@mnci/cli 4.40.1 → 4.40.3

package/dist/cli.js

@@ -283,7 +283,17 @@ function classifyNpmAudit(report) {
   });
   return { blocking, total: all.length, notes };
 }
-function auditNpm(result, log) {
+function planIsEmpty(stdout) {
+  try {
+    const start = stdout.search(/^\{/m);
+    const plan = JSON.parse(start === -1 ? stdout : stdout.slice(start));
+    const lists = [plan.add, plan.change, plan.remove];
+    return lists.every((list) => Array.isArray(list) && list.length === 0);
+  } catch {
+    return false;
+  }
+}
+function auditNpm(result, dryRun, log) {
   let report;
   try {
     report = JSON.parse(result.stdout);
@@ -299,6 +309,13 @@ function auditNpm(result, log) {
     log(`npm audit - ${total} advisory(ies), none actionable at moderate or above.`);
     return 0;
   }
+  if (planIsEmpty(dryRun().stdout)) {
+    for (const advisory of blocking) {
+      log(`  note [${advisory.severity}] ${advisory.name} - npm reports a fix, but npm audit fix has nothing to apply`);
+    }
+    log(`npm audit - ${total} advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
+    return 0;
+  }
   for (const advisory of blocking) {
     log(`  BLOCKING [${advisory.severity}] ${advisory.name} - fix available`);
   }
@@ -325,7 +342,7 @@ function runAudit(workspaceRoot, dependencies = {}) {
     }
   };
   log(groupStart(host, "npm audit"));
-  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), log);
+  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), () => processes.capture("npm", ["audit", "fix", "--dry-run", "--json"]), log);
   closeGroup();
   if (npm !== 0) {
     return npm;
@@ -3151,7 +3168,7 @@ function runPhase(phase, workspaceRoot, dependencies) {
 }
 
 // src/project-scaffolding/add-project.use-case.ts
-var import_node_path31 = require("path");
+var import_node_path33 = require("path");
 var import_prompts3 = require("@inquirer/prompts");
 
 // src/project-name/project-name.validator.ts
@@ -5059,11 +5076,65 @@ function addNodeFunctionApp(workspaceRoot, name, stack, empty = false) {
 }
 
 // src/project-scaffolding/npm-lib.use-case.ts
-var import_node_path22 = require("path");
+var import_node_path24 = require("path");
 
-// src/rollup-library/repair-publishable-manifest.use-case.ts
+// src/lockfile-pruning/prune-stale-local-registry.use-case.ts
+var import_node_fs20 = require("fs");
+var import_node_path20 = require("path");
+
+// src/lockfile-pruning/stale-local-registry.validator.ts
 var import_node_fs19 = require("fs");
 var import_node_path19 = require("path");
+var LOCAL_REGISTRY_PACKAGE = "verdaccio";
+var LOCAL_REGISTRY_LOCK_KEY = `node_modules/${LOCAL_REGISTRY_PACKAGE}`;
+var DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+function readJsonFile(path) {
+  if (!(0, import_node_fs19.existsSync)(path)) {
+    return void 0;
+  }
+  try {
+    return JSON.parse((0, import_node_fs19.readFileSync)(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function declaresLocalRegistry(manifest) {
+  return DEPENDENCY_FIELDS.some((field) => {
+    const list = manifest?.[field];
+    return list !== void 0 && Object.hasOwn(list, LOCAL_REGISTRY_PACKAGE);
+  });
+}
+function hasStaleLocalRegistry(workspaceRoot) {
+  const lock = readJsonFile((0, import_node_path19.join)(workspaceRoot, "package-lock.json"));
+  const entries = lock?.packages ?? {};
+  if (!Object.hasOwn(entries, LOCAL_REGISTRY_LOCK_KEY)) {
+    return false;
+  }
+  const members = Object.keys(entries).filter((key) => key !== "" && !key.startsWith("node_modules/") && !key.includes("/node_modules/"));
+  const manifests = ["", ...members].map((directory) => readJsonFile((0, import_node_path19.join)(workspaceRoot, directory, "package.json")));
+  return manifests.every((manifest) => !declaresLocalRegistry(manifest));
+}
+
+// src/lockfile-pruning/prune-stale-local-registry.use-case.ts
+function pruneStaleLocalRegistry(workspaceRoot, resolve2 = runShell) {
+  if (!hasStaleLocalRegistry(workspaceRoot)) {
+    return { stale: false, status: 0 };
+  }
+  const lockPath = (0, import_node_path20.join)(workspaceRoot, "package-lock.json");
+  const lock = JSON.parse((0, import_node_fs20.readFileSync)(lockPath, "utf8"));
+  Reflect.deleteProperty(lock.packages, LOCAL_REGISTRY_LOCK_KEY);
+  const root = lock.packages[""];
+  if (root?.devDependencies !== void 0) {
+    Reflect.deleteProperty(root.devDependencies, LOCAL_REGISTRY_PACKAGE);
+  }
+  (0, import_node_fs20.writeFileSync)(lockPath, `${JSON.stringify(lock, void 0, 2)}
+`);
+  return { stale: true, status: resolve2("npm", ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"], workspaceRoot) };
+}
+
+// src/rollup-library/repair-publishable-manifest.use-case.ts
+var import_node_fs21 = require("fs");
+var import_node_path21 = require("path");
 var WRONG_TYPES_PATH = "./dist/index.esm.d.ts";
 var ACTUAL_TYPES_PATH = "./dist/src/index.d.ts";
 var DECLARATION_MAP_EXCLUSION = "!**/*.d.ts.map";
@@ -5086,14 +5157,14 @@ function repairPublishableManifest(manifestPath) {
 }
 function repairPublishableManifests(workspaceRoot) {
   const changed = [];
-  const manifests = (0, import_node_fs19.globSync)(["packages/*/package.json", "libs/*/package.json"], {
+  const manifests = (0, import_node_fs21.globSync)(["packages/*/package.json", "libs/*/package.json"], {
     cwd: workspaceRoot
   });
   for (const relativePath of manifests) {
-    const manifestPath = (0, import_node_path19.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs19.readFileSync)(manifestPath, "utf8");
+    const manifestPath = (0, import_node_path21.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs21.readFileSync)(manifestPath, "utf8");
     repairPublishableManifest(manifestPath);
-    const after = (0, import_node_fs19.readFileSync)(manifestPath, "utf8");
+    const after = (0, import_node_fs21.readFileSync)(manifestPath, "utf8");
     if (after !== before) {
       changed.push(relativePath.replaceAll("\\", "/"));
     }
@@ -5102,8 +5173,8 @@ function repairPublishableManifests(workspaceRoot) {
 }
 
 // src/rollup-library/repair-rollup-config.use-case.ts
-var import_node_fs20 = require("fs");
-var import_node_path20 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path22 = require("path");
 
 // src/rollup-library/rollup-config.algorithm.ts
 var ROLLUP_CONFIG_PLACEHOLDER = [
@@ -5305,12 +5376,12 @@ function withUpgradedDeclarationSpecifierPlugin(config) {
 // src/rollup-library/repair-rollup-config.use-case.ts
 function repairRollupSourceMaps(workspaceRoot) {
   const changed = [];
-  const configs = (0, import_node_fs20.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs22.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   });
   for (const relativePath of configs) {
-    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs20.readFileSync)(configPath, "utf8");
+    const configPath = (0, import_node_path22.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs22.readFileSync)(configPath, "utf8");
     const after = withRollupSourceMaps(before);
     if (after !== before) {
       writeFileEnsured(configPath, after);
@@ -5321,12 +5392,12 @@ function repairRollupSourceMaps(workspaceRoot) {
 }
 function upgradeDeclarationSpecifierPlugins(workspaceRoot) {
   const changed = [];
-  const configs = (0, import_node_fs20.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs22.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   });
   for (const relativePath of configs) {
-    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
-    const before = (0, import_node_fs20.readFileSync)(configPath, "utf8");
+    const configPath = (0, import_node_path22.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs22.readFileSync)(configPath, "utf8");
     const after = withUpgradedDeclarationSpecifierPlugin(before);
     if (after !== before) {
       writeFileEnsured(configPath, after);
@@ -5336,11 +5407,11 @@ function upgradeDeclarationSpecifierPlugins(workspaceRoot) {
   return changed;
 }
 function repairDeclarationSpecifiers(projectRoot) {
-  const configPath = (0, import_node_path20.join)(projectRoot, "rollup.config.cjs");
+  const configPath = (0, import_node_path22.join)(projectRoot, "rollup.config.cjs");
   if (!fileExists(configPath)) {
     return;
   }
-  const config = (0, import_node_fs20.readFileSync)(configPath, "utf8");
+  const config = (0, import_node_fs22.readFileSync)(configPath, "utf8");
   if (!config.includes(ROLLUP_CONFIG_PLACEHOLDER)) {
     return;
   }
@@ -5349,10 +5420,10 @@ function repairDeclarationSpecifiers(projectRoot) {
 }
 
 // src/rollup-library/rollup-config.repository.ts
-var import_node_fs21 = require("fs");
-var import_node_path21 = require("path");
+var import_node_fs23 = require("fs");
+var import_node_path23 = require("path");
 function resolveRequireTarget(fromDir, specifier) {
-  const base = (0, import_node_path21.join)(fromDir, specifier);
+  const base = (0, import_node_path23.join)(fromDir, specifier);
   return [base, `${base}.cjs`, `${base}.js`].find((candidate) => fileExists(candidate));
 }
 function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()) {
@@ -5362,7 +5433,7 @@ function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()
   visited.add(configPath);
   let text;
   try {
-    text = (0, import_node_fs21.readFileSync)(configPath, "utf8");
+    text = (0, import_node_fs23.readFileSync)(configPath, "utf8");
   } catch {
     return "";
   }
@@ -5370,15 +5441,15 @@ function resolveRollupConfigText(configPath, visited = /* @__PURE__ */ new Set()
     text.matchAll(/require\((['"])(\.[^'"]*)\1\)/g),
     (match) => match[2]
   );
-  const requiredText = specifiers.map((specifier) => resolveRequireTarget((0, import_node_path21.dirname)(configPath), specifier)).filter((target) => target !== void 0).map((target) => resolveRollupConfigText(target, visited));
+  const requiredText = specifiers.map((specifier) => resolveRequireTarget((0, import_node_path23.dirname)(configPath), specifier)).filter((target) => target !== void 0).map((target) => resolveRollupConfigText(target, visited));
   return [text, ...requiredText].join("\n");
 }
 
 // src/project-scaffolding/npm-lib.use-case.ts
 async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  const projectRoot = (0, import_node_path22.join)(workspaceRoot, "packages", name);
-  const manifestPath = (0, import_node_path22.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path24.join)(workspaceRoot, "packages", name);
+  const manifestPath = (0, import_node_path24.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -5401,14 +5472,18 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
       renameScaffoldPlaceholder(projectRoot, name, options.empty === true);
       removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
       removeLocalRegistryScaffolding(workspaceRoot);
+      const pruned = pruneStaleLocalRegistry(workspaceRoot);
+      if (pruned.stale && pruned.status !== 0) {
+        logger.warn("Could not drop the unused local registry from package-lock.json: run `mnci upgrade` once the network is back.");
+      }
       registerProjectCommands(workspaceRoot, name, { build: true });
     }
   );
 }
 
 // src/project-scaffolding/python.use-case.ts
-var import_node_fs22 = require("fs");
-var import_node_path23 = require("path");
+var import_node_fs24 = require("fs");
+var import_node_path25 = require("path");
 function ensurePython(workspaceRoot) {
   const hasPython = runShell("python3", ["--version"], workspaceRoot) === 0 || runShell("python", ["--version"], workspaceRoot) === 0;
   if (!hasPython) {
@@ -5431,7 +5506,7 @@ function ensurePythonPipPlugin(workspaceRoot) {
   registerPythonGraphPlugin(workspaceRoot);
 }
 function registerPythonGraphPlugin(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path23.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path25.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     return;
   }
@@ -5454,7 +5529,7 @@ pytest
 pip-audit
 `;
 function ensureRequirementsDev(workspaceRoot) {
-  const requirementsDevPath = (0, import_node_path23.join)(workspaceRoot, "requirements-dev.txt");
+  const requirementsDevPath = (0, import_node_path25.join)(workspaceRoot, "requirements-dev.txt");
   if (!fileExists(requirementsDevPath)) {
     writeFileEnsured(requirementsDevPath, PYTHON_REQUIREMENTS_DEV);
   }
@@ -5514,8 +5589,8 @@ function addPythonApp(workspaceRoot, name) {
     ["g", "@mnci/nx-python-pip:application", name, `--directory=apps/${name}`, "--no-interactive"],
     workspaceRoot
   );
-  writeFileEnsured((0, import_node_path23.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
-  addProjectJsonTargets((0, import_node_path23.join)(workspaceRoot, "apps", name, "project.json"), {
+  writeFileEnsured((0, import_node_path25.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
+  addProjectJsonTargets((0, import_node_path25.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonAppPackageTarget(name),
     start: pythonAppStartTarget(name)
   });
@@ -5537,7 +5612,7 @@ function addPythonFunctionApp(workspaceRoot, name) {
     workspaceRoot
   );
   const moduleDirectory = pythonModuleDirectory(name);
-  addProjectJsonTargets((0, import_node_path23.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path25.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonFunctionAppPackageTarget(name, moduleDirectory),
     start: pythonFunctionAppStartTarget(name)
   });
@@ -5578,7 +5653,7 @@ function addPythonInternalLib(workspaceRoot, name) {
 var PYTHON_PROJECT_DIRS = ["apps", "python-packages", "libs"];
 function findPythonProjectDirectory(workspaceRoot, name) {
   return PYTHON_PROJECT_DIRS.find(
-    (directory) => fileExists((0, import_node_path23.join)(workspaceRoot, directory, name, "pyproject.toml"))
+    (directory) => fileExists((0, import_node_path25.join)(workspaceRoot, directory, name, "pyproject.toml"))
   );
 }
 function parseVendorEntries(pyprojectToml) {
@@ -5617,7 +5692,7 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
       `No Python project named '${consumer}' with a pyproject.toml found (checked apps/, python-packages/, libs/). A Python function app has no pyproject.toml \u2014 there is nothing to vendor into.`
     );
   }
-  if (!fileExists((0, import_node_path23.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
+  if (!fileExists((0, import_node_path25.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
     throw new Error(
       `No internal Python library named '${lib}' found at libs/${lib}/pyproject.toml. Only an internal library (added via 'mnci add python-internal-lib') can be vendored.`
     );
@@ -5625,8 +5700,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
   if (consumerDirectory === "libs" && consumer === lib) {
     throw new Error(`'${consumer}' cannot vendor itself.`);
   }
-  const pyprojectPath = (0, import_node_path23.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
-  const pyprojectToml = (0, import_node_fs22.readFileSync)(pyprojectPath, "utf8");
+  const pyprojectPath = (0, import_node_path25.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
+  const pyprojectToml = (0, import_node_fs24.readFileSync)(pyprojectPath, "utf8");
   if (parseVendorEntries(pyprojectToml).includes(lib)) {
     logger.info(`'${consumer}' already vendors '${lib}' \u2014 nothing to do.`);
     return;
@@ -5638,8 +5713,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
 }
 
 // src/project-scaffolding/react-app.use-case.ts
-var import_node_fs23 = require("fs");
-var import_node_path24 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_path26 = require("path");
 
 // src/project-scaffolding/react-app-example.algorithm.ts
 function reactAppExampleFiles(name) {
@@ -5756,12 +5831,12 @@ function reactAppTargets(name) {
   return targets;
 }
 function allowEnvFiles(workspaceRoot) {
-  const gitignorePath = (0, import_node_path24.join)(workspaceRoot, ".gitignore");
+  const gitignorePath = (0, import_node_path26.join)(workspaceRoot, ".gitignore");
   if (!fileExists(gitignorePath)) {
     return;
   }
   const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
-  const current = (0, import_node_fs23.readFileSync)(gitignorePath, "utf8");
+  const current = (0, import_node_fs25.readFileSync)(gitignorePath, "utf8");
   if (current.includes(marker)) {
     return;
   }
@@ -5788,30 +5863,30 @@ function addReactApp(workspaceRoot, name, stack) {
     workspaceRoot
   );
   ensureAdmZip(workspaceRoot);
-  const reactAppRoot = (0, import_node_path24.join)(workspaceRoot, "apps", name);
+  const reactAppRoot = (0, import_node_path26.join)(workspaceRoot, "apps", name);
   for (const environment of REACT_ENVIRONMENTS) {
-    writeFileEnsured((0, import_node_path24.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+    writeFileEnsured((0, import_node_path26.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
   }
   allowEnvFiles(workspaceRoot);
-  addNxTargets((0, import_node_path24.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  addNxTargets((0, import_node_path26.join)(reactAppRoot, "package.json"), reactAppTargets(name));
   reshapeReactAppScaffold(reactAppRoot);
-  (0, import_node_fs23.rmSync)((0, import_node_path24.join)(reactAppRoot, "src/app/nx-welcome.component.tsx"), { force: true });
+  (0, import_node_fs25.rmSync)((0, import_node_path26.join)(reactAppRoot, "src/app/nx-welcome.component.tsx"), { force: true });
   const example = reactAppExampleFiles(name);
   for (const [relative, contents] of Object.entries(example)) {
-    writeFileEnsured((0, import_node_path24.join)(reactAppRoot, "src", relative), contents);
+    writeFileEnsured((0, import_node_path26.join)(reactAppRoot, "src", relative), contents);
   }
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 
 // src/project-scaffolding/react-lib.use-case.ts
-var import_node_path25 = require("path");
+var import_node_path27 = require("path");
 var REACT_LIB_BUNDLER = "rollup";
 async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
   ensurePlugin(workspaceRoot, "@nx/react");
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  const projectRoot = (0, import_node_path25.join)(workspaceRoot, "packages", name);
-  const publishableManifest = (0, import_node_path25.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path27.join)(workspaceRoot, "packages", name);
+  const publishableManifest = (0, import_node_path27.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -5835,14 +5910,18 @@ async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
       reshapeReactScaffold(projectRoot, name, options.empty === true);
       removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
       removeLocalRegistryScaffolding(workspaceRoot);
+      const pruned = pruneStaleLocalRegistry(workspaceRoot);
+      if (pruned.stale && pruned.status !== 0) {
+        logger.warn("Could not drop the unused local registry from package-lock.json: run `mnci upgrade` once the network is back.");
+      }
       registerProjectCommands(workspaceRoot, name, { build: true });
     }
   );
 }
 function addReactInternalLib(workspaceRoot, name, stack, empty = false) {
   ensurePlugin(workspaceRoot, "@nx/react");
-  const projectRoot = (0, import_node_path25.join)(workspaceRoot, "libs", name);
-  const privateManifest = (0, import_node_path25.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path27.join)(workspaceRoot, "libs", name);
+  const privateManifest = (0, import_node_path27.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -5869,8 +5948,8 @@ function addReactInternalLib(workspaceRoot, name, stack, empty = false) {
 }
 
 // src/project-scaffolding/vscode-extension.use-case.ts
-var import_node_fs24 = require("fs");
-var import_node_path26 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path28 = require("path");
 var VSCODE_EXTENSION_SCRIPT_PATH = "tools/vscode-extension.cjs";
 var VSCODE_ENGINE_FLOOR = "1.96.0";
 var VSCODE_SIDECAR_TARGETS = {
@@ -6055,8 +6134,8 @@ export const window = {
 var VSCODE_STUB_PATH = "test/vscode.stub.ts";
 function mapVscodeToStub(projectRoot, testRunner) {
   const [file, anchor, mapping] = testRunner === "jest" ? ["jest.config.cts", "testEnvironment: 'node',", `moduleNameMapper: { '^vscode$': '<rootDir>/${VSCODE_STUB_PATH}' },`] : ["vitest.config.mts", "environment: 'node',", `alias: { vscode: \`\${import.meta.dirname}/${VSCODE_STUB_PATH}\` },`];
-  const path = (0, import_node_path26.join)(projectRoot, file);
-  const content = fileExists(path) ? (0, import_node_fs24.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path28.join)(projectRoot, file);
+  const content = fileExists(path) ? (0, import_node_fs26.readFileSync)(path, "utf8") : "";
   const line = content.split("\n").find((candidate) => candidate.trim() === anchor);
   if (line === void 0) {
     throw new Error(`${file} has no "${anchor}" line to map the vscode module after; map 'vscode' to ${VSCODE_STUB_PATH} by hand.`);
@@ -6076,11 +6155,11 @@ function ensureVscodeToolchain(workspaceRoot) {
   }
 }
 function defaultPublisher(workspaceRoot) {
-  const { name } = readJson((0, import_node_path26.join)(workspaceRoot, "package.json"));
+  const { name } = readJson((0, import_node_path28.join)(workspaceRoot, "package.json"));
   return (name ?? "publisher").replace(/^@/, "").split("/", 1)[0];
 }
 function reshapeManifest(projectRoot, name, publisher) {
-  const manifestPath = (0, import_node_path26.join)(projectRoot, "package.json");
+  const manifestPath = (0, import_node_path28.join)(projectRoot, "package.json");
   const manifest = readJson(manifestPath);
   const { nx = {}, ...rest } = manifest;
   const targets = { ...nx.targets };
@@ -6144,11 +6223,11 @@ function vscodeExtensionPublishTarget(name, sidecar) {
   };
 }
 function addDebugLaunch(workspaceRoot, name) {
-  const file = (0, import_node_fs24.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
+  const file = (0, import_node_fs26.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
   if (file === void 0) {
     return;
   }
-  const path = (0, import_node_path26.join)(workspaceRoot, file);
+  const path = (0, import_node_path28.join)(workspaceRoot, file);
   const workspace = readCodeWorkspace(path) ?? {};
   const folder = `\${workspaceFolder:${workspace.folders?.[0]?.name ?? file.replace(/\.code-workspace$/, "")}}`;
   const taskLabel = `${name}: build (development)`;
@@ -6181,39 +6260,39 @@ function addDebugLaunch(workspaceRoot, name) {
   );
 }
 function refreshVscodeExtensionScript(workspaceRoot) {
-  const apps = (0, import_node_path26.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path28.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs24.readdirSync)(apps);
+    entries = (0, import_node_fs26.readdirSync)(apps);
   } catch {
     return false;
   }
   const hasExtension = entries.some((entry) => {
-    const manifestPath = (0, import_node_path26.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path28.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       return false;
     }
     const tags = readJson(manifestPath).nx?.tags ?? [];
     return tags.includes(VSCODE_EXTENSION_TAG);
   });
-  const path = (0, import_node_path26.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
-  if (!hasExtension || fileExists(path) && (0, import_node_fs24.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
+  const path = (0, import_node_path28.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
+  if (!hasExtension || fileExists(path) && (0, import_node_fs26.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
     return false;
   }
   writeFileEnsured(path, VSCODE_EXTENSION_SCRIPT);
   return true;
 }
 function pinVscodeExtensionProjectNames(workspaceRoot) {
-  const apps = (0, import_node_path26.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path28.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs24.readdirSync)(apps);
+    entries = (0, import_node_fs26.readdirSync)(apps);
   } catch {
     return [];
   }
   const updated = [];
   for (const entry of entries) {
-    const manifestPath = (0, import_node_path26.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path28.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       continue;
     }
@@ -6233,22 +6312,22 @@ function refreshLockFile(workspaceRoot, name) {
 }
 function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
   const { sidecar } = options;
-  if (sidecar !== void 0 && !fileExists((0, import_node_path26.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
+  if (sidecar !== void 0 && !fileExists((0, import_node_path28.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
     throw new Error(`--sidecar ${sidecar}: no Go app at apps/${sidecar}. Add it first with \`mnci add go-app ${sidecar}\`.`);
   }
   runNodeApp(workspaceRoot, name, stack, "none");
   ensureVscodeToolchain(workspaceRoot);
-  const projectRoot = (0, import_node_path26.join)(workspaceRoot, "apps", name);
+  const projectRoot = (0, import_node_path28.join)(workspaceRoot, "apps", name);
   reshapeManifest(projectRoot, name, options.publisher ?? defaultPublisher(workspaceRoot));
-  addVscodeTypes((0, import_node_path26.join)(projectRoot, "tsconfig.app.json"));
-  addVscodeTypes((0, import_node_path26.join)(projectRoot, "tsconfig.spec.json"));
-  writeFileEnsured((0, import_node_path26.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
-  writeFileEnsured((0, import_node_path26.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
-  writeFileEnsured((0, import_node_path26.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
+  addVscodeTypes((0, import_node_path28.join)(projectRoot, "tsconfig.app.json"));
+  addVscodeTypes((0, import_node_path28.join)(projectRoot, "tsconfig.spec.json"));
+  writeFileEnsured((0, import_node_path28.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
+  writeFileEnsured((0, import_node_path28.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
+  writeFileEnsured((0, import_node_path28.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
   mapVscodeToStub(projectRoot, stack.testRunner);
-  writeFileEnsured((0, import_node_path26.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
-  writeFileEnsured((0, import_node_path26.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
-  addNxTargets((0, import_node_path26.join)(projectRoot, "package.json"), {
+  writeFileEnsured((0, import_node_path28.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
+  writeFileEnsured((0, import_node_path28.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
+  addNxTargets((0, import_node_path28.join)(projectRoot, "package.json"), {
     "package": vscodeExtensionPackageTarget(name, sidecar),
     "nx-release-publish": vscodeExtensionPublishTarget(name, sidecar)
   });
@@ -6259,12 +6338,12 @@ function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
 }
 
 // src/dependency-management/install-dependencies.use-case.ts
-var import_node_fs26 = require("fs");
-var import_node_path28 = require("path");
+var import_node_fs28 = require("fs");
+var import_node_path30 = require("path");
 
 // src/dependency-management/manifest.repository.ts
-var import_node_fs25 = require("fs");
-var import_node_path27 = require("path");
+var import_node_fs27 = require("fs");
+var import_node_path29 = require("path");
 var ECOSYSTEMS = ["npm", "pip", "pub", "nuget", "go"];
 var ROOT_LABEL = "(root)";
 var MANIFEST_GLOBS = {
@@ -6297,23 +6376,23 @@ function projectOf(manifestRelativePath) {
 }
 function hasEcosystem(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path27.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path29.join)(workspaceRoot, "go.mod"));
   }
   if (ecosystem === "nuget") {
-    return (0, import_node_fs25.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
+    return (0, import_node_fs27.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
   }
   const rootMarker = {
     npm: "package.json",
     pip: "requirements-dev.txt",
     pub: "pubspec.yaml"
   };
-  return fileExists((0, import_node_path27.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs25.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+  return fileExists((0, import_node_path29.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs27.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
 }
 function collectNpm(workspaceRoot) {
   const sites = [];
-  const relativePaths = ["package.json", ...(0, import_node_fs25.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  const relativePaths = ["package.json", ...(0, import_node_fs27.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
   for (const relativePath of relativePaths) {
-    const manifestPath = (0, import_node_path27.join)(workspaceRoot, relativePath);
+    const manifestPath = (0, import_node_path29.join)(workspaceRoot, relativePath);
     try {
       const manifest = readJson(manifestPath);
       sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
@@ -6374,17 +6453,17 @@ function collectPip(workspaceRoot) {
       name: parsed.name,
       ecosystem: "pip",
       project: projectOf(relativePath),
-      manifestPath: (0, import_node_path27.join)(workspaceRoot, relativePath),
+      manifestPath: (0, import_node_path29.join)(workspaceRoot, relativePath),
       section,
       spec: parsed.spec,
       rewritable: parsed.rewritable && parsed.spec !== ""
     });
   };
-  const pyprojectPaths = (0, import_node_fs25.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  const pyprojectPaths = (0, import_node_fs27.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
   for (const relativePath of pyprojectPaths) {
     let content;
     try {
-      content = (0, import_node_fs25.readFileSync)((0, import_node_path27.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs27.readFileSync)((0, import_node_path29.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6395,14 +6474,14 @@ function collectPip(workspaceRoot) {
   }
   const requirementsPaths = [
     "requirements-dev.txt",
-    ...(0, import_node_fs25.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+    ...(0, import_node_fs27.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
   ];
   for (const relativePath of requirementsPaths) {
-    if (!fileExists((0, import_node_path27.join)(workspaceRoot, relativePath))) {
+    if (!fileExists((0, import_node_path29.join)(workspaceRoot, relativePath))) {
       continue;
     }
     const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
-    const lines = (0, import_node_fs25.readFileSync)((0, import_node_path27.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs27.readFileSync)((0, import_node_path29.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
     for (const line of lines) {
       push(relativePath, section, line);
     }
@@ -6440,11 +6519,11 @@ function pyprojectDependencies(content) {
 }
 function collectPub(workspaceRoot) {
   const sites = [];
-  const pubspecPaths = (0, import_node_fs25.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  const pubspecPaths = (0, import_node_fs27.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
   for (const relativePath of pubspecPaths) {
     let content;
     try {
-      content = (0, import_node_fs25.readFileSync)((0, import_node_path27.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs27.readFileSync)((0, import_node_path29.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6454,7 +6533,7 @@ function collectPub(workspaceRoot) {
           name: entry.name,
           ecosystem: "pub",
           project: projectOf(relativePath),
-          manifestPath: (0, import_node_path27.join)(workspaceRoot, relativePath),
+          manifestPath: (0, import_node_path29.join)(workspaceRoot, relativePath),
           section: block === "dependencies" ? "dep" : "devDep",
           spec: entry.spec,
           rewritable: entry.spec !== ""
@@ -6504,11 +6583,11 @@ function stripQuotes(value) {
 }
 function collectNuget(workspaceRoot) {
   const sites = [];
-  const csprojPaths = (0, import_node_fs25.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
+  const csprojPaths = (0, import_node_fs27.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
   for (const relativePath of csprojPaths) {
     let content;
     try {
-      content = (0, import_node_fs25.readFileSync)((0, import_node_path27.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs27.readFileSync)((0, import_node_path29.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6517,7 +6596,7 @@ function collectNuget(workspaceRoot) {
         name: entry.name,
         ecosystem: "nuget",
         project: projectOf(relativePath),
-        manifestPath: (0, import_node_path27.join)(workspaceRoot, relativePath),
+        manifestPath: (0, import_node_path29.join)(workspaceRoot, relativePath),
         section: "dep",
         spec: entry.spec,
         // A plain SemVer string is rewritable; an MSBuild property reference
@@ -6542,13 +6621,13 @@ function csprojPackageReferences(content) {
   return entries;
 }
 function collectGo(workspaceRoot) {
-  const manifestPath = (0, import_node_path27.join)(workspaceRoot, "go.mod");
+  const manifestPath = (0, import_node_path29.join)(workspaceRoot, "go.mod");
   if (!fileExists(manifestPath)) {
     return [];
   }
   let content;
   try {
-    content = (0, import_node_fs25.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs27.readFileSync)(manifestPath, "utf8");
   } catch {
     return [];
   }
@@ -6597,7 +6676,7 @@ var PROJECT_GLOBS = {
 function locateProjects(workspaceRoot) {
   const locations = [];
   for (const ecosystem of ECOSYSTEMS) {
-    const relativePaths = (0, import_node_fs25.globSync)(PROJECT_GLOBS[ecosystem], { cwd: workspaceRoot });
+    const relativePaths = (0, import_node_fs27.globSync)(PROJECT_GLOBS[ecosystem], { cwd: workspaceRoot });
     for (const relativePath of relativePaths) {
       const posix = toPosix(relativePath);
       const dir = posix.slice(0, posix.lastIndexOf("/"));
@@ -6605,7 +6684,7 @@ function locateProjects(workspaceRoot) {
         ecosystem,
         dir,
         name: dir.slice(dir.lastIndexOf("/") + 1),
-        manifestPath: (0, import_node_path27.join)(workspaceRoot, relativePath)
+        manifestPath: (0, import_node_path29.join)(workspaceRoot, relativePath)
       });
     }
   }
@@ -6626,7 +6705,7 @@ function rewriteSpec(site, spec) {
     writeFileEnsured(site.manifestPath, toJson(manifest));
     return true;
   }
-  const before = (0, import_node_fs25.readFileSync)(site.manifestPath, "utf8");
+  const before = (0, import_node_fs27.readFileSync)(site.manifestPath, "utf8");
   const after = (() => {
     switch (site.ecosystem) {
       case "pip": {
@@ -6717,13 +6796,13 @@ function escapeForRegex(value) {
 function isWorkspaceProject(workspaceRoot, name) {
   const short = name.includes("/") ? name.split("/").at(-1) : name;
   return ["apps", "libs", "packages"].some(
-    (directory) => fileExists((0, import_node_path27.join)(workspaceRoot, directory, short ?? name, "package.json"))
+    (directory) => fileExists((0, import_node_path29.join)(workspaceRoot, directory, short ?? name, "package.json"))
   );
 }
 function isAliasedInstall(workspaceRoot, name) {
   try {
     const installed = readJson(
-      (0, import_node_path27.join)(workspaceRoot, "node_modules", name, "package.json")
+      (0, import_node_path29.join)(workspaceRoot, "node_modules", name, "package.json")
     );
     return installed.name !== void 0 && installed.name !== name;
   } catch {
@@ -6734,14 +6813,14 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
   if (ecosystem === "npm") {
     try {
       return readJson(
-        (0, import_node_path27.join)(workspaceRoot, "node_modules", name, "package.json")
+        (0, import_node_path29.join)(workspaceRoot, "node_modules", name, "package.json")
       ).version;
     } catch {
       return void 0;
     }
   }
   if (ecosystem === "pub") {
-    const lockPath = (0, import_node_path27.join)(workspaceRoot, "pubspec.lock");
+    const lockPath = (0, import_node_path29.join)(workspaceRoot, "pubspec.lock");
     if (!fileExists(lockPath)) {
       return void 0;
     }
@@ -6749,7 +6828,7 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
       const match = new RegExp(
         String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
         "m"
-      ).exec((0, import_node_fs25.readFileSync)(lockPath, "utf8"));
+      ).exec((0, import_node_fs27.readFileSync)(lockPath, "utf8"));
       return match?.[1];
     } catch {
       return void 0;
@@ -6815,7 +6894,7 @@ function resolveTarget(locations, target) {
   return byName[0];
 }
 function installInto(workspaceRoot, location, packages, saveDev) {
-  const projectDir = (0, import_node_path28.join)(workspaceRoot, location.dir);
+  const projectDir = (0, import_node_path30.join)(workspaceRoot, location.dir);
   switch (location.ecosystem) {
     case "npm": {
       const flags = saveDev ? ["--save-dev"] : [];
@@ -6868,7 +6947,7 @@ function installInto(workspaceRoot, location, packages, saveDev) {
 function addPythonDependency(manifestPath, specifier) {
   let content;
   try {
-    content = (0, import_node_fs26.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs28.readFileSync)(manifestPath, "utf8");
   } catch {
     logger.warn(`Could not read ${manifestPath} \u2014 skipped ${specifier}`);
     return;
@@ -6897,7 +6976,7 @@ function installEverything(workspaceRoot, only) {
 }
 function ecosystemPresent(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path28.join)(workspaceRoot, "go.work")) || fileExists((0, import_node_path28.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path30.join)(workspaceRoot, "go.work")) || fileExists((0, import_node_path30.join)(workspaceRoot, "go.mod"));
   }
   return hasEcosystem(workspaceRoot, ecosystem);
 }
@@ -6916,7 +6995,7 @@ function splitAtLast(value, separator) {
 }
 
 // src/dependency-management/sync-dependencies.use-case.ts
-var import_node_path29 = require("path");
+var import_node_path31 = require("path");
 
 // src/dependency-management/semver.algorithm.ts
 var UPDATE_KINDS = ["patch", "minor", "major", "non-semver"];
@@ -7093,7 +7172,7 @@ function describe(finding) {
   return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
 }
 function runSync(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path29.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path31.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
     );
@@ -7143,7 +7222,7 @@ function runSync(workspaceRoot, options) {
 }
 
 // src/dependency-management/update-dependencies.use-case.ts
-var import_node_path30 = require("path");
+var import_node_path32 = require("path");
 var import_prompts2 = require("@inquirer/prompts");
 
 // src/dependency-management/registry.client.ts
@@ -7426,7 +7505,7 @@ function reinstall(workspaceRoot, ecosystems) {
 function hasPythonInstallScript(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path30.join)(workspaceRoot, "package.json")
+      (0, import_node_path32.join)(workspaceRoot, "package.json")
     );
     return manifest.scripts?.["python:install"] !== void 0;
   } catch {
@@ -7442,7 +7521,7 @@ function applyGoUpdates(workspaceRoot, entries) {
   }
 }
 async function runUp(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path30.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path32.join)(workspaceRoot, "nx.json"))) {
     throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
   }
   const ecosystems = resolveEcosystems(options.ecosystem);
@@ -7519,7 +7598,7 @@ var PROJECT_KINDS = [
 var EMPTY_KINDS = /* @__PURE__ */ new Set(["npm-lib", "internal-lib", "react-lib", "react-internal-lib", "node-function-app"]);
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path31.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path33.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
@@ -7582,8 +7661,8 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path31.join)(workspaceRoot, "libs", resolvedName, "package.json"));
-      renameScaffoldPlaceholder((0, import_node_path31.join)(workspaceRoot, "libs", resolvedName), resolvedName, options.empty === true);
+      markPrivate((0, import_node_path33.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      renameScaffoldPlaceholder((0, import_node_path33.join)(workspaceRoot, "libs", resolvedName), resolvedName, options.empty === true);
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -7675,7 +7754,7 @@ async function runAdd(kind, name, options) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path31.join)(workspaceRoot, "nx.json")
+    (0, import_node_path33.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -7724,15 +7803,15 @@ function runKinds(options) {
 
 // src/workspace-diagnostics/check-invariants.use-case.ts
 var import_node_child_process = require("child_process");
-var import_node_fs27 = require("fs");
-var import_node_path32 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_path34 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs27.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs27.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs29.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs29.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return [
@@ -7752,10 +7831,10 @@ function checkEslintConfigs(workspaceRoot) {
   ];
 }
 function checkEslintEntryPointReachesTheRules(workspaceRoot) {
-  const rules = (0, import_node_path32.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
-  if (!(0, import_node_fs27.existsSync)(rules)) return [];
-  const entryPoint = (0, import_node_path32.join)(workspaceRoot, ESLINT_USER_FILENAME);
-  const source = (0, import_node_fs27.existsSync)(entryPoint) ? (0, import_node_fs27.readFileSync)(entryPoint, "utf8") : "";
+  const rules = (0, import_node_path34.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
+  if (!(0, import_node_fs29.existsSync)(rules)) return [];
+  const entryPoint = (0, import_node_path34.join)(workspaceRoot, ESLINT_USER_FILENAME);
+  const source = (0, import_node_fs29.existsSync)(entryPoint) ? (0, import_node_fs29.readFileSync)(entryPoint, "utf8") : "";
   return [
     {
       check: `${ESLINT_USER_FILENAME} imports the mnci rules`,
@@ -7768,7 +7847,7 @@ function checkEslintEntryPointReachesTheRules(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path32.join)(workspaceRoot, "package.json")
+      (0, import_node_path34.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -7776,7 +7855,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path32.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path34.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -7802,7 +7881,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path32.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path34.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -7820,11 +7899,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path32.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path34.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs27.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs29.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -7841,11 +7920,11 @@ function checkNpmrc(workspaceRoot, registry, scope) {
   };
 }
 function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
-  const npmrcPath = (0, import_node_path32.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path34.join)(workspaceRoot, ".npmrc");
   if (!fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs27.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs29.readFileSync)(npmrcPath, "utf8");
   const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
   const referenced = [
     ...new Set(
@@ -7869,13 +7948,13 @@ function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env)
   };
 }
 function checkNpmAuthMatchesPipeline(workspaceRoot, registry) {
-  const npmrcPath = (0, import_node_path32.join)(workspaceRoot, ".npmrc");
-  const pipelinePath = (0, import_node_path32.join)(workspaceRoot, "azure-pipelines.yml");
+  const npmrcPath = (0, import_node_path34.join)(workspaceRoot, ".npmrc");
+  const pipelinePath = (0, import_node_path34.join)(workspaceRoot, "azure-pipelines.yml");
   if (registry?.kind !== "azure-artifacts" || !fileExists(npmrcPath) || !fileExists(pipelinePath)) {
     return void 0;
   }
-  const holdsCredentials = (0, import_node_fs27.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
-  const runsTask = (0, import_node_fs27.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
+  const holdsCredentials = (0, import_node_fs29.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const runsTask = (0, import_node_fs29.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
   if (!holdsCredentials && !runsTask) {
     return {
       check: "npm auth: .npmrc and azure-pipelines.yml agree",
@@ -7920,13 +7999,13 @@ function npmjsCredentialShape(credentials, environment) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs27.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs27.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
-    ...(0, import_node_fs27.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+    ...(0, import_node_fs29.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs29.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
+    ...(0, import_node_fs29.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path32.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path34.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -7955,7 +8034,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path32.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path34.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -7971,8 +8050,8 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs27.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs27.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+      ...(0, import_node_fs29.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs29.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
     ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
@@ -7987,7 +8066,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path32.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path34.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -8026,15 +8105,15 @@ function checkGoPluginRegistered(workspaceRoot) {
   };
 }
 function checkGoWorkInSync(workspaceRoot) {
-  const goWorkPath = (0, import_node_path32.join)(workspaceRoot, "go.work");
+  const goWorkPath = (0, import_node_path34.join)(workspaceRoot, "go.work");
   if (!fileExists(goWorkPath)) {
     return void 0;
   }
-  const contents = (0, import_node_fs27.existsSync)(goWorkPath) ? (0, import_node_fs27.readFileSync)(goWorkPath, "utf8") : "";
+  const contents = (0, import_node_fs29.existsSync)(goWorkPath) ? (0, import_node_fs29.readFileSync)(goWorkPath, "utf8") : "";
   const blockEntries = Array.from(contents.matchAll(/(?:^|\n)\s*use\s+\(([^)]*)\)/g), (match) => match[1].split("\n")).flat();
   const singleEntries = Array.from(contents.matchAll(/(?:^|\n)\s*use\s+(\.\S+)/g), (match) => match[1]);
   const uses = [...blockEntries, ...singleEntries].map((entry) => entry.trim()).filter(Boolean);
-  const stale = uses.filter((entry) => !(0, import_node_fs27.existsSync)((0, import_node_path32.join)(workspaceRoot, entry, "go.mod")));
+  const stale = uses.filter((entry) => !(0, import_node_fs29.existsSync)((0, import_node_path34.join)(workspaceRoot, entry, "go.mod")));
   return {
     check: "every go.work `use` entry points to a module that still exists",
     ok: stale.length === 0,
@@ -8050,9 +8129,9 @@ function checkNativeApps(workspaceRoot) {
     { file: ".github/workflows/ci.yml", marker: "native (${{ matrix.os }})" },
     { file: "azure-pipelines.yml", marker: "- job: native" }
   ];
-  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path32.join)(workspaceRoot, file))).map(({ file, marker }) => ({
+  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path34.join)(workspaceRoot, file))).map(({ file, marker }) => ({
     check: `${file} builds the native apps on every OS`,
-    ok: (0, import_node_fs27.readFileSync)((0, import_node_path32.join)(workspaceRoot, file), "utf8").includes(marker),
+    ok: (0, import_node_fs29.readFileSync)((0, import_node_path34.join)(workspaceRoot, file), "utf8").includes(marker),
     detail: `${file} has no native job: CI would verify a cgo app on the one agent that cannot build it`,
     remedy: "run `mnci upgrade`"
   }));
@@ -8065,7 +8144,7 @@ function checkNativeApps(workspaceRoot) {
   return findings;
 }
 function checkNoRootRuntimeDependencies(workspaceRoot) {
-  const manifestPath = (0, import_node_path32.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path34.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -8085,14 +8164,14 @@ function checkNoRootRuntimeDependencies(workspaceRoot) {
   };
 }
 function checkRollupSourceMaps(workspaceRoot) {
-  const configs = (0, import_node_fs27.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs29.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path32.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path34.join)(workspaceRoot, relativePath);
     let config;
     try {
-      config = (0, import_node_fs27.readFileSync)(configPath, "utf8");
+      config = (0, import_node_fs29.readFileSync)(configPath, "utf8");
     } catch {
       return [];
     }
@@ -8107,11 +8186,11 @@ function checkRollupSourceMaps(workspaceRoot) {
   });
 }
 function checkDeclarationSpecifiers(workspaceRoot) {
-  const configs = (0, import_node_fs27.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs29.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path32.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path34.join)(workspaceRoot, relativePath);
     if (!fileExists(configPath)) {
       return [];
     }
@@ -8146,8 +8225,8 @@ function checkDeclarationSpecifiers(workspaceRoot) {
 }
 function checkPipelinePhases(workspaceRoot) {
   const files = ["azure-pipelines.yml", ".github/workflows/ci.yml"];
-  return files.filter((file) => fileExists((0, import_node_path32.join)(workspaceRoot, file))).flatMap((file) => {
-    const { verifyActive, switchedOff } = inspectPipeline((0, import_node_fs27.readFileSync)((0, import_node_path32.join)(workspaceRoot, file), "utf8"));
+  return files.filter((file) => fileExists((0, import_node_path34.join)(workspaceRoot, file))).flatMap((file) => {
+    const { verifyActive, switchedOff } = inspectPipeline((0, import_node_fs29.readFileSync)((0, import_node_path34.join)(workspaceRoot, file), "utf8"));
     const verify = {
       check: `${file} runs the enforced verify phase`,
       ok: verifyActive,
@@ -8187,8 +8266,19 @@ function checkDependencyRangesNotPreserved(nxJson) {
     remedy: "run `mnci upgrade`, or set release.version.preserveMatchingDependencyRanges to false in nx.json"
   };
 }
+function checkLockfileHasNoLocalRegistry(workspaceRoot) {
+  if (!fileExists((0, import_node_path34.join)(workspaceRoot, "package-lock.json"))) {
+    return void 0;
+  }
+  return {
+    check: "package-lock.json carries no unused local registry (verdaccio)",
+    ok: !hasStaleLocalRegistry(workspaceRoot),
+    detail: "package-lock.json still holds verdaccio and its chain, which no manifest declares; npm audit reports high advisories (braces has no patched release) on packages nothing uses",
+    remedy: "run `mnci upgrade`, which removes it, then commit package-lock.json"
+  };
+}
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path32.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path34.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -8214,7 +8304,8 @@ function collectFindings(workspaceRoot) {
     ...checkNativeApps(workspaceRoot),
     ...checkPipelinePhases(workspaceRoot),
     ...checkNativeBuildConfig(workspaceRoot),
-    checkDependencyRangesNotPreserved(nxJson)
+    checkDependencyRangesNotPreserved(nxJson),
+    checkLockfileHasNoLocalRegistry(workspaceRoot)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot, options = {}) {
@@ -8320,11 +8411,11 @@ function runCommands(program, options) {
 }
 
 // src/workspace-info/list-projects.use-case.ts
-var import_node_path33 = require("path");
+var import_node_path35 = require("path");
 var TYPE_TAG_PREFIX = "type:";
 function listProjects(workspaceRoot) {
   return locateProjects(workspaceRoot).map((location) => {
-    const projectJsonPath = (0, import_node_path33.join)(workspaceRoot, location.dir, "project.json");
+    const projectJsonPath = (0, import_node_path35.join)(workspaceRoot, location.dir, "project.json");
     const project = fileExists(projectJsonPath) ? readJson(projectJsonPath) : {};
     const typeTag = (project.tags ?? []).find((tag) => tag.startsWith(TYPE_TAG_PREFIX));
     return {
@@ -8337,7 +8428,7 @@ function listProjects(workspaceRoot) {
   }).toSorted((a, b) => a.dir.localeCompare(b.dir));
 }
 function runProjects(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path33.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path35.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `projects` from the workspace root.");
   }
   const projects = listProjects(workspaceRoot);
@@ -8351,11 +8442,11 @@ function runProjects(workspaceRoot, options) {
 }
 
 // src/workspace-info/read-workspace-info.use-case.ts
-var import_node_path35 = require("path");
+var import_node_path37 = require("path");
 
 // src/cli-version/check-for-update.use-case.ts
-var import_node_fs28 = require("fs");
-var import_node_path34 = require("path");
+var import_node_fs30 = require("fs");
+var import_node_path36 = require("path");
 var import_cross_spawn3 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME2 = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -8414,8 +8505,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path34.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path36.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -8425,7 +8516,7 @@ function readCliVersion(packageDirectory) {
 // src/workspace-info/read-workspace-info.use-case.ts
 function readWorkspaceInfo(workspaceRoot, cliVersion) {
   const latest = fetchLatestVersion() ?? null;
-  const isWorkspace = fileExists((0, import_node_path35.join)(workspaceRoot, "nx.json"));
+  const isWorkspace = fileExists((0, import_node_path37.join)(workspaceRoot, "nx.json"));
   return {
     cli: {
       version: cliVersion,
@@ -8446,8 +8537,8 @@ function runInfo(workspaceRoot, cliVersion, options) {
 }
 
 // src/workspace-creation/adopt-directory.use-case.ts
-var import_node_fs29 = require("fs");
-var import_node_path36 = require("path");
+var import_node_fs31 = require("fs");
+var import_node_path38 = require("path");
 var NEVER_COPIED = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var AGENT_AND_CI_ENTRIES = [
   "AGENTS.md",
@@ -8478,13 +8569,13 @@ var PREFLIGHT_BLOCKERS = [
   "packages"
 ];
 function assertAdoptableDirectory(target) {
-  if (!(0, import_node_fs29.existsSync)(target)) {
+  if (!(0, import_node_fs31.existsSync)(target)) {
     throw new Error(`--into '${target}' does not exist. Create or clone it first.`);
   }
-  if (!(0, import_node_fs29.statSync)(target).isDirectory()) {
+  if (!(0, import_node_fs31.statSync)(target).isDirectory()) {
     throw new Error(`--into '${target}' is not a directory.`);
   }
-  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs29.existsSync)((0, import_node_path36.join)(target, entry)));
+  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs31.existsSync)((0, import_node_path38.join)(target, entry)));
   if (blockers.length > 0) {
     throw new Error(
       `--into '${target}' already holds ${blockers.join(", ")}, so it is a project already. Use \`mnci upgrade\` to re-apply the overlay to an existing workspace, or point --into at an empty checkout.`
@@ -8492,15 +8583,15 @@ function assertAdoptableDirectory(target) {
   }
 }
 function mergeGitignore(generatedFile, targetFile) {
-  const existing = (0, import_node_fs29.readFileSync)(targetFile, "utf8");
+  const existing = (0, import_node_fs31.readFileSync)(targetFile, "utf8");
   const present = new Set(existing.split("\n").map((line) => line.trim()));
-  const additions = (0, import_node_fs29.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
+  const additions = (0, import_node_fs31.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
     const trimmed = line.trim();
     return trimmed !== "" && !trimmed.startsWith("#") && !present.has(trimmed);
   });
   if (additions.length === 0) return false;
   const separator = existing.endsWith("\n") ? "" : "\n";
-  (0, import_node_fs29.writeFileSync)(
+  (0, import_node_fs31.writeFileSync)(
     targetFile,
     `${existing}${separator}
 # Added by mnci (Nx workspace)
@@ -8510,9 +8601,9 @@ ${additions.join("\n")}
   return true;
 }
 function adoptGeneratedWorkspace(generatedRoot, target) {
-  const entries = (0, import_node_fs29.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
+  const entries = (0, import_node_fs31.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
   const collisions = entries.filter(
-    (entry) => (0, import_node_fs29.existsSync)((0, import_node_path36.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
+    (entry) => (0, import_node_fs31.existsSync)((0, import_node_path38.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
   );
   if (collisions.length > 0) {
     throw new Error(
@@ -8521,28 +8612,28 @@ function adoptGeneratedWorkspace(generatedRoot, target) {
   }
   const result = { copied: [], kept: [], mergedGitignore: false };
   for (const entry of entries) {
-    const from = (0, import_node_path36.join)(generatedRoot, entry);
-    const to = (0, import_node_path36.join)(target, entry);
-    if (entry === ".gitignore" && (0, import_node_fs29.existsSync)(to)) {
+    const from = (0, import_node_path38.join)(generatedRoot, entry);
+    const to = (0, import_node_path38.join)(target, entry);
+    if (entry === ".gitignore" && (0, import_node_fs31.existsSync)(to)) {
       result.mergedGitignore = mergeGitignore(from, to);
       result.kept.push(entry);
       continue;
     }
-    if ((0, import_node_fs29.existsSync)(to)) {
+    if ((0, import_node_fs31.existsSync)(to)) {
       result.kept.push(entry);
       continue;
     }
-    (0, import_node_fs29.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs31.cpSync)(from, to, { recursive: true });
     result.copied.push(entry);
   }
-  (0, import_node_fs29.rmSync)(generatedRoot, { recursive: true, force: true });
+  (0, import_node_fs31.rmSync)(generatedRoot, { recursive: true, force: true });
   return result;
 }
 
 // src/workspace-creation/create-workspace.use-case.ts
-var import_node_fs30 = require("fs");
+var import_node_fs32 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path37 = require("path");
+var import_node_path39 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -8585,9 +8676,9 @@ async function resolveRegistry(options) {
   return await promptRegistry();
 }
 async function runNew(name, options) {
-  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path37.resolve)(process.cwd(), options.into);
+  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path39.resolve)(process.cwd(), options.into);
   if (adoptTarget !== void 0) assertAdoptableDirectory(adoptTarget);
-  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path37.basename)(adoptTarget));
+  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path39.basename)(adoptTarget));
   assertValidProjectName(workspaceName, "Workspace name");
   const scope = options.scope ?? (options.yes ? `@${workspaceName}` : await promptText("npm scope for publishable packages", `@${workspaceName}`));
   const registry = await resolveRegistry(options);
@@ -8600,8 +8691,8 @@ async function runNew(name, options) {
   const npmAuth = resolveNpmAuth(options.npmAuth, registry, ci);
   const stack = await resolveStack(options);
   const nxCloud = options.nxCloud ?? (options.yes ? false : await promptNxCloud());
-  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs30.mkdtempSync)((0, import_node_path37.join)((0, import_node_os2.tmpdir)(), "mnci-new-"));
-  let workspaceRoot = (0, import_node_path37.join)(stagingParent, workspaceName);
+  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs32.mkdtempSync)((0, import_node_path39.join)((0, import_node_os2.tmpdir)(), "mnci-new-"));
+  let workspaceRoot = (0, import_node_path39.join)(stagingParent, workspaceName);
   try {
     logger.step(`Creating Nx workspace '${workspaceName}' (preset: ts)`);
     runNpx(
@@ -8624,7 +8715,7 @@ async function runNew(name, options) {
       workspaceRoot = adoptTarget;
     }
   } finally {
-    if (adoptTarget !== void 0) (0, import_node_fs30.rmSync)(stagingParent, { recursive: true, force: true });
+    if (adoptTarget !== void 0) (0, import_node_fs32.rmSync)(stagingParent, { recursive: true, force: true });
   }
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
@@ -8634,8 +8725,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack, ...npmAuth && { npmAuth } },
     logger.detail
   );
-  (0, import_node_fs30.rmSync)((0, import_node_path37.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs30.rmSync)((0, import_node_path37.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs32.rmSync)((0, import_node_path39.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs32.rmSync)((0, import_node_path39.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -8673,12 +8764,12 @@ function projectKindHintLines(kinds = PROJECT_KINDS) {
 }
 
 // src/workspace-creation/interactive-wizard.use-case.ts
-var import_node_path39 = require("path");
+var import_node_path41 = require("path");
 var import_prompts4 = require("@inquirer/prompts");
 
 // src/workspace-upgrade/upgrade-workspace.use-case.ts
-var import_node_fs31 = require("fs");
-var import_node_path38 = require("path");
+var import_node_fs33 = require("fs");
+var import_node_path40 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -8707,7 +8798,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs31.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs33.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -8715,11 +8806,11 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path38.basename)(workspaceRoot);
+  return (0, import_node_path40.basename)(workspaceRoot);
 }
 function detectNpmAuth(workspaceRoot) {
   try {
-    return (0, import_node_fs31.readFileSync)((0, import_node_path38.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
+    return (0, import_node_fs33.readFileSync)((0, import_node_path40.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
   } catch {
     return void 0;
   }
@@ -8766,7 +8857,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path38.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path40.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -8789,6 +8880,13 @@ function runUpgrade(workspaceRoot, options) {
       logger.detail(`updated ${path}`);
     }
   }
+  const lockfile = pruneStaleLocalRegistry(workspaceRoot);
+  if (lockfile.stale) {
+    logger.step("Dropping the unused local registry (verdaccio) from package-lock.json");
+    if (lockfile.status !== 0) {
+      logger.warn("npm could not re-resolve the lockfile; run `npm install --package-lock-only` once you are online.");
+    }
+  }
   const goApps = addGoPlatformTargets(workspaceRoot);
   if (goApps.length > 0) {
     logger.step("Adding the six-platform build to Go apps (build-all, package-all)");
@@ -8832,7 +8930,7 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/workspace-creation/interactive-wizard.use-case.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path39.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path41.join)(process.cwd(), "nx.json"));
   const choiceNew = { name: "Create a new monorepo", value: "new" };
   const choiceAdd = { name: "Add a project to this workspace", value: "add" };
   const choiceUpgrade = {