@mnci/cli 4.49.0 → 4.50.0

package/dist/cli.js

@@ -3187,7 +3187,7 @@ function runPhase(phase, workspaceRoot, dependencies) {
 }
 
 // src/project-scaffolding/add-project.use-case.ts
-var import_node_path34 = require("path");
+var import_node_path35 = require("path");
 var import_prompts3 = require("@inquirer/prompts");
 
 // src/project-name/project-name.validator.ts
@@ -3372,7 +3372,10 @@ function findCodeWorkspaceFile(workspaceRoot) {
 function projectTask(name, kind) {
   const script = `${name}:${kind}`;
   const base = { label: `${name}: ${kind}`, type: "npm", script, problemMatcher: [] };
-  return kind === "start" ? { ...base, isBackground: true } : { ...base, group: kind };
+  if (kind === "start") {
+    return { ...base, isBackground: true };
+  }
+  return kind === "build" || kind === "qa" ? { ...base, group: kind } : base;
 }
 function renameScaffoldPlaceholder(projectRoot, name, empty = false) {
   reshapeScaffoldSlice(projectRoot, name, "ts", "use-case", empty);
@@ -3529,6 +3532,10 @@ function registerProjectCommands(workspaceRoot, name, commands) {
   if (commands.start) {
     scripts[`${name}:start`] = commands.start;
   }
+  const extraScripts = Object.entries(commands.extra ?? {});
+  for (const [suffix, command] of extraScripts) {
+    scripts[`${name}:${suffix}`] = command;
+  }
   const dependabotPath = (0, import_node_path11.join)(workspaceRoot, ".github/dependabot.yml");
   if ((0, import_node_fs13.existsSync)(dependabotPath)) {
     writeFileEnsured(dependabotPath, dependabotConfig(workspaceRoot));
@@ -3555,7 +3562,8 @@ function registerProjectCommands(workspaceRoot, name, commands) {
   const newTasks = [
     projectTask(name, "qa"),
     ...commands.build ? [projectTask(name, "build")] : [],
-    ...commands.start ? [projectTask(name, "start")] : []
+    ...commands.start ? [projectTask(name, "start")] : [],
+    ...Object.keys(commands.extra ?? {}).map((suffix) => projectTask(name, suffix))
   ];
   writeFileEnsured(
     codeWorkspacePath,
@@ -5862,10 +5870,229 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
   );
 }
 
-// src/project-scaffolding/react-app.use-case.ts
+// src/project-scaffolding/container.use-case.ts
 var import_node_fs26 = require("fs");
 var import_node_path27 = require("path");
 
+// src/project-scaffolding/container-image.algorithm.ts
+var CONTAINER_TARGETS = ["node-app", "react-app", "go-app"];
+var NGINX_SPA = `server {
+  listen 80;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}
+`;
+function planNode(app, port) {
+  const portLines = port === void 0 ? "" : `ENV HOST=0.0.0.0
+ENV PORT=${port}
+EXPOSE ${port}
+`;
+  return {
+    dockerfile: `# Written by MoNecromanCI. The build context is the app's pruned output (its manifest, lockfile and compiled
+# code), so the image holds only what the app needs to run.
+FROM node:24-alpine
+WORKDIR /app
+COPY . .
+RUN npm install --omit=dev --ignore-scripts --no-audit --no-fund
+ENV NODE_ENV=production
+${portLines}USER node
+CMD ["node", "main.js"]
+`,
+    dockerignore: "node_modules\n",
+    files: {},
+    contextDirectory: `apps/${app}/dist`,
+    dependsOn: "prune",
+    ...port !== void 0 && { publish: `${port}:${port}` }
+  };
+}
+function planReact(app) {
+  return {
+    dockerfile: `# Written by MoNecromanCI. The build context is the app's production build.
+FROM nginx:1.27-alpine
+COPY --from=files default.conf /etc/nginx/conf.d/default.conf
+COPY . /usr/share/nginx/html
+EXPOSE 80
+`,
+    dockerignore: "",
+    files: { "default.conf": NGINX_SPA },
+    contextDirectory: `apps/${app}/dist`,
+    dependsOn: "build",
+    publish: "8080:80"
+  };
+}
+function planGo(app, port) {
+  return {
+    dockerfile: `# Written by MoNecromanCI. The build context holds the app's static linux-amd64 binary from build-all.
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY ${app} /app
+${port === void 0 ? "" : `EXPOSE ${port}
+`}ENTRYPOINT ["/app"]
+`,
+    dockerignore: "",
+    files: {},
+    contextDirectory: `dist/platforms/${app}/linux-amd64`,
+    dependsOn: "build-all",
+    ...port !== void 0 && { publish: `${port}:${port}` }
+  };
+}
+function planContainer(target, app, port) {
+  switch (target) {
+    case "node-app": {
+      return planNode(app, port);
+    }
+    case "react-app": {
+      return planReact(app);
+    }
+    case "go-app": {
+      return planGo(app, port);
+    }
+  }
+}
+
+// src/project-scaffolding/container.use-case.ts
+var CONTAINER_TAG = "type:container";
+var CONTAINER_SCRIPT_PATH = "tools/container-image.cjs";
+var CONTAINER_SCRIPT = `// Written by MoNecromanCI; \`mnci upgrade\` rewrites it. Builds and runs a container image.
+//   node tools/container-image.cjs build --image <name> --file <Dockerfile> --context <dir> [--files <dir>]
+//   node tools/container-image.cjs start --image <name> [--publish <host:container>]
+const { spawnSync } = require('node:child_process')
+const { existsSync } = require('node:fs')
+
+const [command, ...rest] = process.argv.slice(2)
+const options = {}
+for (let index = 0; index < rest.length; index += 2) {
+  options[rest[index].replace(/^--/, '')] = rest[index + 1]
+}
+const version = process.env.VERSION || 'dev'
+
+/** Runs docker with the output shown, and exits with its status. */
+function docker (args) {
+  const result = spawnSync('docker', args, { stdio: 'inherit' })
+  if (result.error) {
+    console.error('Docker is not available: ' + result.error.message)
+    process.exit(1)
+  }
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1)
+  }
+}
+
+if (command === 'build') {
+  const args = ['build', '-f', options.file, '-t', options.image + ':' + version, '-t', options.image + ':latest']
+  if (options.files && existsSync(options.files)) {
+    args.push('--build-context', 'files=' + options.files)
+  }
+  args.push(options.context)
+  docker(args)
+} else if (command === 'start') {
+  const args = ['run', '--rm', '--init']
+  if (options.publish) {
+    args.push('-p', options.publish)
+  }
+  args.push(options.image + ':latest')
+  docker(args)
+} else {
+  console.error('usage: container-image.cjs build|start --image <name> ...')
+  process.exit(2)
+}
+`;
+function detectTarget(appRoot) {
+  if (fileExists((0, import_node_path27.join)(appRoot, "go.mod"))) {
+    return fileExists((0, import_node_path27.join)(appRoot, "host.json")) ? void 0 : "go-app";
+  }
+  const manifestPath = (0, import_node_path27.join)(appRoot, "package.json");
+  if (!fileExists(manifestPath) || fileExists((0, import_node_path27.join)(appRoot, "host.json"))) {
+    return void 0;
+  }
+  const manifest = readJson(manifestPath);
+  const declared = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies });
+  if (declared.includes("react") && fileExists((0, import_node_path27.join)(appRoot, "index.html"))) {
+    return "react-app";
+  }
+  return manifest.nx?.targets?.build?.executor === "@nx/esbuild:esbuild" ? "node-app" : void 0;
+}
+function containerTargets(name, appProject, plan) {
+  const build = [
+    "node",
+    CONTAINER_SCRIPT_PATH,
+    "build",
+    "--image",
+    name,
+    "--file",
+    `apps/${name}/Dockerfile`,
+    "--context",
+    plan.contextDirectory,
+    "--files",
+    `apps/${name}/files`
+  ].join(" ");
+  const start = ["node", CONTAINER_SCRIPT_PATH, "start", "--image", name, ...plan.publish === void 0 ? [] : ["--publish", plan.publish]].join(" ");
+  return {
+    // Not called `build`: CI runs every project's `build`, and building an image needs a Docker engine that
+    // an agent may not have (a Windows agent cannot run Linux images at all).
+    image: { executor: "nx:run-commands", cache: false, dependsOn: [`${appProject}:${plan.dependsOn}`], options: { command: build } },
+    start: { executor: "nx:run-commands", continuous: true, dependsOn: ["image"], options: { command: start } }
+  };
+}
+function addContainer(workspaceRoot, name, options) {
+  const appRoot = (0, import_node_path27.join)(workspaceRoot, "apps", options.app);
+  if (!fileExists(appRoot)) {
+    throw new Error(`--app ${options.app}: there is no apps/${options.app} to put in an image. Add the app first.`);
+  }
+  const target = detectTarget(appRoot);
+  if (target === void 0) {
+    throw new Error(`--app ${options.app}: apps/${options.app} is not an app an image is built for (${CONTAINER_TARGETS.join(", ")}). An Azure Functions app has its own host image and is not supported yet.`);
+  }
+  const plan = planContainer(target, options.app, options.port);
+  const appManifestPath = (0, import_node_path27.join)(appRoot, "package.json");
+  const appProject = fileExists(appManifestPath) ? readJson(appManifestPath).name : options.app;
+  const scope = appProject.startsWith("@") ? `${appProject.split("/", 1)[0]}/` : "";
+  const projectRoot = (0, import_node_path27.join)(workspaceRoot, "apps", name);
+  writeFileEnsured((0, import_node_path27.join)(projectRoot, "Dockerfile"), plan.dockerfile);
+  writeFileEnsured((0, import_node_path27.join)(projectRoot, "Dockerfile.dockerignore"), plan.dockerignore);
+  for (const [file, text] of Object.entries(plan.files)) {
+    writeFileEnsured((0, import_node_path27.join)(projectRoot, "files", file), text);
+  }
+  writeFileEnsured((0, import_node_path27.join)(workspaceRoot, CONTAINER_SCRIPT_PATH), CONTAINER_SCRIPT);
+  writeFileEnsured((0, import_node_path27.join)(projectRoot, "package.json"), toJson({
+    name: `${scope}${name}`,
+    version: "0.0.1",
+    private: true,
+    nx: { tags: [CONTAINER_TAG], implicitDependencies: [appProject], targets: containerTargets(name, appProject, plan) }
+  }));
+  registerProjectCommands(workspaceRoot, name, {
+    build: false,
+    start: `nx run ${name}:start`,
+    qa: `nx run ${name}:image`,
+    extra: { image: `nx run ${name}:image` }
+  });
+}
+function refreshContainerScript(workspaceRoot) {
+  let entries;
+  try {
+    entries = (0, import_node_fs26.readdirSync)((0, import_node_path27.join)(workspaceRoot, "apps"));
+  } catch {
+    return false;
+  }
+  const hasContainer = entries.some((entry) => {
+    const manifestPath = (0, import_node_path27.join)(workspaceRoot, "apps", entry, "package.json");
+    return fileExists(manifestPath) && (readJson(manifestPath).nx?.tags ?? []).includes(CONTAINER_TAG);
+  });
+  const path = (0, import_node_path27.join)(workspaceRoot, CONTAINER_SCRIPT_PATH);
+  if (!hasContainer || fileExists(path) && (0, import_node_fs26.readFileSync)(path, "utf8") === CONTAINER_SCRIPT) {
+    return false;
+  }
+  writeFileEnsured(path, CONTAINER_SCRIPT);
+  return true;
+}
+
+// src/project-scaffolding/react-app.use-case.ts
+var import_node_fs27 = require("fs");
+var import_node_path28 = require("path");
+
 // src/project-scaffolding/react-app-example.algorithm.ts
 function reactAppExampleFiles(name) {
   return {
@@ -5990,12 +6217,12 @@ function reactAppTargets(name) {
   return targets;
 }
 function allowEnvFiles(workspaceRoot) {
-  const gitignorePath = (0, import_node_path27.join)(workspaceRoot, ".gitignore");
+  const gitignorePath = (0, import_node_path28.join)(workspaceRoot, ".gitignore");
   if (!fileExists(gitignorePath)) {
     return;
   }
   const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
-  const current = (0, import_node_fs26.readFileSync)(gitignorePath, "utf8");
+  const current = (0, import_node_fs27.readFileSync)(gitignorePath, "utf8");
   if (current.includes(marker)) {
     return;
   }
@@ -6022,17 +6249,17 @@ function addReactApp(workspaceRoot, name, stack, e2e = false) {
     workspaceRoot
   );
   ensureAdmZip(workspaceRoot);
-  const reactAppRoot = (0, import_node_path27.join)(workspaceRoot, "apps", name);
+  const reactAppRoot = (0, import_node_path28.join)(workspaceRoot, "apps", name);
   for (const environment of REACT_ENVIRONMENTS) {
-    writeFileEnsured((0, import_node_path27.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+    writeFileEnsured((0, import_node_path28.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
   }
   allowEnvFiles(workspaceRoot);
-  addNxTargets((0, import_node_path27.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  addNxTargets((0, import_node_path28.join)(reactAppRoot, "package.json"), reactAppTargets(name));
   reshapeReactAppScaffold(reactAppRoot);
-  (0, import_node_fs26.rmSync)((0, import_node_path27.join)(reactAppRoot, "src/app/nx-welcome.component.tsx"), { force: true });
+  (0, import_node_fs27.rmSync)((0, import_node_path28.join)(reactAppRoot, "src/app/nx-welcome.component.tsx"), { force: true });
   const example = reactAppExampleFiles(name);
   for (const [relative, contents] of Object.entries(example)) {
-    writeFileEnsured((0, import_node_path27.join)(reactAppRoot, "src", relative), contents);
+    writeFileEnsured((0, import_node_path28.join)(reactAppRoot, "src", relative), contents);
   }
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
@@ -6042,9 +6269,9 @@ function addReactApp(workspaceRoot, name, stack, e2e = false) {
 }
 function pairE2eProject(workspaceRoot, name) {
   const e2eName = `${name}-e2e`;
-  const e2eRoot = (0, import_node_path27.join)(workspaceRoot, "apps", e2eName);
-  (0, import_node_fs26.rmSync)((0, import_node_path27.join)(e2eRoot, "src/example.spec.ts"), { force: true });
-  writeFileEnsured((0, import_node_path27.join)(e2eRoot, "src/greeting.e2e.spec.ts"), reactAppE2eSpec(name));
+  const e2eRoot = (0, import_node_path28.join)(workspaceRoot, "apps", e2eName);
+  (0, import_node_fs27.rmSync)((0, import_node_path28.join)(e2eRoot, "src/example.spec.ts"), { force: true });
+  writeFileEnsured((0, import_node_path28.join)(e2eRoot, "src/greeting.e2e.spec.ts"), reactAppE2eSpec(name));
   removeGeneratedEslintConfig(workspaceRoot, `apps/${e2eName}`);
   registerProjectCommands(workspaceRoot, e2eName, {
     build: false,
@@ -6053,13 +6280,13 @@ function pairE2eProject(workspaceRoot, name) {
 }
 
 // src/project-scaffolding/react-lib.use-case.ts
-var import_node_path28 = require("path");
+var import_node_path29 = require("path");
 var REACT_LIB_BUNDLER = "rollup";
 async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
   ensurePlugin(workspaceRoot, "@nx/react");
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
-  const projectRoot = (0, import_node_path28.join)(workspaceRoot, "packages", name);
-  const publishableManifest = (0, import_node_path28.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path29.join)(workspaceRoot, "packages", name);
+  const publishableManifest = (0, import_node_path29.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -6103,8 +6330,8 @@ function dropNxProjectName(manifestPath) {
 }
 function addReactInternalLib(workspaceRoot, name, stack, empty = false) {
   ensurePlugin(workspaceRoot, "@nx/react");
-  const projectRoot = (0, import_node_path28.join)(workspaceRoot, "libs", name);
-  const privateManifest = (0, import_node_path28.join)(projectRoot, "package.json");
+  const projectRoot = (0, import_node_path29.join)(workspaceRoot, "libs", name);
+  const privateManifest = (0, import_node_path29.join)(projectRoot, "package.json");
   runGeneratorAndRepair(
     workspaceRoot,
     [
@@ -6131,8 +6358,8 @@ function addReactInternalLib(workspaceRoot, name, stack, empty = false) {
 }
 
 // src/project-scaffolding/vscode-extension.use-case.ts
-var import_node_fs27 = require("fs");
-var import_node_path29 = require("path");
+var import_node_fs28 = require("fs");
+var import_node_path30 = require("path");
 var VSCODE_EXTENSION_SCRIPT_PATH = "tools/vscode-extension.cjs";
 var VSCODE_ENGINE_FLOOR = "1.96.0";
 var VSCODE_SIDECAR_TARGETS = {
@@ -6317,8 +6544,8 @@ export const window = {
 var VSCODE_STUB_PATH = "test/vscode.stub.ts";
 function mapVscodeToStub(projectRoot, testRunner) {
   const [file, anchor, mapping] = testRunner === "jest" ? ["jest.config.cts", "testEnvironment: 'node',", `moduleNameMapper: { '^vscode$': '<rootDir>/${VSCODE_STUB_PATH}' },`] : ["vitest.config.mts", "environment: 'node',", `alias: { vscode: \`\${import.meta.dirname}/${VSCODE_STUB_PATH}\` },`];
-  const path = (0, import_node_path29.join)(projectRoot, file);
-  const content = fileExists(path) ? (0, import_node_fs27.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path30.join)(projectRoot, file);
+  const content = fileExists(path) ? (0, import_node_fs28.readFileSync)(path, "utf8") : "";
   const line = content.split("\n").find((candidate) => candidate.trim() === anchor);
   if (line === void 0) {
     throw new Error(`${file} has no "${anchor}" line to map the vscode module after; map 'vscode' to ${VSCODE_STUB_PATH} by hand.`);
@@ -6338,11 +6565,11 @@ function ensureVscodeToolchain(workspaceRoot) {
   }
 }
 function defaultPublisher(workspaceRoot) {
-  const { name } = readJson((0, import_node_path29.join)(workspaceRoot, "package.json"));
+  const { name } = readJson((0, import_node_path30.join)(workspaceRoot, "package.json"));
   return (name ?? "publisher").replace(/^@/, "").split("/", 1)[0];
 }
 function reshapeManifest(projectRoot, name, publisher) {
-  const manifestPath = (0, import_node_path29.join)(projectRoot, "package.json");
+  const manifestPath = (0, import_node_path30.join)(projectRoot, "package.json");
   const manifest = readJson(manifestPath);
   const { nx = {}, ...rest } = manifest;
   const targets = { ...nx.targets };
@@ -6406,11 +6633,11 @@ function vscodeExtensionPublishTarget(name, sidecar) {
   };
 }
 function addDebugLaunch(workspaceRoot, name) {
-  const file = (0, import_node_fs27.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
+  const file = (0, import_node_fs28.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
   if (file === void 0) {
     return;
   }
-  const path = (0, import_node_path29.join)(workspaceRoot, file);
+  const path = (0, import_node_path30.join)(workspaceRoot, file);
   const workspace = readCodeWorkspace(path) ?? {};
   const folder = `\${workspaceFolder:${workspace.folders?.[0]?.name ?? file.replace(/\.code-workspace$/, "")}}`;
   const taskLabel = `${name}: build (development)`;
@@ -6443,39 +6670,39 @@ function addDebugLaunch(workspaceRoot, name) {
   );
 }
 function refreshVscodeExtensionScript(workspaceRoot) {
-  const apps = (0, import_node_path29.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path30.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs27.readdirSync)(apps);
+    entries = (0, import_node_fs28.readdirSync)(apps);
   } catch {
     return false;
   }
   const hasExtension = entries.some((entry) => {
-    const manifestPath = (0, import_node_path29.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path30.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       return false;
     }
     const tags = readJson(manifestPath).nx?.tags ?? [];
     return tags.includes(VSCODE_EXTENSION_TAG);
   });
-  const path = (0, import_node_path29.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
-  if (!hasExtension || fileExists(path) && (0, import_node_fs27.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
+  const path = (0, import_node_path30.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
+  if (!hasExtension || fileExists(path) && (0, import_node_fs28.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
     return false;
   }
   writeFileEnsured(path, VSCODE_EXTENSION_SCRIPT);
   return true;
 }
 function pinVscodeExtensionProjectNames(workspaceRoot) {
-  const apps = (0, import_node_path29.join)(workspaceRoot, "apps");
+  const apps = (0, import_node_path30.join)(workspaceRoot, "apps");
   let entries;
   try {
-    entries = (0, import_node_fs27.readdirSync)(apps);
+    entries = (0, import_node_fs28.readdirSync)(apps);
   } catch {
     return [];
   }
   const updated = [];
   for (const entry of entries) {
-    const manifestPath = (0, import_node_path29.join)(apps, entry, "package.json");
+    const manifestPath = (0, import_node_path30.join)(apps, entry, "package.json");
     if (!fileExists(manifestPath)) {
       continue;
     }
@@ -6495,22 +6722,22 @@ function refreshLockFile(workspaceRoot, name) {
 }
 function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
   const { sidecar } = options;
-  if (sidecar !== void 0 && !fileExists((0, import_node_path29.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
+  if (sidecar !== void 0 && !fileExists((0, import_node_path30.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
     throw new Error(`--sidecar ${sidecar}: no Go app at apps/${sidecar}. Add it first with \`mnci add go-app ${sidecar}\`.`);
   }
   runNodeApp(workspaceRoot, name, stack, "none");
   ensureVscodeToolchain(workspaceRoot);
-  const projectRoot = (0, import_node_path29.join)(workspaceRoot, "apps", name);
+  const projectRoot = (0, import_node_path30.join)(workspaceRoot, "apps", name);
   reshapeManifest(projectRoot, name, options.publisher ?? defaultPublisher(workspaceRoot));
-  addVscodeTypes((0, import_node_path29.join)(projectRoot, "tsconfig.app.json"));
-  addVscodeTypes((0, import_node_path29.join)(projectRoot, "tsconfig.spec.json"));
-  writeFileEnsured((0, import_node_path29.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
-  writeFileEnsured((0, import_node_path29.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
-  writeFileEnsured((0, import_node_path29.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
+  addVscodeTypes((0, import_node_path30.join)(projectRoot, "tsconfig.app.json"));
+  addVscodeTypes((0, import_node_path30.join)(projectRoot, "tsconfig.spec.json"));
+  writeFileEnsured((0, import_node_path30.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
+  writeFileEnsured((0, import_node_path30.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
+  writeFileEnsured((0, import_node_path30.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
   mapVscodeToStub(projectRoot, stack.testRunner);
-  writeFileEnsured((0, import_node_path29.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
-  writeFileEnsured((0, import_node_path29.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
-  addNxTargets((0, import_node_path29.join)(projectRoot, "package.json"), {
+  writeFileEnsured((0, import_node_path30.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
+  writeFileEnsured((0, import_node_path30.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
+  addNxTargets((0, import_node_path30.join)(projectRoot, "package.json"), {
     "package": vscodeExtensionPackageTarget(name, sidecar),
     "nx-release-publish": vscodeExtensionPublishTarget(name, sidecar)
   });
@@ -6521,12 +6748,12 @@ function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
 }
 
 // src/dependency-management/install-dependencies.use-case.ts
-var import_node_fs29 = require("fs");
-var import_node_path31 = require("path");
+var import_node_fs30 = require("fs");
+var import_node_path32 = require("path");
 
 // src/dependency-management/manifest.repository.ts
-var import_node_fs28 = require("fs");
-var import_node_path30 = require("path");
+var import_node_fs29 = require("fs");
+var import_node_path31 = require("path");
 var ECOSYSTEMS = ["npm", "pip", "pub", "nuget", "go"];
 var ROOT_LABEL = "(root)";
 var MANIFEST_GLOBS = {
@@ -6559,23 +6786,23 @@ function projectOf(manifestRelativePath) {
 }
 function hasEcosystem(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path30.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path31.join)(workspaceRoot, "go.mod"));
   }
   if (ecosystem === "nuget") {
-    return (0, import_node_fs28.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
+    return (0, import_node_fs29.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
   }
   const rootMarker = {
     npm: "package.json",
     pip: "requirements-dev.txt",
     pub: "pubspec.yaml"
   };
-  return fileExists((0, import_node_path30.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs28.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+  return fileExists((0, import_node_path31.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs29.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
 }
 function collectNpm(workspaceRoot) {
   const sites = [];
-  const relativePaths = ["package.json", ...(0, import_node_fs28.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  const relativePaths = ["package.json", ...(0, import_node_fs29.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
   for (const relativePath of relativePaths) {
-    const manifestPath = (0, import_node_path30.join)(workspaceRoot, relativePath);
+    const manifestPath = (0, import_node_path31.join)(workspaceRoot, relativePath);
     try {
       const manifest = readJson(manifestPath);
       sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
@@ -6636,17 +6863,17 @@ function collectPip(workspaceRoot) {
       name: parsed.name,
       ecosystem: "pip",
       project: projectOf(relativePath),
-      manifestPath: (0, import_node_path30.join)(workspaceRoot, relativePath),
+      manifestPath: (0, import_node_path31.join)(workspaceRoot, relativePath),
       section,
       spec: parsed.spec,
       rewritable: parsed.rewritable && parsed.spec !== ""
     });
   };
-  const pyprojectPaths = (0, import_node_fs28.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  const pyprojectPaths = (0, import_node_fs29.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
   for (const relativePath of pyprojectPaths) {
     let content;
     try {
-      content = (0, import_node_fs28.readFileSync)((0, import_node_path30.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs29.readFileSync)((0, import_node_path31.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6657,14 +6884,14 @@ function collectPip(workspaceRoot) {
   }
   const requirementsPaths = [
     "requirements-dev.txt",
-    ...(0, import_node_fs28.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+    ...(0, import_node_fs29.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
   ];
   for (const relativePath of requirementsPaths) {
-    if (!fileExists((0, import_node_path30.join)(workspaceRoot, relativePath))) {
+    if (!fileExists((0, import_node_path31.join)(workspaceRoot, relativePath))) {
       continue;
     }
     const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
-    const lines = (0, import_node_fs28.readFileSync)((0, import_node_path30.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs29.readFileSync)((0, import_node_path31.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
     for (const line of lines) {
       push(relativePath, section, line);
     }
@@ -6702,11 +6929,11 @@ function pyprojectDependencies(content) {
 }
 function collectPub(workspaceRoot) {
   const sites = [];
-  const pubspecPaths = (0, import_node_fs28.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  const pubspecPaths = (0, import_node_fs29.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
   for (const relativePath of pubspecPaths) {
     let content;
     try {
-      content = (0, import_node_fs28.readFileSync)((0, import_node_path30.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs29.readFileSync)((0, import_node_path31.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6716,7 +6943,7 @@ function collectPub(workspaceRoot) {
           name: entry.name,
           ecosystem: "pub",
           project: projectOf(relativePath),
-          manifestPath: (0, import_node_path30.join)(workspaceRoot, relativePath),
+          manifestPath: (0, import_node_path31.join)(workspaceRoot, relativePath),
           section: block === "dependencies" ? "dep" : "devDep",
           spec: entry.spec,
           rewritable: entry.spec !== ""
@@ -6766,11 +6993,11 @@ function stripQuotes(value) {
 }
 function collectNuget(workspaceRoot) {
   const sites = [];
-  const csprojPaths = (0, import_node_fs28.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
+  const csprojPaths = (0, import_node_fs29.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
   for (const relativePath of csprojPaths) {
     let content;
     try {
-      content = (0, import_node_fs28.readFileSync)((0, import_node_path30.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs29.readFileSync)((0, import_node_path31.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -6779,7 +7006,7 @@ function collectNuget(workspaceRoot) {
         name: entry.name,
         ecosystem: "nuget",
         project: projectOf(relativePath),
-        manifestPath: (0, import_node_path30.join)(workspaceRoot, relativePath),
+        manifestPath: (0, import_node_path31.join)(workspaceRoot, relativePath),
         section: "dep",
         spec: entry.spec,
         // A plain SemVer string is rewritable; an MSBuild property reference
@@ -6804,13 +7031,13 @@ function csprojPackageReferences(content) {
   return entries;
 }
 function collectGo(workspaceRoot) {
-  const manifestPath = (0, import_node_path30.join)(workspaceRoot, "go.mod");
+  const manifestPath = (0, import_node_path31.join)(workspaceRoot, "go.mod");
   if (!fileExists(manifestPath)) {
     return [];
   }
   let content;
   try {
-    content = (0, import_node_fs28.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs29.readFileSync)(manifestPath, "utf8");
   } catch {
     return [];
   }
@@ -6859,7 +7086,7 @@ var PROJECT_GLOBS = {
 function locateProjects(workspaceRoot) {
   const locations = [];
   for (const ecosystem of ECOSYSTEMS) {
-    const relativePaths = (0, import_node_fs28.globSync)(PROJECT_GLOBS[ecosystem], { cwd: workspaceRoot });
+    const relativePaths = (0, import_node_fs29.globSync)(PROJECT_GLOBS[ecosystem], { cwd: workspaceRoot });
     for (const relativePath of relativePaths) {
       const posix = toPosix(relativePath);
       const dir = posix.slice(0, posix.lastIndexOf("/"));
@@ -6867,7 +7094,7 @@ function locateProjects(workspaceRoot) {
         ecosystem,
         dir,
         name: dir.slice(dir.lastIndexOf("/") + 1),
-        manifestPath: (0, import_node_path30.join)(workspaceRoot, relativePath)
+        manifestPath: (0, import_node_path31.join)(workspaceRoot, relativePath)
       });
     }
   }
@@ -6888,7 +7115,7 @@ function rewriteSpec(site, spec) {
     writeFileEnsured(site.manifestPath, toJson(manifest));
     return true;
   }
-  const before = (0, import_node_fs28.readFileSync)(site.manifestPath, "utf8");
+  const before = (0, import_node_fs29.readFileSync)(site.manifestPath, "utf8");
   const after = (() => {
     switch (site.ecosystem) {
       case "pip": {
@@ -6979,13 +7206,13 @@ function escapeForRegex(value) {
 function isWorkspaceProject(workspaceRoot, name) {
   const short = name.includes("/") ? name.split("/").at(-1) : name;
   return ["apps", "libs", "packages"].some(
-    (directory) => fileExists((0, import_node_path30.join)(workspaceRoot, directory, short ?? name, "package.json"))
+    (directory) => fileExists((0, import_node_path31.join)(workspaceRoot, directory, short ?? name, "package.json"))
   );
 }
 function isAliasedInstall(workspaceRoot, name) {
   try {
     const installed = readJson(
-      (0, import_node_path30.join)(workspaceRoot, "node_modules", name, "package.json")
+      (0, import_node_path31.join)(workspaceRoot, "node_modules", name, "package.json")
     );
     return installed.name !== void 0 && installed.name !== name;
   } catch {
@@ -6996,14 +7223,14 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
   if (ecosystem === "npm") {
     try {
       return readJson(
-        (0, import_node_path30.join)(workspaceRoot, "node_modules", name, "package.json")
+        (0, import_node_path31.join)(workspaceRoot, "node_modules", name, "package.json")
       ).version;
     } catch {
       return void 0;
     }
   }
   if (ecosystem === "pub") {
-    const lockPath = (0, import_node_path30.join)(workspaceRoot, "pubspec.lock");
+    const lockPath = (0, import_node_path31.join)(workspaceRoot, "pubspec.lock");
     if (!fileExists(lockPath)) {
       return void 0;
     }
@@ -7011,7 +7238,7 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
       const match = new RegExp(
         String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
         "m"
-      ).exec((0, import_node_fs28.readFileSync)(lockPath, "utf8"));
+      ).exec((0, import_node_fs29.readFileSync)(lockPath, "utf8"));
       return match?.[1];
     } catch {
       return void 0;
@@ -7077,7 +7304,7 @@ function resolveTarget(locations, target) {
   return byName[0];
 }
 function installInto(workspaceRoot, location, packages, saveDev) {
-  const projectDir = (0, import_node_path31.join)(workspaceRoot, location.dir);
+  const projectDir = (0, import_node_path32.join)(workspaceRoot, location.dir);
   switch (location.ecosystem) {
     case "npm": {
       const flags = saveDev ? ["--save-dev"] : [];
@@ -7130,7 +7357,7 @@ function installInto(workspaceRoot, location, packages, saveDev) {
 function addPythonDependency(manifestPath, specifier) {
   let content;
   try {
-    content = (0, import_node_fs29.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs30.readFileSync)(manifestPath, "utf8");
   } catch {
     logger.warn(`Could not read ${manifestPath} \u2014 skipped ${specifier}`);
     return;
@@ -7159,7 +7386,7 @@ function installEverything(workspaceRoot, only) {
 }
 function ecosystemPresent(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path31.join)(workspaceRoot, "go.work")) || fileExists((0, import_node_path31.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path32.join)(workspaceRoot, "go.work")) || fileExists((0, import_node_path32.join)(workspaceRoot, "go.mod"));
   }
   return hasEcosystem(workspaceRoot, ecosystem);
 }
@@ -7178,7 +7405,7 @@ function splitAtLast(value, separator) {
 }
 
 // src/dependency-management/sync-dependencies.use-case.ts
-var import_node_path32 = require("path");
+var import_node_path33 = require("path");
 
 // src/dependency-management/semver.algorithm.ts
 var UPDATE_KINDS = ["patch", "minor", "major", "non-semver"];
@@ -7355,7 +7582,7 @@ function describe(finding) {
   return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
 }
 function runSync(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path32.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path33.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
     );
@@ -7405,7 +7632,7 @@ function runSync(workspaceRoot, options) {
 }
 
 // src/dependency-management/update-dependencies.use-case.ts
-var import_node_path33 = require("path");
+var import_node_path34 = require("path");
 var import_prompts2 = require("@inquirer/prompts");
 
 // src/dependency-management/registry.client.ts
@@ -7688,7 +7915,7 @@ function reinstall(workspaceRoot, ecosystems) {
 function hasPythonInstallScript(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path33.join)(workspaceRoot, "package.json")
+      (0, import_node_path34.join)(workspaceRoot, "package.json")
     );
     return manifest.scripts?.["python:install"] !== void 0;
   } catch {
@@ -7704,7 +7931,7 @@ function applyGoUpdates(workspaceRoot, entries) {
   }
 }
 async function runUp(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path33.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path34.join)(workspaceRoot, "nx.json"))) {
     throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
   }
   const ecosystems = resolveEcosystems(options.ecosystem);
@@ -7776,12 +8003,13 @@ var PROJECT_KINDS = [
   "csharp-function-app",
   "csharp-lib",
   "csharp-internal-lib",
-  "vscode-extension"
+  "vscode-extension",
+  "container"
 ];
 var EMPTY_KINDS = /* @__PURE__ */ new Set(["npm-lib", "internal-lib", "react-lib", "react-internal-lib", "node-function-app"]);
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path34.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path35.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
@@ -7810,6 +8038,17 @@ async function runAdd(kind, name, options) {
       throw new Error(`--esm is not supported with --framework ${options.framework}: its layout (autoloaded routes, decorators) is mandated by the framework. Use express, koa or none.`);
     }
   }
+  if (resolvedKind === "container" && options.app === void 0) {
+    throw new Error("container needs --app <project>: the app to put in an image, for example `mnci add container api-image --app api`.");
+  }
+  for (const [flag, requested] of [["--app", options.app !== void 0], ["--port", options.port !== void 0]]) {
+    if (resolvedKind !== "container" && requested) {
+      throw new Error(`${flag} applies to container, not ${resolvedKind}.`);
+    }
+  }
+  if (options.port !== void 0 && !/^\d+$/.test(options.port)) {
+    throw new Error(`--port ${options.port}: a port is a whole number.`);
+  }
   if (resolvedKind !== "react-app" && options.e2e === true) {
     throw new Error(`--e2e applies to react-app, not ${resolvedKind}.`);
   }
@@ -7855,8 +8094,8 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path34.join)(workspaceRoot, "libs", resolvedName, "package.json"));
-      renameScaffoldPlaceholder((0, import_node_path34.join)(workspaceRoot, "libs", resolvedName), resolvedName, options.empty === true);
+      markPrivate((0, import_node_path35.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      renameScaffoldPlaceholder((0, import_node_path35.join)(workspaceRoot, "libs", resolvedName), resolvedName, options.empty === true);
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -7877,6 +8116,10 @@ async function runAdd(kind, name, options) {
       addPythonInternalLib(workspaceRoot, resolvedName);
       break;
     }
+    case "container": {
+      addContainer(workspaceRoot, resolvedName, { app: options.app, port: options.port === void 0 ? void 0 : Number(options.port) });
+      break;
+    }
     case "go-app": {
       addGoApp(workspaceRoot, resolvedName, { release: options.release, cgo: options.cgo, web: options.web });
       break;
@@ -7948,7 +8191,7 @@ async function runAdd(kind, name, options) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path34.join)(workspaceRoot, "nx.json")
+    (0, import_node_path35.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -7965,6 +8208,7 @@ var PROJECT_KIND_CATALOG = [
   { kind: "node-function-app", language: "typescript", label: "Node function app", description: "An Azure Functions (v4) app in TypeScript", flags: ["empty", "esm"], requiredFlags: [] },
   { kind: "npm-lib", language: "typescript", label: "npm library", description: "A library published to npm, bundled with Rollup", flags: ["scope", "empty"], requiredFlags: [] },
   { kind: "internal-lib", language: "typescript", label: "Internal library", description: "A private TypeScript library for apps in this workspace", flags: ["empty"], requiredFlags: [] },
+  { kind: "container", language: "container", label: "Container image", description: "A Dockerfile and image targets for an existing Node, React or Go app", flags: ["app", "port"], requiredFlags: ["app"] },
   { kind: "vscode-extension", language: "typescript", label: "VS Code extension", description: "A bundled Marketplace extension, optionally shipping a Go sidecar", flags: ["publisher", "sidecar"], requiredFlags: [] },
   { kind: "python-app", language: "python", label: "Python app", description: "A pip-native Python application (Ruff, pytest)", flags: [], requiredFlags: [] },
   { kind: "python-function-app", language: "python", label: "Python function app", description: "An Azure Functions (v2 model) app in Python", flags: [], requiredFlags: [] },
@@ -7997,12 +8241,12 @@ function runKinds(options) {
 
 // src/workspace-diagnostics/check-invariants.use-case.ts
 var import_node_child_process = require("child_process");
-var import_node_fs31 = require("fs");
-var import_node_path36 = require("path");
+var import_node_fs32 = require("fs");
+var import_node_path37 = require("path");
 
 // src/workspace-diagnostics/locate-stranded-release-tags.use-case.ts
-var import_node_fs30 = require("fs");
-var import_node_path35 = require("path");
+var import_node_fs31 = require("fs");
+var import_node_path36 = require("path");
 
 // src/workspace-diagnostics/stranded-release-tags.algorithm.ts
 function compareVersions2(left, right) {
@@ -8039,7 +8283,7 @@ function locateStrandedReleaseTags(workspaceRoot, tagPattern) {
   if (listed.status !== 0) {
     return [];
   }
-  const projects = (0, import_node_fs30.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot }).map((path) => readJson((0, import_node_path35.join)(workspaceRoot, path))).filter((manifest) => manifest.private !== true && manifest.name !== void 0).map((manifest) => manifest.name);
+  const projects = (0, import_node_fs31.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot }).map((path) => readJson((0, import_node_path36.join)(workspaceRoot, path))).filter((manifest) => manifest.private !== true && manifest.name !== void 0).map((manifest) => manifest.name);
   return findStrandedReleaseTags(projects, listed.stdout.split(/\r?\n/).filter(Boolean));
 }
 
@@ -8049,8 +8293,8 @@ function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs31.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs31.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs32.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs32.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return [
@@ -8070,10 +8314,10 @@ function checkEslintConfigs(workspaceRoot) {
   ];
 }
 function checkEslintEntryPointReachesTheRules(workspaceRoot) {
-  const rules = (0, import_node_path36.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
-  if (!(0, import_node_fs31.existsSync)(rules)) return [];
-  const entryPoint = (0, import_node_path36.join)(workspaceRoot, ESLINT_USER_FILENAME);
-  const source = (0, import_node_fs31.existsSync)(entryPoint) ? (0, import_node_fs31.readFileSync)(entryPoint, "utf8") : "";
+  const rules = (0, import_node_path37.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
+  if (!(0, import_node_fs32.existsSync)(rules)) return [];
+  const entryPoint = (0, import_node_path37.join)(workspaceRoot, ESLINT_USER_FILENAME);
+  const source = (0, import_node_fs32.existsSync)(entryPoint) ? (0, import_node_fs32.readFileSync)(entryPoint, "utf8") : "";
   return [
     {
       check: `${ESLINT_USER_FILENAME} imports the mnci rules`,
@@ -8086,7 +8330,7 @@ function checkEslintEntryPointReachesTheRules(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path36.join)(workspaceRoot, "package.json")
+      (0, import_node_path37.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -8094,7 +8338,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path36.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path37.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -8120,7 +8364,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path36.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path37.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -8138,11 +8382,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path36.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path37.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs31.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs32.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -8159,11 +8403,11 @@ function checkNpmrc(workspaceRoot, registry, scope) {
   };
 }
 function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
-  const npmrcPath = (0, import_node_path36.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path37.join)(workspaceRoot, ".npmrc");
   if (!fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs31.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs32.readFileSync)(npmrcPath, "utf8");
   const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
   const referenced = [
     ...new Set(
@@ -8187,13 +8431,13 @@ function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env)
   };
 }
 function checkNpmAuthMatchesPipeline(workspaceRoot, registry) {
-  const npmrcPath = (0, import_node_path36.join)(workspaceRoot, ".npmrc");
-  const pipelinePath = (0, import_node_path36.join)(workspaceRoot, "azure-pipelines.yml");
+  const npmrcPath = (0, import_node_path37.join)(workspaceRoot, ".npmrc");
+  const pipelinePath = (0, import_node_path37.join)(workspaceRoot, "azure-pipelines.yml");
   if (registry?.kind !== "azure-artifacts" || !fileExists(npmrcPath) || !fileExists(pipelinePath)) {
     return void 0;
   }
-  const holdsCredentials = (0, import_node_fs31.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
-  const runsTask = (0, import_node_fs31.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
+  const holdsCredentials = (0, import_node_fs32.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const runsTask = (0, import_node_fs32.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
   if (!holdsCredentials && !runsTask) {
     return {
       check: "npm auth: .npmrc and azure-pipelines.yml agree",
@@ -8238,13 +8482,13 @@ function npmjsCredentialShape(credentials, environment) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs31.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs31.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
-    ...(0, import_node_fs31.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+    ...(0, import_node_fs32.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs32.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
+    ...(0, import_node_fs32.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path36.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path37.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -8273,7 +8517,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path36.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path37.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -8289,8 +8533,8 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs31.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs31.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+      ...(0, import_node_fs32.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs32.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
     ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
@@ -8305,7 +8549,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path36.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path37.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -8344,15 +8588,15 @@ function checkGoPluginRegistered(workspaceRoot) {
   };
 }
 function checkGoWorkInSync(workspaceRoot) {
-  const goWorkPath = (0, import_node_path36.join)(workspaceRoot, "go.work");
+  const goWorkPath = (0, import_node_path37.join)(workspaceRoot, "go.work");
   if (!fileExists(goWorkPath)) {
     return void 0;
   }
-  const contents = (0, import_node_fs31.existsSync)(goWorkPath) ? (0, import_node_fs31.readFileSync)(goWorkPath, "utf8") : "";
+  const contents = (0, import_node_fs32.existsSync)(goWorkPath) ? (0, import_node_fs32.readFileSync)(goWorkPath, "utf8") : "";
   const blockEntries = Array.from(contents.matchAll(/(?:^|\n)\s*use\s+\(([^)]*)\)/g), (match) => match[1].split("\n")).flat();
   const singleEntries = Array.from(contents.matchAll(/(?:^|\n)\s*use\s+(\.\S+)/g), (match) => match[1]);
   const uses = [...blockEntries, ...singleEntries].map((entry) => entry.trim()).filter(Boolean);
-  const stale = uses.filter((entry) => !(0, import_node_fs31.existsSync)((0, import_node_path36.join)(workspaceRoot, entry, "go.mod")));
+  const stale = uses.filter((entry) => !(0, import_node_fs32.existsSync)((0, import_node_path37.join)(workspaceRoot, entry, "go.mod")));
   return {
     check: "every go.work `use` entry points to a module that still exists",
     ok: stale.length === 0,
@@ -8368,9 +8612,9 @@ function checkNativeApps(workspaceRoot) {
     { file: ".github/workflows/ci.yml", marker: "native (${{ matrix.os }})" },
     { file: "azure-pipelines.yml", marker: "- job: native" }
   ];
-  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path36.join)(workspaceRoot, file))).map(({ file, marker }) => ({
+  const findings = pipelines.filter(({ file }) => fileExists((0, import_node_path37.join)(workspaceRoot, file))).map(({ file, marker }) => ({
     check: `${file} builds the native apps on every OS`,
-    ok: (0, import_node_fs31.readFileSync)((0, import_node_path36.join)(workspaceRoot, file), "utf8").includes(marker),
+    ok: (0, import_node_fs32.readFileSync)((0, import_node_path37.join)(workspaceRoot, file), "utf8").includes(marker),
     detail: `${file} has no native job: CI would verify a cgo app on the one agent that cannot build it`,
     remedy: "run `mnci upgrade`"
   }));
@@ -8383,7 +8627,7 @@ function checkNativeApps(workspaceRoot) {
   return findings;
 }
 function checkNoRootRuntimeDependencies(workspaceRoot) {
-  const manifestPath = (0, import_node_path36.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path37.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -8403,14 +8647,14 @@ function checkNoRootRuntimeDependencies(workspaceRoot) {
   };
 }
 function checkRollupSourceMaps(workspaceRoot) {
-  const configs = (0, import_node_fs31.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs32.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path36.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path37.join)(workspaceRoot, relativePath);
     let config;
     try {
-      config = (0, import_node_fs31.readFileSync)(configPath, "utf8");
+      config = (0, import_node_fs32.readFileSync)(configPath, "utf8");
     } catch {
       return [];
     }
@@ -8425,11 +8669,11 @@ function checkRollupSourceMaps(workspaceRoot) {
   });
 }
 function checkDeclarationSpecifiers(workspaceRoot) {
-  const configs = (0, import_node_fs31.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs32.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path36.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path37.join)(workspaceRoot, relativePath);
     if (!fileExists(configPath)) {
       return [];
     }
@@ -8444,7 +8688,7 @@ function checkDeclarationSpecifiers(workspaceRoot) {
           // `plugins` array (what @nx/react:library writes). For any other shape it would no-op, and
           // naming a command that silently does nothing is the failure mode the source-map check
           // above goes out of its way to avoid, so the remedy depends on the shape.
-          remedy: canAddDeclarationSpecifierPlugin((0, import_node_fs31.readFileSync)(configPath, "utf8")) ? "run `mnci upgrade`, which adds the plugin to the plugins array of withNx's second argument" : "add the plugin to withNx's second argument by hand (copy it from a freshly `mnci add npm-lib`'d project) \u2014 mnci does not recognise the shape of this config, so `mnci upgrade` cannot add it"
+          remedy: canAddDeclarationSpecifierPlugin((0, import_node_fs32.readFileSync)(configPath, "utf8")) ? "run `mnci upgrade`, which adds the plugin to the plugins array of withNx's second argument" : "add the plugin to withNx's second argument by hand (copy it from a freshly `mnci add npm-lib`'d project) \u2014 mnci does not recognise the shape of this config, so `mnci upgrade` cannot add it"
         }
       ];
     }
@@ -8460,8 +8704,8 @@ function checkDeclarationSpecifiers(workspaceRoot) {
 }
 function checkPipelinePhases(workspaceRoot) {
   const files = ["azure-pipelines.yml", ".github/workflows/ci.yml"];
-  return files.filter((file) => fileExists((0, import_node_path36.join)(workspaceRoot, file))).flatMap((file) => {
-    const { verifyActive, switchedOff } = inspectPipeline((0, import_node_fs31.readFileSync)((0, import_node_path36.join)(workspaceRoot, file), "utf8"));
+  return files.filter((file) => fileExists((0, import_node_path37.join)(workspaceRoot, file))).flatMap((file) => {
+    const { verifyActive, switchedOff } = inspectPipeline((0, import_node_fs32.readFileSync)((0, import_node_path37.join)(workspaceRoot, file), "utf8"));
     const verify = {
       check: `${file} runs the enforced verify phase`,
       ok: verifyActive,
@@ -8502,7 +8746,7 @@ function checkDependencyRangesNotPreserved(nxJson) {
   };
 }
 function checkLockfileHasNoLocalRegistry(workspaceRoot) {
-  if (!fileExists((0, import_node_path36.join)(workspaceRoot, "package-lock.json"))) {
+  if (!fileExists((0, import_node_path37.join)(workspaceRoot, "package-lock.json"))) {
     return void 0;
   }
   return {
@@ -8522,7 +8766,7 @@ function checkReleaseTagsResolve(workspaceRoot, nxJson) {
   };
 }
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path36.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path37.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -8587,8 +8831,8 @@ function runDoctor(workspaceRoot, options = {}) {
 }
 
 // src/repository-adoption/adopt-dependencies.use-case.ts
-var import_node_fs32 = require("fs");
-var import_node_path37 = require("path");
+var import_node_fs33 = require("fs");
+var import_node_path38 = require("path");
 
 // src/repository-adoption/clean-working-tree.validator.ts
 function requireCleanWorkingTree(repositoryRoot, capture = runCapture) {
@@ -8659,7 +8903,7 @@ var SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
 var TEST_FILE = /\.(?:spec|test)\.[^.]+$|[\\/](?:__tests__|tests?|e2e)[\\/]/;
 var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", "out", ".git", ".nx", "tmp"]);
 function sourceFiles(directory, relative = "") {
-  const entries = (0, import_node_fs32.readdirSync)((0, import_node_path37.join)(directory, relative), { withFileTypes: true });
+  const entries = (0, import_node_fs33.readdirSync)((0, import_node_path38.join)(directory, relative), { withFileTypes: true });
   const found = [];
   for (const entry of entries) {
     const path = relative === "" ? entry.name : `${relative}/${entry.name}`;
@@ -8675,7 +8919,7 @@ function sourceFiles(directory, relative = "") {
 }
 function wantedImportsOf(path, wanted) {
   try {
-    const imported = [...extractImportedPackages((0, import_node_fs32.readFileSync)(path, "utf8"))];
+    const imported = [...extractImportedPackages((0, import_node_fs33.readFileSync)(path, "utf8"))];
     return imported.filter((name) => wanted.has(name));
   } catch {
     return [];
@@ -8686,7 +8930,7 @@ function importsOfProject(projectDirectory, wanted) {
   const tested = /* @__PURE__ */ new Set();
   const files = sourceFiles(projectDirectory);
   for (const file of files) {
-    const names = wantedImportsOf((0, import_node_path37.join)(projectDirectory, file), wanted);
+    const names = wantedImportsOf((0, import_node_path38.join)(projectDirectory, file), wanted);
     const target = TEST_FILE.test(file) ? tested : shipped;
     for (const name of names) {
       target.add(name);
@@ -8698,7 +8942,7 @@ function importsOfProject(projectDirectory, wanted) {
 function findUsage(repositoryRoot, projectDirectories, wanted) {
   const usage = {};
   for (const dir of projectDirectories) {
-    const { shipped, testsOnly } = importsOfProject((0, import_node_path37.join)(repositoryRoot, dir), wanted);
+    const { shipped, testsOnly } = importsOfProject((0, import_node_path38.join)(repositoryRoot, dir), wanted);
     for (const name of shipped) {
       usage[name] ??= { runtime: [], testsOnly: [] };
       usage[name].runtime.push(dir);
@@ -8713,7 +8957,7 @@ function findUsage(repositoryRoot, projectDirectories, wanted) {
 function adoptDependencies(repositoryRoot, dependencies = {}) {
   const run = dependencies.run ?? runShell;
   requireCleanWorkingTree(repositoryRoot, dependencies.capture ?? runCapture);
-  const rootPath = (0, import_node_path37.join)(repositoryRoot, "package.json");
+  const rootPath = (0, import_node_path38.join)(repositoryRoot, "package.json");
   if (!fileExists(rootPath)) {
     throw new Error("No package.json at the repository root.");
   }
@@ -8748,8 +8992,8 @@ function adoptDependencies(repositoryRoot, dependencies = {}) {
 }
 
 // src/repository-adoption/adopt-kinds.use-case.ts
-var import_node_fs33 = require("fs");
-var import_node_path38 = require("path");
+var import_node_fs34 = require("fs");
+var import_node_path39 = require("path");
 
 // src/repository-adoption/infer-project-kind.algorithm.ts
 var SERVER_FRAMEWORKS = ["express", "koa", "fastify", "@nestjs/core"];
@@ -8850,32 +9094,32 @@ function inferProjectKind(evidence) {
 // src/repository-adoption/adopt-kinds.use-case.ts
 var TYPE_TAG = "type:";
 function readEvidence(repositoryRoot, location) {
-  const directory = (0, import_node_path38.join)(repositoryRoot, location.dir);
-  const files = (0, import_node_fs33.readdirSync)(directory);
+  const directory = (0, import_node_path39.join)(repositoryRoot, location.dir);
+  const files = (0, import_node_fs34.readdirSync)(directory);
   const manifest = location.ecosystem === "npm" ? readJson(location.manifestPath) : {};
-  const text = location.ecosystem === "npm" ? "" : (0, import_node_fs33.readFileSync)(location.manifestPath, "utf8");
+  const text = location.ecosystem === "npm" ? "" : (0, import_node_fs34.readFileSync)(location.manifestPath, "utf8");
   let hasProgram = false;
   if (location.ecosystem === "go") {
-    hasProgram = files.filter((file) => file.endsWith(".go")).some((file) => /^package main\b/m.test((0, import_node_fs33.readFileSync)((0, import_node_path38.join)(directory, file), "utf8")));
+    hasProgram = files.filter((file) => file.endsWith(".go")).some((file) => /^package main\b/m.test((0, import_node_fs34.readFileSync)((0, import_node_path39.join)(directory, file), "utf8")));
   } else if (location.ecosystem === "pub") {
-    hasProgram = (0, import_node_fs33.existsSync)((0, import_node_path38.join)(directory, "lib", "main.dart"));
+    hasProgram = (0, import_node_fs34.existsSync)((0, import_node_path39.join)(directory, "lib", "main.dart"));
   }
   return { ecosystem: location.ecosystem, manifest, text, files, hasProgram };
 }
 function existingKind(directory) {
   const sources = [];
-  if (fileExists((0, import_node_path38.join)(directory, "project.json"))) {
-    sources.push(readJson((0, import_node_path38.join)(directory, "project.json")).tags ?? []);
+  if (fileExists((0, import_node_path39.join)(directory, "project.json"))) {
+    sources.push(readJson((0, import_node_path39.join)(directory, "project.json")).tags ?? []);
   }
-  if (fileExists((0, import_node_path38.join)(directory, "package.json"))) {
-    sources.push(readJson((0, import_node_path38.join)(directory, "package.json")).nx?.tags ?? []);
+  if (fileExists((0, import_node_path39.join)(directory, "package.json"))) {
+    sources.push(readJson((0, import_node_path39.join)(directory, "package.json")).nx?.tags ?? []);
   }
   return sources.flat().find((tag) => tag.startsWith(TYPE_TAG))?.slice(TYPE_TAG.length);
 }
 function writeKindTag(directory, name, kind) {
   const tag = `${TYPE_TAG}${kind}`;
-  const projectJson = (0, import_node_path38.join)(directory, "project.json");
-  const packageJson = (0, import_node_path38.join)(directory, "package.json");
+  const projectJson = (0, import_node_path39.join)(directory, "project.json");
+  const packageJson = (0, import_node_path39.join)(directory, "package.json");
   if (fileExists(projectJson)) {
     const project = readJson(projectJson);
     writeFileEnsured(projectJson, toJson({ ...project, tags: [...project.tags ?? [], tag] }));
@@ -8899,7 +9143,7 @@ function adoptKinds(repositoryRoot, overrides = {}, dependencies = {}) {
     }
   }
   return locations.map((location) => {
-    const directory = (0, import_node_path38.join)(repositoryRoot, location.dir);
+    const directory = (0, import_node_path39.join)(repositoryRoot, location.dir);
     const present = existingKind(directory);
     if (present !== void 0) {
       return { dir: location.dir, outcome: "already", kind: present, reason: PROJECT_KINDS.includes(present) ? "it already has a type tag" : "it already has a type tag of its own, which is not an mnci kind name; left as it is" };
@@ -8915,12 +9159,12 @@ function adoptKinds(repositoryRoot, overrides = {}, dependencies = {}) {
 }
 
 // src/repository-adoption/adopt-overlay.use-case.ts
-var import_node_fs35 = require("fs");
-var import_node_path40 = require("path");
+var import_node_fs36 = require("fs");
+var import_node_path41 = require("path");
 
 // src/workspace-upgrade/upgrade-workspace.use-case.ts
-var import_node_fs34 = require("fs");
-var import_node_path39 = require("path");
+var import_node_fs35 = require("fs");
+var import_node_path40 = require("path");
 function resolveRegistry(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -8949,7 +9193,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs34.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs35.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -8957,11 +9201,11 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path39.basename)(workspaceRoot);
+  return (0, import_node_path40.basename)(workspaceRoot);
 }
 function detectNpmAuth(workspaceRoot) {
   try {
-    return (0, import_node_fs34.readFileSync)((0, import_node_path39.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
+    return (0, import_node_fs35.readFileSync)((0, import_node_path40.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
   } catch {
     return void 0;
   }
@@ -9008,7 +9252,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path39.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path40.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -9056,6 +9300,10 @@ function runUpgrade(workspaceRoot, options) {
     logger.step("Updating the VS Code extension packaging script");
     logger.detail(`updated ${VSCODE_EXTENSION_SCRIPT_PATH}`);
   }
+  if (refreshContainerScript(workspaceRoot)) {
+    logger.step("Updating the container image script");
+    logger.detail("updated tools/container-image.cjs");
+  }
   if (refreshGoReleaseScript(workspaceRoot)) {
     logger.step("Updating the releasable Go app script");
     logger.detail(`updated ${GO_RELEASE_SCRIPT_PATH}`);
@@ -9082,7 +9330,7 @@ function runUpgrade(workspaceRoot, options) {
     "Formatting the workspace (eslint --fix) \u2014 the slowest step, minutes on a large workspace"
   );
   runFormatter(workspaceRoot);
-  const nxJson = readJson((0, import_node_path39.join)(workspaceRoot, "nx.json"));
+  const nxJson = readJson((0, import_node_path40.join)(workspaceRoot, "nx.json"));
   const stranded = locateStrandedReleaseTags(workspaceRoot, nxJson.release?.releaseTag?.pattern);
   for (const entry of stranded) {
     logger.warn(`${entry.project} has release tags only under ${entry.oldTag}: nx release would restart it from its disk version. Run \`mnci adopt --tags\` before the next release to create ${entry.newTag} locally (\`mnci doctor\` lists them all).`);
@@ -9093,9 +9341,9 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/repository-adoption/adopt-overlay.use-case.ts
 function detectCiProvider(repositoryRoot) {
-  const azure = (0, import_node_fs35.existsSync)((0, import_node_path40.join)(repositoryRoot, "azure-pipelines.yml"));
-  const workflows = (0, import_node_path40.join)(repositoryRoot, ".github", "workflows");
-  const github = (0, import_node_fs35.existsSync)(workflows) && (0, import_node_fs35.readdirSync)(workflows).some((file) => /\.ya?ml$/.test(file));
+  const azure = (0, import_node_fs36.existsSync)((0, import_node_path41.join)(repositoryRoot, "azure-pipelines.yml"));
+  const workflows = (0, import_node_path41.join)(repositoryRoot, ".github", "workflows");
+  const github = (0, import_node_fs36.existsSync)(workflows) && (0, import_node_fs36.readdirSync)(workflows).some((file) => /\.ya?ml$/.test(file));
   if (azure && github) {
     return "both";
   }
@@ -9105,7 +9353,7 @@ function detectCiProvider(repositoryRoot) {
   return github ? "github" : void 0;
 }
 function detectTestRunner(repositoryRoot) {
-  const manifestPath = (0, import_node_path40.join)(repositoryRoot, "package.json");
+  const manifestPath = (0, import_node_path41.join)(repositoryRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -9118,7 +9366,7 @@ function detectTestRunner(repositoryRoot) {
 }
 function adoptOverlay(repositoryRoot, options, dependencies = {}) {
   requireCleanWorkingTree(repositoryRoot, dependencies.capture ?? runCapture);
-  if (!fileExists((0, import_node_path40.join)(repositoryRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path41.join)(repositoryRoot, "nx.json"))) {
     throw new Error("There is no nx.json, so Nx is not set up here. Set it up first (`npx nx@latest init`); adopt does not install Nx yet.");
   }
   const persisted = readMnciConfig(repositoryRoot);
@@ -9131,7 +9379,7 @@ function adoptOverlay(repositoryRoot, options, dependencies = {}) {
 }
 
 // src/repository-adoption/adopt-toolchain.use-case.ts
-var import_node_path42 = require("path");
+var import_node_path43 = require("path");
 
 // src/repository-adoption/align-nx-family.algorithm.ts
 var VERSION = /^[\^~]?(\d+)\.(\d+)\.(\d+)$/;
@@ -9169,24 +9417,24 @@ function alignNxFamily(dependencies, version) {
 }
 
 // src/repository-adoption/retire-tooling.use-case.ts
-var import_node_fs36 = require("fs");
-var import_node_path41 = require("path");
+var import_node_fs37 = require("fs");
+var import_node_path42 = require("path");
 var RETIRED_COMMAND = /\b(?:prettier|oxfmt|oxlint)\b/;
 function retireTooling(repositoryRoot) {
   const removed = [];
   for (const file of RETIRED_FORMATTER_FILES) {
-    if (!fileExists((0, import_node_path41.join)(repositoryRoot, file))) {
+    if (!fileExists((0, import_node_path42.join)(repositoryRoot, file))) {
       continue;
     }
-    (0, import_node_fs36.rmSync)((0, import_node_path41.join)(repositoryRoot, file), { force: true });
+    (0, import_node_fs37.rmSync)((0, import_node_path42.join)(repositoryRoot, file), { force: true });
     removed.push(file);
   }
-  const hadRegistry = fileExists((0, import_node_path41.join)(repositoryRoot, ".verdaccio"));
+  const hadRegistry = fileExists((0, import_node_path42.join)(repositoryRoot, ".verdaccio"));
   removeLocalRegistryScaffolding(repositoryRoot);
   if (hadRegistry) {
     removed.push(".verdaccio, its dependency and the local-registry target");
   }
-  const manifestPath = (0, import_node_path41.join)(repositoryRoot, "package.json");
+  const manifestPath = (0, import_node_path42.join)(repositoryRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return removed;
   }
@@ -9233,7 +9481,7 @@ function adoptToolchain(repositoryRoot, options = {}, dependencies = {}) {
     console.log(message);
   });
   requireCleanWorkingTree(repositoryRoot, capture);
-  const manifestPath = (0, import_node_path42.join)(repositoryRoot, "package.json");
+  const manifestPath = (0, import_node_path43.join)(repositoryRoot, "package.json");
   if (!fileExists(manifestPath)) {
     throw new Error("No package.json at the repository root.");
   }
@@ -9283,8 +9531,8 @@ function createBaselineTags(repositoryRoot, stranded) {
 }
 
 // src/repository-adoption/inspect-repository.use-case.ts
-var import_node_fs37 = require("fs");
-var import_node_path43 = require("path");
+var import_node_fs38 = require("fs");
+var import_node_path44 = require("path");
 var LOCKFILES = [
   ["package-lock.json", "npm"],
   ["pnpm-lock.yaml", "pnpm"],
@@ -9305,25 +9553,25 @@ function inspectRepository(repositoryRoot) {
   const isGitRepo = inside.status === 0 && inside.stdout.trim() === "true";
   const dirty = isGitRepo && runCapture("git", ["status", "--porcelain"], repositoryRoot).stdout.trim() !== "";
   const tags = isGitRepo ? runCapture("git", ["tag", "--list"], repositoryRoot).stdout.split(/\r?\n/).filter(Boolean) : [];
-  const manifestPath = (0, import_node_path43.join)(repositoryRoot, "package.json");
+  const manifestPath = (0, import_node_path44.join)(repositoryRoot, "package.json");
   const manifest = fileExists(manifestPath) ? readJson(manifestPath) : {};
-  const nxJsonPath = (0, import_node_path43.join)(repositoryRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path44.join)(repositoryRoot, "nx.json");
   const nxJson = fileExists(nxJsonPath) ? readJson(nxJsonPath) : {};
   const ci = [];
   const pipelines = [];
-  if ((0, import_node_fs37.existsSync)((0, import_node_path43.join)(repositoryRoot, "azure-pipelines.yml"))) {
+  if ((0, import_node_fs38.existsSync)((0, import_node_path44.join)(repositoryRoot, "azure-pipelines.yml"))) {
     ci.push("azure");
-    pipelines.push((0, import_node_path43.join)(repositoryRoot, "azure-pipelines.yml"));
+    pipelines.push((0, import_node_path44.join)(repositoryRoot, "azure-pipelines.yml"));
   }
-  const workflows = (0, import_node_path43.join)(repositoryRoot, ".github", "workflows");
-  if ((0, import_node_fs37.existsSync)(workflows)) {
-    const files = (0, import_node_fs37.readdirSync)(workflows).filter((file) => /\.ya?ml$/.test(file));
+  const workflows = (0, import_node_path44.join)(repositoryRoot, ".github", "workflows");
+  if ((0, import_node_fs38.existsSync)(workflows)) {
+    const files = (0, import_node_fs38.readdirSync)(workflows).filter((file) => /\.ya?ml$/.test(file));
     if (files.length > 0) {
       ci.push("github");
-      pipelines.push(...files.map((file) => (0, import_node_path43.join)(workflows, file)));
+      pipelines.push(...files.map((file) => (0, import_node_path44.join)(workflows, file)));
     }
   }
-  const rootFiles = (0, import_node_fs37.readdirSync)(repositoryRoot);
+  const rootFiles = (0, import_node_fs38.readdirSync)(repositoryRoot);
   return {
     isGitRepo,
     dirty,
@@ -9334,7 +9582,7 @@ function inspectRepository(repositoryRoot) {
     tagCount: tags.length,
     strandedTags: isGitRepo ? locateStrandedReleaseTags(repositoryRoot, nxJson.release?.releaseTag?.pattern) : [],
     ci,
-    pipelineUsesMnci: pipelines.some((file) => /\bmnci ci\b/.test((0, import_node_fs37.readFileSync)(file, "utf8"))),
+    pipelineUsesMnci: pipelines.some((file) => /\bmnci ci\b/.test((0, import_node_fs38.readFileSync)(file, "utf8"))),
     retiredTooling: [.../* @__PURE__ */ new Set([...rootFiles.filter((file) => RETIRED_FILE_PATTERN.test(file) || file === ".verdaccio"), ...retiredNamesIn(manifest)])],
     personalFiles: PERSONAL_FILES.filter((file) => rootFiles.includes(file))
   };
@@ -9631,13 +9879,13 @@ function runCommands(program, options) {
 }
 
 // src/workspace-info/list-projects.use-case.ts
-var import_node_path44 = require("path");
+var import_node_path45 = require("path");
 var TYPE_TAG_PREFIX = "type:";
 function listProjects(workspaceRoot) {
   return locateProjects(workspaceRoot).map((location) => {
-    const projectJsonPath = (0, import_node_path44.join)(workspaceRoot, location.dir, "project.json");
+    const projectJsonPath = (0, import_node_path45.join)(workspaceRoot, location.dir, "project.json");
     const project = fileExists(projectJsonPath) ? readJson(projectJsonPath) : {};
-    const manifestPath = (0, import_node_path44.join)(workspaceRoot, location.dir, "package.json");
+    const manifestPath = (0, import_node_path45.join)(workspaceRoot, location.dir, "package.json");
     const manifestTags = fileExists(manifestPath) ? readJson(manifestPath).nx?.tags ?? [] : [];
     const typeTag = [...project.tags ?? [], ...manifestTags].find((tag) => tag.startsWith(TYPE_TAG_PREFIX));
     return {
@@ -9650,7 +9898,7 @@ function listProjects(workspaceRoot) {
   }).toSorted((a, b) => a.dir.localeCompare(b.dir));
 }
 function runProjects(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path44.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path45.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `projects` from the workspace root.");
   }
   const projects = listProjects(workspaceRoot);
@@ -9664,11 +9912,11 @@ function runProjects(workspaceRoot, options) {
 }
 
 // src/workspace-info/read-workspace-info.use-case.ts
-var import_node_path46 = require("path");
+var import_node_path47 = require("path");
 
 // src/cli-version/check-for-update.use-case.ts
-var import_node_fs38 = require("fs");
-var import_node_path45 = require("path");
+var import_node_fs39 = require("fs");
+var import_node_path46 = require("path");
 var import_cross_spawn3 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME2 = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -9727,8 +9975,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path45.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path46.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -9738,7 +9986,7 @@ function readCliVersion(packageDirectory) {
 // src/workspace-info/read-workspace-info.use-case.ts
 function readWorkspaceInfo(workspaceRoot, cliVersion) {
   const latest = fetchLatestVersion() ?? null;
-  const isWorkspace = fileExists((0, import_node_path46.join)(workspaceRoot, "nx.json"));
+  const isWorkspace = fileExists((0, import_node_path47.join)(workspaceRoot, "nx.json"));
   return {
     cli: {
       version: cliVersion,
@@ -9759,7 +10007,7 @@ function runInfo(workspaceRoot, cliVersion, options) {
 }
 
 // src/interactive-wizard/interactive-wizard.use-case.ts
-var import_node_path47 = require("path");
+var import_node_path48 = require("path");
 
 // src/interactive-wizard/adopt-steps.config.ts
 var ADOPT_GLOBAL_OPTIONS = ["json"];
@@ -9940,7 +10188,7 @@ function wizardMenu(commands, inWorkspace) {
 }
 async function runInteractive(program, prompter = createInquirerPrompter(), workingDirectory = process.cwd()) {
   const commands = describeCommands(program);
-  const inWorkspace = fileExists((0, import_node_path47.join)(workingDirectory, "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path48.join)(workingDirectory, "nx.json"));
   const name = await prompter.select("What would you like to do?", wizardMenu(commands, inWorkspace));
   const command = commands.find((candidate) => candidate.name === name);
   const argv = buildArgv(command, await askCommand(command, prompter));
@@ -9953,8 +10201,8 @@ async function runInteractive(program, prompter = createInquirerPrompter(), work
 }
 
 // src/workspace-creation/adopt-directory.use-case.ts
-var import_node_fs39 = require("fs");
-var import_node_path48 = require("path");
+var import_node_fs40 = require("fs");
+var import_node_path49 = require("path");
 var NEVER_COPIED = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var AGENT_AND_CI_ENTRIES = [
   "AGENTS.md",
@@ -9985,13 +10233,13 @@ var PREFLIGHT_BLOCKERS = [
   "packages"
 ];
 function assertAdoptableDirectory(target) {
-  if (!(0, import_node_fs39.existsSync)(target)) {
+  if (!(0, import_node_fs40.existsSync)(target)) {
     throw new Error(`--into '${target}' does not exist. Create or clone it first.`);
   }
-  if (!(0, import_node_fs39.statSync)(target).isDirectory()) {
+  if (!(0, import_node_fs40.statSync)(target).isDirectory()) {
     throw new Error(`--into '${target}' is not a directory.`);
   }
-  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs39.existsSync)((0, import_node_path48.join)(target, entry)));
+  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs40.existsSync)((0, import_node_path49.join)(target, entry)));
   if (blockers.length > 0) {
     throw new Error(
       `--into '${target}' already holds ${blockers.join(", ")}, so it is a project already. Use \`mnci upgrade\` to re-apply the overlay to an existing workspace, or point --into at an empty checkout.`
@@ -9999,15 +10247,15 @@ function assertAdoptableDirectory(target) {
   }
 }
 function mergeGitignore(generatedFile, targetFile) {
-  const existing = (0, import_node_fs39.readFileSync)(targetFile, "utf8");
+  const existing = (0, import_node_fs40.readFileSync)(targetFile, "utf8");
   const present = new Set(existing.split("\n").map((line) => line.trim()));
-  const additions = (0, import_node_fs39.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
+  const additions = (0, import_node_fs40.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
     const trimmed = line.trim();
     return trimmed !== "" && !trimmed.startsWith("#") && !present.has(trimmed);
   });
   if (additions.length === 0) return false;
   const separator = existing.endsWith("\n") ? "" : "\n";
-  (0, import_node_fs39.writeFileSync)(
+  (0, import_node_fs40.writeFileSync)(
     targetFile,
     `${existing}${separator}
 # Added by mnci (Nx workspace)
@@ -10017,9 +10265,9 @@ ${additions.join("\n")}
   return true;
 }
 function adoptGeneratedWorkspace(generatedRoot, target) {
-  const entries = (0, import_node_fs39.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
+  const entries = (0, import_node_fs40.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
   const collisions = entries.filter(
-    (entry) => (0, import_node_fs39.existsSync)((0, import_node_path48.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
+    (entry) => (0, import_node_fs40.existsSync)((0, import_node_path49.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
   );
   if (collisions.length > 0) {
     throw new Error(
@@ -10028,28 +10276,28 @@ function adoptGeneratedWorkspace(generatedRoot, target) {
   }
   const result = { copied: [], kept: [], mergedGitignore: false };
   for (const entry of entries) {
-    const from = (0, import_node_path48.join)(generatedRoot, entry);
-    const to = (0, import_node_path48.join)(target, entry);
-    if (entry === ".gitignore" && (0, import_node_fs39.existsSync)(to)) {
+    const from = (0, import_node_path49.join)(generatedRoot, entry);
+    const to = (0, import_node_path49.join)(target, entry);
+    if (entry === ".gitignore" && (0, import_node_fs40.existsSync)(to)) {
       result.mergedGitignore = mergeGitignore(from, to);
       result.kept.push(entry);
       continue;
     }
-    if ((0, import_node_fs39.existsSync)(to)) {
+    if ((0, import_node_fs40.existsSync)(to)) {
       result.kept.push(entry);
       continue;
     }
-    (0, import_node_fs39.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs40.cpSync)(from, to, { recursive: true });
     result.copied.push(entry);
   }
-  (0, import_node_fs39.rmSync)(generatedRoot, { recursive: true, force: true });
+  (0, import_node_fs40.rmSync)(generatedRoot, { recursive: true, force: true });
   return result;
 }
 
 // src/workspace-creation/create-workspace.use-case.ts
-var import_node_fs40 = require("fs");
+var import_node_fs41 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path49 = require("path");
+var import_node_path50 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -10092,9 +10340,9 @@ async function resolveRegistry2(options) {
   return await promptRegistry();
 }
 async function runNew(name, options) {
-  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path49.resolve)(process.cwd(), options.into);
+  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path50.resolve)(process.cwd(), options.into);
   if (adoptTarget !== void 0) assertAdoptableDirectory(adoptTarget);
-  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path49.basename)(adoptTarget));
+  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path50.basename)(adoptTarget));
   assertValidProjectName(workspaceName, "Workspace name");
   const scope = options.scope ?? (options.yes ? `@${workspaceName}` : await promptText("npm scope for publishable packages", `@${workspaceName}`));
   const registry = await resolveRegistry2(options);
@@ -10107,8 +10355,8 @@ async function runNew(name, options) {
   const npmAuth = resolveNpmAuth(options.npmAuth, registry, ci);
   const stack = await resolveStack(options);
   const nxCloud = options.nxCloud ?? (options.yes ? false : await promptNxCloud());
-  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs40.mkdtempSync)((0, import_node_path49.join)((0, import_node_os2.tmpdir)(), "mnci-new-"));
-  let workspaceRoot = (0, import_node_path49.join)(stagingParent, workspaceName);
+  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs41.mkdtempSync)((0, import_node_path50.join)((0, import_node_os2.tmpdir)(), "mnci-new-"));
+  let workspaceRoot = (0, import_node_path50.join)(stagingParent, workspaceName);
   try {
     logger.step(`Creating Nx workspace '${workspaceName}' (preset: ts)`);
     runNpx(
@@ -10131,7 +10379,7 @@ async function runNew(name, options) {
       workspaceRoot = adoptTarget;
     }
   } finally {
-    if (adoptTarget !== void 0) (0, import_node_fs40.rmSync)(stagingParent, { recursive: true, force: true });
+    if (adoptTarget !== void 0) (0, import_node_fs41.rmSync)(stagingParent, { recursive: true, force: true });
   }
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
@@ -10141,8 +10389,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack, ...npmAuth && { npmAuth } },
     logger.detail
   );
-  (0, import_node_fs40.rmSync)((0, import_node_path49.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs40.rmSync)((0, import_node_path49.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs41.rmSync)((0, import_node_path50.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs41.rmSync)((0, import_node_path50.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -10244,7 +10492,7 @@ function buildProgram(cliVersion) {
   ).option(
     "--empty",
     "npm-lib, internal-lib, react-lib, react-internal-lib, node-function-app: scaffold the slice skeleton only, with no sample code or spec"
-  ).option(
+  ).option("--app <project>", "container only: the app to put in an image (a node-app, react-app or go-app)").option("--port <port>", "container only: the port the app listens on, exposed by the image and published by start").option(
     "--e2e",
     "react-app only: also scaffold a Playwright end-to-end project, <name>-e2e, that runs the app and checks its greeting; its e2e target needs a browser (npx playwright install) and is not part of CI verify"
   ).option(