own scope.
-;
-; '${scope}:registry' sends BOTH resolution and 'npm publish' of ${scope}/* to the
-; feed: npm prefers a scope's registry over the global one when publishing a
-; scoped package, so a ${scope}/* package cannot reach npmjs.org by accident.
-;
-; Only the scope is routed, on purpose. A global 'registry=' would send every
-; install through the feed as well, so 'npm ci' would need feed auth just to fetch
-; public packages.
-${scope}:registry=${feedUrl}
 
-; Feed credentials. PAT is the BASE64 value Azure Artifacts' "Connect to feed"
-; instructions give you, which is exactly what _password expects, so it is used
-; as-is. (twine wants the RAW token; the CI release step decodes it there.)
-; Azure ignores the username, and npm requires an email it never uses.
-;
-; NOT _authToken, and that is measured rather than assumed. The feed answers an
-; unauthenticated PUT to the publish endpoint with:
-;   www-authenticate: Bearer authorization_uri=https://login.windows.net/<tenant>,
-;                     Basic realm="...", TFS-Federated
-; so its Bearer scheme wants an Entra ID access token, NOT a PAT. npm sends
-; _authToken verbatim as a Bearer header, so a PAT there is rejected with
-; "Unable to authenticate, your authentication token seems to be invalid". A PAT
-; authenticates through the Basic scheme, which is username/_password. Note the
-; Packaging REST API DOES accept a PAT as Bearer - do not generalise from it.
-;
-; Both path forms are keyed because npm walks only UP a URL when matching.
-${feedKey}:username=AzureArtifacts
-${feedKey}:_password=\${PAT}
-${feedKey}:email=npm-requires-this-and-never-uses-it
-${feedShortKey}:username=AzureArtifacts
-${feedShortKey}:_password=\${PAT}
-${feedShortKey}:email=npm-requires-this-and-never-uses-it
-`;
-}
-function releaseConfig(ci) {
-  const githubReleases = ci === "github";
-  return {
-    projectsRelationship: "independent",
-    projects: ["packages/*", "python-packages/*", "!tag:type:go-lib"],
-    releaseTag: { pattern: "{projectName}@{version}" },
-    git: { commit: false, tag: true, push: githubReleases },
-    version: {
-      conventionalCommits: true,
-      fallbackCurrentVersionResolver: "disk",
-      // Build only what is being released. Without this, @nx/js:lib's generator
-      // defaults the pre-version command to building EVERY project, so a broken
-      // (or merely slow) app build would block releasing unrelated packages.
-      // Set here at `new` time it wins: the generator only fills this in when
-      // absent (it spreads the existing release.version over its default). Both
-      // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
-      preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*"
-    },
-    changelog: githubReleases ? {
-      workspaceChangelog: false,
-      projectChangelogs: { createRelease: "github", file: false }
-    } : { workspaceChangelog: false }
-  };
-}
-var SYNC_CONFIG = { applyChanges: true };
-var ESLINT_PLUGIN_CONFIG = {
-  plugin: "@nx/eslint/plugin",
-  options: { targetName: "lint" }
-};
-function pluginName(entry) {
-  return typeof entry === "string" ? entry : entry.plugin;
-}
-function withEslintPlugin(nxJson) {
-  const plugins = nxJson.plugins ?? [];
-  const registered = plugins.some((entry) => pluginName(entry) === ESLINT_PLUGIN_CONFIG.plugin);
-  return registered ? { ...nxJson, plugins } : { ...nxJson, plugins: [...plugins, ESLINT_PLUGIN_CONFIG] };
+// src/commands/add/shared.ts
+function hasPlugin(workspaceRoot, packageName) {
+  const manifest = readJson((0, import_node_path3.join)(workspaceRoot, "package.json"));
+  const installed = { ...manifest.dependencies, ...manifest.devDependencies };
+  return Object.hasOwn(installed, packageName);
 }
-var SHARED_GLOBAL_INPUTS = [
-  "{workspaceRoot}/eslint.config.mjs",
-  "{workspaceRoot}/tsconfig.base.json",
-  "{workspaceRoot}/package.json"
-];
-function withSharedGlobals(nxJson) {
-  const namedInputs = nxJson.namedInputs ?? {};
-  const existing = namedInputs.sharedGlobals ?? [];
-  const missing = SHARED_GLOBAL_INPUTS.filter((entry) => !existing.includes(entry));
-  return {
-    ...nxJson,
-    namedInputs: { ...namedInputs, sharedGlobals: [...existing, ...missing] }
-  };
+function ensurePlugin(workspaceRoot, packageName) {
+  if (hasPlugin(workspaceRoot, packageName)) {
+    return;
+  }
+  logger.step(`Installing Nx plugin ${packageName}`);
+  runNx(["add", packageName], workspaceRoot);
 }
-function withReleaseConfig(nxJson, ci) {
-  return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
+function markPrivate(manifestPath) {
+  const manifest = readJson(manifestPath);
+  writeFileEnsured(manifestPath, toJson({ ...manifest, private: true }));
 }
-var COMMITLINT_CONFIG = `export default { extends: ['@commitlint/config-conventional'] }
-`;
-var COMMIT_MSG_HOOK = `npx --no -- commitlint --edit "$1"
-`;
-var ESLINT_CONFIG_VERSION = "^0.1.0";
-function eslintConfigSpec() {
-  return process.env.MNCI_ESLINT_CONFIG_SPEC ?? ESLINT_CONFIG_VERSION;
+function markPublic(manifestPath) {
+  const manifest = readJson(manifestPath);
+  writeFileEnsured(manifestPath, toJson({ ...manifest, publishConfig: { access: "public" } }));
 }
-var ESLINT_VERSION = "^10.8.0";
-function devcontainerJson(workspaceName) {
-  return `${toJson({
-    name: workspaceName,
-    image: `mcr.microsoft.com/devcontainers/typescript-node:${NODE_VERSION}-bookworm`,
-    features: {
-      "ghcr.io/devcontainers/features/python:1": { version: "3.12" },
-      "ghcr.io/devcontainers/features/go:1": { version: "latest" }
-    },
-    // `npm ci` first: every guard after it runs through the workspace's own
-    // scripts and Nx, which do not exist until the install completes.
-    postCreateCommand: [
-      // Same pin the workflow applies, for the same reason — a container whose
-      // npm major differs from CI's resolves dependencies differently, which is
-      // precisely the drift this file exists to remove.
-      `npm install -g npm@${NPM_VERSION}`,
-      "npm ci",
-      "npm run python:install",
-      GOLANGCI_LINT_INSTALL_GUARD,
-      FLUTTER_SDK_INSTALL_GUARD
-    ].join(" && "),
-    // The same recommendations the `.code-workspace` file carries, so opening
-    // the folder in a container suggests the identical toolset.
-    customizations: {
-      vscode: { extensions: VSCODE_RECOMMENDED_EXTENSIONS }
-    }
-  })}
-`;
+var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
+var ACTUAL_TYPES_PATH = "./dist/src/index.d.ts";
+var DECLARATION_MAP_EXCLUSION = "!**/*.d.ts.map";
+function repairPublishableManifest(manifestPath) {
+  const manifest = readJson(manifestPath);
+  if (manifest.types === WRONG_TYPES_PATH) {
+    manifest.types = ACTUAL_TYPES_PATH;
+  }
+  const dot = manifest.exports?.["."];
+  if (typeof dot === "object" && dot.types === WRONG_TYPES_PATH) {
+    dot.types = ACTUAL_TYPES_PATH;
+  }
+  if (manifest.files && !manifest.files.includes(DECLARATION_MAP_EXCLUSION)) {
+    manifest.files.push(DECLARATION_MAP_EXCLUSION);
+  }
+  writeFileEnsured(manifestPath, toJson(manifest));
 }
-var ROOT_LINT_TARGET = {
-  executor: "nx:run-commands",
-  cache: true,
-  options: {
-    command: [
-      // `--cache` is the one ESLint speed option that actually pays here:
-      // measured best-of-3 on this repo, an unchanged re-run drops from 9,546ms
-      // to 2,835ms (3.4x). `--concurrency=auto` was measured too and REJECTED —
-      // it came out 8% SLOWER, because per-worker TypeScript type-service
-      // startup costs more than the parallelism saves. The cache file is
-      // per-machine and gitignored.
-      "eslint . --cache",
-      '--ignore-pattern "apps/**"',
-      '--ignore-pattern "libs/**"',
-      '--ignore-pattern "packages/**"',
-      '--ignore-pattern "python-packages/**"',
-      "--ignore-pattern package-lock.json"
-    ].join(" "),
-    cwd: "."
+function ensureAdmZip(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "adm-zip")) {
+    return;
+  }
+  logger.step("Installing the app packager (adm-zip)");
+  if (runShell(
+    "npm",
+    ["install", "--save-dev", "adm-zip", "--no-audit", "--no-fund"],
+    workspaceRoot
+  ) !== 0) {
+    throw new Error("npm install of adm-zip failed");
   }
-};
-var ESLINT_PEER_OVERRIDES = {
-  "eslint-plugin-jsx-a11y": { eslint: "$eslint" },
-  // Scoped to EACH named parent, not top-level and not `nx` alone.
-  //
-  // `nx` alone was the first attempt and it did not work: the e2e's audit step
-  // still reported all six advisories in a freshly generated workspace, because
-  // `@nx/js`, `@nx/eslint`, `@nx/eslint-plugin` and `@nx/workspace` are their own
-  // dependents there, and an override scoped to `nx` never reaches a sibling's
-  // dependencies. Those four are exactly the packages npm audit named.
-  //
-  // Top-level would be worse than wrong. A tree with `minimatch@3` legitimately
-  // carries `brace-expansion@1.1.18` (and `@2.1.4` elsewhere) — this repo has
-  // both — and forcing those to v5 breaks them. So the blast radius is one
-  // dependency edge per named parent, and a test asserts there is no top-level
-  // entry.
-  nx: { "brace-expansion": "^5.0.9" },
-  "@nx/js": { "brace-expansion": "^5.0.9" },
-  "@nx/eslint": { "brace-expansion": "^5.0.9" },
-  "@nx/eslint-plugin": { "brace-expansion": "^5.0.9" },
-  "@nx/workspace": { "brace-expansion": "^5.0.9" },
-  // `postcss` → `nanoid` reaches a generated workspace through `@nx/rollup`,
-  // which every publishable `npm-lib` gets. GHSA-2v37-7h3g-55p8 is high, fixed in
-  // 3.3.18, and the fix is a patch — so unlike the entry above this one is not
-  // even a trade, just a version nobody had bumped yet.
-  postcss: { nanoid: "^3.3.18" }
-};
-var SECURITY_OVERRIDES = {
-  "brace-expansion@4.0.0 - 5.0.8": "^5.0.9"
-};
-function eslintToolchainDependencies(nxVersion) {
-  return {
-    eslint: ESLINT_VERSION,
-    "@nx/eslint": nxVersion,
-    "@nx/eslint-plugin": nxVersion,
-    "@mnci/eslint-config": eslintConfigSpec()
-  };
 }
-var RETIRED_FORMATTER_FILES = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.mjs",
-  ".prettierignore",
-  "oxlint.config.ts",
-  ".oxfmtrc.json"
-];
-function withoutRetiredFormatterDependencies(devDeps) {
-  const retired = /* @__PURE__ */ new Set([
-    "prettier",
-    "eslint-config-prettier",
-    "oxlint",
-    "oxfmt",
-    "@mnci/oxlint-config"
-  ]);
-  return Object.fromEntries(Object.entries(devDeps).filter(([name]) => !retired.has(name)));
+function defaultScope(workspaceRoot) {
+  const { name } = readJson((0, import_node_path3.join)(workspaceRoot, "package.json"));
+  const base = (name.startsWith("@") ? name.slice(1) : name).split("/", 1)[0];
+  return `@${base}`;
 }
-var ESLINT_BLOCK_INVENTORY = `// WHAT IS IN HERE. Each line is one config block, by the \`name\` it carries.
-//
-//   mnci/ignores                  paths never linted (dist, coverage, .venv, \u2026)
-//   mnci/base                     JS/TS correctness \u2014 @eslint/js, eslint-plugin-unicorn,
-//                                 -promise, -n, -unused-imports
-//   typescript-eslint/*           typescript-eslint's own recommended blocks
-//   mnci/typescript*              TS rules on top of them, no type information needed
-//   mnci/type-aware*              the rules that DO read types (no-floating-promises and
-//                                 friends), scoped to {apps,libs,packages}/*/src
-//   mnci/import-graph             import cycles \u2014 eslint-plugin-import-x
-//   mnci/react                    JSX/TSX \u2014 @eslint-react/eslint-plugin,
-//                                 eslint-plugin-react-hooks, -react-refresh, -jsx-a11y
-//   mnci/regexp*                  regex correctness \u2014 eslint-plugin-regexp
-//   mnci/json  mnci/jsonc  mnci/json5
-//                                 eslint-plugin-jsonc \u2014 comments are allowed in .jsonc
-//                                 and tsconfig.json, forbidden in plain .json
-//   mnci/yaml*                    eslint-plugin-yml \u2014 your CI pipeline files
-//   mnci/toml/base*               eslint-plugin-toml, PARSER ONLY: a malformed
-//                                 pyproject.toml is a syntax error, nothing is styled
-//   mnci/markdown                 @eslint/markdown
-//   mnci/css                      @eslint/css
-//   mnci/html                     @html-eslint/eslint-plugin
-//   mnci/tests                    *.spec/*.test relaxations \u2014 eslint-plugin-jest
-//                                 (Vitest's globals too; the two stacks share them)
-//   mnci/nx-dependency-checks     @nx/eslint-plugin, on publishable packages' manifests
-//   mnci/standard                 JavaScript Standard Style as ESLint rules \u2014 the
-//                                 whole formatting opinion. Composed LAST, on
-//                                 purpose: nothing may follow that disables it.
-//
-// To list them as ESLint actually resolves them:  npx eslint --inspect-config
-`;
-var ESLINT_CONFIG = `import mnci from '@mnci/eslint-config'
-
-${ESLINT_BLOCK_INVENTORY}//
-// TO OVERRIDE a rule, append a block AFTER the spread \u2014 later blocks win, so one
-// of your own beats anything above it. Give it a name, so the inspector shows
-// where the change came from:
-//
-//   export default [
-//     ...mnci({ workspaceRoot: import.meta.dirname }),
-//     {
-//       name: 'local/legacy-app-allows-any',
-//       files: ['apps/legacy/**/*.ts'],
-//       rules: { '@typescript-eslint/no-explicit-any': 'off' }
-//     }
-//   ]
-//
-// Do NOT edit @mnci/eslint-config inside node_modules, and do not fork it: it is
-// a dependency, so \`npm update\` brings rule fixes in the way it brings any
-// other. An override here survives that; an edit to the package does not.
-//
-// FORMATTING IS LINTING HERE. There is no Prettier, no oxfmt and no
-// \`format:check\` \u2014 \`npm run lint\` reports indentation, quotes and spacing as
-// ordinary errors, and \`npm run format\` is \`eslint . --fix\`. So do not add a
-// formatter: whichever one you pick will disagree with the \`mnci/standard\`
-// block above, and because a formatter runs on save it wins silently, leaving
-// \`lint\` to fail on files you never edited by hand.
-//
-// That also applies to the editor. Installing a Prettier or oxfmt extension is
-// enough on its own \u2014 neither needs a config file, and with none present they
-// format against their own defaults (semicolons, double quotes), which is the
-// inverse of Standard.
-export default mnci({ workspaceRoot: import.meta.dirname })
-`;
-var VSCODE_RECOMMENDED_EXTENSIONS = [
-  "dbaeumer.vscode-eslint",
-  "nrwl.angular-console",
-  "firsttris.vscode-jest-runner"
-];
-var FORMATTED_LANGUAGES = [
-  "javascript",
-  "javascriptreact",
-  "typescript",
-  "typescriptreact",
-  "json",
-  "jsonc",
-  "yaml",
-  "markdown",
-  "css",
-  "html",
-  // TOML is here for PARSING, not formatting, and the distinction is measured
-  // rather than assumed: `eslint --fix` leaves a badly-laid-out `.toml`
-  // byte-identical (the TOML block is `flat/base`, parser only — `flat/standard`
-  // reported six errors on the `pyproject.toml` mnci itself generates), but it
-  // DOES report `Parsing error: ...` on a malformed one.
-  //
-  // So the entry buys two things. `eslint.validate` gains toml, so a broken
-  // `pyproject.toml` is flagged in the editor rather than at the next CI run.
-  // And pinning the formatter to ESLint means format-on-save does nothing to the
-  // file instead of handing it to whichever TOML formatter the user happens to
-  // have installed — the same reasoning as every other entry here: nothing
-  // reformats against an opinion no gate checks.
-  //
-  // Impossible under the Prettier stack, which is why it is only here now:
-  // `npx prettier` on a `.toml` exits with "No parser could be inferred".
-  "toml"
-];
-function vscodeSettings() {
-  const formatter = "dbaeumer.vscode-eslint";
-  const eslintLanguages = [...FORMATTED_LANGUAGES];
-  return {
-    "eslint.validate": eslintLanguages,
-    "editor.codeActionsOnSave": {
-      "source.fixAll.eslint": "explicit"
-    },
-    "editor.defaultFormatter": formatter,
-    "editor.formatOnSave": true,
-    // Every language spelled out, and the global default above is NOT enough on
-    // its own — which is the bug this fixes rather than a belt-and-braces habit.
-    //
-    // VS Code resolves a language-specific setting ahead of a general one, and it
-    // does that comparison BEFORE scope. So a `[typescript]` block in someone's
-    // USER settings — left over from any other project — outranks this file's
-    // workspace-level `editor.defaultFormatter`, and format-on-save quietly uses
-    // that other formatter instead — and nothing reports it, because the gate
-    // and the editor are looking at different tools. That is how it was found:
-    // reported from a real workspace, not deduced from the docs.
-    //
-    // Reported from a real workspace where `.ts` files were not being formatted
-    // while `.json`/`.jsonc`/`.yaml` were — exactly the three that had explicit
-    // entries here and nothing else did.
-    ...Object.fromEntries(
-      FORMATTED_LANGUAGES.map((language) => [
-        `[${language}]`,
-        { "editor.defaultFormatter": formatter }
-      ])
-    )
-  };
+function addNxTargets(manifestPath, newTargets) {
+  const manifest = fileExists(manifestPath) ? readJson(manifestPath) : {};
+  const nx = manifest.nx ?? {};
+  const targets = nx.targets ?? {};
+  writeFileEnsured(
+    manifestPath,
+    toJson({ ...manifest, nx: { ...nx, targets: { ...targets, ...newTargets } } })
+  );
 }
-var LAUNCH_CONFIG_PREFIX = "mnci: ";
-var LAUNCH_CONFIGURATIONS = ["build", "test", "lint", "typecheck"];
-function launchConfigurations(workspaceName) {
-  return LAUNCH_CONFIGURATIONS.map((script, index) => ({
-    type: "node-terminal",
-    request: "launch",
-    name: `${LAUNCH_CONFIG_PREFIX}${script}`,
-    command: `npm run ${script}`,
-    // Scoped by folder name rather than a bare ${workspaceFolder}: that variable is
-    // ambiguous once a second folder is added to the workspace, and VS Code then
-    // refuses to resolve it.
-    cwd: `\${workspaceFolder:${workspaceName}}`,
-    // One shared group keeps the four together in the dropdown; a per-entry group
-    // would make four groups of one. `order` holds them in verify order.
-    presentation: { group: "mnci", order: index + 1 }
-  }));
+var ESLINT_CONFIG_FILENAMES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts",
+  "eslint.config.mts",
+  "eslint.config.cts"
+];
+function removeGeneratedEslintConfig(workspaceRoot, projectRoot) {
+  for (const filename of ESLINT_CONFIG_FILENAMES) {
+    (0, import_node_fs3.rmSync)((0, import_node_path3.join)(workspaceRoot, projectRoot, filename), { force: true });
+  }
+  (0, import_node_fs3.rmSync)((0, import_node_path3.join)(workspaceRoot, ".vscode"), { recursive: true, force: true });
 }
-function vscodeWorkspace(workspaceName, existingTasks, existingLaunch, existingSettings) {
-  const userConfigurations = (existingLaunch?.configurations ?? []).filter(
-    (configuration) => !String(configuration.name ?? "").startsWith(LAUNCH_CONFIG_PREFIX)
+function findCodeWorkspaceFile(workspaceRoot) {
+  try {
+    const entry = (0, import_node_fs3.readdirSync)(workspaceRoot).find((file) => file.endsWith(".code-workspace"));
+    return entry ? (0, import_node_path3.join)(workspaceRoot, entry) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function projectTask(name, kind) {
+  const script = `${name}:${kind}`;
+  const base = { label: `${name}: ${kind}`, type: "npm", script, problemMatcher: [] };
+  return kind === "start" ? { ...base, isBackground: true } : { ...base, group: kind };
+}
+function registerProjectCommands(workspaceRoot, name, commands) {
+  const scripts = {
+    [`${name}:qa`]: `nx run ${name}:lint && nx run ${name}:test`
+  };
+  if (commands.build) {
+    scripts[`${name}:build`] = `nx run ${name}:build`;
+  }
+  if (commands.start) {
+    scripts[`${name}:start`] = commands.start;
+  }
+  const dependabotPath = (0, import_node_path3.join)(workspaceRoot, ".github/dependabot.yml");
+  if ((0, import_node_fs3.existsSync)(dependabotPath)) {
+    writeFileEnsured(dependabotPath, dependabotConfig(workspaceRoot));
+  }
+  const manifestPath = (0, import_node_path3.join)(workspaceRoot, "package.json");
+  const manifest = readJson(manifestPath);
+  const existingScripts = manifest.scripts ?? {};
+  const overrides = {
+    ...manifest.overrides,
+    ...reactExpressPeerOverride(manifest)
+  };
+  writeFileEnsured(
+    manifestPath,
+    toJson({
+      ...manifest,
+      scripts: { ...existingScripts, ...scripts },
+      ...Object.keys(overrides).length > 0 && { overrides }
+    })
   );
-  const settings = { ...existingSettings, ...vscodeSettings() };
-  return JSON.stringify(
-    {
-      folders: [{ path: ".", name: workspaceName }],
-      settings,
-      extensions: { recommendations: VSCODE_RECOMMENDED_EXTENSIONS },
+  const codeWorkspacePath = findCodeWorkspaceFile(workspaceRoot);
+  if (!codeWorkspacePath) {
+    return;
+  }
+  const workspaceFile = readCodeWorkspace(codeWorkspacePath) ?? {};
+  const label = (task) => task.label ?? "";
+  const existingTasks = (workspaceFile.tasks?.tasks ?? []).filter(
+    (task) => !label(task).startsWith(`${name}: `)
+  );
+  const newTasks = [
+    projectTask(name, "qa"),
+    ...commands.build ? [projectTask(name, "build")] : [],
+    ...commands.start ? [projectTask(name, "start")] : []
+  ];
+  writeFileEnsured(
+    codeWorkspacePath,
+    toJson({
+      ...workspaceFile,
       tasks: {
-        version: existingTasks?.version ?? "2.0.0",
-        tasks: existingTasks?.tasks ?? []
-      },
-      launch: {
-        version: existingLaunch?.version ?? "0.2.0",
-        configurations: [...launchConfigurations(workspaceName), ...userConfigurations]
+        version: workspaceFile.tasks?.version ?? "2.0.0",
+        tasks: [...existingTasks, ...newTasks]
       }
-    },
-    null,
-    2
+    })
   );
 }
-var ROOT_SCRIPTS = {
-  build: "nx run-many -t build",
-  lint: "nx run-many -t lint",
-  test: "nx run-many -t test",
-  typecheck: "nx run-many -t typecheck",
-  affected: "nx affected -t lint,typecheck,test,build",
-  graph: "nx graph",
-  "release:preview": "nx release --dry-run",
-  prepare: "husky"
-};
-function rootScripts() {
-  return {
-    ...ROOT_SCRIPTS,
-    // ESLint is the formatter, so `format` is `--fix` and there is no separate
-    // `format:check`: `lint` already reports formatting as ordinary errors.
-    // Carrying a second script that ran the same tool twice would just make a
-    // CI run slower for no extra coverage.
-    format: "eslint . --fix --cache",
-    "python:install": `${PYTHON_INSTALL_GUARD} && ${PYTHON_WORKSPACE_INSTALL_GUARD}`
-  };
+
+// src/commands/add/flutter.ts
+function addProjectJsonTargets(projectJsonPath, newTargets) {
+  const project = readJson(projectJsonPath);
+  const targets = project.targets ?? {};
+  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
 }
-function generatorDefaults(stack) {
-  const shared = {
-    // `none`, not `eslint`, and the workspace is still fully linted. The root
-    // config plus `@nx/eslint/plugin` ({@link ESLINT_PLUGIN_CONFIG}) give every
-    // project its `lint` target; `eslint` here would only make the generator
-    // scaffold a per-project config mnci deletes anyway — and drag in
-    // `eslint-plugin-import@2.31.0`, which peer-caps at ESLint 9 and breaks the
-    // install outright on this workspace's ESLint 10.
-    linter: "none",
-    unitTestRunner: stack.testRunner
-  };
+function flutterAppStartTarget(name) {
   return {
-    "@nx/react:application": shared,
-    "@nx/react:library": shared,
-    "@nx/js:library": shared
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "flutter run -d chrome", cwd: `apps/${name}` }
   };
 }
-function mnciConfig(options) {
-  return {
-    // Persisted so `mnci upgrade` can name the `<name>.code-workspace` file it
-    // rewrites. Its absence is why upgrade used to write a file literally called
-    // `undefined.code-workspace` and therefore never refreshed the real one —
-    // see `resolveWorkspaceName` in `commands/upgrade.ts`, which still needs a
-    // fallback chain for workspaces generated before this field existed.
-    workspaceName: options.workspaceName,
-    scope: options.scope,
-    registry: options.registry,
-    agent: options.agent,
-    variableGroup: options.variableGroup,
-    ci: options.ci,
-    stack: { testRunner: options.stack.testRunner }
-  };
+function ensureFlutter(workspaceRoot) {
+  if (runShell("flutter", ["--version"], workspaceRoot) !== 0) {
+    throw new Error(
+      "Flutter not found. Install the Flutter SDK first (3.27+, for Dart 3.6+ pub workspaces): https://docs.flutter.dev/get-started/install"
+    );
+  }
 }
-function readMnciConfig(workspaceRoot) {
-  const nxJson = readJson((0, import_node_path11.join)(workspaceRoot, "nx.json"));
-  return nxJson.mnci ?? {};
+function nxFlutterPluginSpec() {
+  return process.env.MNCI_NX_FLUTTER_SPEC ?? "@mnci/nx-flutter";
 }
-function pythonPublishUrl(registry) {
-  if (registry.kind === "azure-artifacts") {
-    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/pypi/upload/`;
+function ensureNxFlutterPlugin(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "@mnci/nx-flutter")) {
+    return;
+  }
+  const spec = nxFlutterPluginSpec();
+  logger.step(`Installing the Flutter toolchain plugin (${spec})`);
+  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error("npm install of @mnci/nx-flutter failed");
   }
-  return void 0;
 }
-var PYTHON_INSTALL_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py+' -m pip install -r requirements-dev.txt',{stdio:'inherit',shell:true}).status ?? 1)"`;
-var PYTHON_WORKSPACE_INSTALL_GUARD = `node -e "const fs=require('node:fs'),path=require('node:path');const editableDirs=[...fs.globSync('apps/*/pyproject.toml'),...fs.globSync('python-packages/*/pyproject.toml'),...fs.globSync('libs/*/pyproject.toml')].map((p)=>path.dirname(p));const requirementsFiles=fs.globSync('apps/*/requirements.txt');if(editableDirs.length===0&&requirementsFiles.length===0){console.log('No Python projects - skipping.');process.exit(0)}const args=['-m','pip','install','--quiet',...editableDirs.flatMap((d)=>['-e',d]),...requirementsFiles.flatMap((f)=>['-r',f])];const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py,args,{stdio:'inherit'}).status ?? 1)"`;
-var PIP_AUDIT_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';require('node:child_process').spawnSync(py,['-m','pip_audit'],{stdio:'inherit'});process.exit(0)"`;
-var GO_MODULE_DOWNLOAD_GUARD = `node -e "if(!require('node:fs').existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('go',['mod','download'],{stdio:'inherit'}).status ?? 1)"`;
-var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}if(cp.spawnSync('golangci-lint',['--version'],{stdio:'ignore'}).status===0){console.log('golangci-lint already installed - skipping.');process.exit(0)}process.exit(cp.spawnSync('go',['install','github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest'],{stdio:'inherit'}).status ?? 1)"`;
-var GO_TOOL_PATH_PRELUDE = "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}const r=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(r.status!==0){console.log('Could not resolve GOPATH - skipping.');process.exit(0)}const bin=require('node:path').join(r.stdout.trim(),'bin');";
-var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
-var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
-var FLUTTER_SDK_VERSION = "3.44.8";
-var NODE_VERSION = "24";
-var NPM_VERSION = "11";
-var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
-var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
-var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
-var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
-var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
-var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
-var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(v.fixAvailable?' - fix available, below the blocking threshold':' - NO fix available upstream, nothing to do here'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available'+(v.fixAvailable&&v.fixAvailable.isSemVerMajor?' (semver-major)':''));console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
-var VERIFY_TARGETS = "lint,typecheck,test,build";
-var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
-var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});if(fs.globSync('apps/*/project.json').length===0){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
-function releaseGuard(pythonPublishEnv) {
-  return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;if(!hasNpm&&!hasPython){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+function prepareFlutter(workspaceRoot) {
+  ensureFlutter(workspaceRoot);
+  ensureNxFlutterPlugin(workspaceRoot);
 }
-function pythonPublishEnvFragment(pythonPublishUrl2) {
-  return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
+function addFlutterApp(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:application", name, "--no-interactive"], workspaceRoot);
+  addProjectJsonTargets((0, import_node_path4.join)(workspaceRoot, "apps", name, "project.json"), {
+    start: flutterAppStartTarget(name)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
+function addFlutterLib(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:library", name, "--no-interactive"], workspaceRoot);
+  registerProjectCommands(workspaceRoot, name, { build: false });
+}
+function addFlutterInternalLib(workspaceRoot, name) {
+  prepareFlutter(workspaceRoot);
+  runNx(["g", "@mnci/nx-flutter:internal-library", name, "--no-interactive"], workspaceRoot);
+  registerProjectCommands(workspaceRoot, name, { build: false });
+}
+
+// src/commands/add/go.ts
+var import_node_fs4 = require("fs");
+var import_node_path5 = require("path");
+function ensureGo(workspaceRoot) {
+  if (runShell("go", ["version"], workspaceRoot) !== 0) {
+    throw new Error("Go not found. Install Go 1.21+ first: https://go.dev/dl/");
+  }
+}
+function warnIfNoGolangciLint(workspaceRoot) {
+  if (runShell("golangci-lint", ["--version"], workspaceRoot) !== 0) {
+    logger.warn(
+      "golangci-lint not found \u2014 the generated lint target needs it. Install: https://golangci-lint.run/welcome/install/"
+    );
+  }
+}
+function nxGoPluginSpec() {
+  return process.env.MNCI_NX_GO_SPEC ?? "@nx-go/nx-go";
+}
+function ensureNxGoPlugin(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "@nx-go/nx-go")) {
+    return;
+  }
+  const spec = nxGoPluginSpec();
+  logger.step(`Installing the Go toolchain plugin (${spec})`);
+  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error("npm install of @nx-go/nx-go failed");
+  }
+}
+function ensureGoModule(workspaceRoot) {
+  if (fileExists((0, import_node_path5.join)(workspaceRoot, "go.mod"))) {
+    return;
+  }
+  logger.step("Bootstrapping the workspace Go module (single root go.mod)");
+  runNx(["g", "@nx-go/nx-go:init", "--no-interactive"], workspaceRoot);
+  runNx(["g", "@nx-go/nx-go:convert-to-one-mod", "--no-interactive"], workspaceRoot);
+}
+function goModulePath(workspaceRoot) {
+  try {
+    const contents = (0, import_node_fs4.readFileSync)((0, import_node_path5.join)(workspaceRoot, "go.mod"), "utf8");
+    return /^module\s+(\S+)/m.exec(contents)?.[1];
+  } catch {
+    return void 0;
+  }
+}
+function addProjectJsonTargets2(projectJsonPath, newTargets) {
+  const project = readJson(projectJsonPath);
+  const targets = project.targets ?? {};
+  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
+}
+function goTestTarget() {
+  return { executor: "@nx-go/nx-go:test" };
+}
+function goLintTarget() {
+  return {
+    executor: "@nx-go/nx-go:lint",
+    parallelism: false,
+    options: { linter: "golangci-lint", args: ["run"] }
+  };
 }
-function npmAuthEnvVariable(registryKind, variableReference) {
-  return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : ["PAT", variableReference("PAT")];
+function goBuildTarget(name) {
+  return {
+    executor: "@nx-go/nx-go:build",
+    outputs: [`{workspaceRoot}/dist/apps/${name}`],
+    options: { outputPath: `../../dist/apps/${name}/${name}` }
+  };
 }
-function poolBlock(agent) {
-  return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
+function goPackageTarget(tag, name) {
+  const zip = `dist/drop/${tag}-${name}.zip`;
+  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('dist/apps/${name}');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
+  };
 }
-function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts") {
-  const onMain = "and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI'), eq(variables['Build.SourceBranchName'], 'main'))";
-  const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(registryKind, (name) => `$(${name})`);
-  return `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
-
-# Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
-# versions from conventional commits and pushes ONLY a tag to main, and each
-# app is packed into dist/drop/<type>-<name>.zip by its own 'package' target.
-#
-# Cross-platform by construction: no bash, no PowerShell. Every step is a
-# built-in task or a single-line git/npm/npx/node command, so the pipeline
-# runs unchanged on Linux, macOS and Windows agents.
-
-trigger:
-  # While a run is in progress, queue further pushes and run them together rather
-  # than concurrently. This is the closest thing Azure Pipelines YAML has to
-  # GitHub's concurrency group, and it is load-bearing on main for the same
-  # reason: two concurrent 'nx release' runs would race to create the same tag.
-  batch: true
-  branches:
-    include:
-      - main
-      # EVERY other branch too, and that breadth is a correction rather than
-      # generosity. On Azure Repos Git a YAML 'pr:' block does nothing at all
-      # (see the note below), so a CI trigger is the only pre-merge
-      # verification this file can switch on by itself. Listing main alone \u2014
-      # which is what this pipeline used to do, next to a 'pr:' block that
-      # looked like it covered the rest \u2014 means a workspace verifies NOTHING
-      # until a change has already reached the branch it was supposed to
-      # protect.
-      #
-      # Release stays gated on main (the 'condition:' on every release step
-      # below), so a topic-branch run installs, audits, syncs, formats,
-      # verifies and packs, and publishes nothing.
-      - '*'
-
-# PR validation is deliberately NOT configured here, because on Azure Repos Git
-# it CANNOT be: "For an Azure Repos Git repo, you cannot configure a PR trigger
-# in the YAML file. You need to use branch policies." A 'pr:' block here is not
-# an error \u2014 it is silently ignored, which is worse, because the file then
-# documents a gate that does not exist. (The same block IS honoured for GitHub
-# and Bitbucket repos, which is why .github/workflows/ci.yml keeps its
-# 'pull_request:' trigger.)
-#
-# To get PR validation, configure it once in the UI: Project Settings ->
-# Repositories -> <repo> -> Policies -> <branch> -> Build Validation, pointing
-# at this pipeline. That is also the only thing that sets
-# System.PullRequest.TargetBranch, which the verify step below reads to scope
-# itself to affected projects \u2014 without a policy that variable is never set and
-# the step verifies every project instead. Correct either way, just slower.
-#
-# Cancelling a superseded PR run lives in that same policy ("automatically
-# cancel"), and likewise has no YAML expression.
-pr: none
-
-pool:
-${poolBlock(agent)}
-
-variables:
-  # Holds the npm auth secret the root .npmrc reads: the base64-encoded \`PAT\`
-  # for an Azure Artifacts feed, or a raw npm automation token as \`NPM_TOKEN\`
-  # for public npm. Mark it secret in Library. Add app build vars here too if needed.
-  - group: ${variableGroup}
-  # Relocates npm's cache inside the pipeline workspace so Cache@2 can restore it
-  # (the default ~/.npm is outside the cacheable area on hosted agents). npm reads
-  # this as an ordinary env var, so it needs no config file and works on every
-  # agent OS.
-  - name: npm_config_cache
-    value: $(Pipeline.Workspace)/.npm
-
-steps:
-  - checkout: self
-    # Lets later steps push release tags back to the repo. The Project
-    # Collection Build Service account needs Contribute permission on this
-    # repo (Project Settings -> Repositories -> Security) \u2014 one-time grant.
-    persistCredentials: true
-    fetchDepth: 0
-
-  # checkout leaves a detached HEAD; nx release needs a real branch.
-  - script: git checkout -B $(Build.SourceBranchName)
-    displayName: Attach HEAD to the source branch
-
-  # Version resolution needs the release tags.
-  - script: git fetch --all --prune --tags
-    displayName: Fetch branches and release tags
-
-  - script: git config user.name "Azure Pipelines" && git config user.email "pipeline@dev.azure.com"
-    displayName: Set the git identity used for release tags
-
-  - task: UseNode@1
-    inputs:
-      version: 24.x
-
-  # The Azure counterpart of \`cache: npm\` on actions/setup-node: restores npm's
-  # download cache so \`npm ci\` does not re-fetch every tarball on every run.
-  # Keyed on the lockfile, so a dependency change misses and anything else hits;
-  # restoreKeys falls back to the newest cache for this OS on a miss, which still
-  # avoids a fully cold install. Agent.OS is in the key because a cached native
-  # module built for one OS is not reusable on another.
-  - task: Cache@2
-    displayName: Cache npm packages
-    inputs:
-      key: 'npm | "$(Agent.OS)" | package-lock.json'
-      restoreKeys: |
-        npm | "$(Agent.OS)"
-      path: $(npm_config_cache)
-
-  - script: npm ci
-    displayName: Install dependencies
-    env:
-      ${npmAuthName}: ${npmAuthValue}
-
-  # Fails ONLY on an advisory that has a published fix, at moderate or above;
-  # anything upstream has not fixed is printed and passes. See NPM_AUDIT_STEP's
-  # remarks for why that split replaced a warn-only step.
-  - script: ${NPM_AUDIT_STEP}
-    displayName: npm audit (fails on an actionable advisory)
-
-  # Installs the fixed Python toolchain (ruff, pytest, build, twine, pip-audit)
-  # \u2014 written by 'mnci add' to requirements-dev.txt on the first Python
-  # project. Plain pip, no uv/Poetry: portable guard skips cleanly on a
-  # workspace with none.
-  - script: ${PYTHON_INSTALL_GUARD}
-    displayName: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
-
-  # Editable-installs every Python project into one shared environment, the
-  # pip-world counterpart of 'npm install' hoisting every workspace package
-  # into one root node_modules \u2014 so a project that imports an internal lib
-  # (normally vendored only at build time) can resolve that import at
-  # lint/test time too. Portable guard skips cleanly on a workspace with none.
-  - script: ${PYTHON_WORKSPACE_INSTALL_GUARD}
-    displayName: Install Python project dependencies (editable, workspace-wide)
-
-  # Non-blocking, same reasoning as the npm audit step above. Runs after the
-  # workspace-wide install so it scans the workspace's actual dependency set,
-  # not just the fixed toolchain.
-  - script: ${PIP_AUDIT_GUARD}
-    displayName: pip-audit (non-blocking)
-
-  # Go, if the workspace has any: hosted agents ship the toolchain, so only
-  # the module cache and the linter need seeding. Both guards skip cleanly on
-  # a workspace with no root go.mod.
-  - script: ${GO_MODULE_DOWNLOAD_GUARD}
-    displayName: Download Go module dependencies
-
-  # golangci-lint is what the generated Go lint target actually runs (the
-  # plugin's own default is 'go fmt', which only reformats). 'go install'
-  # drops it in GOPATH/bin, which is not on PATH by default on a hosted
-  # agent \u2014 so prepend it for every later step in the job.
-  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
-    displayName: Install golangci-lint
-
-  - script: ${GO_TOOL_PATH_AZURE}
-    displayName: Add Go tool bin to PATH
-
-  # Flutter, if the workspace has any. Unlike Python and Go, hosted agents do
-  # NOT ship the Flutter SDK, so this installs it (shallow git clone at a
-  # pinned tag) and puts it on PATH. All three guards skip cleanly on a
-  # workspace with no root pubspec.yaml, and the install also skips when an
-  # SDK is already on PATH.
-  - script: ${FLUTTER_SDK_INSTALL_GUARD}
-    displayName: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
-
-  - script: ${FLUTTER_TOOL_PATH_AZURE}
-    displayName: Add the Flutter SDK to PATH
-
-  # One command resolves EVERY Dart dependency, internal and external, for the
-  # whole workspace: the projects are pub workspace members, so this writes a
-  # single root pubspec.lock they all share.
-  - script: ${FLUTTER_PUB_GET_GUARD}
-    displayName: Resolve Dart dependencies (one pub get for the whole workspace)
-
-  # Fails fast, with an unambiguous message, when a stale TypeScript project
-  # reference (or another sync generator's drift) was never synced+committed
-  # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
-  # CI still needs its own explicit, early check rather than surfacing this as
-  # a confusing failure buried inside the build step below.
-  - script: npx nx sync:check
-    displayName: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
-
-  # The one verify step, and deliberately the only one: affected projects on a
-  # pull request, EVERY project on anything else (a push to main included, so a
-  # release is always verified in full). Every fallback \u2014 no target branch, an
-  # unresolvable merge-base \u2014 takes the full path, because a run that verifies
-  # too little still reports green.
-  #
-  # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
-  # below, so adding it back as its own step would only duplicate work \u2014 and on
-  # a pull request it would re-lint every project, discarding the point of this.
-  - script: ${AFFECTED_OR_ALL_GUARD}
-    displayName: Verify (affected on a PR, every project on main)
-
-  # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
-  # target. Portable guard: skip cleanly when the workspace has no apps yet.
-  - script: ${PACK_APPS_GUARD}
-    displayName: Pack all apps (one zip per app -> dist/drop)
-    condition: ${onMain}
-
-  - task: PublishBuildArtifacts@1
-    displayName: Publish the drop (one zip per app)
-    condition: ${onMain}
-    inputs:
-      PathtoPublish: $(Build.SourcesDirectory)/dist/drop
-      ArtifactName: drop
-
-  # One build tag per packed app, EXACTLY the zip name (type-name), so the
-  # classic release pipeline knows which app to run for. Derived from the zip
-  # filenames so the tag can never drift from the artifact.
-  - script: node -e "const fs=require('node:fs');const path=require('node:path');for(const f of fs.globSync('dist/drop/*.zip')){console.log('##vso[build.addbuildtag]'+path.basename(f,'.zip'))}"
-    displayName: Tag the run per app (type-name)
-    condition: ${onMain}
-
-  # Version + tag + publish, in one release, for npm (packages/*) AND Python
-  # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
-  # nx release errors on an empty scope, so skip cleanly when there is nothing
-  # to release. When there are Python packages and an Azure feed, twine
-  # publish credentials are exported (raw PAT, decoded from the base64 variable).
-  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-    displayName: Release \u2014 version, tag and publish (npm + Python)
-    condition: ${onMain}
-    env:
-      ${npmAuthName}: ${npmAuthValue}
-
-  # nx release's own git push (release.git.push) is deliberately left off: it
-  # only runs when a remote GitHub/GitLab Release is configured, which this
-  # pipeline never does, so it would never push the tag the step above just
-  # created. Pushed explicitly, unconditionally (a no-op when nothing released)
-  # once tagging is guaranteed to have already happened.
-  - script: git push origin --tags
-    displayName: Push release tags (nx release's own push never runs without a remote Release configured)
-    condition: ${onMain}
-`;
+function goStartTarget(name) {
+  return {
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "go run .", cwd: `apps/${name}` }
+  };
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github") {
-  const onMain = "github.event_name == 'push' && github.ref_name == 'main'";
-  const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
-    registryKind,
-    (name) => `\${{ secrets.${name} }}`
+function prepareGo(workspaceRoot) {
+  ensureGo(workspaceRoot);
+  warnIfNoGolangciLint(workspaceRoot);
+  ensureNxGoPlugin(workspaceRoot);
+  ensureGoModule(workspaceRoot);
+}
+function addGoApp(workspaceRoot, name) {
+  prepareGo(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@nx-go/nx-go:application",
+      `apps/${name}`,
+      `--name=${name}`,
+      "--tags=type:go-app",
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  const githubReleases = ci === "github";
-  return `name: CI
-
-# Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
-# versions from conventional commits and pushes ONLY a tag to main, and each
-# app is packed into dist/drop/<type>-<name>.zip by its own 'package' target.
-# The GitHub Actions equivalent of azure-pipelines.yml \u2014 see there for the
-# fuller rationale; both stay hand-kept in lockstep, there is no shared template.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-concurrency:
-  # One run at a time per ref, but \`cancel-in-progress\` is an **expression** on
-  # purpose rather than a flat \`true\`.
-  #
-  # A superseded PR run is pure waste, so cancel it. A run on \`main\` must never
-  # be cancelled: it publishes packages and pushes release tags, and killing it
-  # part-way can leave a tag pushed with the publish only half done \u2014 a state no
-  # rerun repairs cleanly, because the version is then already tagged. Those runs
-  # queue instead, which also stops two \`nx release\` invocations racing to create
-  # the same tag when two commits land close together.
-  group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
-
-permissions:
-  # Lets the release step push the version tag nx release creates back to main,
-  # and (github-only provider) create the GitHub Release itself.
-  contents: write
-
-jobs:
-  ci:
-    runs-on: ${agent}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # Version resolution needs the release tags.
-      - run: git fetch --all --prune --tags
-        name: Fetch branches and release tags
-
-      - run: git config user.name "github-actions[bot]" && git config user.email "github-actions[bot]@users.noreply.github.com"
-        name: Set the git identity used for release tags
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${NODE_VERSION}
-          # Caches ~/.npm keyed on package-lock.json, so \`npm ci\` restores from
-          # the local cache instead of re-downloading every tarball on every run.
-          # Nothing to invalidate by hand: the action keys on the lockfile, so a
-          # dependency change misses the cache and a no-op change hits it.
-          cache: npm
-
-      # setup-node installs whatever npm the Node image bundles, and npm's major
-      # is part of the contract: npm 11 reuses an already-installed tree instead
-      # of re-resolving, so it applies \`overrides\` differently from npm 10. See
-      # NPM_VERSION's remarks for the measurement.
-      - run: npm install -g npm@${NPM_VERSION}
-        name: Pin npm to the major mnci verifies against
-
-      - run: npm ci
-        name: Install dependencies
-        env:
-          ${npmAuthName}: ${npmAuthValue}
-
-      # Fails ONLY on an advisory that has a published fix, at moderate or
-      # above; anything upstream has not fixed is printed and passes. See
-      # NPM_AUDIT_STEP's remarks for why that split replaced a warn-only step.
-      - run: ${NPM_AUDIT_STEP}
-        name: npm audit (fails on an actionable advisory)
-
-      # Installs the fixed Python toolchain (ruff, pytest, build, twine,
-      # pip-audit) \u2014 written by 'mnci add' to requirements-dev.txt on the
-      # first Python project. Plain pip, no uv/Poetry: portable guard skips
-      # cleanly on a workspace with none.
-      - run: ${PYTHON_INSTALL_GUARD}
-        name: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
-
-      # Editable-installs every Python project into one shared environment, the
-      # pip-world counterpart of 'npm install' hoisting every workspace package
-      # into one root node_modules \u2014 so a project that imports an internal lib
-      # (normally vendored only at build time) can resolve that import at
-      # lint/test time too. Portable guard skips cleanly on a workspace with none.
-      - run: ${PYTHON_WORKSPACE_INSTALL_GUARD}
-        name: Install Python project dependencies (editable, workspace-wide)
-
-      # Non-blocking, same reasoning as the npm audit step above. Runs after
-      # the workspace-wide install so it scans the workspace's actual
-      # dependency set, not just the fixed toolchain.
-      - run: ${PIP_AUDIT_GUARD}
-        name: pip-audit (non-blocking)
-
-      # Go, if the workspace has any: hosted runners ship the toolchain, so
-      # only the module cache and the linter need seeding. Both guards skip
-      # cleanly on a workspace with no root go.mod.
-      - run: ${GO_MODULE_DOWNLOAD_GUARD}
-        name: Download Go module dependencies
-
-      # golangci-lint is what the generated Go lint target actually runs (the
-      # plugin's own default is 'go fmt', which only reformats). 'go install'
-      # drops it in GOPATH/bin, which is not on PATH by default on a hosted
-      # runner \u2014 so publish it for every later step in the job.
-      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
-        name: Install golangci-lint
-
-      - run: ${GO_TOOL_PATH_GITHUB}
-        name: Add Go tool bin to PATH
-
-      # Flutter, if the workspace has any. Unlike Python and Go, hosted runners
-      # do NOT ship the Flutter SDK, so this installs it (shallow git clone at
-      # a pinned tag) and puts it on PATH. All three guards skip cleanly on a
-      # workspace with no root pubspec.yaml, and the install also skips when an
-      # SDK is already on PATH.
-      - run: ${FLUTTER_SDK_INSTALL_GUARD}
-        name: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
-
-      - run: ${FLUTTER_TOOL_PATH_GITHUB}
-        name: Add the Flutter SDK to PATH
-
-      # One command resolves EVERY Dart dependency, internal and external, for
-      # the whole workspace: the projects are pub workspace members, so this
-      # writes a single root pubspec.lock they all share.
-      - run: ${FLUTTER_PUB_GET_GUARD}
-        name: Resolve Dart dependencies (one pub get for the whole workspace)
+  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "apps", name, "project.json"), {
+    build: goBuildTarget(name),
+    test: goTestTarget(),
+    lint: goLintTarget(),
+    package: goPackageTarget("go-app", name),
+    start: goStartTarget(name)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
+function addGoFunctionApp(workspaceRoot, name) {
+  prepareGo(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@nx-go/nx-go:application",
+      `apps/${name}`,
+      `--name=${name}`,
+      "--tags=type:go-function-app",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "apps", name, "project.json"), {
+    build: goBuildTarget(name),
+    test: goTestTarget(),
+    lint: goLintTarget(),
+    package: goPackageTarget("go-function-app", name)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+function addGoLib(workspaceRoot, name) {
+  prepareGo(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@nx-go/nx-go:library",
+      `packages/${name}`,
+      `--name=${name}`,
+      "--tags=type:go-lib",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "packages", name, "project.json"), {
+    test: goTestTarget(),
+    lint: goLintTarget()
+  });
+  registerProjectCommands(workspaceRoot, name, { build: false });
+  const module2 = goModulePath(workspaceRoot);
+  if (module2) {
+    logger.step(`Import it as ${module2}/packages/${name}`);
+  }
+}
+function addGoInternalLib(workspaceRoot, name) {
+  prepareGo(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@nx-go/nx-go:library",
+      `libs/${name}`,
+      `--name=${name}`,
+      "--tags=type:go-internal-lib",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "libs", name, "project.json"), {
+    test: goTestTarget(),
+    lint: goLintTarget()
+  });
+  registerProjectCommands(workspaceRoot, name, { build: false });
+  const module2 = goModulePath(workspaceRoot);
+  if (module2) {
+    logger.step(`Import it as ${module2}/libs/${name}`);
+  }
+}
 
-      # Fails fast, with an unambiguous message, when a stale TypeScript project
-      # reference (or another sync generator's drift) was never synced+committed
-      # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
-      # CI still needs its own explicit, early check rather than surfacing this as
-      # a confusing failure buried inside the build step below.
-      - run: npx nx sync:check
-        name: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
+// src/commands/add/node.ts
+var import_node_path6 = require("path");
+function ensurePlugin2(workspaceRoot, packageName) {
+  if (hasPlugin(workspaceRoot, packageName)) {
+    return;
+  }
+  logger.step(`Installing Nx plugin ${packageName}`);
+  runNx(["add", packageName], workspaceRoot);
+}
+function runNodeApp(workspaceRoot, name, stack, framework) {
+  ensurePlugin2(workspaceRoot, "@nx/node");
+  runNx(
+    [
+      "g",
+      "@nx/node:application",
+      `apps/${name}`,
+      "--bundler=esbuild",
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--e2eTestRunner=none",
+      `--framework=${framework}`,
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+}
+function nodeAppPackageTarget(name) {
+  const zip = `dist/drop/node-app-${name}.zip`;
+  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('apps/${name}/dist');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
+  };
+}
+function addNodeApp(workspaceRoot, name, stack, framework = "none") {
+  runNodeApp(workspaceRoot, name, stack, framework);
+  ensureAdmZip(workspaceRoot);
+  addNxTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "package.json"), {
+    package: nodeAppPackageTarget(name)
+  });
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
+}
+function ensureAzureFunctionsPackage(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "@azure/functions")) {
+    return;
+  }
+  logger.step("Installing @azure/functions");
+  if (runShell("npm", ["install", "@azure/functions", "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error("npm install of @azure/functions failed");
+  }
+}
+var NODE_FUNCTION_APP_MAIN = `// esbuild only includes what is reachable from here, so add one import per
+// function file you create under src/functions/.
+import './functions/hello'
+`;
+var NODE_FUNCTION_APP_HOST_JSON = `{
+  "version": "2.0",
+  "extensionBundle": {
+    "id": "Microsoft.Azure.Functions.ExtensionBundle",
+    "version": "[4.*, 5.0.0)"
+  }
+}
+`;
+var NODE_FUNCTION_APP_HELLO = `import { app } from '@azure/functions'
+import type { HttpRequest, HttpResponseInit } from '@azure/functions'
+import { buildGreeting } from './greeting'
 
-      # The one verify step, and deliberately the only one: affected projects on
-      # a pull request, EVERY project on anything else (a push to main included,
-      # so a release is always verified in full). Every fallback \u2014 no target
-      # branch, an unresolvable merge-base \u2014 takes the full path, because a run
-      # that verifies too little still reports green.
-      #
-      # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
-      # below, so adding it back as its own step would only duplicate work \u2014 and
-      # on a pull request it would re-lint every project, discarding the point
-      # of this.
-      - run: ${AFFECTED_OR_ALL_GUARD}
-        name: Verify (affected on a PR, every project on main)
+async function hello(request: HttpRequest): Promise<HttpResponseInit> {
+  const name = request.query.get('name') ?? 'world'
+  return { body: buildGreeting(name) }
+}
 
-      # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
-      # target. Portable guard: skip cleanly when the workspace has no apps yet.
-      - run: ${PACK_APPS_GUARD}
-        name: Pack all apps (one zip per app -> dist/drop)
-        if: \${{ ${onMain} }}
+app.http('hello', {
+  methods: ['GET'],
+  authLevel: 'anonymous',
+  route: 'hello',
+  handler: hello,
+})
+`;
+var NODE_FUNCTION_APP_GREETING = `export function buildGreeting (name: string): string {
+  return 'Hello, ' + name + '!'
+}
+`;
+var NODE_FUNCTION_APP_GREETING_SPEC = `import { buildGreeting } from './greeting'
 
-      - uses: actions/upload-artifact@v4
-        if: \${{ ${onMain} }}
-        with:
-          name: drop
-          path: dist/drop
-          if-no-files-found: ignore
+describe('buildGreeting', () => {
+  it('greets a name', () => {
+    expect(buildGreeting('world')).toBe('Hello, world!')
+  })
+})
+`;
+function repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot) {
+  const manifestPath = (0, import_node_path6.join)(nodeFunctionAppRoot, "package.json");
+  const manifest = readJson(manifestPath);
+  const azureFunctionsVersion = readJson(
+    (0, import_node_path6.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
+  ).version;
+  const dependencies = manifest.dependencies ?? {};
+  writeFileEnsured(
+    manifestPath,
+    toJson({
+      ...manifest,
+      main: "dist/main.js",
+      dependencies: { ...dependencies, "@azure/functions": `^${azureFunctionsVersion}` }
+    })
+  );
+}
+function nodeFunctionAppPackageTarget(name) {
+  const zip = `dist/drop/node-function-app-${name}.zip`;
+  const root = `apps/${name}`;
+  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('${root}/dist','dist');z.addLocalFile('${root}/host.json');z.addLocalFile('${root}/package.json');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
+  };
+}
+function nodeFunctionAppStartTarget(name) {
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    continuous: true,
+    options: { command: "func start", cwd: `apps/${name}` }
+  };
+}
+function addNodeFunctionApp(workspaceRoot, name, stack) {
+  runNodeApp(workspaceRoot, name, stack, "none");
+  ensureAzureFunctionsPackage(workspaceRoot);
+  const nodeFunctionAppRoot = (0, import_node_path6.join)(workspaceRoot, "apps", name);
+  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
+  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
+  writeFileEnsured(
+    (0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
+    NODE_FUNCTION_APP_GREETING
+  );
+  writeFileEnsured(
+    (0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
+    NODE_FUNCTION_APP_GREETING_SPEC
+  );
+  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
+  repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  addNxTargets((0, import_node_path6.join)(nodeFunctionAppRoot, "package.json"), {
+    package: nodeFunctionAppPackageTarget(name),
+    start: nodeFunctionAppStartTarget(name)
+  });
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
 
-      # Version + tag + publish, in one release, for npm (packages/*) AND Python
-      # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
-      # nx release errors on an empty scope, so skip cleanly when there is nothing
-      # to release. When there are Python packages and an Azure feed, twine
-      # publish credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
-      # This provider also creates a per-project GitHub Release (changelog
-      # generated from conventional commits since that project's last tag),
-      # which is why 'nx release' pushes the tag itself here \u2014 see
-      # releaseConfig's remarks for why that is safe on this Nx version and
-      # why every other provider combination keeps the explicit push step below.` : ""}
-      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python)
-        if: \${{ ${onMain} }}
-        env:
-          ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
-          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
-${githubReleases ? "" : `
-      # nx release's own git push (release.git.push) is deliberately left off: it
-      # only runs when a remote GitHub/GitLab Release is configured, which this
-      # workflow never does, so it would never push the tag the step above just
-      # created. Pushed explicitly, unconditionally (a no-op when nothing released)
-      # once tagging is guaranteed to have already happened.
-      - run: git push origin --tags
-        name: Push release tags (nx release's own push never runs without a remote Release configured)
-        if: \${{ ${onMain} }}
-`}`;
+// src/commands/add/npmLib.ts
+var import_node_path7 = require("path");
+async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
+  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
+  runNx(
+    [
+      "g",
+      "@nx/js:lib",
+      `packages/${name}`,
+      "--publishable",
+      `--importPath=${scope}/${name}`,
+      "--bundler=rollup",
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  const manifestPath = (0, import_node_path7.join)(workspaceRoot, "packages", name, "package.json");
+  markPublic(manifestPath);
+  repairPublishableManifest(manifestPath);
+  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
 }
-var DEPENDABOT_CONFIG = `# Generated by MoNecromanCI. Weekly dependency-update PRs so vulnerable or
-# stale dependencies surface as a reviewable PR instead of only a push-time
-# warning.
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: "/"
-    schedule:
-      interval: weekly
 
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
+// src/commands/add/python.ts
+var import_node_fs5 = require("fs");
+var import_node_path8 = require("path");
+function ensurePython(workspaceRoot) {
+  const hasPython = runShell("python3", ["--version"], workspaceRoot) === 0 || runShell("python", ["--version"], workspaceRoot) === 0;
+  if (!hasPython) {
+    throw new Error(
+      "Python not found. Install Python 3.9+ first: https://www.python.org/downloads/"
+    );
+  }
+}
+function pythonPipPluginSpec() {
+  return process.env.MNCI2_PYTHON_PIP_SPEC ?? "@mnci/nx-python-pip";
+}
+function ensurePythonPipPlugin(workspaceRoot) {
+  if (hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
+    return;
+  }
+  const spec = pythonPipPluginSpec();
+  logger.step(`Installing the Python toolchain plugin (${spec})`);
+  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error("npm install of @mnci/nx-python-pip failed");
+  }
+}
+var PYTHON_REQUIREMENTS_DEV = `build
+twine
+ruff
+pytest
+pip-audit
+`;
+function ensureRequirementsDev(workspaceRoot) {
+  const requirementsDevPath = (0, import_node_path8.join)(workspaceRoot, "requirements-dev.txt");
+  if (!fileExists(requirementsDevPath)) {
+    writeFileEnsured(requirementsDevPath, PYTHON_REQUIREMENTS_DEV);
+  }
+}
+function pythonModuleDirectory(name) {
+  return name.replaceAll("-", "_");
+}
+function addProjectJsonTargets3(projectJsonPath, newTargets) {
+  const project = readJson(projectJsonPath);
+  const targets = project.targets ?? {};
+  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
+}
+function pythonAppMain(name) {
+  return `def main() -> None:
+    print('${name} is running')
 
-  # Globs, not one entry per project: Python projects are added later via
-  # 'mnci add python-*', so this starts covering them automatically the
-  # moment the first one exists \u2014 a glob matching nothing yet is not an error.
-  - package-ecosystem: pip
-    directories:
-      - "/apps/*"
-      - "/python-packages/*"
-      - "/libs/*"
-    schedule:
-      interval: weekly
 
-  # Same glob reasoning as pip above. Dart projects are pub workspace members,
-  # so each one declares its own dependencies even though they all resolve
-  # through the single root pubspec.lock \u2014 hence the per-project directories
-  # rather than just "/".
-  - package-ecosystem: pub
-    directories:
-      - "/apps/*"
-      - "/packages/*"
-      - "/libs/*"
-    schedule:
-      interval: weekly
+if __name__ == '__main__':
+    main()
 `;
-var NX_SCAFFOLDING_TO_REMOVE = [".prettierrc", ".prettierrc.json", ".vscode"];
-function removeNxScaffolding(workspaceRoot) {
-  for (const entry of NX_SCAFFOLDING_TO_REMOVE) {
-    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, entry), { recursive: true, force: true });
-  }
-  removeProjectEslintConfigs(workspaceRoot);
 }
-function removeIfPresent(path) {
-  (0, import_node_fs6.rmSync)(path, { recursive: true, force: true });
+function pythonAppStartTarget(name) {
+  return {
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "python3 main.py", cwd: `apps/${name}` }
+  };
 }
-function removeProjectEslintConfigs(workspaceRoot) {
-  const matches = (0, import_node_fs6.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
-    cwd: workspaceRoot
-  });
-  for (const match of matches) {
-    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, match), { force: true });
-  }
+function pythonFunctionAppStartTarget(name) {
+  return {
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "func start", cwd: `apps/${name}` }
+  };
 }
-function applyOverlay(workspaceRoot, options, onProgress = () => {
-}) {
-  const nxJsonPath = (0, import_node_path11.join)(workspaceRoot, "nx.json");
-  const nxJson = readJson(nxJsonPath);
-  const generators = {
-    ...nxJson.generators,
-    ...generatorDefaults(options.stack)
+function pythonAppPackageTarget(name) {
+  const zip = `dist/drop/python-app-${name}.zip`;
+  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('apps/${name}/dist');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
   };
-  const sync = { ...nxJson.sync, ...SYNC_CONFIG };
-  const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  const patched = withSharedGlobals(withEslintPlugin(withReleaseConfig(nxJson, options.ci)));
-  onProgress("nx.json \u2014 release, sync, generators, shared inputs, mnci block");
-  writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
-  onProgress("package.json \u2014 root scripts, TS compilers, ESLint toolchain, overrides");
-  const manifestPath = (0, import_node_path11.join)(workspaceRoot, "package.json");
-  const manifest = readJson(manifestPath);
-  const scripts = {
-    ...manifest.scripts,
-    ...rootScripts()
+}
+function pythonFunctionAppPackageTarget(name, moduleDirectory) {
+  const zip = `dist/drop/python-function-app-${name}.zip`;
+  const root = `apps/${name}`;
+  const command = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFile('${root}/function_app.py');z.addLocalFile('${root}/host.json');z.addLocalFile('${root}/requirements.txt');z.addLocalFolder('${root}/${moduleDirectory}','${moduleDirectory}');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
   };
-  const existingDevDeps = manifest.devDependencies;
-  const devDeps = withoutRetiredFormatterDependencies({
-    ...existingDevDeps,
-    ...TS_COMPILER_DEPENDENCIES,
-    // The preset pins `nx` itself; the ESLint plugins must match it exactly.
-    ...eslintToolchainDependencies(existingDevDeps?.nx ?? "latest")
+}
+function addPythonApp(workspaceRoot, name) {
+  ensurePython(workspaceRoot);
+  ensurePythonPipPlugin(workspaceRoot);
+  ensureRequirementsDev(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(
+    ["g", "@mnci/nx-python-pip:application", name, `--directory=apps/${name}`, "--no-interactive"],
+    workspaceRoot
+  );
+  writeFileEnsured((0, import_node_path8.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
+  addProjectJsonTargets3((0, import_node_path8.join)(workspaceRoot, "apps", name, "project.json"), {
+    package: pythonAppPackageTarget(name),
+    start: pythonAppStartTarget(name)
   });
-  const overrides = {
-    ...manifest.overrides,
-    ...ESLINT_PEER_OVERRIDES,
-    ...SECURITY_OVERRIDES
-  };
-  const existingNx = manifest.nx;
-  const nx = {
-    ...existingNx,
-    includedScripts: existingNx?.includedScripts ?? [],
-    targets: {
-      ...existingNx?.targets,
-      lint: ROOT_LINT_TARGET
-    }
-  };
-  writeFileEnsured(
-    manifestPath,
-    toJson({
-      ...manifest,
-      name: `${options.scope}/source`,
-      scripts,
-      devDependencies: devDeps,
-      overrides,
-      nx
-    })
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
+function addPythonFunctionApp(workspaceRoot, name) {
+  ensurePython(workspaceRoot);
+  ensurePythonPipPlugin(workspaceRoot);
+  ensureRequirementsDev(workspaceRoot);
+  ensureAdmZip(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@mnci/nx-python-pip:function-application",
+      name,
+      `--directory=apps/${name}`,
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  onProgress(
-    `.npmrc \u2014 ${options.registry.kind === "azure-artifacts" ? "Azure Artifacts feed routing and credentials" : "public npm registry auth"}`
+  const moduleDirectory = pythonModuleDirectory(name);
+  addProjectJsonTargets3((0, import_node_path8.join)(workspaceRoot, "apps", name, "project.json"), {
+    package: pythonFunctionAppPackageTarget(name, moduleDirectory),
+    start: pythonFunctionAppStartTarget(name)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: false, start: `nx run ${name}:start` });
+}
+function addPythonLib(workspaceRoot, name) {
+  ensurePython(workspaceRoot);
+  ensurePythonPipPlugin(workspaceRoot);
+  ensureRequirementsDev(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@mnci/nx-python-pip:library",
+      name,
+      `--directory=python-packages/${name}`,
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".npmrc"), npmrcContent(options.registry, options.scope));
-  onProgress("commitlint.config.mjs and .husky/commit-msg \u2014 conventional commit enforcement");
-  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, "commitlint.config.mjs"), COMMITLINT_CONFIG);
-  const hookPath = (0, import_node_path11.join)(workspaceRoot, ".husky/commit-msg");
-  writeFileEnsured(hookPath, COMMIT_MSG_HOOK);
-  markExecutable(hookPath);
-  onProgress("eslint.config.mjs \u2014 the shared lint AND formatting opinion");
-  writeFileEnsured((0, import_node_path11.join)(workspaceRoot, "eslint.config.mjs"), ESLINT_CONFIG);
-  for (const retired of RETIRED_FORMATTER_FILES) {
-    removeIfPresent((0, import_node_path11.join)(workspaceRoot, retired));
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+function addPythonInternalLib(workspaceRoot, name) {
+  ensurePython(workspaceRoot);
+  ensurePythonPipPlugin(workspaceRoot);
+  ensureRequirementsDev(workspaceRoot);
+  runNx(
+    [
+      "g",
+      "@mnci/nx-python-pip:internal-library",
+      name,
+      `--directory=libs/${name}`,
+      "--no-interactive"
+    ],
+    workspaceRoot
+  );
+  registerProjectCommands(workspaceRoot, name, { build: false });
+}
+var PYTHON_PROJECT_DIRS = ["apps", "python-packages", "libs"];
+function findPythonProjectDirectory(workspaceRoot, name) {
+  return PYTHON_PROJECT_DIRS.find(
+    (directory) => fileExists((0, import_node_path8.join)(workspaceRoot, directory, name, "pyproject.toml"))
+  );
+}
+function parseVendorEntries(pyprojectToml) {
+  const match = /^\s*vendor\s*=\s*\[([^\]]*)\]/m.exec(pyprojectToml);
+  if (!match) {
+    return [];
+  }
+  return match[1].split(",").map((entry) => entry.trim().replaceAll(/^["']|["']$/g, "")).filter(Boolean);
+}
+function addVendorEntry(pyprojectToml, lib) {
+  const existing = parseVendorEntries(pyprojectToml);
+  if (existing.length > 0) {
+    const merged = [...existing, lib].map((name) => `"${name}"`).join(", ");
+    return pyprojectToml.replace(
+      /^(\s*vendor\s*=\s*)\[[^\]]*\]/m,
+      (_match, prefix) => `${prefix}[${merged}]`
+    );
+  }
+  const table = `[tool.mnci-python-pip]
+vendor = ["${lib}"]
+
+`;
+  return pyprojectToml.includes("[tool.pytest.ini_options]") ? pyprojectToml.replace("[tool.pytest.ini_options]", () => `${table}[tool.pytest.ini_options]`) : `${pyprojectToml}
+${table}`;
+}
+async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
+  const lib = options.lib ?? (kindProvided ? void 0 : await promptText("Internal Python library to vendor (an existing libs/<name>)"));
+  if (!lib) {
+    throw new Error(
+      "`add python-vendor` needs the library to vendor: pass --lib <name> (an existing libs/<name> internal library)."
+    );
+  }
+  const consumerDirectory = findPythonProjectDirectory(workspaceRoot, consumer);
+  if (!consumerDirectory) {
+    throw new Error(
+      `No Python project named '${consumer}' with a pyproject.toml found (checked apps/, python-packages/, libs/). A Python function app has no pyproject.toml \u2014 there is nothing to vendor into.`
+    );
+  }
+  if (!fileExists((0, import_node_path8.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
+    throw new Error(
+      `No internal Python library named '${lib}' found at libs/${lib}/pyproject.toml. Only an internal library (added via 'mnci add python-internal-lib') can be vendored.`
+    );
+  }
+  if (consumerDirectory === "libs" && consumer === lib) {
+    throw new Error(`'${consumer}' cannot vendor itself.`);
+  }
+  const pyprojectPath = (0, import_node_path8.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
+  const pyprojectToml = (0, import_node_fs5.readFileSync)(pyprojectPath, "utf8");
+  if (parseVendorEntries(pyprojectToml).includes(lib)) {
+    logger.info(`'${consumer}' already vendors '${lib}' \u2014 nothing to do.`);
+    return;
+  }
+  writeFileEnsured(pyprojectPath, addVendorEntry(pyprojectToml, lib));
+  logger.success(
+    `'${consumer}' now vendors '${lib}' \u2014 its wheel will include '${lib}''s module on the next build.`
+  );
+}
+
+// src/commands/add/reactApp.ts
+var import_node_fs6 = require("fs");
+var import_node_path9 = require("path");
+var REACT_ENVIRONMENTS = ["dev", "uat", "prod"];
+function reactEnvironmentFile(environment) {
+  return `# Vite compiles VITE_-prefixed vars into the '${environment}' bundle at build time.
+# They ship to the browser, so keep only PUBLIC config here \u2014 never secrets.
+VITE_ENVIRONMENT=${environment}
+VITE_API_URL=https://api.${environment}.example.com
+`;
+}
+function reactAppTargets(name) {
+  const targets = {};
+  for (const environment of REACT_ENVIRONMENTS) {
+    targets[`build-${environment}`] = {
+      executor: "nx:run-commands",
+      outputs: [`{workspaceRoot}/apps/${name}/dist-${environment}`],
+      options: {
+        command: `vite build --mode ${environment} --outDir dist-${environment}`,
+        cwd: `apps/${name}`
+      }
+    };
+  }
+  const zipStatements = REACT_ENVIRONMENTS.map(
+    (environment) => `z=new A();z.addLocalFolder('apps/${name}/dist-${environment}');z.writeZip('dist/drop/react-app-${name}-${environment}.zip')`
+  ).join(";");
+  targets.package = {
+    executor: "nx:run-commands",
+    dependsOn: REACT_ENVIRONMENTS.map((environment) => `build-${environment}`),
+    outputs: REACT_ENVIRONMENTS.map(
+      (environment) => `{workspaceRoot}/dist/drop/react-app-${name}-${environment}.zip`
+    ),
+    options: {
+      command: `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');let z;${zipStatements}"`
+    }
+  };
+  return targets;
+}
+function allowEnvFiles(workspaceRoot) {
+  const gitignorePath = (0, import_node_path9.join)(workspaceRoot, ".gitignore");
+  if (!fileExists(gitignorePath)) {
+    return;
   }
-  onProgress(".devcontainer/devcontainer.json \u2014 a local toolchain matching CI");
-  writeFileEnsured(
-    (0, import_node_path11.join)(workspaceRoot, ".devcontainer/devcontainer.json"),
-    devcontainerJson(options.workspaceName)
+  const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
+  const current = (0, import_node_fs6.readFileSync)(gitignorePath, "utf8");
+  if (current.includes(marker)) {
+    return;
+  }
+  const allow = REACT_ENVIRONMENTS.map((environment) => `!apps/*/.env.${environment}`).join("\n");
+  writeFileEnsured(gitignorePath, `${current.replace(/\n*$/, "\n")}
+${marker}
+${allow}
+`);
+}
+function addReactApp(workspaceRoot, name, stack) {
+  ensurePlugin(workspaceRoot, "@nx/react");
+  runNx(
+    [
+      "g",
+      "@nx/react:app",
+      `apps/${name}`,
+      "--bundler=vite",
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--style=css",
+      "--e2eTestRunner=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  removeNxScaffolding(workspaceRoot);
-  onProgress(
-    `${options.workspaceName}.code-workspace \u2014 settings, extensions, launch configs`
+  ensureAdmZip(workspaceRoot);
+  const reactAppRoot = (0, import_node_path9.join)(workspaceRoot, "apps", name);
+  for (const environment of REACT_ENVIRONMENTS) {
+    writeFileEnsured((0, import_node_path9.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+  }
+  allowEnvFiles(workspaceRoot);
+  addNxTargets((0, import_node_path9.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
+}
+
+// src/commands/add/reactLib.ts
+var import_node_path10 = require("path");
+var REACT_LIB_BUNDLER = "rollup";
+async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
+  ensurePlugin(workspaceRoot, "@nx/react");
+  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
+  runNx(
+    [
+      "g",
+      "@nx/react:library",
+      `packages/${name}`,
+      `--name=${name}`,
+      "--publishable",
+      `--importPath=${scope}/${name}`,
+      `--bundler=${REACT_LIB_BUNDLER}`,
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  const codeWorkspacePath = (0, import_node_path11.join)(workspaceRoot, `${options.workspaceName}.code-workspace`);
-  const existing = readCodeWorkspace(codeWorkspacePath);
-  writeFileEnsured(
-    codeWorkspacePath,
-    vscodeWorkspace(
-      options.workspaceName,
-      existing?.tasks,
-      existing?.launch,
-      existing?.settings
-    )
+  const publishableManifest = (0, import_node_path10.join)(workspaceRoot, "packages", name, "package.json");
+  markPublic(publishableManifest);
+  repairPublishableManifest(publishableManifest);
+  removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+function addReactInternalLib(workspaceRoot, name, stack) {
+  ensurePlugin(workspaceRoot, "@nx/react");
+  runNx(
+    [
+      "g",
+      "@nx/react:library",
+      `libs/${name}`,
+      `--name=${name}`,
+      `--bundler=${REACT_LIB_BUNDLER}`,
+      `--unitTestRunner=${stack.testRunner}`,
+      "--linter=none",
+      "--no-interactive"
+    ],
+    workspaceRoot
   );
-  if (options.workspaceName !== "undefined") {
-    (0, import_node_fs6.rmSync)((0, import_node_path11.join)(workspaceRoot, "undefined.code-workspace"), { force: true });
+  const privateManifest = (0, import_node_path10.join)(workspaceRoot, "libs", name, "package.json");
+  markPrivate(privateManifest);
+  repairPublishableManifest(privateManifest);
+  removeGeneratedEslintConfig(workspaceRoot, `libs/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+
+// src/commands/add.ts
+var PROJECT_KINDS = [
+  "react-app",
+  "react-lib",
+  "react-internal-lib",
+  "node-app",
+  "node-function-app",
+  "npm-lib",
+  "internal-lib",
+  "python-app",
+  "python-function-app",
+  "python-lib",
+  "python-internal-lib",
+  "python-vendor",
+  "go-app",
+  "go-function-app",
+  "go-lib",
+  "go-internal-lib",
+  "flutter-app",
+  "flutter-lib",
+  "flutter-internal-lib"
+];
+async function runAdd(kind, name, options) {
+  const workspaceRoot = process.cwd();
+  if (!fileExists((0, import_node_path11.join)(workspaceRoot, "nx.json"))) {
+    throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
-  const publishUrl = pythonPublishUrl(options.registry);
-  if (options.ci === "azure" || options.ci === "both") {
-    onProgress("azure-pipelines.yml \u2014 build, verify, pack and release");
-    writeFileEnsured(
-      (0, import_node_path11.join)(workspaceRoot, "azure-pipelines.yml"),
-      azurePipelinesYaml(options.agent, options.variableGroup, publishUrl, options.registry.kind)
-    );
+  const stack = readWorkspaceStack(workspaceRoot);
+  const kindProvided = kind !== void 0;
+  const resolvedKind = kind ?? await (0, import_prompts5.select)({
+    message: "What kind of project?",
+    choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
+  });
+  const resolvedName = name ?? await promptText("Project name");
+  assertValidProjectName(resolvedName, "Project name");
+  switch (resolvedKind) {
+    case "react-app": {
+      addReactApp(workspaceRoot, resolvedName, stack);
+      break;
+    }
+    case "react-lib": {
+      await addReactLib(workspaceRoot, resolvedName, options, kindProvided, stack);
+      break;
+    }
+    case "react-internal-lib": {
+      addReactInternalLib(workspaceRoot, resolvedName, stack);
+      break;
+    }
+    case "node-app": {
+      addNodeApp(workspaceRoot, resolvedName, stack, options.framework);
+      break;
+    }
+    case "node-function-app": {
+      addNodeFunctionApp(workspaceRoot, resolvedName, stack);
+      break;
+    }
+    case "npm-lib": {
+      await addNpmLib(workspaceRoot, resolvedName, options, kindProvided, stack);
+      break;
+    }
+    case "internal-lib": {
+      runNx(
+        [
+          "g",
+          "@nx/js:lib",
+          `libs/${resolvedName}`,
+          "--bundler=tsc",
+          `--unitTestRunner=${stack.testRunner}`,
+          "--linter=none",
+          "--no-interactive"
+        ],
+        workspaceRoot
+      );
+      markPrivate((0, import_node_path11.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
+      registerProjectCommands(workspaceRoot, resolvedName, { build: true });
+      break;
+    }
+    case "python-app": {
+      addPythonApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "python-function-app": {
+      addPythonFunctionApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "python-lib": {
+      addPythonLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "python-internal-lib": {
+      addPythonInternalLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "go-app": {
+      addGoApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "go-function-app": {
+      addGoFunctionApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "go-lib": {
+      addGoLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "go-internal-lib": {
+      addGoInternalLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "flutter-app": {
+      addFlutterApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "flutter-lib": {
+      addFlutterLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "flutter-internal-lib": {
+      addFlutterInternalLib(workspaceRoot, resolvedName);
+      break;
+    }
+    case "python-vendor": {
+      await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
+      syncProjectReferences(workspaceRoot);
+      runFormatter(workspaceRoot);
+      return;
+    }
+    default: {
+      const exhaustive = resolvedKind;
+      throw new Error(
+        `Unknown project kind '${exhaustive}'. Expected one of: ${PROJECT_KINDS.join(", ")}.`
+      );
+    }
   }
-  if (options.ci === "github" || options.ci === "both") {
-    onProgress(".github/workflows/ci.yml and dependabot.yml");
-    writeFileEnsured(
-      (0, import_node_path11.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
+  syncProjectReferences(workspaceRoot);
+  runFormatter(workspaceRoot);
+  logger.success(`Added ${resolvedKind} '${resolvedName}'.`);
+}
+function syncProjectReferences(workspaceRoot) {
+  logger.step("Syncing TypeScript project references (nx sync)");
+  if (runShell("npx", ["nx", "sync"], workspaceRoot) !== 0) {
+    logger.warn(
+      "nx sync did not complete \u2014 run `npx nx sync` yourself so cross-project imports resolve in your editor."
     );
-    writeFileEnsured((0, import_node_path11.join)(workspaceRoot, ".github/dependabot.yml"), DEPENDABOT_CONFIG);
   }
 }
+function readWorkspaceStack(workspaceRoot) {
+  const nxJson = readJson(
+    (0, import_node_path11.join)(workspaceRoot, "nx.json")
+  );
+  const stack = nxJson.mnci?.stack;
+  return {
+    testRunner: stack?.testRunner === "vitest" ? "vitest" : "jest"
+  };
+}
 
 // src/commands/doctor.ts
+var import_node_fs7 = require("fs");
+var import_node_path12 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix(path) {
   return path.replaceAll("\\", "/");