@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/upgrade-CtZtRkTE.js

@@ -0,0 +1,1332 @@
+import { n as getPMCommands } from "./package-manager-DSEOwTqM.js";
+import { i as failAsJson, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BnmsEXvu.js";
+import { o as ManifestError, p as loadManifest } from "./manifest-DRp0UVTj.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { execFileSync } from "child_process";
+import { execa } from "execa";
+import { isDeepStrictEqual } from "util";
+//#region src/upgrade.ts
+/**
+* Moving a project's `@rebasepro/*` pins to one release.
+*
+* Every `@rebasepro/*` package ships at one version, and a project declares them
+* in several `package.json` files — the root, `backend/`, `frontend/`,
+* `config/`, and whatever else the repository holds. Bumping them by hand means
+* finding every one, keeping each range's `^` or `~`, and noticing the override
+* that quietly wins over all of them. `rebase upgrade` is that job, done the same
+* way every time; the control plane runs it too, when it rebuilds a managed
+* project on a newer release.
+*
+* Everything here is file work — git is asked only which files are the
+* project's — so it can be tested against a temporary directory: which files
+* are read, which specs move, the rewrite itself, and what overrides say. The
+* command in `commands/upgrade.ts` adds the registry lookup, the install and the
+* printing.
+*
+* ## The rewrite is textual
+*
+* A `package.json` is authored. Parsing it and writing `JSON.stringify` back
+* reformats the file, reorders nothing but reindents everything, and drops a
+* trailing newline or a two-space indent somebody chose — a one-line version
+* bump that arrives as a whole-file diff. So the file is scanned for the exact
+* byte range of each value, only those bytes are replaced, and the result is
+* parsed again and compared against what was intended. A file whose rewrite
+* does not parse back to exactly the intended values is not written.
+*/
+/** The dependency blocks a pin is moved in. `peerDependencies` is not one. */
+var PIN_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+/** The package whose published versions stand for the release as a whole. */
+var RELEASE_PACKAGE = "@rebasepro/cli";
+/** `MAJOR.MINOR.PATCH`, with an optional prerelease and build, and nothing else. */
+var SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+/** Whether `value` is one exact version — `0.21.0`, `0.21.1-canary.g8c5a265`. */
+function isExactVersion(value) {
+	return SEMVER.test(value);
+}
+/** An error that carries the `--json` envelope's code and a remedy. */
+var UpgradeError = class extends Error {
+	code;
+	hint;
+	constructor(message, code, hint) {
+		super(message);
+		this.code = code;
+		this.hint = hint;
+		this.name = "UpgradeError";
+	}
+};
+/**
+* What a dependency spec is, as far as moving it goes.
+*
+* Only a plain version is moved, because only a plain version has an obvious
+* answer: `^0.19.1` becomes `^0.21.0`. A `>=` floor, a `||` union or a partial
+* `^0.19` could each be rewritten several ways, and a tag or a workspace link
+* already means something other than "this release" — so each is reported with
+* its reason and left as written.
+*/
+function classifySpec(spec) {
+	const movable = /^([\^~]?)(.+)$/.exec(spec);
+	if (movable && isExactVersion(movable[2])) return {
+		kind: "movable",
+		prefix: movable[1],
+		version: movable[2]
+	};
+	for (const protocol of [
+		"link:",
+		"file:",
+		"portal:"
+	]) if (spec.startsWith(protocol)) return {
+		kind: "local",
+		protocol
+	};
+	const catalog = /^catalog:(.*)$/.exec(spec.trim());
+	if (catalog) return {
+		kind: "catalog",
+		catalog: catalog[1].trim() || "default"
+	};
+	return {
+		kind: "other",
+		reason: otherReason(spec)
+	};
+}
+/** Why a spec that does not move is left alone, as the report says it. */
+function leftAloneReason(cls) {
+	if (cls.kind === "local") return `a local ${cls.protocol} path, which points at a checkout on this machine rather than a release`;
+	if (cls.kind === "catalog") return "a catalog: reference inside a catalog, which pnpm does not resolve";
+	return cls.reason;
+}
+function otherReason(spec) {
+	const trimmed = spec.trim();
+	if (trimmed.startsWith("workspace:")) return "a workspace: link, resolved inside this repository rather than from the registry";
+	if (trimmed.startsWith("npm:")) return "an npm: alias; move the aliased version by hand";
+	if (/^(git\+|git:|github:|gitlab:|bitbucket:|git@)/.test(trimmed) || /^https?:\/\//.test(trimmed)) return "a git or URL dependency, not a registry version";
+	if (trimmed === "" || trimmed === "*" || /^[xX]$/.test(trimmed)) return "a wildcard, which already takes whatever the registry has";
+	if (trimmed.includes("||")) return "a union of ranges, with no single version to move";
+	if (/^[<>=]/.test(trimmed) || /\s-\s/.test(trimmed)) return "a comparator range, with no single version to move";
+	if (/^[\^~]?v?\d/.test(trimmed)) return "not a plain MAJOR.MINOR.PATCH version";
+	return "a dist-tag, not a version";
+}
+/**
+* The `@rebasepro/*` package an override key targets, or null.
+*
+* pnpm and npm key an override by name, optionally narrowed: `@rebasepro/x@<1`,
+* `parent>@rebasepro/x`; yarn's `resolutions` by a path, `**\/@rebasepro/x`. The
+* target is the last segment either way.
+*/
+function overrideTarget(key) {
+	const match = /(?:^|[/>])(@rebasepro\/[^/@>\s]+)(?:@[^/>]*)?$/.exec(key);
+	return match ? match[1] : null;
+}
+/**
+* Directories the walk never enters: installed packages, build output (`dist`,
+* `dist-bundle`, `dist-bundle-admin`, …) and anything hidden (`.git`,
+* `.rebase`, an editor's worktrees). None of them hold a manifest anybody
+* authored for this project, and `dist-bundle/package.json` in particular is a
+* generated copy that `rebase build` rewrites anyway. They are skipped whether
+* or not git ignores them.
+*/
+function skipDirectory(name) {
+	return name === "node_modules" || name.startsWith("dist") || name.startsWith(".");
+}
+var runGit = (cwd, args) => execFileSync("git", [
+	"-C",
+	cwd,
+	...args
+], {
+	encoding: "utf8",
+	stdio: [
+		"ignore",
+		"pipe",
+		"ignore"
+	],
+	maxBuffer: 256 * 1024 * 1024
+});
+/**
+* The files git counts as part of the project — tracked, or untracked and not
+* ignored — relative to `projectRoot`, POSIX. Null when git has no say: no git,
+* no repository, or a repository that lists nothing under the project root.
+*
+* Listing nothing means the repository ignores the project as a whole: a copy
+* of it under a gitignored scratch directory, say. Running the upgrade in that
+* copy is asking for the copy to move, and the repository's rules would leave
+* nothing in it to move. Asked with `git ls-files` rather than
+* `git check-ignore`, which answers differently across git versions for a
+* directory and for a negated pattern.
+*/
+function gitProjectFiles(projectRoot, git) {
+	let listed;
+	try {
+		listed = git(projectRoot, [
+			"ls-files",
+			"-z",
+			"--cached",
+			"--others",
+			"--exclude-standard"
+		]);
+	} catch {
+		return null;
+	}
+	const files = new Set(listed.split("\0").filter(Boolean));
+	return files.size > 0 ? files : null;
+}
+/**
+* Every `package.json` and `pnpm-workspace.yaml` under the project root that
+* belongs to the project.
+*
+* In a git repository that means what git lists: a gitignored build context,
+* scratch copy or vendored package is not the project's, and rewriting it
+* would change files nobody committed. The walk enters only directories that
+* hold a listed file, so an ignored tree is not read at all. Outside a
+* repository every directory is walked. {@link skipDirectory} applies either
+* way.
+*/
+function discoverProjectFiles(projectRoot, git = runGit) {
+	const found = {
+		packageJsons: [],
+		workspaceYamls: []
+	};
+	const listed = gitProjectFiles(projectRoot, git);
+	/** Every directory a listed file sits in, at any depth. */
+	const listedDirectories = /* @__PURE__ */ new Set();
+	for (const file of listed ?? []) for (let dir = path.posix.dirname(file); dir !== "." && !listedDirectories.has(dir); dir = path.posix.dirname(dir)) listedDirectories.add(dir);
+	const walk = (dir, relativeDir) => {
+		let entries;
+		try {
+			entries = fs.readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+		for (const entry of entries) {
+			const full = path.join(dir, entry.name);
+			const relative = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) {
+				if (!skipDirectory(entry.name) && (!listed || listedDirectories.has(relative))) walk(full, relative);
+			} else if (entry.isFile() && (!listed || listed.has(relative))) {
+				if (entry.name === "package.json") found.packageJsons.push(full);
+				else if (entry.name === "pnpm-workspace.yaml") found.workspaceYamls.push(full);
+			}
+		}
+	};
+	walk(projectRoot, "");
+	return found;
+}
+function catalogKey(catalog, pkg) {
+	return `${catalog}\u0000${pkg}`;
+}
+/** Project-relative, POSIX. What every file path in the output looks like. */
+function relativeTo(projectRoot, absolute) {
+	return path.relative(projectRoot, absolute).split(path.sep).join("/");
+}
+/**
+* Work out every change the upgrade makes, without writing anything.
+*
+* `--dry-run` prints this; a real run writes `writes` and nothing else.
+*/
+function planUpgrade(projectRoot, target, options = {}) {
+	if (!isExactVersion(target)) throw new UpgradeError(`"${target}" is not an exact version.`, "target_invalid");
+	const plan = {
+		target,
+		changed: [],
+		skipped: [],
+		overrides: [],
+		unreadable: [],
+		writes: [],
+		unchanged: 0
+	};
+	const ledger = {
+		refs: [],
+		defined: /* @__PURE__ */ new Set()
+	};
+	const files = discoverProjectFiles(projectRoot);
+	for (const absolute of files.packageJsons) {
+		const file = relativeTo(projectRoot, absolute);
+		const original = fs.readFileSync(absolute, "utf8");
+		const content = planPackageJson(file, original, target, options, plan, ledger);
+		if (content !== null && content !== original) plan.writes.push({
+			file,
+			absolute,
+			content
+		});
+	}
+	for (const absolute of files.workspaceYamls) {
+		const file = relativeTo(projectRoot, absolute);
+		const original = fs.readFileSync(absolute, "utf8");
+		const content = planWorkspaceYaml(file, original, target, options, plan, ledger);
+		if (content !== original) plan.writes.push({
+			file,
+			absolute,
+			content
+		});
+	}
+	for (const ref of ledger.refs) {
+		if (ledger.defined.has(catalogKey(ref.catalog, ref.pkg))) continue;
+		plan.skipped.push({
+			file: ref.file,
+			name: ref.name,
+			field: ref.field,
+			spec: ref.spec,
+			reason: `a pnpm catalog: reference, and no catalog under this project defines it — move the version where the "${ref.catalog}" catalog is declared`
+		});
+	}
+	return plan;
+}
+/** Write what the plan changes. Nothing else on disk is touched. */
+function applyUpgradePlan(plan) {
+	for (const write of plan.writes) fs.writeFileSync(write.absolute, write.content, "utf8");
+}
+/** Override blocks in a `package.json`, as paths from the root object. */
+var JSON_OVERRIDE_BLOCKS = [
+	["pnpm", "overrides"],
+	["overrides"],
+	["resolutions"]
+];
+function planPackageJson(file, original, target, options, plan, ledger) {
+	const bom = original.startsWith("") ? "" : "";
+	const text = original.slice(bom.length);
+	let parsed;
+	let tree;
+	try {
+		parsed = JSON.parse(text);
+		tree = scanJson(text);
+	} catch (err) {
+		plan.unreadable.push({
+			file,
+			reason: `not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+		});
+		return null;
+	}
+	if (!isRecord(parsed) || tree.kind !== "object") {
+		plan.unreadable.push({
+			file,
+			reason: "not a JSON object"
+		});
+		return null;
+	}
+	const expected = structuredClone(parsed);
+	const edits = [];
+	/** Override members to remove, as [block path, key]. */
+	const removals = [];
+	for (const field of PIN_FIELDS) {
+		const block = memberValue(tree, [field]);
+		if (block?.kind !== "object") continue;
+		for (const member of block.members) {
+			if (!member.key.startsWith("@rebasepro/")) continue;
+			if (member.value.kind !== "string") {
+				plan.skipped.push({
+					file,
+					name: member.key,
+					field,
+					spec: text.slice(member.value.start, member.value.end),
+					reason: "not a string"
+				});
+				continue;
+			}
+			const spec = member.value.value;
+			const cls = classifySpec(spec);
+			if (cls.kind === "movable") {
+				const to = `${cls.prefix}${target}`;
+				if (to === spec) {
+					plan.unchanged++;
+					continue;
+				}
+				edits.push({
+					start: member.value.start,
+					end: member.value.end,
+					replacement: JSON.stringify(to)
+				});
+				setPath(expected, [field, member.key], to);
+				plan.changed.push({
+					file,
+					name: member.key,
+					field,
+					from: spec,
+					to
+				});
+			} else if (cls.kind === "catalog") ledger.refs.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				catalog: cls.catalog,
+				pkg: member.key
+			});
+			else plan.skipped.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				reason: leftAloneReason(cls)
+			});
+		}
+	}
+	for (const blockPath of JSON_OVERRIDE_BLOCKS) {
+		const block = memberValue(tree, blockPath);
+		if (block?.kind !== "object") continue;
+		const field = blockPath.join(".");
+		for (const member of block.members) {
+			if (!overrideTarget(member.key)) continue;
+			if (member.value.kind !== "string") {
+				plan.skipped.push({
+					file,
+					name: member.key,
+					field,
+					spec: text.slice(member.value.start, member.value.end),
+					reason: "a nested override, which has no single version to move; edit it by hand"
+				});
+				continue;
+			}
+			const spec = member.value.value;
+			const cls = classifySpec(spec);
+			const pkg = overrideTarget(member.key);
+			if (cls.kind === "movable") {
+				const to = `${cls.prefix}${target}`;
+				if (to === spec) {
+					plan.unchanged++;
+					continue;
+				}
+				edits.push({
+					start: member.value.start,
+					end: member.value.end,
+					replacement: JSON.stringify(to)
+				});
+				setPath(expected, [...blockPath, member.key], to);
+				plan.overrides.push({
+					file,
+					name: member.key,
+					spec,
+					action: "bumped",
+					to
+				});
+			} else if (cls.kind === "catalog" && pkg) ledger.refs.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				catalog: cls.catalog,
+				pkg
+			});
+			else if (cls.kind === "local") if (options.dropLocalOverrides) {
+				removals.push([blockPath, member.key]);
+				deletePath(expected, [...blockPath, member.key]);
+				plan.overrides.push({
+					file,
+					name: member.key,
+					spec,
+					action: "removed-local"
+				});
+			} else plan.overrides.push({
+				file,
+				name: member.key,
+				spec,
+				action: "kept-local"
+			});
+			else plan.skipped.push({
+				file,
+				name: member.key,
+				field,
+				spec,
+				reason: leftAloneReason(cls)
+			});
+		}
+	}
+	if (edits.length === 0 && removals.length === 0) return original;
+	let next = applyEdits(text, edits);
+	for (const [blockPath, key] of removals) next = removeJsonMember(next, blockPath, key);
+	for (const blockPath of JSON_OVERRIDE_BLOCKS) {
+		if (!removals.some(([removedFrom]) => removedFrom === blockPath)) continue;
+		for (let depth = blockPath.length; depth > 0; depth--) {
+			const containerPath = blockPath.slice(0, depth);
+			const node = memberValue(scanJson(next), containerPath);
+			if (node?.kind !== "object" || node.members.length > 0) break;
+			next = removeJsonMember(next, containerPath.slice(0, -1), containerPath[containerPath.length - 1]);
+			deletePath(expected, containerPath);
+		}
+	}
+	let reparsed;
+	try {
+		reparsed = JSON.parse(next);
+	} catch {
+		reparsed = void 0;
+	}
+	if (!isDeepStrictEqual(reparsed, expected)) throw new UpgradeError(`Could not rewrite ${file} without disturbing it; nothing was written.`, "rewrite_failed", "Move its @rebasepro versions by hand, then run `rebase upgrade` again.");
+	return bom + next;
+}
+/**
+* The structure of a JSON document, with where each value starts and ends.
+*
+* `JSON.parse` answers what a file says; this answers where it says it, which is
+* what a rewrite that leaves every other byte alone needs. Throws on anything
+* that is not JSON — callers have already parsed the same text, so that never
+* happens in practice.
+*/
+function scanJson(text) {
+	let i = 0;
+	const WHITESPACE = " 	\n\r";
+	const skipWhitespace = () => {
+		while (i < text.length && WHITESPACE.includes(text[i])) i++;
+	};
+	const unexpected = () => {
+		throw new Error(`unexpected ${i < text.length ? `"${text[i]}"` : "end of input"} at offset ${i}`);
+	};
+	const readString = () => {
+		const start = i;
+		if (text[i] !== "\"") unexpected();
+		i++;
+		while (i < text.length && text[i] !== "\"") i += text[i] === "\\" ? 2 : 1;
+		if (i >= text.length) unexpected();
+		i++;
+		return {
+			kind: "string",
+			start,
+			end: i,
+			value: JSON.parse(text.slice(start, i))
+		};
+	};
+	const readValue = () => {
+		skipWhitespace();
+		const start = i;
+		if (text[i] === "{") {
+			i++;
+			const members = [];
+			skipWhitespace();
+			if (text[i] === "}") {
+				i++;
+				return {
+					kind: "object",
+					start,
+					end: i,
+					members
+				};
+			}
+			for (;;) {
+				skipWhitespace();
+				const key = readString();
+				skipWhitespace();
+				if (text[i] !== ":") unexpected();
+				i++;
+				members.push({
+					key: key.value,
+					keyStart: key.start,
+					value: readValue()
+				});
+				skipWhitespace();
+				if (text[i] === ",") {
+					i++;
+					continue;
+				}
+				if (text[i] === "}") {
+					i++;
+					return {
+						kind: "object",
+						start,
+						end: i,
+						members
+					};
+				}
+				unexpected();
+			}
+		}
+		if (text[i] === "[") {
+			i++;
+			skipWhitespace();
+			if (text[i] === "]") {
+				i++;
+				return {
+					kind: "array",
+					start,
+					end: i
+				};
+			}
+			for (;;) {
+				readValue();
+				skipWhitespace();
+				if (text[i] === ",") {
+					i++;
+					continue;
+				}
+				if (text[i] === "]") {
+					i++;
+					return {
+						kind: "array",
+						start,
+						end: i
+					};
+				}
+				unexpected();
+			}
+		}
+		if (text[i] === "\"") return readString();
+		while (i < text.length && !",:{}[]\"".includes(text[i]) && !WHITESPACE.includes(text[i])) i++;
+		if (i === start) unexpected();
+		return {
+			kind: "scalar",
+			start,
+			end: i
+		};
+	};
+	const root = readValue();
+	skipWhitespace();
+	if (i !== text.length) unexpected();
+	return root;
+}
+/** The value at a path of object keys, or undefined. The last duplicate wins, as in `JSON.parse`. */
+function memberValue(root, keys) {
+	let node = root;
+	for (const key of keys) {
+		if (node?.kind !== "object") return void 0;
+		const members = node.members.filter((m) => m.key === key);
+		node = members[members.length - 1]?.value;
+	}
+	return node;
+}
+/** Apply non-overlapping edits, last first so the earlier offsets stay valid. */
+function applyEdits(text, edits) {
+	let out = text;
+	for (const edit of [...edits].sort((a, b) => b.start - a.start)) out = out.slice(0, edit.start) + edit.replacement + out.slice(edit.end);
+	return out;
+}
+/**
+* Remove one member from the object at `objectPath`, taking its comma with it.
+*
+* Rescans rather than trusting offsets from before an earlier edit. A middle or
+* first member takes everything up to the next key, so the next member inherits
+* its indentation; the last takes the comma and whitespace after the previous
+* value, so the closing brace keeps its line; an only member leaves `{}`.
+*/
+function removeJsonMember(text, objectPath, key) {
+	const container = memberValue(scanJson(text), objectPath);
+	if (container?.kind !== "object") return text;
+	const index = container.members.findIndex((m) => m.key === key);
+	if (index === -1) return text;
+	const members = container.members;
+	const member = members[index];
+	if (members.length === 1) return text.slice(0, container.start + 1) + text.slice(container.end - 1);
+	if (index < members.length - 1) return text.slice(0, member.keyStart) + text.slice(members[index + 1].keyStart);
+	return text.slice(0, members[index - 1].value.end) + text.slice(member.value.end);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function setPath(root, keys, value) {
+	let node = root;
+	for (const key of keys.slice(0, -1)) {
+		const next = node[key];
+		if (!isRecord(next)) return;
+		node = next;
+	}
+	node[keys[keys.length - 1]] = value;
+}
+function deletePath(root, keys) {
+	let node = root;
+	for (const key of keys.slice(0, -1)) {
+		const next = node[key];
+		if (!isRecord(next)) return;
+		node = next;
+	}
+	delete node[keys[keys.length - 1]];
+}
+/** Lines, each without its `\r`, and whether the file used them. */
+function splitLines(text) {
+	return text.split("\n").map((line) => line.endsWith("\r") ? line.slice(0, -1) : line);
+}
+/**
+* A YAML scalar at the start of `rest`: its text, and where that text sits.
+*
+* Double- and single-quoted and plain scalars, which is every shape an override
+* value is written in. A double-quoted one with an escape in it is refused
+* rather than decoded: no version or path needs one, and getting the decoding
+* wrong would rewrite a value this does not understand.
+*/
+function readYamlScalar(rest) {
+	if (rest.startsWith("\"")) {
+		const close = rest.indexOf("\"", 1);
+		if (close === -1 || rest.slice(1, close).includes("\\")) return null;
+		if (!/^\s*(#.*)?$/.test(rest.slice(close + 1))) return null;
+		return {
+			value: rest.slice(1, close),
+			start: 1,
+			end: close
+		};
+	}
+	if (rest.startsWith("'")) {
+		const close = rest.indexOf("'", 1);
+		if (close === -1 || rest[close + 1] === "'") return null;
+		if (!/^\s*(#.*)?$/.test(rest.slice(close + 1))) return null;
+		return {
+			value: rest.slice(1, close),
+			start: 1,
+			end: close
+		};
+	}
+	const comment = rest.search(/\s#/);
+	const plain = (comment === -1 ? rest : rest.slice(0, comment)).trimEnd();
+	if (plain === "" || /^[[{&*!|>%@`]/.test(plain)) return null;
+	return {
+		value: plain,
+		start: 0,
+		end: plain.length
+	};
+}
+/**
+* A top-level block mapping of a `pnpm-workspace.yaml` — `overrides:`,
+* `catalog:` — read line by line.
+*
+* Deliberately narrow. The file is YAML, and the CLI carries no YAML parser; the
+* shape pnpm documents and every project writes is a block mapping of one
+* scalar per line, which a line reader handles exactly. Anything else in the
+* block is counted rather than guessed at, and an inline `overrides: { … }` is
+* reported as not handled.
+*/
+function readYamlBlock(lines, key) {
+	const keyLine = lines.findIndex((line) => new RegExp(`^${key}:\\s*(#.*)?$`).test(line));
+	if (keyLine === -1) return null;
+	const block = {
+		keyLine,
+		lines: [],
+		entries: [],
+		otherContent: 0
+	};
+	for (let index = keyLine + 1; index < lines.length; index++) {
+		const line = lines[index];
+		if (line.trim() !== "" && !/^\s/.test(line) && !line.startsWith("#")) break;
+		block.lines.push(index);
+		if (line.trim() === "" || /^\s*#/.test(line)) continue;
+		const entry = readYamlEntry(line, index);
+		if (entry) block.entries.push(entry);
+		else block.otherContent++;
+	}
+	return block;
+}
+/** One `key: scalar` line of a block mapping, or null when it is anything else. */
+function readYamlEntry(line, index) {
+	const entry = /^(\s+)("[^"]*"|'[^']*'|[^\s"'#][^:#]*?)\s*:(\s+|$)/.exec(line);
+	const valueOffset = entry ? entry[0].length : -1;
+	const scalar = entry ? readYamlScalar(line.slice(valueOffset)) : null;
+	if (!entry || !scalar) return null;
+	const rawKey = entry[2];
+	return {
+		line: index,
+		key: /^["']/.test(rawKey) ? rawKey.slice(1, -1) : rawKey,
+		value: scalar.value,
+		valueStart: valueOffset + scalar.start,
+		valueEnd: valueOffset + scalar.end
+	};
+}
+/**
+* Every catalog a `pnpm-workspace.yaml` declares: the top-level `catalog:`
+* block, and each named block under `catalogs:`.
+*
+* `catalogs:` is one level deeper — a header line per catalog, its entries
+* indented under it — and is read with the same one-scalar-per-line rule.
+*/
+function readYamlCatalogs(lines) {
+	const catalogs = [];
+	const single = readYamlBlock(lines, "catalog");
+	if (single) catalogs.push({
+		name: "default",
+		field: "catalog",
+		entries: single.entries
+	});
+	const keyLine = lines.findIndex((line) => /^catalogs:\s*(#.*)?$/.test(line));
+	if (keyLine === -1) return catalogs;
+	let current = null;
+	let headerIndent = -1;
+	for (let index = keyLine + 1; index < lines.length; index++) {
+		const line = lines[index];
+		if (line.trim() !== "" && !/^\s/.test(line) && !line.startsWith("#")) break;
+		if (line.trim() === "" || /^\s*#/.test(line)) continue;
+		const indent = line.length - line.trimStart().length;
+		const header = /^\s+("[^"]*"|'[^']*'|[^\s"'#][^:#]*?)\s*:\s*(#.*)?$/.exec(line);
+		if (header && (headerIndent === -1 || indent === headerIndent)) {
+			headerIndent = indent;
+			const name = /^["']/.test(header[1]) ? header[1].slice(1, -1) : header[1];
+			current = {
+				name,
+				field: `catalogs.${name}`,
+				entries: []
+			};
+			catalogs.push(current);
+			continue;
+		}
+		if (!current || indent <= headerIndent) continue;
+		const entry = readYamlEntry(line, index);
+		if (entry) current.entries.push(entry);
+	}
+	return catalogs;
+}
+/** A `pnpm-workspace.yaml`, with its overrides and then its catalogs moved. */
+function planWorkspaceYaml(file, original, target, options, plan, ledger) {
+	return planYamlCatalogs(file, planYamlOverrides(file, original, target, options, plan, ledger), target, plan, ledger);
+}
+/**
+* Move the framework entries of every catalog. Entries are rewritten in place
+* — a catalog loses no line — and the result is read back and held to what was
+* meant, like every other rewrite here.
+*/
+function planYamlCatalogs(file, original, target, plan, ledger) {
+	const lines = splitLines(original);
+	const catalogs = readYamlCatalogs(lines);
+	for (const key of ["catalog", "catalogs"]) {
+		const inline = lines.find((line) => new RegExp(`^${key}:\\s*[^\\s#]`).test(line));
+		if (inline && inline.includes("@rebasepro/")) plan.skipped.push({
+			file,
+			name: key,
+			field: key,
+			spec: inline.slice(key.length + 1).trim(),
+			reason: `an inline ${key} map, which this does not rewrite; write it as a block, or edit it by hand`
+		});
+	}
+	if (catalogs.length === 0) return original;
+	const next = [...lines];
+	const expected = [];
+	for (const catalog of catalogs) for (const entry of catalog.entries) {
+		const meant = [
+			catalog.field,
+			entry.key,
+			entry.value
+		];
+		expected.push(meant);
+		if (!entry.key.startsWith("@rebasepro/")) continue;
+		ledger.defined.add(catalogKey(catalog.name, entry.key));
+		const cls = classifySpec(entry.value);
+		if (cls.kind !== "movable") {
+			plan.skipped.push({
+				file,
+				name: entry.key,
+				field: catalog.field,
+				spec: entry.value,
+				reason: leftAloneReason(cls)
+			});
+			continue;
+		}
+		const to = `${cls.prefix}${target}`;
+		if (to === entry.value) {
+			plan.unchanged++;
+			continue;
+		}
+		meant[2] = to;
+		const line = next[entry.line];
+		next[entry.line] = line.slice(0, entry.valueStart) + to + line.slice(entry.valueEnd);
+		plan.changed.push({
+			file,
+			name: entry.key,
+			field: catalog.field,
+			from: entry.value,
+			to
+		});
+	}
+	const content = next.join(original.includes("\r\n") ? "\r\n" : "\n");
+	if (!isDeepStrictEqual(readYamlCatalogs(splitLines(content)).flatMap((catalog) => catalog.entries.map((e) => [
+		catalog.field,
+		e.key,
+		e.value
+	])), expected)) throw new UpgradeError(`Could not rewrite ${file} without disturbing it; nothing was written.`, "rewrite_failed", "Move its @rebasepro catalog entries by hand, then run `rebase upgrade` again.");
+	return content;
+}
+function planYamlOverrides(file, original, target, options, plan, ledger) {
+	const lines = splitLines(original);
+	const crlf = original.includes("\r\n");
+	const block = readYamlBlock(lines, "overrides");
+	if (!block) {
+		const inline = lines.find((line) => /^overrides:\s*[^\s#]/.test(line));
+		if (inline && inline.includes("@rebasepro/")) plan.skipped.push({
+			file,
+			name: "overrides",
+			field: "overrides",
+			spec: inline.slice(10).trim(),
+			reason: "an inline overrides map, which this does not rewrite; write it as a block, or edit it by hand"
+		});
+		return original;
+	}
+	const next = [...lines];
+	const removed = /* @__PURE__ */ new Set();
+	const expected = /* @__PURE__ */ new Map();
+	for (const entry of block.entries) {
+		if (!overrideTarget(entry.key)) {
+			expected.set(entry.key, entry.value);
+			continue;
+		}
+		const cls = classifySpec(entry.value);
+		const pkg = overrideTarget(entry.key);
+		if (cls.kind === "movable") {
+			const to = `${cls.prefix}${target}`;
+			expected.set(entry.key, to);
+			if (to === entry.value) {
+				plan.unchanged++;
+				continue;
+			}
+			const line = lines[entry.line];
+			next[entry.line] = line.slice(0, entry.valueStart) + to + line.slice(entry.valueEnd);
+			plan.overrides.push({
+				file,
+				name: entry.key,
+				spec: entry.value,
+				action: "bumped",
+				to
+			});
+		} else if (cls.kind === "catalog" && pkg) {
+			expected.set(entry.key, entry.value);
+			ledger.refs.push({
+				file,
+				name: entry.key,
+				field: "overrides",
+				spec: entry.value,
+				catalog: cls.catalog,
+				pkg
+			});
+		} else if (cls.kind === "local") if (options.dropLocalOverrides) {
+			removed.add(entry.line);
+			plan.overrides.push({
+				file,
+				name: entry.key,
+				spec: entry.value,
+				action: "removed-local"
+			});
+		} else {
+			expected.set(entry.key, entry.value);
+			plan.overrides.push({
+				file,
+				name: entry.key,
+				spec: entry.value,
+				action: "kept-local"
+			});
+		}
+		else {
+			expected.set(entry.key, entry.value);
+			plan.skipped.push({
+				file,
+				name: entry.key,
+				field: "overrides",
+				spec: entry.value,
+				reason: leftAloneReason(cls)
+			});
+		}
+	}
+	const survivors = block.entries.filter((entry) => !removed.has(entry.line)).length + block.otherContent;
+	if (removed.size > 0 && survivors === 0) removed.add(block.keyLine);
+	const content = next.filter((_, index) => !removed.has(index)).join(crlf ? "\r\n" : "\n");
+	const after = readYamlBlock(splitLines(content), "overrides");
+	if (!isDeepStrictEqual(after ? after.entries.map((e) => [e.key, e.value]) : [], [...expected.entries()])) throw new UpgradeError(`Could not rewrite ${file} without disturbing it; nothing was written.`, "rewrite_failed", "Move its @rebasepro overrides by hand, then run `rebase upgrade` again.");
+	return content;
+}
+/** Lockfiles, in the order they are looked for in each directory. */
+var LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["package-lock.json", "npm"],
+	["yarn.lock", "yarn"],
+	["bun.lockb", "bun"],
+	["bun.lock", "bun"]
+];
+/**
+* The package manager this project installs with, from what is on disk.
+*
+* A lockfile is the project's own statement, so it wins. The search starts at
+* the project root and walks up, because a project inside a workspace has its
+* lockfile at the workspace root; it stops at the repository's root, so a stray
+* lockfile in a home directory is never read as this project's choice. With no
+* lockfile anywhere, a `pnpm-workspace.yaml` still says pnpm; otherwise npm,
+* the one every Node install has.
+*/
+function detectInstaller(projectRoot) {
+	let dir = path.resolve(projectRoot);
+	let workspaceYaml = false;
+	for (;;) {
+		for (const [lockfile, installer] of LOCKFILES) if (fs.existsSync(path.join(dir, lockfile))) return installer;
+		if (fs.existsSync(path.join(dir, "pnpm-workspace.yaml"))) workspaceYaml = true;
+		const parent = path.dirname(dir);
+		if (parent === dir || fs.existsSync(path.join(dir, ".git"))) break;
+		dir = parent;
+	}
+	return workspaceYaml ? "pnpm" : "npm";
+}
+/**
+* The install command for each package manager — pnpm's and npm's from the
+* helpers every other command uses, yarn's and bun's spelled the same way.
+*/
+function installCommand(installer) {
+	const [bin, ...args] = installer === "pnpm" || installer === "npm" ? getPMCommands(installer).install : [installer, "install"];
+	return [bin, args];
+}
+/**
+* The exact version `--to` names.
+*
+* An exact version is used as written, with no network call: the control plane
+* passes one when it rebuilds a project, and that rebuild must not depend on a
+* registry lookup succeeding for anything but the install itself. Anything
+* else is a dist-tag, asked of the registry through `npmView` — which runs npm
+* in the project, so its `.npmrc` and the user's registry config apply.
+*/
+async function resolveTarget(requested, npmView) {
+	const trimmed = requested.trim();
+	const bare = trimmed.replace(/^v(?=\d)/, "");
+	if (isExactVersion(bare)) return bare;
+	if (!/^[A-Za-z][\w.-]*$/.test(trimmed)) throw new UpgradeError(`"${requested}" is neither an exact version nor a dist-tag.`, "target_invalid", "Pass an exact version such as 0.21.0, or a dist-tag such as latest or canary.");
+	let answer;
+	try {
+		answer = (await npmView(`${RELEASE_PACKAGE}@${trimmed}`)).trim();
+	} catch (err) {
+		const detail = err instanceof Error ? firstLine(err.message) : String(err);
+		throw new UpgradeError(`Could not resolve "${trimmed}" on the npm registry${detail ? `: ${detail}` : "."}`, "target_unresolved", "Check the tag and your registry access, or pass an exact version with --to.");
+	}
+	if (!isExactVersion(answer)) throw new UpgradeError(`The registry has no single version for ${RELEASE_PACKAGE}@${trimmed}${answer ? ` (it answered "${firstLine(answer)}")` : ""}.`, "target_unresolved", "Check the tag, or pass an exact version with --to.");
+	return answer;
+}
+function firstLine(text) {
+	return text.split("\n").map((line) => line.trim()).filter(Boolean)[0] ?? "";
+}
+/**
+* Whether moving from `from` to `to` goes backwards — the note the summary
+* prints, and what `rebase upgrade` refuses without `--allow-downgrade`.
+*
+* Prerelease identifiers compare as SemVer orders them: a release outranks its
+* own prereleases, numbers compare as numbers, and the channel (`alpha` <
+* `beta` < `rc`) compares as text. One case SemVer orders and this does not:
+* two builds on one channel told apart by a non-numeric identifier. A canary
+* is `0.24.1-canary.g<git hash>`, and hashes sort in no order at all — so
+* `canary.gcb918fc` → `canary.g8c5a265` is neither forwards nor backwards as
+* far as the version can say, and the `canary` tag, which points at the newest
+* build, is the only thing that knows.
+*/
+function isDowngrade(from, to) {
+	const a = SEMVER.exec(from.replace(/^[\^~]/, ""));
+	const b = SEMVER.exec(to.replace(/^[\^~]/, ""));
+	if (!a || !b) return false;
+	for (let i = 1; i <= 3; i++) {
+		const diff = Number(a[i]) - Number(b[i]);
+		if (diff !== 0) return diff > 0;
+	}
+	const preA = a[4];
+	const preB = b[4];
+	if (preA === preB) return false;
+	if (preA === void 0) return true;
+	if (preB === void 0) return false;
+	const partsA = preA.split(".");
+	const partsB = preB.split(".");
+	for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
+		const x = partsA[i];
+		const y = partsB[i];
+		if (x === void 0) return false;
+		if (y === void 0) return true;
+		if (x === y) continue;
+		const nx = /^\d+$/.test(x) ? Number(x) : NaN;
+		const ny = /^\d+$/.test(y) ? Number(y) : NaN;
+		if (!Number.isNaN(nx) && !Number.isNaN(ny)) return nx > ny;
+		if (!Number.isNaN(nx)) return false;
+		if (!Number.isNaN(ny)) return true;
+		if (i > 0) return false;
+		return x > y;
+	}
+	return false;
+}
+/**
+* The prerelease channel a project's pins are on — `canary` for
+* `0.24.1-canary.gcb918fc` — or null when none is on a prerelease, or they are
+* on more than one channel.
+*
+* The channel is the prerelease's first identifier, which is also the dist-tag
+* it is published under. `rebase upgrade` with no `--to` stays on it rather than
+* defaulting to `latest`, which for a canary project is usually older than the
+* build it already has.
+*/
+function prereleaseChannel(versions) {
+	const channels = /* @__PURE__ */ new Set();
+	for (const version of versions) {
+		const channel = (SEMVER.exec(version.replace(/^[\^~]/, ""))?.[4])?.split(".")[0];
+		if (channel && /^[A-Za-z][0-9A-Za-z-]*$/.test(channel)) channels.add(channel);
+	}
+	return channels.size === 1 ? [...channels][0] : null;
+}
+/** The pins a plan moves to an older release. */
+function downgradedPins(plan) {
+	return plan.changed.filter((pin) => isDowngrade(pin.from, pin.to));
+}
+//#endregion
+//#region src/commands/upgrade.ts
+/**
+* CLI command: rebase upgrade [--to <version|tag>]
+*
+* Moves every `@rebasepro/*` package the project pins to one release, then
+* installs. The file work — which specs move, the rewrite, what overrides say —
+* is `../upgrade.ts`; this adds the registry lookup for a tag, the install, and
+* the two ways of saying what happened.
+*/
+/** Every flag `rebase upgrade` accepts. Its help page and the docs verifier read this. */
+var UPGRADE_FLAGS = {
+	"--to": String,
+	"--allow-downgrade": Boolean,
+	"--drop-local-overrides": Boolean,
+	"--no-install": Boolean,
+	"--dry-run": Boolean,
+	"--json": Boolean
+};
+function printHelp() {
+	console.log(`
+${chalk.bold("rebase upgrade")} — move every @rebasepro package this project pins to one release
+
+${chalk.bold("Usage")}
+  rebase upgrade [--to <version|tag>] [options]
+
+${chalk.bold("Options")}
+  --to <version|tag>          The release: an exact version (0.21.0) or a dist-tag
+                              (latest, canary). Default: latest — or, for a project
+                              on a prerelease, its channel (canary), unless latest
+                              is newer
+  --allow-downgrade           Let a dist-tag move pins to an older release. Without
+                              it that is refused; an exact --to version is taken
+                              as asked
+  --drop-local-overrides      Remove link: and file: overrides of @rebasepro packages,
+                              which win over every pin
+  --no-install                Rewrite the package.json files, but do not install
+  --dry-run                   Print what would change, and write nothing
+  --json                      One JSON document on stdout
+  -h, --help                  Show this help
+
+${chalk.bold("What it changes")}
+  Every @rebasepro/* entry in dependencies, devDependencies and optionalDependencies,
+  in every package.json under the project that git does not ignore (node_modules,
+  dist* and hidden directories excepted, in a repository or not). ^ and ~ are kept.
+  peerDependencies are left alone, and so are workspace:, link:, file:, git and tag
+  specs, which are listed with the reason.
+  Overrides in pnpm-workspace.yaml and package.json are bumped the same way, and so
+  are the entries of pnpm-workspace.yaml's catalog: and catalogs: blocks, which is
+  where a catalog: pin's version lives.
+
+${chalk.bold("Examples")}
+  rebase upgrade                          Move to the newest release on this project's channel
+  rebase upgrade --to latest --allow-downgrade   Move a canary project back to stable
+  rebase upgrade --to canary --dry-run    See what the canary would change
+  rebase upgrade --to 0.21.0 --no-install --json
+`.trim());
+}
+var defaultIo = {
+	npmView: async (spec, cwd) => {
+		try {
+			return (await execa("npm", [
+				"view",
+				spec,
+				"version"
+			], { cwd })).stdout;
+		} catch (err) {
+			throw new Error(npmFailure(err));
+		}
+	},
+	install: async ([bin, args], cwd, quietStdout) => {
+		await execa(bin, args, {
+			cwd,
+			stdio: quietStdout ? [
+				"ignore",
+				2,
+				"inherit"
+			] : "inherit"
+		});
+	}
+};
+/**
+* The one line of a failed `npm view` worth printing.
+*
+* execa's own message is the command line that failed, which says nothing the
+* reader does not know. npm's stderr says why — `404 No match found for version
+* nosuchtag` — under an `npm error code E404` line that says less.
+*/
+function npmFailure(err) {
+	return (typeof err === "object" && err !== null && "stderr" in err && typeof err.stderr === "string" ? err.stderr : "").split("\n").map((line) => line.replace(/^npm (?:error|ERR!)\s*/, "").trim()).find((line) => line !== "" && !/^code\s/.test(line) && !/^\d{3}$/.test(line)) ?? (err instanceof Error ? err.message : String(err));
+}
+/**
+* The one release every moved pin came from, or `null` when they disagreed.
+* A range's `^`/`~` is not part of it: `upgrade --to` keeps each pin's operator.
+*/
+function previousRelease(plan) {
+	const versions = new Set(plan.changed.map((pin) => pin.from.replace(/^[\^~]/, "")));
+	if (versions.size !== 1) return null;
+	const [version] = versions;
+	return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version) ? version : null;
+}
+async function upgradeCommand(rawArgs, io = defaultIo) {
+	if (wantsHelp(rawArgs)) {
+		printHelp();
+		return;
+	}
+	const { flags } = parseCommandArgs({
+		spec: UPGRADE_FLAGS,
+		rawArgs,
+		commandWords: 1,
+		command: "upgrade",
+		maxPositionals: 0
+	});
+	const json = flags["--json"] === true;
+	const dryRun = flags["--dry-run"] === true;
+	const projectRoot = requireProjectRoot();
+	/** Every refusal, in whichever of the two languages was asked for. */
+	const refuse = (message, code, hint, issues) => {
+		if (json) failAsJson(message, code, hint, issues);
+		console.error(chalk.red(`✗ ${message}`));
+		for (const issue of issues ?? []) console.error(`  ${chalk.gray(issue.path ?? "")} ${issue.message}`);
+		if (hint) console.error(chalk.gray(`  ${hint}`));
+		process.exit(1);
+	};
+	try {
+		loadManifest(projectRoot);
+	} catch (err) {
+		if (err instanceof ManifestError) refuse(err.message, "manifest_invalid", "Fix rebase.json, then run this again.", err.issues.map((issue) => ({
+			path: issue.path,
+			message: issue.message
+		})));
+		throw err;
+	}
+	const requested = flags["--to"];
+	let plan;
+	let channel = null;
+	try {
+		const npmView = (spec) => io.npmView(spec, projectRoot);
+		const planFor = (target) => planUpgrade(projectRoot, target, { dropLocalOverrides: flags["--drop-local-overrides"] === true });
+		plan = planFor(await resolveTarget(requested ?? "latest", npmView));
+		channel = prereleaseChannel(plan.changed.map((pin) => pin.from));
+		if (requested === void 0 && channel) {
+			const onChannel = await resolveTarget(channel, npmView).catch(() => null);
+			if (onChannel && isDowngrade(onChannel, plan.target)) {
+				if (!json) {
+					console.log(chalk.gray(`  This project is on the ${channel} channel, so this stays on it: ${channel} is ${onChannel}.`));
+					console.log(chalk.gray(`  \`rebase upgrade --to latest\` is the stable release, ${plan.target}.`));
+				}
+				plan = planFor(onChannel);
+			}
+		}
+	} catch (err) {
+		if (err instanceof UpgradeError) refuse(err.message, err.code, err.hint);
+		throw err;
+	}
+	const backwards = downgradedPins(plan);
+	const exactRequest = requested !== void 0 && isExactVersion(requested.trim().replace(/^v(?=\d)/, ""));
+	if (backwards.length > 0 && !exactRequest && flags["--allow-downgrade"] !== true && !dryRun) {
+		const tag = requested?.trim() ?? "latest";
+		const current = [...new Set(backwards.map((pin) => pin.from.replace(/^[\^~]/, "")))].join(", ");
+		refuse(`\`${tag}\` is ${plan.target}, older than this project's ${current}: upgrading to it would move ${backwards.length} pin${backwards.length === 1 ? "" : "s"} backwards. Nothing was changed.`, "downgrade_refused", channel ? `Stay on the ${channel} channel with \`rebase upgrade --to ${channel}\`, or pass --allow-downgrade to move to ${plan.target}.` : `Pass --allow-downgrade to move to ${plan.target} anyway, or --to <version> for an exact release.`);
+	}
+	if (!dryRun) applyUpgradePlan(plan);
+	const wrote = !dryRun && plan.writes.length > 0;
+	const install = wrote && flags["--no-install"] !== true;
+	const installer = detectInstaller(projectRoot);
+	const [bin, args] = installCommand(installer);
+	const installLine = [bin, ...args].join(" ");
+	if (!json) {
+		printSummary(plan, dryRun);
+		if (backwards.length > 0) {
+			const pins = `${backwards.length} pin${backwards.length === 1 ? "" : "s"}`;
+			console.log(chalk.yellow(exactRequest || flags["--allow-downgrade"] === true ? `  ⚠ ${plan.target} is an older release than ${pins} here ${dryRun ? "are" : "were"} on: this is a downgrade.` : `  ⚠ ${plan.target} is an older release than ${pins} here are on. A real run refuses it without --allow-downgrade.`));
+			console.log("");
+		}
+	}
+	let installed = false;
+	if (install) {
+		if (!json) console.log(chalk.gray(`  Installing with ${installer}...\n`));
+		try {
+			await io.install([bin, args], projectRoot, json);
+			installed = true;
+		} catch {
+			const previous = previousRelease(plan);
+			refuse(`\`${installLine}\` failed.`, "install_failed", `The package.json edits were kept. Fix what the install reported and run \`${installLine}\` again, ` + (previous ? `or put every pin back with \`rebase upgrade --to ${previous}\`.` : "or revert the edits with git."));
+		}
+	}
+	const result = {
+		target: plan.target,
+		changed: plan.changed,
+		skipped: plan.skipped,
+		overrides: plan.overrides,
+		unreadable: plan.unreadable,
+		installed,
+		dryRun
+	};
+	if (json) {
+		console.log(JSON.stringify(result, null, 2));
+		return;
+	}
+	printOutcome(plan, {
+		dryRun,
+		wrote,
+		installed,
+		installLine
+	});
+}
+/** Changes grouped by file, then what was left alone and why, then overrides. */
+function printSummary(plan, dryRun) {
+	console.log("");
+	console.log(`${chalk.bold("Rebase")} — ${dryRun ? "what upgrading" : "upgrading"} @rebasepro packages to ${chalk.cyan(plan.target)}${dryRun ? " would change" : ""}`);
+	const byFile = /* @__PURE__ */ new Map();
+	for (const pin of plan.changed) byFile.set(pin.file, [...byFile.get(pin.file) ?? [], pin]);
+	const nameWidth = Math.max(0, ...plan.changed.map((pin) => pin.name.length));
+	for (const [file, pins] of byFile) {
+		console.log("");
+		console.log(`  ${chalk.bold(file)}`);
+		for (const pin of pins) {
+			const field = pin.field === "dependencies" ? "" : chalk.gray(`  ${pin.field}`);
+			const older = isDowngrade(pin.from, pin.to) ? chalk.yellow("  (older)") : "";
+			console.log(`    ${pin.name.padEnd(nameWidth)}  ${chalk.gray(pin.from)} → ${chalk.green(pin.to)}${field}${older}`);
+		}
+	}
+	if (plan.skipped.length > 0) {
+		console.log("");
+		console.log(`  ${chalk.bold("Left alone")}`);
+		for (const skip of plan.skipped) {
+			console.log(`    ${skip.name}  ${chalk.gray(skip.spec)}  ${chalk.gray(`(${skip.file}, ${skip.field})`)}`);
+			console.log(chalk.gray(`      ${skip.reason}`));
+		}
+	}
+	if (plan.overrides.length > 0) {
+		console.log("");
+		console.log(`  ${chalk.bold("Overrides")}`);
+		for (const override of plan.overrides) {
+			const where = chalk.gray(`(${override.file})`);
+			if (override.action === "bumped") console.log(`    ${override.name}  ${chalk.gray(override.spec)} → ${chalk.green(override.to ?? "")}  ${where}`);
+			else if (override.action === "removed-local") console.log(`    ${override.name}  ${chalk.gray(override.spec)}  ${where}  ${chalk.green(dryRun ? "would be removed" : "removed")}`);
+			else {
+				console.log(`    ${chalk.yellow("⚠")} ${override.name} → ${override.spec}  ${where}`);
+				console.log(chalk.yellow("      local override — wins over every pin, the upgrade will not reach these packages"));
+			}
+		}
+		if (plan.overrides.some((o) => o.action === "kept-local")) console.log(chalk.gray("      Run again with --drop-local-overrides to remove them."));
+	}
+	if (plan.unreadable.length > 0) {
+		console.log("");
+		console.log(`  ${chalk.bold("Not read")}`);
+		for (const entry of plan.unreadable) console.log(`    ${entry.file}  ${chalk.gray(entry.reason)}`);
+	}
+	console.log("");
+}
+function printOutcome(plan, outcome) {
+	const moved = plan.changed.length + plan.overrides.filter((o) => o.action !== "kept-local").length;
+	const leftAlone = plan.skipped.length + plan.overrides.filter((o) => o.action === "kept-local").length;
+	const entries = (n) => `${n} entr${n === 1 ? "y" : "ies"}`;
+	if (moved === 0 && leftAlone > 0) {
+		if (plan.unchanged > 0) console.log(chalk.green(`✓ Every pin this can move is already on ${plan.target}; ${entries(leftAlone)} ${leftAlone === 1 ? "was" : "were"} left alone, above.`));
+		else if (outcome.dryRun) console.log(chalk.yellow(`  Nothing to move to ${plan.target}: ${entries(leftAlone)} ${leftAlone === 1 ? "is" : "are"} left alone, above.`));
+		else console.log(chalk.yellow(`⚠ Nothing moved to ${plan.target}: ${entries(leftAlone)} ${leftAlone === 1 ? "was" : "were"} left alone, above.`));
+		console.log("");
+		return;
+	}
+	if (outcome.dryRun) {
+		console.log(chalk.gray(moved === 0 ? `  Nothing to change: this project is already on ${plan.target}.` : "  Dry run — nothing was written. Run it without --dry-run to apply."));
+		console.log("");
+		return;
+	}
+	if (!outcome.wrote) {
+		console.log(chalk.green(`✓ This project is already on ${plan.target}.`));
+		console.log("");
+		return;
+	}
+	const files = plan.writes.length;
+	console.log(chalk.green(`✓ Moved ${moved} entr${moved === 1 ? "y" : "ies"} in ${files} file${files === 1 ? "" : "s"} to ${plan.target}${outcome.installed ? " and installed" : ""}.`));
+	if (!outcome.installed) console.log(chalk.gray(`  Install with \`${outcome.installLine}\`, then run \`rebase build\`, then \`rebase cloud deploy\`.`));
+	else console.log(chalk.gray("  Run `rebase build`, then `rebase cloud deploy`."));
+	console.log("");
+}
+//#endregion
+export { upgradeCommand };
+
+//# sourceMappingURL=upgrade-CtZtRkTE.js.map