@mnci/cli 4.13.1 → 4.15.0

package/dist/cli.js

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(main_exports);
 var import_commander = require("commander");
 
 // src/project-scaffolding/add-project.use-case.ts
-var import_node_path19 = require("path");
+var import_node_path20 = require("path");
 var import_prompts3 = require("@inquirer/prompts");
 
 // src/nx-workspace/nx.client.ts
@@ -434,11 +434,23 @@ ${feedShortKey}:email=npm-requires-this-and-never-uses-it
 `;
 }
 var VSCODE_EXTENSION_TAG = "type:vscode-extension";
+var GO_RELEASE_TAG = "release:go";
+var GO_CGO_TAG = "build:cgo";
+function hasNativeGoApp(workspaceRoot) {
+  return (0, import_node_fs2.globSync)("apps/*/project.json", { cwd: workspaceRoot }).some((projectJson) => {
+    try {
+      const { tags } = JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path2.join)(workspaceRoot, projectJson), "utf8"));
+      return (tags ?? []).includes(GO_CGO_TAG);
+    } catch {
+      return false;
+    }
+  });
+}
 function releaseConfig(ci) {
   const githubReleases = ci === "github";
   return {
     projectsRelationship: "independent",
-    projects: ["packages/*", "python-packages/*", `tag:${VSCODE_EXTENSION_TAG}`, "!tag:type:go-lib"],
+    projects: ["packages/*", "python-packages/*", `tag:${VSCODE_EXTENSION_TAG}`, `tag:${GO_RELEASE_TAG}`, "!tag:type:go-lib"],
     releaseTag: { pattern: "{projectName}@{version}" },
     git: { commit: false, tag: true, push: githubReleases },
     version: {
@@ -1034,7 +1046,126 @@ var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process
 var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
 var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const major=v=>v.fixAvailable&&typeof v.fixAvailable==='object'&&v.fixAvailable.isSemVerMajor;const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity)&&!major(v));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(!v.fixAvailable?' - NO fix available upstream, nothing to do here':major(v)?' - only a semver-major change would remove it (often a parent downgrade), not applied automatically':' - fix available, below the blocking threshold'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available');console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
 var VERIFY_TARGETS = "lint,typecheck,test,build";
-var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
+function affectedOrAllGuard(exclude = "") {
+  const extra = exclude === "" ? "" : `+' ${exclude}'`;
+  return `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T${extra},{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base${extra},{stdio:'inherit',shell:true}).status ?? 1)"`;
+}
+var AFFECTED_OR_ALL_GUARD = affectedOrAllGuard();
+var AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE = affectedOrAllGuard(`--exclude=tag:${GO_CGO_TAG}`);
+var NATIVE_BUILD_COMMAND = `npx nx run-many -t lint,test,build-native,package-native --projects=tag:${GO_CGO_TAG}`;
+var NATIVE_LINUX_PREREQUISITES = "sudo apt-get update && sudo apt-get install -y gcc pkg-config";
+function githubNativeJob(npmAuthName, npmAuthValue, onMain) {
+  return `
+  # Apps that need a C toolchain (mnci add go-app --cgo) cannot be cross-compiled
+  # from the job above, so each is linted, tested, built and packaged here, on a
+  # runner of every OS it ships for, and is left out of that job's verify step.
+  native:
+    name: native (\${{ matrix.os }})
+    needs: ci
+    runs-on: \${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-latest]
+    steps:
+      - uses: actions/checkout@${ACTION_VERSIONS["actions/checkout"]}
+        with:
+          fetch-depth: 0
+
+      # The release tags name the version a native build is stamped with.
+      - run: git fetch --all --prune --tags
+        name: Fetch branches and release tags
+
+      - uses: actions/setup-node@${ACTION_VERSIONS["actions/setup-node"]}
+        with:
+          node-version: ${NODE_VERSION}
+          cache: npm
+
+      - run: npm install -g npm@${NPM_VERSION}
+        name: Pin npm to the major mnci verifies against
+
+      - run: npm ci
+        name: Install dependencies
+        env:
+          ${npmAuthName}: ${npmAuthValue}
+
+      - run: ${GO_MODULE_DOWNLOAD_GUARD}
+        name: Download Go module dependencies
+
+      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
+        name: Install golangci-lint
+
+      - run: ${GO_TOOL_PATH_GITHUB}
+        name: Add Go tool bin to PATH
+
+      # A C compiler and pkg-config, which is all mnci can know a cgo app needs.
+      # Add the -dev packages your app links to this line, for example
+      # libgtk-3-dev and libayatana-appindicator3-dev for a system-tray icon.
+      # macOS and Windows runners ship their toolchains.
+      - run: ${NATIVE_LINUX_PREREQUISITES}
+        name: Install native prerequisites (Linux)
+        if: \${{ runner.os == 'Linux' }}
+
+      - run: ${NATIVE_BUILD_COMMAND}
+        name: Lint, test, build and package the native apps
+
+      - uses: actions/upload-artifact@${ACTION_VERSIONS["actions/upload-artifact"]}
+        with:
+          name: native-\${{ matrix.os }}
+          path: dist/drop
+          if-no-files-found: ignore
+
+      # A releasable native app (--cgo with --release) gets this OS's zip attached to
+      # the GitHub Release the ci job just created, stamped with the tag's version.
+      - run: node tools/go-app-release.cjs assets --native
+        name: Attach this OS's zip to the GitHub Release (releasable native apps)
+        if: \${{ ${onMain} && hashFiles('tools/go-app-release.cjs') != '' }}
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+`;
+}
+function indentYaml(text, spaces) {
+  const pad = " ".repeat(spaces);
+  return text.split("\n").map((line) => line === "" ? line : pad + line).join("\n");
+}
+function withAzureNativeJob(document, nativeSteps) {
+  const poolAt = document.indexOf("\npool:\n");
+  const variablesAt = document.indexOf("\nvariables:\n");
+  const stepsAt = document.indexOf("\nsteps:\n");
+  if (poolAt === -1 || variablesAt < poolAt || stepsAt < variablesAt) {
+    throw new Error("The Azure pipeline no longer has its pool, variables and steps blocks in that order.");
+  }
+  const head = document.slice(0, poolAt + 1);
+  const pool2 = document.slice(poolAt + "\npool:\n".length, variablesAt).replace(/\n+$/, "");
+  const variables = document.slice(variablesAt + 1, stepsAt).replace(/\n+$/, "");
+  const steps = document.slice(stepsAt + "\nsteps:\n".length).replace(/\n+$/, "");
+  const matrix = Object.entries({ windows: "windows-latest", macos: "macos-latest", linux: "ubuntu-latest" }).map(([leg, image]) => `        ${leg}:
+          legName: ${leg}
+          vmImage: ${image}`).join("\n");
+  return `${head}${variables}
+
+jobs:
+  - job: ci
+    pool:
+${indentYaml(pool2, 4)}
+    steps:
+${indentYaml(steps, 4)}
+
+  # Apps that need a C toolchain (mnci add go-app --cgo) cannot be cross-compiled
+  # from the job above, so each is linted, tested, built and packaged here, on an
+  # agent of every OS it ships for, and is left out of that job's verify step.
+  - job: native
+    displayName: Native apps (cgo)
+    dependsOn: ci
+    strategy:
+      matrix:
+${matrix}
+    pool:
+      vmImage: $(vmImage)
+    steps:
+${indentYaml(nativeSteps, 4)}
+`;
+}
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
 var NPM_AUTH_PREFLIGHT = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(fs.globSync('packages/*/package.json').length===0){console.log('No npm packages to release - skipping.');process.exit(0)}if(!process.env.NODE_AUTH_TOKEN){console.error('NPM_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly NPM_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret. Use an npm Automation token - a Publish token is refused by 2FA in CI.');process.exit(1)}const r=cp.spawnSync('npm',['whoami','--registry=https://registry.npmjs.org/'],{encoding:'utf8',shell:process.platform==='win32'});if(r.status!==0){console.error('NPM_TOKEN is set but the registry rejected it - '+((r.stderr||'')+(r.stdout||'')).trim()+'. Check that it has not expired and that it grants publish rights on this scope.');process.exit(1)}console.log('npm auth OK as '+r.stdout.trim())"`;
 function npmAuthPreflight(registryKind) {
@@ -1046,7 +1177,7 @@ function pypiReleasePreflight(registryKind) {
 }
 var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
-  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const vscodeCount=fs.globSync('apps/*/package.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).nx?.tags||[]).includes('${VSCODE_EXTENSION_TAG}')}catch{return false}}).length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;const hasVscode=vscodeCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart&&!hasVscode){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount+vscodeCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const vscodeCount=fs.globSync('apps/*/package.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).nx?.tags||[]).includes('${VSCODE_EXTENSION_TAG}')}catch{return false}}).length;const goCount=fs.globSync('apps/*/project.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).tags||[]).includes('${GO_RELEASE_TAG}')}catch{return false}}).length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;const hasVscode=vscodeCount>0;const hasGo=goCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart&&!hasVscode&&!hasGo){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount+vscodeCount+goCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
 var AZURE_PAT_VARIABLE = "PAT";
@@ -1075,7 +1206,7 @@ function npmAuthEnvVariable(registryKind, variableReference) {
 function poolBlock(agent) {
   return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
 }
-function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts", nugetFeedUrl2, npmAuth = "pat") {
+function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts", nugetFeedUrl2, npmAuth = "pat", nativeApps = false) {
   const onMain = "and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI'), eq(variables['Build.SourceBranchName'], 'main'))";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(registryKind, (name) => `$(${name})`);
   const buildIdentity = npmAuth === "build-identity" && registryKind === "azure-artifacts";
@@ -1093,7 +1224,7 @@ function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKin
   const npmCiEnv = buildIdentity ? "" : `
     env:
       ${npmAuthName}: ${npmAuthValue}`;
-  return `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
+  const document = `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
 
 # Generated by MoNecromanCI. Deliberately thin: Nx builds, 'nx release'
 # versions from conventional commits and pushes ONLY a tag to main, and each
@@ -1304,7 +1435,7 @@ ${npmAuthenticateStep}  - script: npm ci
   # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
   # below, so adding it back as its own step would only duplicate work \u2014 and on
   # a pull request it would re-lint every project, discarding the point of this.
-  - script: ${AFFECTED_OR_ALL_GUARD}
+  - script: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
     displayName: Verify (affected on a PR, every project on main)
 
   # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
@@ -1395,8 +1526,56 @@ ${npmAuthPreflight(registryKind) ? `
     displayName: Push release tags (nx release's own push never runs without a remote Release configured)
     condition: ${onMain}
 `;
+  if (!nativeApps) {
+    return document;
+  }
+  const nativeSteps = `  - checkout: self
+    fetchDepth: 0
+
+  - task: UseNode@1
+    inputs:
+      version: 24.x
+
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
+${npmAuthenticateStep}  - script: npm ci
+    displayName: Install dependencies${npmCiEnv}
+
+  - script: ${GO_MODULE_DOWNLOAD_GUARD}
+    displayName: Download Go module dependencies
+
+  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
+    displayName: Install golangci-lint
+
+  - script: ${GO_TOOL_PATH_AZURE}
+    displayName: Add Go tool bin to PATH
+
+  # A C compiler and pkg-config, which is all mnci can know a cgo app needs. Add the
+  # -dev packages your app links to this line, for example libgtk-3-dev and
+  # libayatana-appindicator3-dev for a system-tray icon. macOS and Windows agents
+  # ship their toolchains.
+  - script: ${NATIVE_LINUX_PREREQUISITES}
+    displayName: Install native prerequisites (Linux)
+    condition: eq(variables['Agent.OS'], 'Linux')
+
+  - script: ${NATIVE_BUILD_COMMAND}
+    displayName: Lint, test, build and package the native apps
+
+  - task: PublishBuildArtifacts@1
+    displayName: Publish this OS's native zips
+    inputs:
+      PathtoPublish: $(Build.SourcesDirectory)/dist/drop
+      ArtifactName: native-$(legName)
+`;
+  return withAzureNativeJob(document, nativeSteps);
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github", nugetFeedUrl2) {
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github", nugetFeedUrl2, nativeApps = false) {
   const onMain = "github.event_name == 'push' && github.ref_name == 'main'";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
     registryKind,
@@ -1565,7 +1744,7 @@ jobs:
       # below, so adding it back as its own step would only duplicate work \u2014 and
       # on a pull request it would re-lint every project, discarding the point
       # of this.
-      - run: ${AFFECTED_OR_ALL_GUARD}
+      - run: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
         name: Verify (affected on a PR, every project on main)
 
       # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
@@ -1667,7 +1846,18 @@ ${npmAuthPreflight(registryKind) ? `
           VSCE_AUTH: \${{ vars.AZURE_CLIENT_ID != '' && 'entra' || '' }}
           VSCE_PAT: \${{ secrets.VSCE_PAT }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
-${githubReleases ? "" : `
+${githubReleases ? `
+      # A releasable Go app (mnci add go-app --release) is versioned by its git
+      # tag, and its per-platform zips are attached to the GitHub Release the step
+      # above just created. Built here, after tagging, with VERSION set to the tag's
+      # version so the binary reports it. A run that released no Go app uploads
+      # nothing, and a workspace without one skips the step.
+      - run: node tools/go-app-release.cjs assets
+        name: Attach the per-platform zips to the GitHub Release (releasable Go apps)
+        if: \${{ ${onMain} && hashFiles('tools/go-app-release.cjs') != '' }}
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+` : `
       # nx release's own git push (release.git.push) is deliberately left off: it
       # only runs when a remote GitHub/GitLab Release is configured, which this
       # workflow never does, so it would never push the tag the step above just
@@ -1676,7 +1866,7 @@ ${githubReleases ? "" : `
       - run: git push origin --tags
         name: Push release tags (nx release's own push never runs without a remote Release configured)
         if: \${{ ${onMain} }}
-`}`;
+`}${nativeApps ? githubNativeJob(npmAuthName, npmAuthValue, onMain) : ""}`;
 }
 var PIP_PROJECT_GLOBS = ["apps", "python-packages", "libs"];
 var PUB_PROJECT_GLOBS = ["apps", "packages", "libs"];
@@ -1993,6 +2183,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
   }
   const publishUrl = pythonPublishUrl(options.registry);
   const nugetUrl = nugetFeedUrl(options.registry);
+  const nativeApps = hasNativeGoApp(workspaceRoot);
   if (options.ci === "azure" || options.ci === "both") {
     onProgress("azure-pipelines.yml \u2014 build, verify, pack and release");
     writeFileEnsured(
@@ -2003,7 +2194,8 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
         publishUrl,
         options.registry.kind,
         nugetUrl,
-        options.npmAuth
+        options.npmAuth,
+        nativeApps
       )
     );
   }
@@ -2011,7 +2203,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
     onProgress(".github/workflows/ci.yml and dependabot.yml");
     writeFileEnsured(
       (0, import_node_path2.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci, nugetUrl)
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci, nugetUrl, nativeApps)
     );
     writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ".github/dependabot.yml"), dependabotConfig(workspaceRoot));
   }
@@ -2605,8 +2797,181 @@ function addFlutterInternalLib(workspaceRoot, name) {
 }
 
 // src/project-scaffolding/go.use-case.ts
+var import_node_fs6 = require("fs");
+var import_node_path7 = require("path");
+
+// src/project-scaffolding/go-release.use-case.ts
 var import_node_fs5 = require("fs");
 var import_node_path6 = require("path");
+var GO_RELEASE_SCRIPT_PATH = "tools/go-app-release.cjs";
+var GO_RELEASE_SCRIPT = String.raw`#!/usr/bin/env node
+// Written by mnci: 'mnci add go-app --release' creates it and 'mnci upgrade'
+// rewrites it, so local edits do not survive an upgrade.
+//
+// A releasable Go app (tag release:go) is versioned from its git tag, with no
+// manifest, and its per-platform zips are attached to its GitHub Release:
+//   release.version.versionActions   this file, loaded by 'nx release'
+//   node tools/go-app-release.cjs assets            the apps built for all six platforms
+//   node tools/go-app-release.cjs assets --native   the apps that need a C toolchain, this OS only
+'use strict'
+const { spawnSync } = require('node:child_process')
+const { existsSync, readdirSync, readFileSync } = require('node:fs')
+const { dirname, join } = require('node:path')
+const { VersionActions } = require('nx/release')
+
+const FIRST_RELEASE_BASE = '0.0.0'
+
+class GoAppVersionActions extends VersionActions {
+  validManifestFilenames = null
+
+  async validate () {
+    // Nothing on disk to check: there is no manifest.
+  }
+
+  async readCurrentVersionFromSourceManifest () {
+    // Reached only as the fallback of the git-tag resolver, i.e. before the first tag.
+    return { currentVersion: FIRST_RELEASE_BASE, manifestPath: 'none (a Go app is versioned by its git tag)' }
+  }
+
+  async readCurrentVersionFromRegistry () {
+    return null
+  }
+
+  async readCurrentVersionOfDependency () {
+    return { currentVersion: null, dependencyCollection: null }
+  }
+
+  async updateProjectVersion () {
+    return []
+  }
+
+  async updateProjectDependencies () {
+    return []
+  }
+}
+
+module.exports = GoAppVersionActions
+
+function fail (message) {
+  console.error(message)
+  process.exit(1)
+}
+
+function run (command, args, env) {
+  const result = spawnSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'], env: { ...process.env, ...env }, shell: false })
+  if (result.status !== 0) fail(command + ' ' + args.join(' ') + ' failed (exit ' + result.status + ')')
+
+  return result.stdout
+}
+
+function nx (args, env) {
+  const manifest = require.resolve('nx/package.json')
+  const bin = require(manifest).bin
+  const entry = typeof bin === 'string' ? bin : bin.nx
+
+  return run(process.execPath, [join(dirname(manifest), entry), ...args], env)
+}
+
+function releasableApps (native) {
+  const names = existsSync('apps') ? readdirSync('apps') : []
+
+  return names.filter(name => {
+    try {
+      const tags = JSON.parse(readFileSync(join('apps', name, 'project.json'), 'utf8')).tags || []
+
+      return tags.includes('release:go') && tags.includes('build:cgo') === native
+    } catch {
+      return false
+    }
+  })
+}
+
+function attachAssets (native) {
+  const apps = releasableApps(native)
+  if (apps.length === 0) {
+    console.log('No releasable ' + (native ? 'native ' : '') + 'Go app - nothing to attach.')
+
+    return
+  }
+  const target = native ? 'package-native' : 'package-all'
+  const tags = run('git', ['tag', '--points-at', 'HEAD']).split(/\r?\n/).filter(Boolean)
+  let attached = 0
+  for (const app of apps) {
+    const tag = tags.find(each => each.startsWith(app + '@'))
+    if (!tag) {
+      console.log(app + ': not released by this run - skipping.')
+      continue
+    }
+    const version = tag.slice(app.length + 1)
+    console.log(app + ': ' + (native ? 'building for this OS' : 'building the six platforms') + ' as ' + version)
+    nx(['run', app + ':' + target], { VERSION: version })
+    const prefix = 'go-app-' + app + '-'
+    const zips = existsSync('dist/drop') ? readdirSync('dist/drop').filter(each => each.startsWith(prefix) && each.endsWith('.zip')) : []
+    if (zips.length === 0) fail(app + ': ' + target + ' produced no ' + prefix + '*.zip in dist/drop.')
+    const upload = spawnSync('gh', ['release', 'upload', tag, ...zips.map(each => join('dist/drop', each)), '--clobber'], { stdio: 'inherit', shell: process.platform === 'win32' })
+    if (upload.status !== 0) fail(app + ': could not attach the zips to the ' + tag + ' release (exit ' + upload.status + ').')
+    console.log(app + ': attached ' + zips.length + ' zips to ' + tag)
+    attached += 1
+  }
+  console.log(attached + ' release(s) carry their platform zips.')
+}
+
+if (require.main === module) {
+  if (process.argv[2] !== 'assets' || (process.argv[3] !== undefined && process.argv[3] !== '--native')) fail('Usage: node tools/go-app-release.cjs assets [--native]')
+  attachAssets(process.argv[3] === '--native')
+}
+`;
+var GO_RELEASE_PUBLISH_TARGET = {
+  executor: "nx:run-commands",
+  options: {
+    command: `node -e "console.log('Published by its git tag; the platform zips are attached to the GitHub Release by tools/go-app-release.cjs assets.')"`
+  }
+};
+function makeGoAppReleasable(workspaceRoot, name) {
+  const projectJsonPath = (0, import_node_path6.join)(workspaceRoot, "apps", name, "project.json");
+  if (!fileExists(projectJsonPath)) {
+    throw new Error(`No Go app at apps/${name}: cannot make it releasable.`);
+  }
+  const project = readJson(projectJsonPath);
+  writeFileEnsured(
+    projectJsonPath,
+    toJson({
+      ...project,
+      tags: [.../* @__PURE__ */ new Set([...project.tags ?? [], GO_RELEASE_TAG])],
+      targets: { ...project.targets, "nx-release-publish": project.targets?.["nx-release-publish"] ?? GO_RELEASE_PUBLISH_TARGET },
+      release: {
+        ...project.release,
+        version: {
+          ...project.release?.version,
+          versionActions: GO_RELEASE_SCRIPT_PATH,
+          currentVersionResolver: "git-tag"
+        }
+      }
+    })
+  );
+  writeFileEnsured((0, import_node_path6.join)(workspaceRoot, GO_RELEASE_SCRIPT_PATH), GO_RELEASE_SCRIPT);
+}
+function refreshGoReleaseScript(workspaceRoot) {
+  const apps = (0, import_node_path6.join)(workspaceRoot, "apps");
+  let entries;
+  try {
+    entries = (0, import_node_fs5.readdirSync)(apps);
+  } catch {
+    return false;
+  }
+  const hasReleasableApp = entries.some((entry) => {
+    const projectJsonPath = (0, import_node_path6.join)(apps, entry, "project.json");
+    return fileExists(projectJsonPath) && (readJson(projectJsonPath).tags ?? []).includes(GO_RELEASE_TAG);
+  });
+  const path = (0, import_node_path6.join)(workspaceRoot, GO_RELEASE_SCRIPT_PATH);
+  if (!hasReleasableApp || fileExists(path) && (0, import_node_fs5.readFileSync)(path, "utf8") === GO_RELEASE_SCRIPT) {
+    return false;
+  }
+  writeFileEnsured(path, GO_RELEASE_SCRIPT);
+  return true;
+}
+
+// src/project-scaffolding/go.use-case.ts
 function ensureGo(workspaceRoot) {
   if (runShell("go", ["version"], workspaceRoot) !== 0) {
     throw new Error("Go not found. Install Go 1.21+ first: https://go.dev/dl/");
@@ -2633,7 +2998,7 @@ function ensureNxGoPlugin(workspaceRoot) {
   }
 }
 function ensureGoModule(workspaceRoot) {
-  if (fileExists((0, import_node_path6.join)(workspaceRoot, "go.mod"))) {
+  if (fileExists((0, import_node_path7.join)(workspaceRoot, "go.mod"))) {
     return;
   }
   logger.step("Bootstrapping the workspace Go module (single root go.mod)");
@@ -2642,7 +3007,7 @@ function ensureGoModule(workspaceRoot) {
 }
 function goModulePath(workspaceRoot) {
   try {
-    const contents = (0, import_node_fs5.readFileSync)((0, import_node_path6.join)(workspaceRoot, "go.mod"), "utf8");
+    const contents = (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(workspaceRoot, "go.mod"), "utf8");
     return /^module\s+(\S+)/m.exec(contents)?.[1];
   } catch {
     return void 0;
@@ -2702,20 +3067,39 @@ function goPackageAllTarget(tag, name) {
     options: { command }
   };
 }
+var GO_HOST_PLATFORM = "const host=k=>spawnSync('go',['env',k],{encoding:'utf8'}).stdout.trim();const os=host('GOOS'),arch=host('GOARCH');";
+function goNativeBuildTarget(name) {
+  const command = `node -e "const{spawnSync}=require('node:child_process');${GO_HOST_PLATFORM}const v=process.env.VERSION||'dev';const out='../../dist/platforms/${name}/'+os+'-'+arch+'/${name}'+(os==='windows'?'.exe':'');const r=spawnSync('go',['build','-trimpath','-ldflags','-s -w -X main.version='+v,'-o',out,'.'],{cwd:'apps/${name}',stdio:'inherit',env:{...process.env,CGO_ENABLED:'1'}});process.exit(r.status??1)"`;
+  return {
+    executor: "nx:run-commands",
+    inputs: ["default", "^default", "{workspaceRoot}/go.mod", "{workspaceRoot}/go.sum", { env: "VERSION" }],
+    outputs: [`{workspaceRoot}/dist/platforms/${name}`],
+    options: { command }
+  };
+}
+function goNativePackageTarget(name) {
+  const command = `node -e "const fs=require('node:fs');const{spawnSync}=require('node:child_process');const A=require('adm-zip');${GO_HOST_PLATFORM}const d=os+'-'+arch;fs.mkdirSync('dist/drop',{recursive:true});const z=new A();z.addLocalFolder('dist/platforms/${name}/'+d);z.writeZip('dist/drop/go-app-${name}-'+d+'.zip')"`;
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build-native"],
+    outputs: [`{workspaceRoot}/dist/drop/go-app-${name}-*.zip`],
+    options: { command }
+  };
+}
 function addGoPlatformTargets(workspaceRoot) {
   const changed = [];
-  const apps = (0, import_node_path6.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path7.join)(workspaceRoot, "apps");
   if (!fileExists(apps)) {
     return changed;
   }
-  for (const name of (0, import_node_fs5.readdirSync)(apps)) {
-    const projectJsonPath = (0, import_node_path6.join)(apps, name, "project.json");
+  for (const name of (0, import_node_fs6.readdirSync)(apps)) {
+    const projectJsonPath = (0, import_node_path7.join)(apps, name, "project.json");
     if (!fileExists(projectJsonPath)) {
       continue;
     }
-    const project = JSON.parse((0, import_node_fs5.readFileSync)(projectJsonPath, "utf8"));
+    const project = JSON.parse((0, import_node_fs6.readFileSync)(projectJsonPath, "utf8"));
     const tag = (project.tags ?? []).find((each) => each === "type:go-app" || each === "type:go-function-app")?.slice("type:".length);
-    if (tag === void 0) {
+    if (tag === void 0 || (project.tags ?? []).includes(GO_CGO_TAG)) {
       continue;
     }
     const missing = {};
@@ -2749,8 +3133,8 @@ function goLibraryIdentifiers(projectName) {
 }
 function reshapeGoLibraryScaffold(projectRoot, projectName) {
   const { packageName, functionName, fileStem } = goLibraryIdentifiers(projectName);
-  (0, import_node_fs5.rmSync)((0, import_node_path6.join)(projectRoot, `${projectName}.go`), { force: true });
-  (0, import_node_fs5.rmSync)((0, import_node_path6.join)(projectRoot, `${projectName}_test.go`), { force: true });
+  (0, import_node_fs6.rmSync)((0, import_node_path7.join)(projectRoot, `${projectName}.go`), { force: true });
+  (0, import_node_fs6.rmSync)((0, import_node_path7.join)(projectRoot, `${projectName}_test.go`), { force: true });
   const files = [
     [
       "doc.go",
@@ -2760,14 +3144,14 @@ package ${packageName}
 `
     ],
     [
-      (0, import_node_path6.join)(packageName, "doc.go"),
+      (0, import_node_path7.join)(packageName, "doc.go"),
       `// Package ${packageName} is the starter slice of ${projectName}: rename it after
 // the outcome it delivers, and add one package per further outcome.
 package ${packageName}
 `
     ],
     [
-      (0, import_node_path6.join)(packageName, `${fileStem}_use_case.go`),
+      (0, import_node_path7.join)(packageName, `${fileStem}_use_case.go`),
       `package ${packageName}
 
 // ${functionName} is the generator's sample behaviour, kept so the slice builds and tests.
@@ -2777,7 +3161,7 @@ func ${functionName}(name string) string {
 `
     ],
     [
-      (0, import_node_path6.join)(packageName, `${fileStem}_use_case_test.go`),
+      (0, import_node_path7.join)(packageName, `${fileStem}_use_case_test.go`),
       `package ${packageName}
 
 import "testing"
@@ -2791,7 +3175,7 @@ func Test${functionName}(t *testing.T) {
     ]
   ];
   for (const [relativePath, content] of files) {
-    const path = (0, import_node_path6.join)(projectRoot, relativePath);
+    const path = (0, import_node_path7.join)(projectRoot, relativePath);
     if (!fileExists(path)) {
       writeFileEnsured(path, content);
     }
@@ -2804,7 +3188,8 @@ function prepareGo(workspaceRoot) {
   ensureNxGoPlugin(workspaceRoot);
   ensureGoModule(workspaceRoot);
 }
-function addGoApp(workspaceRoot, name) {
+function addGoApp(workspaceRoot, name, options = {}) {
+  const cgo = options.cgo === true;
   prepareGo(workspaceRoot);
   ensureAdmZip(workspaceRoot);
   runNx(
@@ -2813,21 +3198,31 @@ function addGoApp(workspaceRoot, name) {
       "@nx-go/nx-go:application",
       `apps/${name}`,
       `--name=${name}`,
-      "--tags=type:go-app",
+      cgo ? `--tags=type:go-app,${GO_CGO_TAG}` : "--tags=type:go-app",
       "--no-interactive"
     ],
     workspaceRoot
   );
-  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "project.json"), {
-    "build": goBuildTarget(name),
-    "test": goTestTarget(),
-    "lint": goLintTarget(),
-    "package": goPackageTarget("go-app", name),
-    "build-all": goBuildAllTarget(name),
-    "package-all": goPackageAllTarget("go-app", name),
-    "start": goStartTarget(name)
+  addProjectJsonTargets((0, import_node_path7.join)(workspaceRoot, "apps", name, "project.json"), {
+    build: goBuildTarget(name),
+    test: goTestTarget(),
+    lint: goLintTarget(),
+    ...cgo ? { "build-native": goNativeBuildTarget(name), "package-native": goNativePackageTarget(name) } : {
+      "package": goPackageTarget("go-app", name),
+      "build-all": goBuildAllTarget(name),
+      "package-all": goPackageAllTarget("go-app", name)
+    },
+    start: goStartTarget(name)
   });
+  if (options.release === true) {
+    makeGoAppReleasable(workspaceRoot, name);
+  }
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+  if (cgo) {
+    logger.warn(
+      `${name} needs a C toolchain, so CI builds it on a runner of each OS. Run \`mnci upgrade\` to add the native job to your pipeline, and add the -dev packages it links to the Linux prerequisites step.`
+    );
+  }
 }
 function addGoFunctionApp(workspaceRoot, name) {
   prepareGo(workspaceRoot);
@@ -2843,7 +3238,7 @@ function addGoFunctionApp(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path7.join)(workspaceRoot, "apps", name, "project.json"), {
     "build": goBuildTarget(name),
     "test": goTestTarget(),
     "lint": goLintTarget(),
@@ -2866,11 +3261,11 @@ function addGoLib(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "packages", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path7.join)(workspaceRoot, "packages", name, "project.json"), {
     test: goTestTarget(),
     lint: goLintTarget()
   });
-  const slice = reshapeGoLibraryScaffold((0, import_node_path6.join)(workspaceRoot, "packages", name), name);
+  const slice = reshapeGoLibraryScaffold((0, import_node_path7.join)(workspaceRoot, "packages", name), name);
   registerProjectCommands(workspaceRoot, name, { build: false });
   const module2 = goModulePath(workspaceRoot);
   if (module2) {
@@ -2890,11 +3285,11 @@ function addGoInternalLib(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "libs", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path7.join)(workspaceRoot, "libs", name, "project.json"), {
     test: goTestTarget(),
     lint: goLintTarget()
   });
-  const slice = reshapeGoLibraryScaffold((0, import_node_path6.join)(workspaceRoot, "libs", name), name);
+  const slice = reshapeGoLibraryScaffold((0, import_node_path7.join)(workspaceRoot, "libs", name), name);
   registerProjectCommands(workspaceRoot, name, { build: false });
   const module2 = goModulePath(workspaceRoot);
   if (module2) {
@@ -2903,7 +3298,7 @@ function addGoInternalLib(workspaceRoot, name) {
 }
 
 // src/project-scaffolding/node.use-case.ts
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 function ensurePlugin2(workspaceRoot, packageName) {
   if (hasPlugin(workspaceRoot, packageName)) {
     return;
@@ -2927,12 +3322,12 @@ function runNodeApp(workspaceRoot, name, stack, framework) {
     ],
     workspaceRoot
   );
-  const appRoot = (0, import_node_path7.join)(workspaceRoot, "apps", name);
+  const appRoot = (0, import_node_path8.join)(workspaceRoot, "apps", name);
   separateDeclarationOutput(appRoot);
   repairAssetMapping(appRoot, name);
 }
 function separateDeclarationOutput(appRoot) {
-  const tsconfigPath = (0, import_node_path7.join)(appRoot, "tsconfig.app.json");
+  const tsconfigPath = (0, import_node_path8.join)(appRoot, "tsconfig.app.json");
   if (!fileExists(tsconfigPath)) {
     return;
   }
@@ -2954,7 +3349,7 @@ function separateDeclarationOutput(appRoot) {
   );
 }
 function repairAssetMapping(appRoot, name) {
-  const manifestPath = (0, import_node_path7.join)(appRoot, "package.json");
+  const manifestPath = (0, import_node_path8.join)(appRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return;
   }
@@ -2981,7 +3376,7 @@ function nodeAppPackageTarget(name) {
 function addNodeApp(workspaceRoot, name, stack, framework = "none") {
   runNodeApp(workspaceRoot, name, stack, framework);
   ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path7.join)(workspaceRoot, "apps", name, "package.json"), {
+  addNxTargets((0, import_node_path8.join)(workspaceRoot, "apps", name, "package.json"), {
     package: nodeAppPackageTarget(name)
   });
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
@@ -3037,10 +3432,10 @@ describe('buildGreeting', () => {
 })
 `;
 function repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot) {
-  const manifestPath = (0, import_node_path7.join)(nodeFunctionAppRoot, "package.json");
+  const manifestPath = (0, import_node_path8.join)(nodeFunctionAppRoot, "package.json");
   const manifest = readJson(manifestPath);
   const azureFunctionsVersion = readJson(
-    (0, import_node_path7.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
+    (0, import_node_path8.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
   ).version;
   const dependencies = manifest.dependencies ?? {};
   writeFileEnsured(
@@ -3083,21 +3478,21 @@ function nodeFunctionAppStartTarget(name) {
 function addNodeFunctionApp(workspaceRoot, name, stack) {
   runNodeApp(workspaceRoot, name, stack, "none");
   ensureAzureFunctionsPackage(workspaceRoot);
-  const nodeFunctionAppRoot = (0, import_node_path7.join)(workspaceRoot, "apps", name);
-  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
-  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
+  const nodeFunctionAppRoot = (0, import_node_path8.join)(workspaceRoot, "apps", name);
+  writeFileEnsured((0, import_node_path8.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
+  writeFileEnsured((0, import_node_path8.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
   writeFileEnsured(
-    (0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
+    (0, import_node_path8.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
     NODE_FUNCTION_APP_GREETING
   );
   writeFileEnsured(
-    (0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
+    (0, import_node_path8.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
     NODE_FUNCTION_APP_GREETING_SPEC
   );
-  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
+  writeFileEnsured((0, import_node_path8.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
   repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot);
   ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path7.join)(nodeFunctionAppRoot, "package.json"), {
+  addNxTargets((0, import_node_path8.join)(nodeFunctionAppRoot, "package.json"), {
     package: nodeFunctionAppPackageTarget(name),
     prune: nodeFunctionAppPruneTarget(name),
     start: nodeFunctionAppStartTarget(name)
@@ -3107,11 +3502,11 @@ function addNodeFunctionApp(workspaceRoot, name, stack) {
 }
 
 // src/project-scaffolding/npm-lib.use-case.ts
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 
 // src/rollup-library/repair-publishable-manifest.use-case.ts
-var import_node_fs6 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path9 = require("path");
 var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
 var ACTUAL_TYPES_PATH = "./dist/src/index.d.ts";
 var DECLARATION_MAP_EXCLUSION = "!**/*.d.ts.map";
@@ -3134,14 +3529,14 @@ function repairPublishableManifest(manifestPath) {
 }
 function repairPublishableManifests(workspaceRoot) {
   const changed = [];
-  const manifests = (0, import_node_fs6.globSync)(["packages/*/package.json", "libs/*/package.json"], {
+  const manifests = (0, import_node_fs7.globSync)(["packages/*/package.json", "libs/*/package.json"], {
     cwd: workspaceRoot
   });
   for (const relativePath of manifests) {
-    const manifestPath = (0, import_node_path8.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs6.readFileSync)(manifestPath, "utf8");
+    const manifestPath = (0, import_node_path9.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs7.readFileSync)(manifestPath, "utf8");
     repairPublishableManifest(manifestPath);
-    const after = (0, import_node_fs6.readFileSync)(manifestPath, "utf8");
+    const after = (0, import_node_fs7.readFileSync)(manifestPath, "utf8");
     if (after !== before) {
       changed.push(relativePath.replaceAll("\\", "/"));
     }
@@ -3150,8 +3545,8 @@ function repairPublishableManifests(workspaceRoot) {
 }
 
 // src/rollup-library/repair-rollup-config.use-case.ts
-var import_node_fs7 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
 
 // src/rollup-library/rollup-config.algorithm.ts
 var ROLLUP_CONFIG_PLACEHOLDER = [
@@ -3353,12 +3748,12 @@ function withUpgradedDeclarationSpecifierPlugin(config) {
 // src/rollup-library/repair-rollup-config.use-case.ts
 function repairRollupSourceMaps(workspaceRoot) {
   const changed = [];
-  const configs = (0, import_node_fs7.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs8.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   });
   for (const relativePath of configs) {
-    const configPath = (0, import_node_path9.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs7.readFileSync)(configPath, "utf8");
+    const configPath = (0, import_node_path10.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs8.readFileSync)(configPath, "utf8");
     const after = withRollupSourceMaps(before);
     if (after !== before) {
       writeFileEnsured(configPath, after);
@@ -3369,12 +3764,12 @@ function repairRollupSourceMaps(workspaceRoot) {
 }
 function upgradeDeclarationSpecifierPlugins(workspaceRoot) {
   const changed = [];
-  const configs = (0, import_node_fs7.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs8.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   });
   for (const relativePath of configs) {
-    const configPath = (0, import_node_path9.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs7.readFileSync)(configPath, "utf8");
+    const configPath = (0, import_node_path10.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs8.readFileSync)(configPath, "utf8");
     const after = withUpgradedDeclarationSpecifierPlugin(before);
     if (after !== before) {
       writeFileEnsured(configPath, after);
@@ -3384,11 +3779,11 @@ function upgradeDeclarationSpecifierPlugins(workspaceRoot) {
   return changed;
 }
 function repairDeclarationSpecifiers(projectRoot) {
-  const configPath = (0, import_node_path9.join)(projectRoot, "rollup.config.cjs");
+  const configPath = (0, import_node_path10.join)(projectRoot, "rollup.config.cjs");
   if (!fileExists(configPath)) {
     return;
   }
-  const config = (0, import_node_fs7.readFileSync)(configPath, "utf8");
+  const config = (0, import_node_fs8.readFileSync)(configPath, "utf8");
   if (!config.includes(ROLLUP_CONFIG_PLACEHOLDER)) {
     return;
   }
@@ -3397,10 +3792,10 @@ function repairDeclarationSpecifiers(projectRoot) {
 }
 
 // src/rollup-library/rollup-config.repository.ts
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path11 = require("path");
 function resolveRequireTarget(fromDir, specifier) {
-  const base = (0, import_node_path10.join)(fromDir, specifier);
+  const base = (0, import_node_path11.join)(fromDir, specifier);
   return [base, `${base}.cjs`, `${base}.js`].find((candidate) => fileExists(candidate));
 }
 function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()) {
@@ -3410,7 +3805,7 @@ function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()
   visited.add(configPath);
   let text;
   try {
-    text = (0, import_node_fs8.readFileSync)(configPath, "utf8");
+    text = (0, import_node_fs9.readFileSync)(configPath, "utf8");
   } catch {
     return "";
   }
@@ -3418,15 +3813,15 @@ function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()
     text.matchAll(/require\((['"])(\.[^'"]*)\1\)/g),
     (match) => match[2]
   );
-  const requiredText = specifiers.map((specifier) => resolveRequireTarget((0, import_node_path10.dirname)(configPath), specifier)).filter((target) => target !== void 0).map((target) => resolveRollupConfigText(target, visited));
+  const requiredText = specifiers.map((specifier) => resolveRequireTarget((0, import_node_path11.dirname)(configPath), specifier)).filter((target) => target !== void 0).map((target) => resolveRollupConfigText(target, visited));
   return [text, ...requiredText].join("\n");
 }
 
 // src/project-scaffolding/npm-lib.use-case.ts
 async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  const projectRoot = (0, import_node_path11.join)(workspaceRoot, "packages", name);
-  const manifestPath = (0, import_node_path11.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path12.join)(workspaceRoot, "packages", name);
+  const manifestPath = (0, import_node_path12.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -3455,8 +3850,8 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
 }
 
 // src/project-scaffolding/python.use-case.ts
-var import_node_fs9 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path13 = require("path");
 function ensurePython(workspaceRoot) {
   const hasPython = runShell("python3", ["--version"], workspaceRoot) === 0 || runShell("python", ["--version"], workspaceRoot) === 0;
   if (!hasPython) {
@@ -3479,7 +3874,7 @@ function ensurePythonPipPlugin(workspaceRoot) {
   registerPythonGraphPlugin(workspaceRoot);
 }
 function registerPythonGraphPlugin(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path12.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path13.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     return;
   }
@@ -3502,7 +3897,7 @@ pytest
 pip-audit
 `;
 function ensureRequirementsDev(workspaceRoot) {
-  const requirementsDevPath = (0, import_node_path12.join)(workspaceRoot, "requirements-dev.txt");
+  const requirementsDevPath = (0, import_node_path13.join)(workspaceRoot, "requirements-dev.txt");
   if (!fileExists(requirementsDevPath)) {
     writeFileEnsured(requirementsDevPath, PYTHON_REQUIREMENTS_DEV);
   }
@@ -3562,8 +3957,8 @@ function addPythonApp(workspaceRoot, name) {
     ["g", "@mnci/nx-python-pip:application", name, `--directory=apps/${name}`, "--no-interactive"],
     workspaceRoot
   );
-  writeFileEnsured((0, import_node_path12.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
-  addProjectJsonTargets((0, import_node_path12.join)(workspaceRoot, "apps", name, "project.json"), {
+  writeFileEnsured((0, import_node_path13.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
+  addProjectJsonTargets((0, import_node_path13.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonAppPackageTarget(name),
     start: pythonAppStartTarget(name)
   });
@@ -3585,7 +3980,7 @@ function addPythonFunctionApp(workspaceRoot, name) {
     workspaceRoot
   );
   const moduleDirectory = pythonModuleDirectory(name);
-  addProjectJsonTargets((0, import_node_path12.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path13.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonFunctionAppPackageTarget(name, moduleDirectory),
     start: pythonFunctionAppStartTarget(name)
   });
@@ -3626,7 +4021,7 @@ function addPythonInternalLib(workspaceRoot, name) {
 var PYTHON_PROJECT_DIRS = ["apps", "python-packages", "libs"];
 function findPythonProjectDirectory(workspaceRoot, name) {
   return PYTHON_PROJECT_DIRS.find(
-    (directory) => fileExists((0, import_node_path12.join)(workspaceRoot, directory, name, "pyproject.toml"))
+    (directory) => fileExists((0, import_node_path13.join)(workspaceRoot, directory, name, "pyproject.toml"))
   );
 }
 function parseVendorEntries(pyprojectToml) {
@@ -3665,7 +4060,7 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
       `No Python project named '${consumer}' with a pyproject.toml found (checked apps/, python-packages/, libs/). A Python function app has no pyproject.toml \u2014 there is nothing to vendor into.`
     );
   }
-  if (!fileExists((0, import_node_path12.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
+  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
     throw new Error(
       `No internal Python library named '${lib}' found at libs/${lib}/pyproject.toml. Only an internal library (added via 'mnci add python-internal-lib') can be vendored.`
     );
@@ -3673,8 +4068,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
   if (consumerDirectory === "libs" && consumer === lib) {
     throw new Error(`'${consumer}' cannot vendor itself.`);
   }
-  const pyprojectPath = (0, import_node_path12.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
-  const pyprojectToml = (0, import_node_fs9.readFileSync)(pyprojectPath, "utf8");
+  const pyprojectPath = (0, import_node_path13.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
+  const pyprojectToml = (0, import_node_fs10.readFileSync)(pyprojectPath, "utf8");
   if (parseVendorEntries(pyprojectToml).includes(lib)) {
     logger.info(`'${consumer}' already vendors '${lib}' \u2014 nothing to do.`);
     return;
@@ -3686,8 +4081,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
 }
 
 // src/project-scaffolding/react-app.use-case.ts
-var import_node_fs10 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path14 = require("path");
 var REACT_ENVIRONMENTS = ["dev", "uat", "prod"];
 function reactEnvironmentFile(environment) {
   return `# Vite compiles VITE_-prefixed vars into the '${environment}' bundle at build time.
@@ -3724,12 +4119,12 @@ function reactAppTargets(name) {
   return targets;
 }
 function allowEnvFiles(workspaceRoot) {
-  const gitignorePath = (0, import_node_path13.join)(workspaceRoot, ".gitignore");
+  const gitignorePath = (0, import_node_path14.join)(workspaceRoot, ".gitignore");
   if (!fileExists(gitignorePath)) {
     return;
   }
   const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
-  const current = (0, import_node_fs10.readFileSync)(gitignorePath, "utf8");
+  const current = (0, import_node_fs11.readFileSync)(gitignorePath, "utf8");
   if (current.includes(marker)) {
     return;
   }
@@ -3756,24 +4151,24 @@ function addReactApp(workspaceRoot, name, stack) {
     workspaceRoot
   );
   ensureAdmZip(workspaceRoot);
-  const reactAppRoot = (0, import_node_path13.join)(workspaceRoot, "apps", name);
+  const reactAppRoot = (0, import_node_path14.join)(workspaceRoot, "apps", name);
   for (const environment of REACT_ENVIRONMENTS) {
-    writeFileEnsured((0, import_node_path13.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+    writeFileEnsured((0, import_node_path14.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
   }
   allowEnvFiles(workspaceRoot);
-  addNxTargets((0, import_node_path13.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  addNxTargets((0, import_node_path14.join)(reactAppRoot, "package.json"), reactAppTargets(name));
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 
 // src/project-scaffolding/react-lib.use-case.ts
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 var REACT_LIB_BUNDLER = "rollup";
 async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
   ensurePlugin(workspaceRoot, "@nx/react");
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  const projectRoot = (0, import_node_path14.join)(workspaceRoot, "packages", name);
-  const publishableManifest = (0, import_node_path14.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path15.join)(workspaceRoot, "packages", name);
+  const publishableManifest = (0, import_node_path15.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -3802,8 +4197,8 @@ async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
 }
 function addReactInternalLib(workspaceRoot, name, stack) {
   ensurePlugin(workspaceRoot, "@nx/react");
-  const projectRoot = (0, import_node_path14.join)(workspaceRoot, "libs", name);
-  const privateManifest = (0, import_node_path14.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path15.join)(workspaceRoot, "libs", name);
+  const privateManifest = (0, import_node_path15.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -3829,8 +4224,8 @@ function addReactInternalLib(workspaceRoot, name, stack) {
 }
 
 // src/project-scaffolding/vscode-extension.use-case.ts
-var import_node_fs11 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path16 = require("path");
 var VSCODE_EXTENSION_SCRIPT_PATH = "tools/vscode-extension.cjs";
 var VSCODE_SIDECAR_TARGETS = {
   "win32-x64": "windows-amd64",
@@ -4014,8 +4409,8 @@ export const window = {
 var VSCODE_STUB_PATH = "test/vscode.stub.ts";
 function mapVscodeToStub(projectRoot, testRunner) {
   const [file, anchor, mapping] = testRunner === "jest" ? ["jest.config.cts", "testEnvironment: 'node',", `moduleNameMapper: { '^vscode$': '<rootDir>/${VSCODE_STUB_PATH}' },`] : ["vitest.config.mts", "environment: 'node',", `alias: { vscode: \`\${import.meta.dirname}/${VSCODE_STUB_PATH}\` },`];
-  const path = (0, import_node_path15.join)(projectRoot, file);
-  const content = fileExists(path) ? (0, import_node_fs11.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path16.join)(projectRoot, file);
+  const content = fileExists(path) ? (0, import_node_fs12.readFileSync)(path, "utf8") : "";
   const line = content.split("\n").find((candidate) => candidate.trim() === anchor);
   if (line === void 0) {
     throw new Error(`${file} has no "${anchor}" line to map the vscode module after; map 'vscode' to ${VSCODE_STUB_PATH} by hand.`);
@@ -4035,11 +4430,11 @@ function ensureVscodeToolchain(workspaceRoot) {
   }
 }
 function defaultPublisher(workspaceRoot) {
-  const { name } = readJson((0, import_node_path15.join)(workspaceRoot, "package.json"));
+  const { name } = readJson((0, import_node_path16.join)(workspaceRoot, "package.json"));
   return (name ?? "publisher").replace(/^@/, "").split("/", 1)[0];
 }
 function reshapeManifest(projectRoot, name, publisher, typesVersion) {
-  const manifestPath = (0, import_node_path15.join)(projectRoot, "package.json");
+  const manifestPath = (0, import_node_path16.join)(projectRoot, "package.json");
   const manifest = readJson(manifestPath);
   const { nx = {}, ...rest } = manifest;
   const targets = { ...nx.targets };
@@ -4103,11 +4498,11 @@ function vscodeExtensionPublishTarget(name, sidecar) {
   };
 }
 function addDebugLaunch(workspaceRoot, name) {
-  const file = (0, import_node_fs11.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
+  const file = (0, import_node_fs12.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
   if (file === void 0) {
     return;
   }
-  const path = (0, import_node_path15.join)(workspaceRoot, file);
+  const path = (0, import_node_path16.join)(workspaceRoot, file);
   const workspace = readCodeWorkspace(path) ?? {};
   const folder = `\${workspaceFolder:${workspace.folders?.[0]?.name ?? file.replace(/\.code-workspace$/, "")}}`;
   const taskLabel = `${name}: build (development)`;
@@ -4140,39 +4535,39 @@ function addDebugLaunch(workspaceRoot, name) {
   );
 }
 function refreshVscodeExtensionScript(workspaceRoot) {
-  const apps = (0, import_node_path15.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path16.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs11.readdirSync)(apps);
+    entries = (0, import_node_fs12.readdirSync)(apps);
   } catch {
     return false;
   }
   const hasExtension = entries.some((entry) => {
-    const manifestPath = (0, import_node_path15.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path16.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       return false;
     }
     const tags = readJson(manifestPath).nx?.tags ?? [];
     return tags.includes(VSCODE_EXTENSION_TAG);
   });
-  const path = (0, import_node_path15.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
-  if (!hasExtension || fileExists(path) && (0, import_node_fs11.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
+  const path = (0, import_node_path16.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
+  if (!hasExtension || fileExists(path) && (0, import_node_fs12.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
     return false;
   }
   writeFileEnsured(path, VSCODE_EXTENSION_SCRIPT);
   return true;
 }
 function pinVscodeExtensionProjectNames(workspaceRoot) {
-  const apps = (0, import_node_path15.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path16.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs11.readdirSync)(apps);
+    entries = (0, import_node_fs12.readdirSync)(apps);
   } catch {
     return [];
   }
   const updated = [];
   for (const entry of entries) {
-    const manifestPath = (0, import_node_path15.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path16.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       continue;
     }
@@ -4192,23 +4587,23 @@ function refreshLockFile(workspaceRoot, name) {
 }
 function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
   const { sidecar } = options;
-  if (sidecar !== void 0 && !fileExists((0, import_node_path15.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
+  if (sidecar !== void 0 && !fileExists((0, import_node_path16.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
     throw new Error(`--sidecar ${sidecar}: no Go app at apps/${sidecar}. Add it first with \`mnci add go-app ${sidecar}\`.`);
   }
   runNodeApp(workspaceRoot, name, stack, "none");
   ensureVscodeToolchain(workspaceRoot);
-  const projectRoot = (0, import_node_path15.join)(workspaceRoot, "apps", name);
-  const typesVersion = readJson((0, import_node_path15.join)(workspaceRoot, "node_modules/@types/vscode/package.json")).version;
+  const projectRoot = (0, import_node_path16.join)(workspaceRoot, "apps", name);
+  const typesVersion = readJson((0, import_node_path16.join)(workspaceRoot, "node_modules/@types/vscode/package.json")).version;
   reshapeManifest(projectRoot, name, options.publisher ?? defaultPublisher(workspaceRoot), typesVersion);
-  addVscodeTypes((0, import_node_path15.join)(projectRoot, "tsconfig.app.json"));
-  addVscodeTypes((0, import_node_path15.join)(projectRoot, "tsconfig.spec.json"));
-  writeFileEnsured((0, import_node_path15.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
-  writeFileEnsured((0, import_node_path15.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
-  writeFileEnsured((0, import_node_path15.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
+  addVscodeTypes((0, import_node_path16.join)(projectRoot, "tsconfig.app.json"));
+  addVscodeTypes((0, import_node_path16.join)(projectRoot, "tsconfig.spec.json"));
+  writeFileEnsured((0, import_node_path16.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
+  writeFileEnsured((0, import_node_path16.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
+  writeFileEnsured((0, import_node_path16.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
   mapVscodeToStub(projectRoot, stack.testRunner);
-  writeFileEnsured((0, import_node_path15.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
-  writeFileEnsured((0, import_node_path15.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
-  addNxTargets((0, import_node_path15.join)(projectRoot, "package.json"), {
+  writeFileEnsured((0, import_node_path16.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
+  writeFileEnsured((0, import_node_path16.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
+  addNxTargets((0, import_node_path16.join)(projectRoot, "package.json"), {
     "package": vscodeExtensionPackageTarget(name, sidecar),
     "nx-release-publish": vscodeExtensionPublishTarget(name, sidecar)
   });
@@ -4219,11 +4614,11 @@ function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
 }
 
 // src/dependency-management/sync-dependencies.use-case.ts
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 
 // src/dependency-management/manifest.repository.ts
-var import_node_fs12 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path17 = require("path");
 var ECOSYSTEMS = ["npm", "pip", "pub", "nuget", "go"];
 var ROOT_LABEL = "(root)";
 var MANIFEST_GLOBS = {
@@ -4256,23 +4651,23 @@ function projectOf(manifestRelativePath) {
 }
 function hasEcosystem(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path16.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path17.join)(workspaceRoot, "go.mod"));
   }
   if (ecosystem === "nuget") {
-    return (0, import_node_fs12.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
+    return (0, import_node_fs13.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
   }
   const rootMarker = {
     npm: "package.json",
     pip: "requirements-dev.txt",
     pub: "pubspec.yaml"
   };
-  return fileExists((0, import_node_path16.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs12.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+  return fileExists((0, import_node_path17.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs13.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
 }
 function collectNpm(workspaceRoot) {
   const sites = [];
-  const relativePaths = ["package.json", ...(0, import_node_fs12.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  const relativePaths = ["package.json", ...(0, import_node_fs13.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
   for (const relativePath of relativePaths) {
-    const manifestPath = (0, import_node_path16.join)(workspaceRoot, relativePath);
+    const manifestPath = (0, import_node_path17.join)(workspaceRoot, relativePath);
     try {
       const manifest = readJson(manifestPath);
       sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
@@ -4333,17 +4728,17 @@ function collectPip(workspaceRoot) {
       name: parsed.name,
       ecosystem: "pip",
       project: projectOf(relativePath),
-      manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
+      manifestPath: (0, import_node_path17.join)(workspaceRoot, relativePath),
       section,
       spec: parsed.spec,
       rewritable: parsed.rewritable && parsed.spec !== ""
     });
   };
-  const pyprojectPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  const pyprojectPaths = (0, import_node_fs13.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
   for (const relativePath of pyprojectPaths) {
     let content;
     try {
-      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs13.readFileSync)((0, import_node_path17.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -4354,14 +4749,14 @@ function collectPip(workspaceRoot) {
   }
   const requirementsPaths = [
     "requirements-dev.txt",
-    ...(0, import_node_fs12.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+    ...(0, import_node_fs13.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
   ];
   for (const relativePath of requirementsPaths) {
-    if (!fileExists((0, import_node_path16.join)(workspaceRoot, relativePath))) {
+    if (!fileExists((0, import_node_path17.join)(workspaceRoot, relativePath))) {
       continue;
     }
     const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
-    const lines = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs13.readFileSync)((0, import_node_path17.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
     for (const line of lines) {
       push(relativePath, section, line);
     }
@@ -4399,11 +4794,11 @@ function pyprojectDependencies(content) {
 }
 function collectPub(workspaceRoot) {
   const sites = [];
-  const pubspecPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  const pubspecPaths = (0, import_node_fs13.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
   for (const relativePath of pubspecPaths) {
     let content;
     try {
-      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs13.readFileSync)((0, import_node_path17.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -4413,7 +4808,7 @@ function collectPub(workspaceRoot) {
           name: entry.name,
           ecosystem: "pub",
           project: projectOf(relativePath),
-          manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
+          manifestPath: (0, import_node_path17.join)(workspaceRoot, relativePath),
           section: block === "dependencies" ? "dep" : "devDep",
           spec: entry.spec,
           rewritable: entry.spec !== ""
@@ -4463,11 +4858,11 @@ function stripQuotes(value) {
 }
 function collectNuget(workspaceRoot) {
   const sites = [];
-  const csprojPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
+  const csprojPaths = (0, import_node_fs13.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
   for (const relativePath of csprojPaths) {
     let content;
     try {
-      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs13.readFileSync)((0, import_node_path17.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -4476,7 +4871,7 @@ function collectNuget(workspaceRoot) {
         name: entry.name,
         ecosystem: "nuget",
         project: projectOf(relativePath),
-        manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
+        manifestPath: (0, import_node_path17.join)(workspaceRoot, relativePath),
         section: "dep",
         spec: entry.spec,
         // A plain SemVer string is rewritable; an MSBuild property reference
@@ -4501,13 +4896,13 @@ function csprojPackageReferences(content) {
   return entries;
 }
 function collectGo(workspaceRoot) {
-  const manifestPath = (0, import_node_path16.join)(workspaceRoot, "go.mod");
+  const manifestPath = (0, import_node_path17.join)(workspaceRoot, "go.mod");
   if (!fileExists(manifestPath)) {
     return [];
   }
   let content;
   try {
-    content = (0, import_node_fs12.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs13.readFileSync)(manifestPath, "utf8");
   } catch {
     return [];
   }
@@ -4564,7 +4959,7 @@ function rewriteSpec(site, spec) {
     writeFileEnsured(site.manifestPath, toJson(manifest));
     return true;
   }
-  const before = (0, import_node_fs12.readFileSync)(site.manifestPath, "utf8");
+  const before = (0, import_node_fs13.readFileSync)(site.manifestPath, "utf8");
   const after = (() => {
     switch (site.ecosystem) {
       case "pip": {
@@ -4620,13 +5015,13 @@ function escapeForRegex(value) {
 function isWorkspaceProject(workspaceRoot, name) {
   const short = name.includes("/") ? name.split("/").at(-1) : name;
   return ["apps", "libs", "packages"].some(
-    (directory) => fileExists((0, import_node_path16.join)(workspaceRoot, directory, short ?? name, "package.json"))
+    (directory) => fileExists((0, import_node_path17.join)(workspaceRoot, directory, short ?? name, "package.json"))
   );
 }
 function isAliasedInstall(workspaceRoot, name) {
   try {
     const installed = readJson(
-      (0, import_node_path16.join)(workspaceRoot, "node_modules", name, "package.json")
+      (0, import_node_path17.join)(workspaceRoot, "node_modules", name, "package.json")
     );
     return installed.name !== void 0 && installed.name !== name;
   } catch {
@@ -4637,14 +5032,14 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
   if (ecosystem === "npm") {
     try {
       return readJson(
-        (0, import_node_path16.join)(workspaceRoot, "node_modules", name, "package.json")
+        (0, import_node_path17.join)(workspaceRoot, "node_modules", name, "package.json")
       ).version;
     } catch {
       return void 0;
     }
   }
   if (ecosystem === "pub") {
-    const lockPath = (0, import_node_path16.join)(workspaceRoot, "pubspec.lock");
+    const lockPath = (0, import_node_path17.join)(workspaceRoot, "pubspec.lock");
     if (!fileExists(lockPath)) {
       return void 0;
     }
@@ -4652,7 +5047,7 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
       const match = new RegExp(
         String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
         "m"
-      ).exec((0, import_node_fs12.readFileSync)(lockPath, "utf8"));
+      ).exec((0, import_node_fs13.readFileSync)(lockPath, "utf8"));
       return match?.[1];
     } catch {
       return void 0;
@@ -4844,7 +5239,7 @@ function describe(finding) {
   return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
 }
 function runSync(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path17.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
     );
@@ -4894,7 +5289,7 @@ function runSync(workspaceRoot, options) {
 }
 
 // src/dependency-management/update-dependencies.use-case.ts
-var import_node_path18 = require("path");
+var import_node_path19 = require("path");
 var import_prompts2 = require("@inquirer/prompts");
 
 // src/dependency-management/registry.client.ts
@@ -5177,7 +5572,7 @@ function reinstall(workspaceRoot, ecosystems) {
 function hasPythonInstallScript(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path18.join)(workspaceRoot, "package.json")
+      (0, import_node_path19.join)(workspaceRoot, "package.json")
     );
     return manifest.scripts?.["python:install"] !== void 0;
   } catch {
@@ -5193,7 +5588,7 @@ function applyGoUpdates(workspaceRoot, entries) {
   }
 }
 async function runUp(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path19.join)(workspaceRoot, "nx.json"))) {
     throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
   }
   const ecosystems = resolveEcosystems(options.ecosystem);
@@ -5269,7 +5664,7 @@ var PROJECT_KINDS = [
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path19.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path20.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
@@ -5278,6 +5673,11 @@ async function runAdd(kind, name, options) {
     message: "What kind of project?",
     choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
   });
+  for (const [flag, requested] of [["--release", options.release], ["--cgo", options.cgo]]) {
+    if (resolvedKind !== "go-app" && requested === true) {
+      throw new Error(`${flag} applies to go-app only, not ${resolvedKind}.`);
+    }
+  }
   const resolvedName = name ?? await promptText("Project name");
   assertValidProjectName(resolvedName, "Project name");
   const rootDependenciesBefore = rootRuntimeDependencies(workspaceRoot);
@@ -5320,8 +5720,8 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path19.join)(workspaceRoot, "libs", resolvedName, "package.json"));
-      renameScaffoldPlaceholder((0, import_node_path19.join)(workspaceRoot, "libs", resolvedName), resolvedName);
+      markPrivate((0, import_node_path20.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      renameScaffoldPlaceholder((0, import_node_path20.join)(workspaceRoot, "libs", resolvedName), resolvedName);
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -5343,7 +5743,7 @@ async function runAdd(kind, name, options) {
       break;
     }
     case "go-app": {
-      addGoApp(workspaceRoot, resolvedName);
+      addGoApp(workspaceRoot, resolvedName, { release: options.release, cgo: options.cgo });
       break;
     }
     case "go-function-app": {
@@ -5413,7 +5813,7 @@ async function runAdd(kind, name, options) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path19.join)(workspaceRoot, "nx.json")
+    (0, import_node_path20.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -5422,15 +5822,16 @@ function readWorkspaceStack(workspaceRoot) {
 }
 
 // src/workspace-diagnostics/check-invariants.use-case.ts
-var import_node_fs13 = require("fs");
-var import_node_path20 = require("path");
+var import_node_child_process = require("child_process");
+var import_node_fs14 = require("fs");
+var import_node_path21 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs13.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs13.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs14.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs14.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return [
@@ -5450,10 +5851,10 @@ function checkEslintConfigs(workspaceRoot) {
   ];
 }
 function checkEslintEntryPointReachesTheRules(workspaceRoot) {
-  const rules = (0, import_node_path20.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
-  if (!(0, import_node_fs13.existsSync)(rules)) return [];
-  const entryPoint = (0, import_node_path20.join)(workspaceRoot, ESLINT_USER_FILENAME);
-  const source = (0, import_node_fs13.existsSync)(entryPoint) ? (0, import_node_fs13.readFileSync)(entryPoint, "utf8") : "";
+  const rules = (0, import_node_path21.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
+  if (!(0, import_node_fs14.existsSync)(rules)) return [];
+  const entryPoint = (0, import_node_path21.join)(workspaceRoot, ESLINT_USER_FILENAME);
+  const source = (0, import_node_fs14.existsSync)(entryPoint) ? (0, import_node_fs14.readFileSync)(entryPoint, "utf8") : "";
   return [
     {
       check: `${ESLINT_USER_FILENAME} imports the mnci rules`,
@@ -5466,7 +5867,7 @@ function checkEslintEntryPointReachesTheRules(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path20.join)(workspaceRoot, "package.json")
+      (0, import_node_path21.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -5474,7 +5875,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path20.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path21.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -5500,7 +5901,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path20.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path21.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -5518,11 +5919,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path21.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs14.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -5539,11 +5940,11 @@ function checkNpmrc(workspaceRoot, registry, scope) {
   };
 }
 function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
-  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path21.join)(workspaceRoot, ".npmrc");
   if (!fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs14.readFileSync)(npmrcPath, "utf8");
   const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
   const referenced = [
     ...new Set(
@@ -5567,13 +5968,13 @@ function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env)
   };
 }
 function checkNpmAuthMatchesPipeline(workspaceRoot, registry) {
-  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
-  const pipelinePath = (0, import_node_path20.join)(workspaceRoot, "azure-pipelines.yml");
+  const npmrcPath = (0, import_node_path21.join)(workspaceRoot, ".npmrc");
+  const pipelinePath = (0, import_node_path21.join)(workspaceRoot, "azure-pipelines.yml");
   if (registry?.kind !== "azure-artifacts" || !fileExists(npmrcPath) || !fileExists(pipelinePath)) {
     return void 0;
   }
-  const holdsCredentials = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
-  const runsTask = (0, import_node_fs13.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
+  const holdsCredentials = (0, import_node_fs14.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const runsTask = (0, import_node_fs14.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
   if (!holdsCredentials && !runsTask) {
     return {
       check: "npm auth: .npmrc and azure-pipelines.yml agree",
@@ -5618,13 +6019,13 @@ function npmjsCredentialShape(credentials, environment) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs13.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs13.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
-    ...(0, import_node_fs13.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+    ...(0, import_node_fs14.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs14.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
+    ...(0, import_node_fs14.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path20.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path21.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -5653,7 +6054,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path20.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path21.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -5669,8 +6070,8 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs13.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs13.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+      ...(0, import_node_fs14.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs14.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
     ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
@@ -5685,7 +6086,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path20.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path21.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -5706,8 +6107,34 @@ function checkSync(workspaceRoot) {
     remedy: "run `npx nx sync` and commit the result"
   };
 }
+function hasCCompiler() {
+  const candidates = [process.env.CC?.split(" ", 1)[0], "gcc", "clang", "cc"];
+  return candidates.some((command) => command !== void 0 && command !== "" && (0, import_node_child_process.spawnSync)(command, ["--version"], { stdio: "ignore" }).status === 0);
+}
+function checkNativeApps(workspaceRoot) {
+  if (!hasNativeGoApp(workspaceRoot)) {
+    return [];
+  }
+  const pipelines = [
+    { file: ".github/workflows/ci.yml", marker: "native (${{ matrix.os }})" },
+    { file: "azure-pipelines.yml", marker: "- job: native" }
+  ];
+  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path21.join)(workspaceRoot, file))).map(({ file, marker }) => ({
+    check: `${file} builds the native apps on every OS`,
+    ok: (0, import_node_fs14.readFileSync)((0, import_node_path21.join)(workspaceRoot, file), "utf8").includes(marker),
+    detail: `${file} has no native job: CI would verify a cgo app on the one agent that cannot build it`,
+    remedy: "run `mnci upgrade`"
+  }));
+  findings.push({
+    check: "a C compiler is installed (cgo needs one)",
+    ok: hasCCompiler(),
+    detail: "none of CC, gcc, clang or cc answered --version, so nx run <app>:build-native cannot build here",
+    remedy: "install one: Xcode command line tools on macOS, build-essential on Linux, MinGW-w64 (gcc) on Windows"
+  });
+  return findings;
+}
 function checkNoRootRuntimeDependencies(workspaceRoot) {
-  const manifestPath = (0, import_node_path20.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path21.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -5727,14 +6154,14 @@ function checkNoRootRuntimeDependencies(workspaceRoot) {
   };
 }
 function checkRollupSourceMaps(workspaceRoot) {
-  const configs = (0, import_node_fs13.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs14.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path21.join)(workspaceRoot, relativePath);
     let config;
     try {
-      config = (0, import_node_fs13.readFileSync)(configPath, "utf8");
+      config = (0, import_node_fs14.readFileSync)(configPath, "utf8");
     } catch {
       return [];
     }
@@ -5749,11 +6176,11 @@ function checkRollupSourceMaps(workspaceRoot) {
   });
 }
 function checkDeclarationSpecifiers(workspaceRoot) {
-  const configs = (0, import_node_fs13.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs14.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path21.join)(workspaceRoot, relativePath);
     if (!fileExists(configPath)) {
       return [];
     }
@@ -5787,7 +6214,7 @@ function checkDeclarationSpecifiers(workspaceRoot) {
   });
 }
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path20.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path21.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -5807,7 +6234,8 @@ function collectFindings(workspaceRoot) {
     ...checkDeclarationSpecifiers(workspaceRoot),
     ...checkVersionActions(workspaceRoot),
     ...checkTargetFilesExist(workspaceRoot),
-    checkSync(workspaceRoot)
+    checkSync(workspaceRoot),
+    ...checkNativeApps(workspaceRoot)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot) {
@@ -5832,8 +6260,8 @@ function runDoctor(workspaceRoot) {
 }
 
 // src/workspace-creation/adopt-directory.use-case.ts
-var import_node_fs14 = require("fs");
-var import_node_path21 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path22 = require("path");
 var NEVER_COPIED = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var AGENT_AND_CI_ENTRIES = [
   "AGENTS.md",
@@ -5864,13 +6292,13 @@ var PREFLIGHT_BLOCKERS = [
   "packages"
 ];
 function assertAdoptableDirectory(target) {
-  if (!(0, import_node_fs14.existsSync)(target)) {
+  if (!(0, import_node_fs15.existsSync)(target)) {
     throw new Error(`--into '${target}' does not exist. Create or clone it first.`);
   }
-  if (!(0, import_node_fs14.statSync)(target).isDirectory()) {
+  if (!(0, import_node_fs15.statSync)(target).isDirectory()) {
     throw new Error(`--into '${target}' is not a directory.`);
   }
-  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs14.existsSync)((0, import_node_path21.join)(target, entry)));
+  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs15.existsSync)((0, import_node_path22.join)(target, entry)));
   if (blockers.length > 0) {
     throw new Error(
       `--into '${target}' already holds ${blockers.join(", ")}, so it is a project already. Use \`mnci upgrade\` to re-apply the overlay to an existing workspace, or point --into at an empty checkout.`
@@ -5878,15 +6306,15 @@ function assertAdoptableDirectory(target) {
   }
 }
 function mergeGitignore(generatedFile, targetFile) {
-  const existing = (0, import_node_fs14.readFileSync)(targetFile, "utf8");
+  const existing = (0, import_node_fs15.readFileSync)(targetFile, "utf8");
   const present = new Set(existing.split("\n").map((line) => line.trim()));
-  const additions = (0, import_node_fs14.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
+  const additions = (0, import_node_fs15.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
     const trimmed = line.trim();
     return trimmed !== "" && !trimmed.startsWith("#") && !present.has(trimmed);
   });
   if (additions.length === 0) return false;
   const separator = existing.endsWith("\n") ? "" : "\n";
-  (0, import_node_fs14.writeFileSync)(
+  (0, import_node_fs15.writeFileSync)(
     targetFile,
     `${existing}${separator}
 # Added by mnci (Nx workspace)
@@ -5896,9 +6324,9 @@ ${additions.join("\n")}
   return true;
 }
 function adoptGeneratedWorkspace(generatedRoot, target) {
-  const entries = (0, import_node_fs14.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
+  const entries = (0, import_node_fs15.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
   const collisions = entries.filter(
-    (entry) => (0, import_node_fs14.existsSync)((0, import_node_path21.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
+    (entry) => (0, import_node_fs15.existsSync)((0, import_node_path22.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
   );
   if (collisions.length > 0) {
     throw new Error(
@@ -5907,28 +6335,28 @@ function adoptGeneratedWorkspace(generatedRoot, target) {
   }
   const result = { copied: [], kept: [], mergedGitignore: false };
   for (const entry of entries) {
-    const from = (0, import_node_path21.join)(generatedRoot, entry);
-    const to = (0, import_node_path21.join)(target, entry);
-    if (entry === ".gitignore" && (0, import_node_fs14.existsSync)(to)) {
+    const from = (0, import_node_path22.join)(generatedRoot, entry);
+    const to = (0, import_node_path22.join)(target, entry);
+    if (entry === ".gitignore" && (0, import_node_fs15.existsSync)(to)) {
       result.mergedGitignore = mergeGitignore(from, to);
       result.kept.push(entry);
       continue;
     }
-    if ((0, import_node_fs14.existsSync)(to)) {
+    if ((0, import_node_fs15.existsSync)(to)) {
       result.kept.push(entry);
       continue;
     }
-    (0, import_node_fs14.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs15.cpSync)(from, to, { recursive: true });
     result.copied.push(entry);
   }
-  (0, import_node_fs14.rmSync)(generatedRoot, { recursive: true, force: true });
+  (0, import_node_fs15.rmSync)(generatedRoot, { recursive: true, force: true });
   return result;
 }
 
 // src/workspace-creation/create-workspace.use-case.ts
-var import_node_fs15 = require("fs");
+var import_node_fs16 = require("fs");
 var import_node_os = require("os");
-var import_node_path22 = require("path");
+var import_node_path23 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -5964,9 +6392,9 @@ async function resolveRegistry(options) {
   return await promptRegistry();
 }
 async function runNew(name, options) {
-  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path22.resolve)(process.cwd(), options.into);
+  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path23.resolve)(process.cwd(), options.into);
   if (adoptTarget !== void 0) assertAdoptableDirectory(adoptTarget);
-  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path22.basename)(adoptTarget));
+  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path23.basename)(adoptTarget));
   assertValidProjectName(workspaceName, "Workspace name");
   const scope = options.scope ?? (options.yes ? `@${workspaceName}` : await promptText("npm scope for publishable packages", `@${workspaceName}`));
   const registry = await resolveRegistry(options);
@@ -5979,8 +6407,8 @@ async function runNew(name, options) {
   const npmAuth = resolveNpmAuth(options.npmAuth, registry, ci);
   const stack = await resolveStack(options);
   const nxCloud = options.nxCloud ?? (options.yes ? false : await promptNxCloud());
-  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs15.mkdtempSync)((0, import_node_path22.join)((0, import_node_os.tmpdir)(), "mnci-new-"));
-  let workspaceRoot = (0, import_node_path22.join)(stagingParent, workspaceName);
+  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs16.mkdtempSync)((0, import_node_path23.join)((0, import_node_os.tmpdir)(), "mnci-new-"));
+  let workspaceRoot = (0, import_node_path23.join)(stagingParent, workspaceName);
   try {
     logger.step(`Creating Nx workspace '${workspaceName}' (preset: ts)`);
     runNpx(
@@ -6003,7 +6431,7 @@ async function runNew(name, options) {
       workspaceRoot = adoptTarget;
     }
   } finally {
-    if (adoptTarget !== void 0) (0, import_node_fs15.rmSync)(stagingParent, { recursive: true, force: true });
+    if (adoptTarget !== void 0) (0, import_node_fs16.rmSync)(stagingParent, { recursive: true, force: true });
   }
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
@@ -6013,8 +6441,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack, ...npmAuth && { npmAuth } },
     logger.detail
   );
-  (0, import_node_fs15.rmSync)((0, import_node_path22.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs15.rmSync)((0, import_node_path22.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs16.rmSync)((0, import_node_path23.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs16.rmSync)((0, import_node_path23.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -6045,12 +6473,12 @@ async function runNew(name, options) {
 }
 
 // src/workspace-creation/interactive-wizard.use-case.ts
-var import_node_path24 = require("path");
+var import_node_path25 = require("path");
 var import_prompts4 = require("@inquirer/prompts");
 
 // src/workspace-upgrade/upgrade-workspace.use-case.ts
-var import_node_fs16 = require("fs");
-var import_node_path23 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path24 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -6079,7 +6507,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs16.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs17.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -6087,11 +6515,11 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path23.basename)(workspaceRoot);
+  return (0, import_node_path24.basename)(workspaceRoot);
 }
 function detectNpmAuth(workspaceRoot) {
   try {
-    return (0, import_node_fs16.readFileSync)((0, import_node_path23.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
+    return (0, import_node_fs17.readFileSync)((0, import_node_path24.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
   } catch {
     return void 0;
   }
@@ -6138,7 +6566,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path23.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path24.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -6179,6 +6607,10 @@ function runUpgrade(workspaceRoot, options) {
     logger.step("Updating the VS Code extension packaging script");
     logger.detail(`updated ${VSCODE_EXTENSION_SCRIPT_PATH}`);
   }
+  if (refreshGoReleaseScript(workspaceRoot)) {
+    logger.step("Updating the releasable Go app script");
+    logger.detail(`updated ${GO_RELEASE_SCRIPT_PATH}`);
+  }
   const upgradedDtsPlugins = upgradeDeclarationSpecifierPlugins(workspaceRoot);
   if (upgradedDtsPlugins.length > 0) {
     logger.step("Upgrading declaration specifiers to resolve under nodenext");
@@ -6195,7 +6627,7 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/workspace-creation/interactive-wizard.use-case.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path24.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path25.join)(process.cwd(), "nx.json"));
   const choiceNew = { name: "Create a new monorepo", value: "new" };
   const choiceAdd = { name: "Add a project to this workspace", value: "add" };
   const choiceUpgrade = {
@@ -6216,8 +6648,8 @@ async function runInteractive() {
 }
 
 // src/cli-version/check-for-update.use-case.ts
-var import_node_fs17 = require("fs");
-var import_node_path25 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path26 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -6273,8 +6705,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path25.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs17.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path26.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs18.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -6335,6 +6767,12 @@ function buildProgram(cliVersion) {
   ).option(
     "--sidecar <go-app>",
     "vscode-extension only: a go-app whose six-platform build ships in the extension, one .vsix per platform"
+  ).option(
+    "--release",
+    "go-app only: release the app. Versioned from its git tag, its six-platform zips attached to its GitHub Release"
+  ).option(
+    "--cgo",
+    "go-app only: the app needs a C toolchain (a tray icon, a native GUI, a cgo driver), so CI builds it on a runner of each OS instead of cross-compiling"
   ).action(
     async (kind, name, options) => {
       await runAdd(kind, name, options);