@mnci/cli 4.0.7 → 4.1.0

package/dist/cli.js

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(cli_exports);
 var import_commander = require("commander");
 
 // src/commands/add.ts
-var import_node_path11 = require("path");
+var import_node_path13 = require("path");
 var import_prompts5 = require("@inquirer/prompts");
 
 // src/nx.ts
@@ -78,6 +78,52 @@ function runShell(command, arguments_, cwd) {
   const result = import_cross_spawn.default.sync(command, arguments_, { stdio: "inherit", cwd });
   return result.status ?? 1;
 }
+var CAPTURE_TIMEOUT_MS = 6e4;
+function runCapture(command, arguments_, cwd) {
+  const result = import_cross_spawn.default.sync(command, arguments_, {
+    cwd,
+    encoding: "utf8",
+    timeout: CAPTURE_TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  if (result.error) {
+    return { status: 1, stdout: "" };
+  }
+  return { status: result.status ?? 1, stdout: result.stdout ?? "" };
+}
+async function runCaptureAsync(command, arguments_, cwd) {
+  return await new Promise((resolve) => {
+    const child = (0, import_cross_spawn.default)(command, arguments_, {
+      cwd,
+      timeout: CAPTURE_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let stdout = "";
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.on("error", () => {
+      resolve({ status: 1, stdout: "" });
+    });
+    child.on("close", (code) => {
+      resolve({ status: code ?? 1, stdout });
+    });
+  });
+}
+async function pool(items, limit, job) {
+  const results = Array.from({ length: items.length });
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const index = next;
+      next += 1;
+      results[index] = await job(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => await worker()));
+  return results;
+}
 function runNx(arguments_, cwd) {
   const status = runShell("npx", ["nx", ...arguments_], cwd);
   if (status !== 0) {
@@ -1343,6 +1389,161 @@ function markPublic(manifestPath) {
 var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
 var ACTUAL_TYPES_PATH = "./dist/src/index.d.ts";
 var DECLARATION_MAP_EXCLUSION = "!**/*.d.ts.map";
+var SOURCE_MAP_EXCLUSION = "!**/*.js.map";
+var ROLLUP_CONFIG_PLACEHOLDER = [
+  "  {",
+  "    // Provide additional rollup configuration here. See: https://rollupjs.org/configuration-options",
+  "    // e.g.",
+  "    // output: { sourcemap: true },",
+  "  }"
+].join("\n");
+var GENERATED_COMPILER = "    compiler: 'swc',";
+var SOURCE_MAP_CAPABLE_COMPILER = [
+  "    // Swapped from swc by MoNecromanCI. @nx/rollup runs swc without",
+  "    // sourceMaps, so it returns no map and the bundle's map comes out empty -",
+  "    // valid-looking, and useless for debugging. See ROADMAP.",
+  "    compiler: 'babel',"
+].join("\n");
+var ROLLUP_ARG_ONE_BOUNDARY = ["  },", "  {", ""].join("\n");
+var ROLLUP_ARG_ONE_WITH_SOURCE_MAPS = [
+  "    // Added by MoNecromanCI: without this rollup emits no .js.map at all, so",
+  "    // a breakpoint in a .ts file can never bind. Not published - see `files`.",
+  "    sourceMap: true",
+  "  },",
+  "  {",
+  ""
+].join("\n");
+function hasRollupSourceMaps(config) {
+  return config.includes("sourceMap: true");
+}
+function withRollupSourceMaps(config) {
+  if (hasRollupSourceMaps(config) || !config.includes(ROLLUP_ARG_ONE_BOUNDARY)) {
+    return config;
+  }
+  const withCompiler = config.replace(GENERATED_COMPILER, () => SOURCE_MAP_CAPABLE_COMPILER);
+  const withFlag = withCompiler.replace(
+    ROLLUP_ARG_ONE_BOUNDARY,
+    () => ROLLUP_ARG_ONE_WITH_SOURCE_MAPS
+  );
+  return withFlag.includes("sourcemapPathTransform") ? withFlag : withFlag.replace(
+    ROLLUP_ARG_ONE_WITH_SOURCE_MAPS,
+    () => `${ROLLUP_ARG_ONE_WITH_SOURCE_MAPS}${SOURCEMAP_PATH_TRANSFORM}`
+  );
+}
+function repairRollupSourceMaps(workspaceRoot) {
+  const changed = [];
+  const configs = (0, import_node_fs3.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+    cwd: workspaceRoot
+  });
+  for (const relativePath of configs) {
+    const configPath = (0, import_node_path3.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs3.readFileSync)(configPath, "utf8");
+    const after = withRollupSourceMaps(before);
+    if (after !== before) {
+      writeFileEnsured(configPath, after);
+      changed.push(relativePath.replaceAll("\\", "/"));
+    }
+  }
+  return changed;
+}
+var SOURCEMAP_PATH_TRANSFORM = [
+  "    // Added by MoNecromanCI. rollup hands sourcemapPathTransform an OS-NATIVE",
+  "    // path with one parent segment too many, so `sources` resolve to nothing",
+  "    // and no breakpoint can bind. Separators are normalised too: a sources",
+  "    // entry is URL-style, so a backslash is wrong on every platform.",
+  "    output: {",
+  "      sourcemapPathTransform: relativeSourcePath =>",
+  "        relativeSourcePath",
+  "          .replaceAll(String.fromCodePoint(92), '/')",
+  "          .replace(/^([.][.][/])+/, '../')",
+  "    },",
+  ""
+].join("\n");
+var ROLLUP_CONFIG_WITH_DTS_FIX = [
+  "  {",
+  "    // Added by MoNecromanCI. @nx/rollup's dts-bundle plugin writes dist/index.d.ts",
+  "    // as a stub re-exporting the real declarations, and builds that specifier with",
+  "    // path.relative() - an OS-NATIVE path. On Windows it emits",
+  String.raw`    //   export * from "./src\\index";`,
+  "    // which is not a valid module specifier on ANY platform: a specifier is",
+  "    // URL-style, so / is correct everywhere and a backslash nowhere. It resolves on",
+  "    // Windows only because the resolver normalises separators there, leaving the",
+  "    // package untyped on Linux and macOS.",
+  "    //",
+  "    // mnci also points `types` past this stub, so nothing depends on it being",
+  "    // correct; this makes the emitted file correct too. Remove once Nx fixes the",
+  "    // plugin - its own devkit already exports normalizePath for exactly this.",
+  "    plugins: [",
+  "      {",
+  "        name: 'mnci-normalise-declaration-specifiers',",
+  "        writeBundle (outputOptions) {",
+  "          const { readFileSync, writeFileSync } = require('node:fs')",
+  "          const { join } = require('node:path')",
+  "          const stub = join(outputOptions.dir ?? './dist', 'index.d.ts')",
+  "          let source",
+  "          try {",
+  "            source = readFileSync(stub, 'utf8')",
+  "          } catch {",
+  "            return",
+  "          }",
+  "          // The stub carries a TWO-character escape (JSON.stringify escaped one",
+  "          // backslash), so this must not match a single one - that would turn",
+  String.raw`          // "./src\index" into "./src//index". Built from char codes so there is`,
+  "          // no escaping in this file to get wrong.",
+  "          const separator = String.fromCodePoint(92, 92)",
+  "          const normalised = source.replaceAll(separator, '/')",
+  "          if (normalised !== source) writeFileSync(stub, normalised)",
+  "        }",
+  "      }",
+  "    ]",
+  "  }"
+].join("\n");
+function repairDeclarationSpecifiers(projectRoot) {
+  const configPath = (0, import_node_path3.join)(projectRoot, "rollup.config.cjs");
+  if (!fileExists(configPath)) {
+    return;
+  }
+  const config = (0, import_node_fs3.readFileSync)(configPath, "utf8");
+  if (!config.includes(ROLLUP_CONFIG_PLACEHOLDER)) {
+    return;
+  }
+  const withDtsFix = config.split(ROLLUP_CONFIG_PLACEHOLDER).join(ROLLUP_CONFIG_WITH_DTS_FIX);
+  writeFileEnsured(configPath, withRollupSourceMaps(withDtsFix));
+}
+function writeProjectReadme(projectRoot, projectName, testRunner) {
+  const runner = testRunner === "vitest" ? "[Vitest](https://vitest.dev)" : "[Jest](https://jestjs.io)";
+  writeFileEnsured(
+    (0, import_node_path3.join)(projectRoot, "README.md"),
+    [
+      `# ${projectName}`,
+      "",
+      "Generated by [MoNecromanCI](https://github.com/russoedu/MoNecromanCi).",
+      "",
+      "## Building",
+      "",
+      `Run \`nx build ${projectName}\` to build this project.`,
+      "",
+      "## Running unit tests",
+      "",
+      `Run \`nx test ${projectName}\` to execute the unit tests via ${runner}.`,
+      ""
+    ].join("\n")
+  );
+}
+function removeStaleGitkeeps(workspaceRoot) {
+  for (const scaffold of ["apps", "libs", "packages"]) {
+    const directory = (0, import_node_path3.join)(workspaceRoot, scaffold);
+    try {
+      const holdsAProject = (0, import_node_fs3.readdirSync)(directory, { withFileTypes: true }).some(
+        (entry) => entry.isDirectory()
+      );
+      if (holdsAProject) {
+        (0, import_node_fs3.rmSync)((0, import_node_path3.join)(directory, ".gitkeep"), { force: true });
+      }
+    } catch {
+    }
+  }
+}
 function repairPublishableManifest(manifestPath) {
   const manifest = readJson(manifestPath);
   if (manifest.types === WRONG_TYPES_PATH) {
@@ -1352,8 +1553,10 @@ function repairPublishableManifest(manifestPath) {
   if (typeof dot === "object" && dot.types === WRONG_TYPES_PATH) {
     dot.types = ACTUAL_TYPES_PATH;
   }
-  if (manifest.files && !manifest.files.includes(DECLARATION_MAP_EXCLUSION)) {
-    manifest.files.push(DECLARATION_MAP_EXCLUSION);
+  for (const exclusion of [DECLARATION_MAP_EXCLUSION, SOURCE_MAP_EXCLUSION]) {
+    if (manifest.files && !manifest.files.includes(exclusion)) {
+      manifest.files.push(exclusion);
+    }
   }
   writeFileEnsured(manifestPath, toJson(manifest));
 }
@@ -1412,6 +1615,7 @@ function projectTask(name, kind) {
   return kind === "start" ? { ...base, isBackground: true } : { ...base, group: kind };
 }
 function registerProjectCommands(workspaceRoot, name, commands) {
+  removeStaleGitkeeps(workspaceRoot);
   const scripts = {
     [`${name}:qa`]: `nx run ${name}:lint && nx run ${name}:test`
   };
@@ -1879,6 +2083,8 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   const manifestPath = (0, import_node_path7.join)(workspaceRoot, "packages", name, "package.json");
   markPublic(manifestPath);
   repairPublishableManifest(manifestPath);
+  repairDeclarationSpecifiers((0, import_node_path7.join)(workspaceRoot, `packages/${name}`));
+  writeProjectReadme((0, import_node_path7.join)(workspaceRoot, `packages/${name}`), `${scope}/${name}`, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
@@ -2207,6 +2413,8 @@ async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
   const publishableManifest = (0, import_node_path10.join)(workspaceRoot, "packages", name, "package.json");
   markPublic(publishableManifest);
   repairPublishableManifest(publishableManifest);
+  repairDeclarationSpecifiers((0, import_node_path10.join)(workspaceRoot, "packages", name));
+  writeProjectReadme((0, import_node_path10.join)(workspaceRoot, "packages", name), `${scope}/${name}`, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
@@ -2228,10 +2436,611 @@ function addReactInternalLib(workspaceRoot, name, stack) {
   const privateManifest = (0, import_node_path10.join)(workspaceRoot, "libs", name, "package.json");
   markPrivate(privateManifest);
   repairPublishableManifest(privateManifest);
+  repairDeclarationSpecifiers((0, import_node_path10.join)(workspaceRoot, "libs", name));
+  writeProjectReadme((0, import_node_path10.join)(workspaceRoot, "libs", name), name, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `libs/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
 
+// src/commands/sync.ts
+var import_node_path12 = require("path");
+
+// src/deps/inventory.ts
+var import_node_fs7 = require("fs");
+var import_node_path11 = require("path");
+var ECOSYSTEMS = ["npm", "pip", "pub", "go"];
+var ROOT_LABEL = "(root)";
+var MANIFEST_GLOBS = {
+  // `libs/*` carries private internal libs; `packages/*` the publishable ones.
+  npm: ["apps/*/package.json", "libs/*/package.json", "packages/*/package.json"],
+  // Matches PYTHON_PROJECT_DIRS in commands/add/python.ts.
+  pip: ["apps/*/pyproject.toml", "python-packages/*/pyproject.toml", "libs/*/pyproject.toml"],
+  pub: ["apps/*/pubspec.yaml", "packages/*/pubspec.yaml", "libs/*/pubspec.yaml"],
+  // Single root module by design — there are no per-project Go manifests.
+  go: []
+};
+var PEER_SECTION = "peerDep";
+var NPM_SECTIONS = {
+  dependencies: "dep",
+  devDependencies: "devDep",
+  peerDependencies: "peerDep",
+  optionalDependencies: "optionalDep"
+};
+function toPosix(path) {
+  return path.replaceAll("\\", "/");
+}
+function projectOf(manifestRelativePath) {
+  const posix = toPosix(manifestRelativePath);
+  const lastSlash = posix.lastIndexOf("/");
+  return lastSlash === -1 ? ROOT_LABEL : posix.slice(0, lastSlash);
+}
+function hasEcosystem(workspaceRoot, ecosystem) {
+  if (ecosystem === "go") {
+    return fileExists((0, import_node_path11.join)(workspaceRoot, "go.mod"));
+  }
+  const rootMarker = {
+    npm: "package.json",
+    pip: "requirements-dev.txt",
+    pub: "pubspec.yaml"
+  };
+  return fileExists((0, import_node_path11.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs7.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+}
+function collectNpm(workspaceRoot) {
+  const sites = [];
+  const relativePaths = ["package.json", ...(0, import_node_fs7.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  for (const relativePath of relativePaths) {
+    const manifestPath = (0, import_node_path11.join)(workspaceRoot, relativePath);
+    try {
+      const manifest = readJson(manifestPath);
+      sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
+    } catch {
+    }
+  }
+  return sites;
+}
+function npmManifestSites(manifest, relativePath, manifestPath) {
+  const sites = [];
+  const project = projectOf(relativePath);
+  for (const [block, section] of Object.entries(NPM_SECTIONS)) {
+    const declared = manifest[block] ?? {};
+    for (const [name, spec] of Object.entries(declared)) {
+      sites.push({
+        name,
+        ecosystem: "npm",
+        project,
+        manifestPath,
+        section,
+        spec,
+        // Two independent reasons to refuse a rewrite. A `file:`/`git+`/
+        // `https:` target, a `workspace:` protocol or npm's `npm:pkg@range`
+        // alias is a shape this cannot safely edit; a peer range is a shape it
+        // could edit and must not (see PEER_SECTION).
+        rewritable: section !== PEER_SECTION && /^[\^~>=<]*\d/.test(spec.trim())
+      });
+    }
+  }
+  return sites;
+}
+function parseRequirement(requirement) {
+  const comment = requirement.indexOf("#");
+  const text = (comment === -1 ? requirement : requirement.slice(0, comment)).trim();
+  if (!text || text.startsWith("-")) {
+    return void 0;
+  }
+  const name = /^[a-z0-9][\w.-]*/i.exec(text)?.[0];
+  if (!name) {
+    return void 0;
+  }
+  const spec = text.slice(name.length).trim();
+  return {
+    name,
+    spec,
+    // Extras, environment markers and compound ranges are reportable only.
+    rewritable: !spec.startsWith("[") && !spec.includes(";") && !spec.includes(",")
+  };
+}
+function collectPip(workspaceRoot) {
+  const sites = [];
+  const push = (relativePath, section, requirement) => {
+    const parsed = parseRequirement(requirement);
+    if (!parsed) {
+      return;
+    }
+    sites.push({
+      name: parsed.name,
+      ecosystem: "pip",
+      project: projectOf(relativePath),
+      manifestPath: (0, import_node_path11.join)(workspaceRoot, relativePath),
+      section,
+      spec: parsed.spec,
+      rewritable: parsed.rewritable && parsed.spec !== ""
+    });
+  };
+  const pyprojectPaths = (0, import_node_fs7.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  for (const relativePath of pyprojectPaths) {
+    let content;
+    try {
+      content = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8");
+    } catch {
+      continue;
+    }
+    const declared = pyprojectDependencies(content);
+    for (const entry of declared) {
+      push(relativePath, "dep", entry);
+    }
+  }
+  const requirementsPaths = [
+    "requirements-dev.txt",
+    ...(0, import_node_fs7.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+  ];
+  for (const relativePath of requirementsPaths) {
+    if (!fileExists((0, import_node_path11.join)(workspaceRoot, relativePath))) {
+      continue;
+    }
+    const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
+    const lines = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    for (const line of lines) {
+      push(relativePath, section, line);
+    }
+  }
+  return sites;
+}
+function pyprojectDependencies(content) {
+  const entries = [];
+  let inProjectTable = false;
+  let inArray = false;
+  for (const line of content.split(/\r?\n/)) {
+    const text = line.trim();
+    if (text.startsWith("[")) {
+      inProjectTable = text === "[project]";
+      inArray = false;
+      continue;
+    }
+    if (!inProjectTable) {
+      continue;
+    }
+    if (!inArray && /^dependencies\s*=\s*\[/.test(text)) {
+      inArray = true;
+    }
+    if (!inArray) {
+      continue;
+    }
+    for (const quoted of text.matchAll(/"([^"]*)"|'([^']*)'/g)) {
+      entries.push(quoted[1] ?? quoted[2]);
+    }
+    if (text.includes("]")) {
+      inArray = false;
+    }
+  }
+  return entries;
+}
+function collectPub(workspaceRoot) {
+  const sites = [];
+  const pubspecPaths = (0, import_node_fs7.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  for (const relativePath of pubspecPaths) {
+    let content;
+    try {
+      content = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8");
+    } catch {
+      continue;
+    }
+    for (const block of ["dependencies", "dev_dependencies"]) {
+      for (const entry of pubspecBlockEntries(content, block)) {
+        sites.push({
+          name: entry.name,
+          ecosystem: "pub",
+          project: projectOf(relativePath),
+          manifestPath: (0, import_node_path11.join)(workspaceRoot, relativePath),
+          section: block === "dependencies" ? "dep" : "devDep",
+          spec: entry.spec,
+          rewritable: entry.spec !== ""
+        });
+      }
+    }
+  }
+  return sites;
+}
+function pubspecBlockEntries(content, block) {
+  const lines = content.split(/\r?\n/);
+  const start = lines.findIndex((line) => line.trimEnd() === `${block}:`);
+  if (start === -1) {
+    return [];
+  }
+  const entries = [];
+  let indent;
+  const body = lines.slice(start + 1);
+  for (const line of body) {
+    if (line.trim() === "" || line.trimStart().startsWith("#")) {
+      continue;
+    }
+    const lineIndent = line.length - line.trimStart().length;
+    if (lineIndent === 0) {
+      break;
+    }
+    indent ??= lineIndent;
+    if (lineIndent > indent) {
+      continue;
+    }
+    if (lineIndent < indent) {
+      break;
+    }
+    const colon = line.indexOf(":");
+    if (colon === -1) {
+      continue;
+    }
+    const key = line.slice(0, colon).trim();
+    if (/^[a-z_][\w-]*$/i.test(key)) {
+      entries.push({ name: key, spec: stripQuotes(line.slice(colon + 1).trim()) });
+    }
+  }
+  return entries;
+}
+function stripQuotes(value) {
+  return /^(['"]).*\1$/.test(value) ? value.slice(1, -1) : value;
+}
+function collectGo(workspaceRoot) {
+  const manifestPath = (0, import_node_path11.join)(workspaceRoot, "go.mod");
+  if (!fileExists(manifestPath)) {
+    return [];
+  }
+  let content;
+  try {
+    content = (0, import_node_fs7.readFileSync)(manifestPath, "utf8");
+  } catch {
+    return [];
+  }
+  const sites = Array.from(content.matchAll(
+    /^\s*(?:require\s+)?([\w.~-]+(?:\/[\w.~-]+)+)\s+(v\S+)(\s*\/\/\s*indirect)?/gm
+  ), (match) => ({
+    name: match[1],
+    ecosystem: "go",
+    project: ROOT_LABEL,
+    manifestPath,
+    section: match[3] ? "indirect" : "module",
+    spec: match[2],
+    rewritable: false
+  }));
+  return sites;
+}
+function collectInventory(workspaceRoot, ecosystems = ECOSYSTEMS) {
+  const readers = {
+    npm: collectNpm,
+    pip: collectPip,
+    pub: collectPub,
+    go: collectGo
+  };
+  const inventory = /* @__PURE__ */ new Map();
+  for (const ecosystem of ecosystems) {
+    if (!hasEcosystem(workspaceRoot, ecosystem)) {
+      continue;
+    }
+    const sites = readers[ecosystem](workspaceRoot);
+    for (const site of sites) {
+      const existing = inventory.get(site.name);
+      if (existing) {
+        existing.push(site);
+      } else {
+        inventory.set(site.name, [site]);
+      }
+    }
+  }
+  return inventory;
+}
+function rewriteSpec(site, spec) {
+  if (!site.rewritable || spec === site.spec) {
+    return false;
+  }
+  const { name } = site;
+  if (site.ecosystem === "npm") {
+    const manifest = readJson(site.manifestPath);
+    const block = Object.entries(NPM_SECTIONS).find(([, label]) => label === site.section)?.[0];
+    if (!block || manifest[block]?.[name] === void 0) {
+      return false;
+    }
+    manifest[block][name] = spec;
+    writeFileEnsured(site.manifestPath, toJson(manifest));
+    return true;
+  }
+  const before = (0, import_node_fs7.readFileSync)(site.manifestPath, "utf8");
+  const after = site.ecosystem === "pip" ? replacePipSpec(before, name, spec) : replacePubSpec(before, name, spec);
+  if (after === before) {
+    return false;
+  }
+  writeFileEnsured(site.manifestPath, after);
+  return true;
+}
+function replacePipSpec(content, name, spec) {
+  const escaped = escapeForRegex(name);
+  return content.replaceAll(
+    new RegExp(String.raw`(^|["'\s])(${escaped})\s*(?:[<>=!~^][^"'\n,]*)?(?=["'\n]|$)`, "gm"),
+    (match, lead, matched) => `${lead}${matched}${spec}`
+  );
+}
+function replacePubSpec(content, name, spec) {
+  return content.replaceAll(
+    new RegExp(String.raw`^(\s+${escapeForRegex(name)}:[^\S\n]*)\S[^\n]*$`, "gm"),
+    (match, lead) => `${lead}${spec}`
+  );
+}
+function escapeForRegex(value) {
+  return value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+}
+function isWorkspaceProject(workspaceRoot, name) {
+  const short = name.includes("/") ? name.split("/").at(-1) : name;
+  return ["apps", "libs", "packages"].some(
+    (directory) => fileExists((0, import_node_path11.join)(workspaceRoot, directory, short ?? name, "package.json"))
+  );
+}
+function isAliasedInstall(workspaceRoot, name) {
+  try {
+    const installed = readJson(
+      (0, import_node_path11.join)(workspaceRoot, "node_modules", name, "package.json")
+    );
+    return installed.name !== void 0 && installed.name !== name;
+  } catch {
+    return false;
+  }
+}
+function resolvedVersion(workspaceRoot, ecosystem, name) {
+  if (ecosystem === "npm") {
+    try {
+      return readJson(
+        (0, import_node_path11.join)(workspaceRoot, "node_modules", name, "package.json")
+      ).version;
+    } catch {
+      return void 0;
+    }
+  }
+  if (ecosystem === "pub") {
+    const lockPath = (0, import_node_path11.join)(workspaceRoot, "pubspec.lock");
+    if (!fileExists(lockPath)) {
+      return void 0;
+    }
+    try {
+      const match = new RegExp(
+        String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
+        "m"
+      ).exec((0, import_node_fs7.readFileSync)(lockPath, "utf8"));
+      return match?.[1];
+    } catch {
+      return void 0;
+    }
+  }
+  if (ecosystem === "pip") {
+    const python = process.platform === "win32" ? "python" : "python3";
+    const result = runCapture(python, ["-m", "pip", "show", name], workspaceRoot);
+    if (result.status !== 0) {
+      return void 0;
+    }
+    return /^Version:\s*(\S+)/m.exec(result.stdout)?.[1];
+  }
+  return void 0;
+}
+
+// src/deps/semver.ts
+var UPDATE_KINDS = ["patch", "minor", "major", "non-semver"];
+var UPDATE_KIND_LABELS = {
+  patch: { title: "Patch Update", blurb: "Backwards-compatible bug fixes." },
+  minor: { title: "Minor Update", blurb: "New backwards-compatible features." },
+  major: { title: "Major Update", blurb: "Potentially breaking API changes. Use caution." },
+  "non-semver": { title: "Non-Semver", blurb: "Versions less than 1.0.0, caution." }
+};
+var RANGE_OPERATORS = [">=", "<=", "^", "~", ">", "<", "="];
+function parseVersion(raw) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([\w.-]+))?/.exec(raw.trim());
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4]
+  };
+}
+function rangeOperator(spec) {
+  const trimmed = spec.trim();
+  return RANGE_OPERATORS.find((operator) => trimmed.startsWith(operator)) ?? "";
+}
+function specVersion(spec) {
+  const bare2 = spec.trim().slice(rangeOperator(spec).length).trim();
+  return /^\d+\.\d+(?:\.\d+)?(?:-[\w.-]+)?$/.test(bare2) ? bare2 : void 0;
+}
+function compareVersions(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b) {
+    return 0;
+  }
+  if (a.major !== b.major) {
+    return a.major - b.major;
+  }
+  if (a.minor !== b.minor) {
+    return a.minor - b.minor;
+  }
+  if (a.patch !== b.patch) {
+    return a.patch - b.patch;
+  }
+  if (a.prerelease === b.prerelease) {
+    return 0;
+  }
+  if (!a.prerelease) {
+    return 1;
+  }
+  if (!b.prerelease) {
+    return -1;
+  }
+  return a.prerelease < b.prerelease ? -1 : 1;
+}
+function isNewer(candidate, current) {
+  return compareVersions(candidate, current) > 0;
+}
+function classify(current, latest) {
+  const from = parseVersion(current);
+  const to = parseVersion(latest);
+  if (!from || !to || from.major === 0) {
+    return "non-semver";
+  }
+  if (from.major !== to.major) {
+    return "major";
+  }
+  return from.minor === to.minor ? "patch" : "minor";
+}
+function highestSpec(specs) {
+  let best;
+  let bestVersion;
+  for (const spec of specs) {
+    const version = specVersion(spec);
+    if (!version) {
+      continue;
+    }
+    if (!bestVersion || isNewer(version, bestVersion)) {
+      best = spec;
+      bestVersion = version;
+    }
+  }
+  return best;
+}
+
+// src/commands/sync.ts
+function resolveEcosystems(requested) {
+  if (!requested) {
+    return ECOSYSTEMS;
+  }
+  const match = ECOSYSTEMS.find((ecosystem) => ecosystem === requested);
+  if (!match) {
+    throw new Error(
+      `Unknown ecosystem '${requested}'. Expected one of: ${ECOSYSTEMS.join(", ")}.`
+    );
+  }
+  return [match];
+}
+function collectDrift(workspaceRoot, ecosystems = ECOSYSTEMS) {
+  const reconcilable = ecosystems.filter((ecosystem) => ecosystem !== "go");
+  const inventory = collectInventory(workspaceRoot, reconcilable);
+  const drift = [];
+  for (const [name, allSites] of inventory) {
+    const sites = allSites.filter((site) => site.section !== PEER_SECTION);
+    if (sites.length < 2 || isWorkspaceLocal(workspaceRoot, sites, name)) {
+      continue;
+    }
+    const distinct = new Set(sites.map((site) => site.spec));
+    if (distinct.size < 2) {
+      continue;
+    }
+    const installed = resolvedVersion(workspaceRoot, sites[0].ecosystem, name);
+    const target = chooseTarget(sites, installed);
+    if (!target) {
+      continue;
+    }
+    const disagreeing = sites.filter((site) => site.spec !== target);
+    drift.push({
+      name,
+      ecosystem: sites[0].ecosystem,
+      target,
+      reason: installed ? "resolved" : "highest",
+      fixable: disagreeing.filter((site) => site.rewritable),
+      blocked: disagreeing.filter((site) => !site.rewritable)
+    });
+  }
+  return drift.toSorted((left, right) => left.name.localeCompare(right.name));
+}
+function isWorkspaceLocal(workspaceRoot, sites, name) {
+  return sites[0].ecosystem === "npm" && isWorkspaceProject(workspaceRoot, name);
+}
+function chooseTarget(sites, installed) {
+  if (!installed) {
+    return highestSpec(sites.map((site) => site.spec));
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const site of sites) {
+    if (!specVersion(site.spec)) {
+      continue;
+    }
+    const operator2 = rangeOperator(site.spec);
+    counts.set(operator2, (counts.get(operator2) ?? 0) + 1);
+  }
+  if (counts.size === 0) {
+    return void 0;
+  }
+  const [operator] = [...counts].toSorted(
+    (left, right) => right[1] - left[1] || (left[0] === "^" ? -1 : 1)
+  )[0];
+  return `${operator}${installed}`;
+}
+function applyDrift(drift) {
+  const changed = /* @__PURE__ */ new Set();
+  for (const finding of drift) {
+    for (const site of finding.fixable) {
+      if (rewriteSpec(site, finding.target)) {
+        changed.add(site.manifestPath);
+      }
+    }
+  }
+  return [...changed];
+}
+function syncProjectReferences(workspaceRoot) {
+  logger.step("Syncing TypeScript project references (nx sync)");
+  if (runShell("npx", ["nx", "sync"], workspaceRoot) !== 0) {
+    logger.warn(
+      "nx sync did not complete \u2014 run `npx nx sync` yourself so cross-project imports resolve in your editor."
+    );
+  }
+}
+function describe(finding) {
+  const sites = [...finding.fixable, ...finding.blocked].map((site) => `${site.project === ROOT_LABEL ? ROOT_LABEL : site.project} ${site.spec}`).join(", ");
+  return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
+}
+function runSync(workspaceRoot, options) {
+  if (!fileExists((0, import_node_path12.join)(workspaceRoot, "nx.json"))) {
+    throw new Error(
+      `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
+    );
+  }
+  const ecosystems = resolveEcosystems(options.ecosystem);
+  for (const ecosystem of ecosystems) {
+    if (!hasEcosystem(workspaceRoot, ecosystem)) {
+      logger.info(`\u2298 SKIPPED ${ecosystem} \u2014 no ${ecosystem} project in this workspace.`);
+    }
+  }
+  if (ecosystems.includes("go") && hasEcosystem(workspaceRoot, "go")) {
+    logger.success("go \u2014 nothing to sync; one root go.mod means one version of every module.");
+  }
+  const drift = collectDrift(workspaceRoot, ecosystems);
+  if (drift.length === 0) {
+    logger.success("Every project agrees on every shared dependency version.");
+  } else {
+    for (const finding of drift) {
+      logger.info(`  ${describe(finding)}`);
+    }
+  }
+  if (options.check) {
+    if (drift.length > 0) {
+      logger.error(
+        `${drift.length} package(s) declared at more than one version. Run 'mnci sync' to converge them.`
+      );
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const changed = applyDrift(drift);
+  for (const path of changed) {
+    logger.detail(`updated ${path}`);
+  }
+  const blocked = drift.flatMap((finding) => finding.blocked);
+  for (const site of blocked) {
+    logger.warn(
+      `${site.name} in ${site.project} is declared as '${site.spec}', which is not a plain version range \u2014 left unchanged.`
+    );
+  }
+  syncProjectReferences(workspaceRoot);
+  if (changed.length > 0) {
+    logger.step("Formatting the changed manifests (eslint --fix)");
+    runFormatter(workspaceRoot);
+  }
+  logger.success("Done. Review the changes with `git diff` before committing.");
+}
+
 // src/commands/add.ts
 var PROJECT_KINDS = [
   "react-app",
@@ -2256,7 +3065,7 @@ var PROJECT_KINDS = [
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path11.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
@@ -2305,7 +3114,7 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path11.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      markPrivate((0, import_node_path13.join)(workspaceRoot, "libs", resolvedName, "package.json"));
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -2371,17 +3180,9 @@ async function runAdd(kind, name, options) {
   runFormatter(workspaceRoot);
   logger.success(`Added ${resolvedKind} '${resolvedName}'.`);
 }
-function syncProjectReferences(workspaceRoot) {
-  logger.step("Syncing TypeScript project references (nx sync)");
-  if (runShell("npx", ["nx", "sync"], workspaceRoot) !== 0) {
-    logger.warn(
-      "nx sync did not complete \u2014 run `npx nx sync` yourself so cross-project imports resolve in your editor."
-    );
-  }
-}
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path11.join)(workspaceRoot, "nx.json")
+    (0, import_node_path13.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -2390,17 +3191,17 @@ function readWorkspaceStack(workspaceRoot) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs7 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path14 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
-function toPosix(path) {
+function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs7.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs7.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs8.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs8.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
-  }).map((config) => toPosix(config));
+  }).map((config) => toPosix2(config));
   return [
     {
       check: "root ESLint config",
@@ -2419,7 +3220,7 @@ function checkEslintConfigs(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path12.join)(workspaceRoot, "package.json")
+      (0, import_node_path14.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -2427,7 +3228,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path12.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path14.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -2453,7 +3254,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path12.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path14.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -2471,11 +3272,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path12.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path14.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs7.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs8.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -2493,12 +3294,12 @@ function checkNpmrc(workspaceRoot, registry, scope) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs7.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs7.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
-  ].map((manifest) => toPosix(manifest));
+    ...(0, import_node_fs8.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs8.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+  ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path12.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path14.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -2527,7 +3328,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path12.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path14.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -2543,9 +3344,9 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs7.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs7.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
-    ].map((manifest) => toPosix(manifest).split("/").slice(0, 2).join("/"))
+      ...(0, import_node_fs8.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs8.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+    ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
     (projectRoot) => declaredTargets(workspaceRoot, projectRoot).flatMap(
@@ -2559,7 +3360,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path12.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path14.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -2580,8 +3381,49 @@ function checkSync(workspaceRoot) {
     remedy: "run `npx nx sync` and commit the result"
   };
 }
+function checkNoRootRuntimeDependencies(workspaceRoot) {
+  const manifestPath = (0, import_node_path14.join)(workspaceRoot, "package.json");
+  if (!fileExists(manifestPath)) {
+    return void 0;
+  }
+  let declared;
+  try {
+    declared = Object.keys(
+      readJson(manifestPath).dependencies ?? {}
+    );
+  } catch {
+    return void 0;
+  }
+  return {
+    check: "no runtime dependencies in the root manifest",
+    ok: declared.length === 0,
+    detail: `the root package.json declares ${declared.join(", ")} \u2014 the root is private and never published, and @nx/rollup externalises only what a project's own manifest declares, so a package importing one of these ships an inlined private copy instead`,
+    remedy: `move ${declared.join(", ")} into the dependencies of each package that imports it (devDependencies at the root are fine \u2014 that is what the root is for)`
+  };
+}
+function checkRollupSourceMaps(workspaceRoot) {
+  const configs = (0, import_node_fs8.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+    cwd: workspaceRoot
+  }).map((config) => toPosix2(config));
+  return configs.flatMap((relativePath) => {
+    let config;
+    try {
+      config = (0, import_node_fs8.readFileSync)((0, import_node_path14.join)(workspaceRoot, relativePath), "utf8");
+    } catch {
+      return [];
+    }
+    return [
+      {
+        check: `source maps enabled in ${relativePath}`,
+        ok: hasRollupSourceMaps(config),
+        detail: "rollup emits no .js.map without it, so a breakpoint in a .ts file can never bind",
+        remedy: "run `mnci upgrade`, which adds it to every rollup config"
+      }
+    ];
+  });
+}
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path12.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path14.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -2594,6 +3436,8 @@ function collectFindings(workspaceRoot) {
     checkEslintPlugin(nxJson),
     checkResolvedEslint(workspaceRoot),
     checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
+    checkNoRootRuntimeDependencies(workspaceRoot),
+    ...checkRollupSourceMaps(workspaceRoot),
     ...checkVersionActions(workspaceRoot),
     ...checkTargetFilesExist(workspaceRoot),
     checkSync(workspaceRoot)
@@ -2621,12 +3465,12 @@ function runDoctor(workspaceRoot) {
 }
 
 // src/commands/interactive.ts
-var import_node_path15 = require("path");
+var import_node_path17 = require("path");
 var import_prompts8 = require("@inquirer/prompts");
 
 // src/commands/new.ts
-var import_node_fs8 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path15 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -2687,7 +3531,7 @@ async function runNew(name, options) {
     ],
     process.cwd()
   );
-  const workspaceRoot = (0, import_node_path13.join)(process.cwd(), workspaceName);
+  const workspaceRoot = (0, import_node_path15.join)(process.cwd(), workspaceName);
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
@@ -2696,8 +3540,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack },
     logger.detail
   );
-  (0, import_node_fs8.rmSync)((0, import_node_path13.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs8.rmSync)((0, import_node_path13.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs9.rmSync)((0, import_node_path15.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs9.rmSync)((0, import_node_path15.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -2727,8 +3571,8 @@ async function runNew(name, options) {
 }
 
 // src/commands/upgrade.ts
-var import_node_fs9 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path16 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -2757,7 +3601,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs9.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs10.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -2765,7 +3609,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path14.basename)(workspaceRoot);
+  return (0, import_node_path16.basename)(workspaceRoot);
 }
 function resolveOverlayOptions(workspaceRoot, options, persisted) {
   const scope = options.scope ?? persisted.scope;
@@ -2803,7 +3647,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path14.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path16.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -2812,6 +3656,13 @@ function runUpgrade(workspaceRoot, options) {
   const resolved = resolveOverlayOptions(workspaceRoot, options, persisted);
   logger.step("Re-applying the MoNecromanCI overlay");
   applyOverlay(workspaceRoot, resolved, logger.detail);
+  const repaired = repairRollupSourceMaps(workspaceRoot);
+  if (repaired.length > 0) {
+    logger.step("Enabling source maps in rollup configs (breakpoints in .ts files)");
+    for (const path of repaired) {
+      logger.detail(`updated ${path}`);
+    }
+  }
   logger.step(
     "Formatting the workspace (eslint --fix) \u2014 the slowest step, minutes on a large workspace"
   );
@@ -2821,7 +3672,7 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/commands/interactive.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path15.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path17.join)(process.cwd(), "nx.json"));
   const choiceNew = { name: "Create a new monorepo", value: "new" };
   const choiceAdd = { name: "Add a project to this workspace", value: "add" };
   const choiceUpgrade = {
@@ -2841,27 +3692,345 @@ async function runInteractive() {
   }
 }
 
+// src/commands/up.ts
+var import_node_path18 = require("path");
+var import_prompts9 = require("@inquirer/prompts");
+
+// src/deps/registry.ts
+var LOOKUP_CONCURRENCY = 8;
+async function latestNpmVersions(names, cwd) {
+  const results = await pool(names, LOOKUP_CONCURRENCY, async (name) => {
+    const result = await runCaptureAsync("npm", ["view", name, "version", "--json"], cwd);
+    if (result.status !== 0) {
+      return;
+    }
+    try {
+      const parsed = JSON.parse(result.stdout);
+      const version = Array.isArray(parsed) ? parsed.at(-1) : parsed;
+      return typeof version === "string" ? [name, version] : void 0;
+    } catch {
+      return;
+    }
+  });
+  return new Map(results.filter((entry) => entry !== void 0));
+}
+async function latestPipVersions(names, cwd) {
+  const python = process.platform === "win32" ? "python" : "python3";
+  const results = await pool(names, LOOKUP_CONCURRENCY, async (name) => {
+    const result = await runCaptureAsync(python, ["-m", "pip", "index", "versions", name], cwd);
+    if (result.status !== 0) {
+      return;
+    }
+    const match = /\(([^)]+)\)/.exec(result.stdout);
+    return match ? [name, match[1]] : void 0;
+  });
+  return new Map(results.filter((entry) => entry !== void 0));
+}
+async function latestGoVersions(cwd) {
+  const result = await runCaptureAsync("go", ["list", "-m", "-u", "-json", "all"], cwd);
+  if (result.status !== 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  const latest = /* @__PURE__ */ new Map();
+  for (const chunk of result.stdout.split(/^\}\s*$/m)) {
+    const text = `${chunk.trim()}${chunk.trim() ? "}" : ""}`;
+    if (!text.startsWith("{")) {
+      continue;
+    }
+    try {
+      const module_ = JSON.parse(text);
+      if (module_.Path && module_.Update?.Version) {
+        latest.set(module_.Path, module_.Update.Version);
+      }
+    } catch {
+    }
+  }
+  return latest;
+}
+async function latestPubVersions(cwd) {
+  const result = await runCaptureAsync("flutter", ["pub", "outdated", "--json"], cwd);
+  if (result.status !== 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  try {
+    const report = JSON.parse(result.stdout);
+    const latest = /* @__PURE__ */ new Map();
+    const packages = report.packages ?? [];
+    for (const entry of packages) {
+      if (entry.package && entry.latest?.version) {
+        latest.set(entry.package, entry.latest.version);
+      }
+    }
+    return latest;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function latestVersions(ecosystem, names, cwd) {
+  switch (ecosystem) {
+    case "npm": {
+      return await latestNpmVersions(names, cwd);
+    }
+    case "pip": {
+      return await latestPipVersions(names, cwd);
+    }
+    case "go": {
+      return await latestGoVersions(cwd);
+    }
+    default: {
+      return await latestPubVersions(cwd);
+    }
+  }
+}
+
+// src/commands/up.ts
+function currentVersion(workspaceRoot, sites) {
+  const installed = resolvedVersion(workspaceRoot, sites[0].ecosystem, sites[0].name);
+  if (installed) {
+    return installed;
+  }
+  if (sites[0].ecosystem === "go") {
+    return bare(sites[0].spec);
+  }
+  const highest = highestSpec(sites.map((site) => site.spec));
+  return highest ? specVersion(highest) : void 0;
+}
+async function collectOutdated(workspaceRoot, ecosystems) {
+  const present = ecosystems.filter((ecosystem) => hasEcosystem(workspaceRoot, ecosystem));
+  const inventory = collectInventory(workspaceRoot, present);
+  const outdated = [];
+  for (const ecosystem of present) {
+    const forEcosystem = [...inventory].filter(
+      ([name, sites]) => offerable(workspaceRoot, ecosystem, name, sites)
+    );
+    const latest = await latestVersions(
+      ecosystem,
+      forEcosystem.map(([name]) => name),
+      workspaceRoot
+    );
+    outdated.push(...upgradable(workspaceRoot, ecosystem, forEcosystem, latest));
+  }
+  return outdated.toSorted(
+    (left, right) => UPDATE_KINDS.indexOf(left.kind) - UPDATE_KINDS.indexOf(right.kind) || left.name.localeCompare(right.name)
+  );
+}
+function offerable(workspaceRoot, ecosystem, name, sites) {
+  if (sites[0].ecosystem !== ecosystem || sites[0].section === "indirect") {
+    return false;
+  }
+  if (sites.every((site) => site.section === PEER_SECTION)) {
+    return false;
+  }
+  if (ecosystem !== "npm") {
+    return true;
+  }
+  return !isWorkspaceProject(workspaceRoot, name) && !isAliasedInstall(workspaceRoot, name);
+}
+function bare(version) {
+  return version.replace(/^v/, "");
+}
+function upgradable(workspaceRoot, ecosystem, declared, latest) {
+  const outdated = [];
+  for (const [name, sites] of declared) {
+    const newest = latest.get(name);
+    const current = currentVersion(workspaceRoot, sites);
+    if (!newest || !current || !isNewer(bare(newest), bare(current))) {
+      continue;
+    }
+    outdated.push({
+      name,
+      ecosystem,
+      current,
+      latest: newest,
+      kind: classify(bare(current), bare(newest)),
+      sites
+    });
+  }
+  return outdated;
+}
+function row(entry, widths) {
+  const sections = [...new Set(entry.sites.map((site) => site.section))].join("/");
+  const projects = [...new Set(entry.sites.map((site) => site.project))].join(", ");
+  return [
+    entry.name.padEnd(widths.name),
+    sections.padEnd(widths.section),
+    `${entry.current.padStart(widths.current)}  \u203A  ${entry.latest}`,
+    projects
+  ].join("  ");
+}
+function columnWidths(entries) {
+  return {
+    name: widthOf(entries.map((entry) => entry.name)),
+    section: widthOf(
+      entries.map((entry) => [...new Set(entry.sites.map((site) => site.section))].join("/"))
+    ),
+    current: widthOf(entries.map((entry) => entry.current))
+  };
+}
+function widthOf(values) {
+  return Math.max(0, ...values.map((value) => value.length));
+}
+function reportOutdated(outdated) {
+  const widths = columnWidths(outdated);
+  for (const kind of UPDATE_KINDS) {
+    const section = outdated.filter((entry) => entry.kind === kind);
+    if (section.length === 0) {
+      continue;
+    }
+    const { title, blurb } = UPDATE_KIND_LABELS[kind];
+    logger.info("");
+    logger.info(`${title}  ${blurb}`);
+    for (const entry of section) {
+      logger.info(`  ${row(entry, widths)}`);
+    }
+  }
+}
+async function promptForUpdates(outdated) {
+  const widths = columnWidths(outdated);
+  const choices = [];
+  for (const kind of UPDATE_KINDS) {
+    const section = outdated.filter((entry) => entry.kind === kind);
+    if (section.length === 0) {
+      continue;
+    }
+    const { title, blurb } = UPDATE_KIND_LABELS[kind];
+    choices.push(new import_prompts9.Separator(`
+${title}  ${blurb}`));
+    for (const entry of section) {
+      choices.push({ name: row(entry, widths), value: entry });
+    }
+  }
+  return await (0, import_prompts9.checkbox)({
+    message: "Choose which packages to update.",
+    choices,
+    pageSize: 20
+  });
+}
+function applyUpdate(entry) {
+  const changed = [];
+  for (const site of entry.sites) {
+    if (!site.rewritable) {
+      continue;
+    }
+    const spec = `${rangeOperator(site.spec)}${entry.latest}`;
+    if (rewriteSpec(site, spec)) {
+      changed.push(site.manifestPath);
+    }
+  }
+  return changed;
+}
+function reinstall(workspaceRoot, ecosystems) {
+  const commands = [
+    ["npm", "npm", ["install"]],
+    ["pip", "npm", ["run", "python:install"]],
+    ["pub", "flutter", ["pub", "get"]],
+    ["go", "go", ["mod", "tidy"]]
+  ];
+  for (const [ecosystem, command, arguments_] of commands) {
+    if (!ecosystems.has(ecosystem)) {
+      continue;
+    }
+    if (ecosystem === "pip" && !hasPythonInstallScript(workspaceRoot)) {
+      logger.warn(
+        "This workspace has no 'python:install' script \u2014 run 'mnci upgrade' to add it, then reinstall by hand."
+      );
+      continue;
+    }
+    logger.step(`Reinstalling ${ecosystem} dependencies (${command} ${arguments_.join(" ")})`);
+    if (runShell(command, arguments_, workspaceRoot) !== 0) {
+      logger.warn(
+        `${command} ${arguments_.join(" ")} failed \u2014 the manifests were updated, so re-run it once the cause is fixed.`
+      );
+    }
+  }
+}
+function hasPythonInstallScript(workspaceRoot) {
+  try {
+    const manifest = readJson(
+      (0, import_node_path18.join)(workspaceRoot, "package.json")
+    );
+    return manifest.scripts?.["python:install"] !== void 0;
+  } catch {
+    return false;
+  }
+}
+function applyGoUpdates(workspaceRoot, entries) {
+  for (const entry of entries) {
+    logger.step(`go get ${entry.name}@${entry.latest}`);
+    if (runShell("go", ["get", `${entry.name}@${entry.latest}`], workspaceRoot) !== 0) {
+      logger.warn(`go get ${entry.name}@${entry.latest} failed \u2014 left at ${entry.current}.`);
+    }
+  }
+}
+async function runUp(workspaceRoot, options) {
+  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
+    throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
+  }
+  const ecosystems = resolveEcosystems(options.ecosystem);
+  for (const ecosystem of ecosystems) {
+    if (!hasEcosystem(workspaceRoot, ecosystem)) {
+      logger.info(`\u2298 SKIPPED ${ecosystem} \u2014 no ${ecosystem} project in this workspace.`);
+    }
+  }
+  logger.step("Querying registries for the latest published versions");
+  const outdated = await collectOutdated(workspaceRoot, ecosystems);
+  if (outdated.length === 0) {
+    logger.success("Every dependency is on its latest published version.");
+    return;
+  }
+  const readOnly = options.check ?? !process.stdout.isTTY;
+  if (readOnly) {
+    reportOutdated(outdated);
+    logger.info("");
+    logger.info(`${outdated.length} package(s) have a newer release. Run 'mnci up' to update them.`);
+    return;
+  }
+  const selected = options.yes ? [...outdated] : await promptForUpdates(outdated);
+  if (selected.length === 0) {
+    logger.info("Nothing selected; no manifest was changed.");
+    return;
+  }
+  const goSelections = selected.filter((entry) => entry.ecosystem === "go");
+  const changed = selected.filter((entry) => entry.ecosystem !== "go").flatMap((entry) => applyUpdate(entry));
+  const changedManifests = new Set(changed);
+  for (const path of changedManifests) {
+    logger.detail(`updated ${path}`);
+  }
+  applyGoUpdates(workspaceRoot, goSelections);
+  if (options.install !== false) {
+    reinstall(workspaceRoot, new Set(selected.map((entry) => entry.ecosystem)));
+  }
+  if (changed.length > 0) {
+    syncProjectReferences(workspaceRoot);
+    logger.step("Formatting the changed manifests (eslint --fix)");
+    runFormatter(workspaceRoot);
+  }
+  logger.success(
+    `Updated ${selected.length} package(s). Review the changes with \`git diff\` before committing.`
+  );
+}
+
 // src/util/versionChecker.ts
-var import_node_fs10 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path19 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
-function checkForUpdate(currentVersion) {
+function checkForUpdate(currentVersion2) {
   try {
     if (!process.stdout.isTTY) {
       return;
     }
     setImmediate(() => {
       try {
-        reportIfOutdated(currentVersion);
+        reportIfOutdated(currentVersion2);
       } catch {
       }
     });
   } catch {
   }
 }
-function reportIfOutdated(currentVersion) {
+function reportIfOutdated(currentVersion2) {
   const result = import_cross_spawn2.default.sync("npm", ["view", PACKAGE_NAME, "version"], {
     encoding: "utf8",
     timeout: REGISTRY_TIMEOUT_MS,
@@ -2871,12 +4040,12 @@ function reportIfOutdated(currentVersion) {
     return;
   }
   const latestVersion = (result.stdout ?? "").trim();
-  if (!latestVersion || !isNewerVersion(latestVersion, currentVersion)) {
+  if (!latestVersion || !isNewerVersion(latestVersion, currentVersion2)) {
     return;
   }
   logger.info("");
   logger.info(`A new version of ${PACKAGE_NAME} is available: ${latestVersion}`);
-  logger.info(`  Current version: ${currentVersion}`);
+  logger.info(`  Current version: ${currentVersion2}`);
   logger.info(`  Update with: npm install -g ${PACKAGE_NAME}@latest`);
   logger.info("");
 }
@@ -2899,8 +4068,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path16.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs10.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path19.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs11.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2930,6 +4099,16 @@ function buildProgram(cliVersion) {
   ).action(() => {
     runDoctor(process.cwd());
   });
+  program.command("sync").description(
+    "Make every project agree: converge external dependency ranges declared at more than one version, then run 'nx sync' for TypeScript project references. Go is a no-op \u2014 one root go.mod means one version of every module"
+  ).option("--check", "report drift and exit non-zero without writing anything").option("--ecosystem <name>", "restrict to one ecosystem: npm | pip | pub | go").action((options) => {
+    runSync(process.cwd(), options);
+  });
+  program.command("up").description(
+    "Show every dependency with a newer published release \u2014 grouped patch/minor/major/non-semver, with the projects declaring each one \u2014 and interactively update the ones you pick"
+  ).option("--check", "report only; never prompt and never write (the default when piped)").option("-y, --yes", "select every available update without prompting").option("--ecosystem <name>", "restrict to one ecosystem: npm | pip | pub | go").option("--no-install", "update the manifests but skip the reinstall step").action(async (options) => {
+    await runUp(process.cwd(), options);
+  });
   program.command("add").addArgument(new import_commander.Argument("[kind]", "project kind").choices(PROJECT_KINDS)).argument("[name]", "project name").description("Add a project by delegating to the matching Nx plugin generator").option("--scope <scope>", "npm scope for a publishable lib (defaults to @<workspace name>)").option(
     "--framework <framework>",
     "node-app only: express | fastify | koa | nest | none (default: none)"