@lenne.tech/cli 1.11.0 → 1.12.0

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const markdown_table_1 = require("../lib/markdown-table");
 /**
  * Server helper functions
  */
@@ -749,6 +750,13 @@ class Server {
                 catch (err) {
                     return { method: result.method, path: dest, success: false };
                 }
+                // Post-install format pass. processApiMode may have left whitespace
+                // artifacts (multi-line arrays/imports) that the formatter flags in
+                // format:check; oxfmt is only available after install, so we run it
+                // here.
+                if (apiMode) {
+                    yield apiModeHelper.formatProject(dest);
+                }
             }
             return { method: result.method, path: dest, success: true };
         });
@@ -890,9 +898,11 @@ class Server {
      *
      * In vendor mode we additionally clone `@lenne.tech/nest-server` to
      * /tmp, copy its framework kernel (`src/core/`, `src/index.ts`,
-     * `src/core.module.ts`, `src/test/`, `src/templates/`, `src/types/`,
-     * `LICENSE`, `bin/migrate.js`) into the project at `src/core/`
-     * applying the flatten-fix, remove `@lenne.tech/nest-server` from the
+     * `src/core.module.ts`, `src/test/`, `src/types/`, `LICENSE`,
+     * `bin/migrate.js`) into the project at `src/core/` applying the
+     * flatten-fix, place upstream `src/templates/` at `<project>/src/templates/`
+     * (outside core/ so the runtime resolver finds it at the same relative
+     * path as in npm mode), remove `@lenne.tech/nest-server` from the
      * project's `package.json`, merge the framework's transitive deps into
      * the project's own deps, and run an AST-based codemod that rewrites
      * every `from '@lenne.tech/nest-server'` import in consumer code
@@ -994,7 +1004,10 @@ class Server {
                 //
                 // Upstream layout: src/core/ (framework sub-dir) + src/index.ts +
                 // src/core.module.ts + src/test/ + src/templates/ + src/types/.
-                // Target layout: everything flat under <project>/src/core/.
+                // Target layout: most things flat under <project>/src/core/, with
+                // one exception: src/templates/ stays at the same upstream location
+                // (<project>/src/templates/) because the runtime email-template
+                // resolver uses __dirname-relative lookup that must match npm mode.
                 //
                 // We WIPE the starter's (non-existent in npm mode) src/core/ first
                 // just to guarantee idempotency when users run this twice.
@@ -1006,7 +1019,15 @@ class Server {
                     [`${tmpClone}/src/index.ts`, `${coreDir}/index.ts`],
                     [`${tmpClone}/src/core.module.ts`, `${coreDir}/core.module.ts`],
                     [`${tmpClone}/src/test`, `${coreDir}/test`],
-                    [`${tmpClone}/src/templates`, `${coreDir}/templates`],
+                    // src/templates/ stays OUTSIDE src/core/ at its upstream location so
+                    // the runtime template resolver (which computes
+                    // `__dirname + '../../../templates'` from within
+                    // src/core/modules/better-auth/) finds E-Mail templates at the same
+                    // relative path as in npm mode (node_modules/@lenne.tech/nest-server/
+                    // src/templates/). Keeping templates as first-class project files
+                    // outside core/ also lets projects customize them without touching
+                    // the vendored framework tree.
+                    [`${tmpClone}/src/templates`, `${dest}/src/templates`],
                     [`${tmpClone}/src/types`, `${coreDir}/types`],
                     [`${tmpClone}/LICENSE`, `${coreDir}/LICENSE`],
                 ];
@@ -1395,14 +1416,14 @@ class Server {
                             "var f=require('fs'),h=require('https');",
                             "try{var c=f.readFileSync('src/core/VENDOR.md','utf8')}catch(e){process.exit(0)}",
                             'var m=c.match(/Baseline-Version[^0-9]*(\\d+\\.\\d+\\.\\d+)/);',
-                            'if(!m){process.stderr.write(String.fromCharCode(9888)+\' vendor-freshness: no baseline\\n\');process.exit(0)}',
+                            "if(!m){process.stderr.write(String.fromCharCode(9888)+' vendor-freshness: no baseline\\n');process.exit(0)}",
                             'var v=m[1];',
                             "h.get('https://registry.npmjs.org/@lenne.tech/nest-server/latest',function(r){",
                             "var d='';r.on('data',function(c){d+=c});r.on('end',function(){",
-                            "try{var l=JSON.parse(d).version;",
+                            'try{var l=JSON.parse(d).version;',
                             "if(v===l)console.log('vendor core up-to-date (v'+v+')');",
                             "else process.stderr.write('vendor core v'+v+', latest v'+l+'\\n')",
-                            '}catch(e){}})}).on(\'error\',function(){});',
+                            "}catch(e){}})}).on('error',function(){});",
                             'setTimeout(function(){process.exit(0)},5000)',
                             '"',
                         ].join('');
@@ -1417,7 +1438,8 @@ class Server {
                                 return;
                             const installPrefix = 'pnpm install && ';
                             if (existing.startsWith(installPrefix)) {
-                                scripts[scriptName] = `${installPrefix}pnpm run check:vendor-freshness && ${existing.slice(installPrefix.length)}`;
+                                scripts[scriptName] =
+                                    `${installPrefix}pnpm run check:vendor-freshness && ${existing.slice(installPrefix.length)}`;
                             }
                             else {
                                 scripts[scriptName] = `pnpm run check:vendor-freshness && ${existing}`;
@@ -1485,7 +1507,7 @@ class Server {
                     ' * Vendor-mode stub for extras/sync-packages.mjs.',
                     ' *',
                     ' * The original script is designed for npm-mode projects where',
-                    " * `@lenne.tech/nest-server` is an installed dependency and",
+                    ' * `@lenne.tech/nest-server` is an installed dependency and',
                     ' * `pnpm run update` pulls the latest upstream deps into the',
                     ' * project package.json.',
                     ' *',
@@ -1547,7 +1569,7 @@ class Server {
                         '',
                         '- **Read framework code from `src/core/**`** — not from `node_modules/`.',
                         '- **Generated imports use relative paths** to `src/core`, e.g.',
-                        '  `import { CrudService } from \'../../../core\';`',
+                        "  `import { CrudService } from '../../../core';`",
                         '  The exact depth depends on the file location. `lt server module`',
                         '  computes it automatically.',
                         '- **Baseline + patch log** live in `src/core/VENDOR.md`. Log any',
@@ -1615,17 +1637,48 @@ class Server {
                     '',
                     'This directory is a curated vendor copy of the `core/` tree from',
                     '@lenne.tech/nest-server. It is first-class project code, not a',
-                    'node_modules shadow copy. Edit freely; log substantial changes in',
-                    'the "Local changes" table below so the `nest-server-core-updater`',
-                    'agent can classify them at sync time.',
+                    'node_modules shadow copy — but it is **not a fork**. The copy',
+                    'exists so Claude Code (and humans) can read framework internals',
+                    'directly. Log substantial local changes in the "Local changes"',
+                    'table below so the `nest-server-core-updater` agent can classify',
+                    'them at sync time.',
                     '',
                     'The flatten-fix was applied during `lt fullstack init`: the',
                     'upstream `src/index.ts`, `src/core.module.ts`, `src/test/`,',
-                    '`src/templates/`, `src/types/`, and `LICENSE` were moved under',
-                    '`src/core/` and their relative `./core/…` specifiers were',
-                    'stripped. See the init code in',
+                    '`src/types/`, and `LICENSE` were moved under `src/core/` and',
+                    'their relative `./core/…` specifiers were stripped. The upstream',
+                    '`src/templates/` tree (E-Mail templates) was placed at the',
+                    'project root `src/templates/` (outside `src/core/`) so the',
+                    'runtime template resolver finds them at the same relative path',
+                    'as in npm mode. See the init code in',
                     '`lenneTech/cli/src/extensions/server.ts#convertCloneToVendored`.',
                     '',
+                    '## Modification Policy',
+                    '',
+                    'Edit `src/core/` **only** when the change is generally useful to every',
+                    '@lenne.tech/nest-server consumer:',
+                    '',
+                    '- Bugfixes that apply to every consumer',
+                    '- Broad framework enhancements',
+                    '- Security vulnerability fixes',
+                    '- Build/TypeScript compatibility fixes every consumer would hit',
+                    '',
+                    'Everything else stays **outside** `src/core/`. Project-specific',
+                    'business rules, customer enums, and proprietary integrations',
+                    'belong in project code via modification, inheritance, extension,',
+                    'or `ICoreModuleOverrides`.',
+                    '',
+                    'Generally-useful changes **MUST** be submitted as an upstream PR',
+                    'to https://github.com/lenneTech/nest-server. Run',
+                    '`/lt-dev:backend:contribute-nest-server-core` to prepare it — the',
+                    'agent filters cosmetic commits, categorizes local changes as',
+                    'upstream-candidate vs. project-specific, and writes PR drafts for',
+                    "human review. Letting useful fixes rot in one project's vendor",
+                    'tree is an anti-pattern: they belong upstream so every consumer',
+                    'benefits and the local patch disappears on the next sync.',
+                    '',
+                    'When in doubt, ask before editing `src/core/`.',
+                    '',
                     '## Baseline',
                     '',
                     '- **Upstream-Repo:** https://github.com/lenneTech/nest-server',
@@ -1636,22 +1689,15 @@ class Server {
                     '',
                     '## Sync history',
                     '',
-                    '| Date | From | To | Notes |',
-                    '| ---- | ---- | -- | ----- |',
-                    `| ${today} | — | ${syncHistoryTo} | scaffolded by lt CLI |`,
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'From', 'To', 'Notes'], [[today, '—', syncHistoryTo, 'scaffolded by lt CLI']]),
                     '',
                     '## Local changes',
                     '',
-                    '| Date | Commit | Scope | Reason | Status |',
-                    '| ---- | ------ | ----- | ------ | ------ |',
-                    '| — | — | (none, pristine) | initial vendor | — |',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'Commit', 'Scope', 'Reason', 'Status'], [['—', '—', '(none, pristine)', 'initial vendor', '—']]),
                     '',
                     '## Upstream PRs',
                     '',
-                    '| PR | Title | Commits | Status |',
-                    '| -- | ----- | ------- | ------ |',
-                    '| — | (none yet) | — | — |',
-                    '',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['PR', 'Title', 'Commits', 'Status'], [['—', '(none yet)', '—', '—']]),
                 ].join('\n'));
             }
             // ── Post-conversion verification ──────────────────────────────────────
@@ -1842,10 +1888,7 @@ class Server {
         if (!this.filesystem.exists(tsconfigPath)) {
             return;
         }
-        const EXCLUDE_ENTRIES = [
-            'src/core/modules/migrate/templates/**/*.template.ts',
-            'src/core/test/**/*.ts',
-        ];
+        const EXCLUDE_ENTRIES = ['src/core/modules/migrate/templates/**/*.template.ts', 'src/core/test/**/*.ts'];
         try {
             // The upstream tsconfig files may contain comments — standard JSON parse
             // breaks on them. Use a regex-based patch as a fallback.
@@ -2080,9 +2123,7 @@ class Server {
                     print.warning('');
                     print.warning('⚠  VENDOR.md documents local patches in src/core/ that will be LOST:');
                     // Extract non-header table rows
-                    const rows = localChangesSection[0]
-                        .split('\n')
-                        .filter((l) => /^\|\s*\d{4}-/.test(l));
+                    const rows = localChangesSection[0].split('\n').filter((l) => /^\|\s*\d{4}-/.test(l));
                     for (const row of rows.slice(0, 5)) {
                         print.info(`  ${row.trim()}`);
                     }
@@ -2112,10 +2153,7 @@ class Server {
             for (const sourceFile of project.getSourceFiles()) {
                 let modified = false;
                 // Static imports + re-exports
-                for (const decl of [
-                    ...sourceFile.getImportDeclarations(),
-                    ...sourceFile.getExportDeclarations(),
-                ]) {
+                for (const decl of [...sourceFile.getImportDeclarations(), ...sourceFile.getExportDeclarations()]) {
                     const spec = decl.getModuleSpecifierValue();
                     if (!spec)
                         continue;
@@ -2182,7 +2220,8 @@ class Server {
                 const migrateCompiler = 'ts:./node_modules/@lenne.tech/nest-server/dist/core/modules/migrate/helpers/ts-compiler.js';
                 const migrateStore = '--store ./migrations-utils/migrate.js --migrations-dir ./migrations';
                 const migrateTemplate = './node_modules/@lenne.tech/nest-server/dist/core/modules/migrate/templates/migration-project.template.ts';
-                scripts['migrate:create'] = `f() { migrate create "$1" --template-file ${migrateTemplate} --migrations-dir ./migrations --compiler ${migrateCompiler}; }; f`;
+                scripts['migrate:create'] =
+                    `f() { migrate create "$1" --template-file ${migrateTemplate} --migrations-dir ./migrations --compiler ${migrateCompiler}; }; f`;
                 scripts['migrate:up'] = `migrate up ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:down'] = `migrate down ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:list'] = `migrate list ${migrateStore} --compiler ${migrateCompiler}`;
@@ -2262,8 +2301,7 @@ class Server {
                 let content = filesystem.read(gitignorePath) || '';
                 content = content
                     .split('\n')
-                    .filter((line) => !line.includes('scripts/vendor/sync-results') &&
-                    !line.includes('scripts/vendor/upstream-candidates'))
+                    .filter((line) => !line.includes('scripts/vendor/sync-results') && !line.includes('scripts/vendor/upstream-candidates'))
                     .join('\n');
                 filesystem.write(gitignorePath, content);
             }
@@ -2279,7 +2317,7 @@ class Server {
                 for (const f of staleRelativeImports.slice(0, 10)) {
                     print.info(`  ${f}`);
                 }
-                print.info('These imports must be manually rewritten to \'@lenne.tech/nest-server\'.');
+                print.info("These imports must be manually rewritten to '@lenne.tech/nest-server'.");
             }
         });
     }

package/build/lib/frontend-framework-detection.js

@@ -81,8 +81,7 @@ function findAppDir(startDir) {
     let current = path.resolve(startDir);
     const root = path.parse(current).root;
     while (current !== root) {
-        if ((0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.ts')) ||
-            (0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.js'))) {
+        if ((0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.ts')) || (0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.js'))) {
             return current;
         }
         current = path.dirname(current);

package/build/lib/hoist-workspace-pnpm-config.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+/**
+ * pnpm workspace-scoped fields that must live at the workspace root.
+ * When present in sub-project package.json files, pnpm emits:
+ *
+ *   WARN  The field "<field>" was found in <path>. This will not take
+ *   effect. You should configure "<field>" at the root of the workspace
+ *   instead.
+ *
+ * Crucially, the WARN also means the values are silently ignored — CVE
+ * overrides defined only in projects/api/package.json never reach the
+ * install resolver. Hoisting them to the root fixes both the warning
+ * and the actual dependency-resolution behavior.
+ */
+const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ignoredOptionalDependencies'];
+/**
+ * Hoist workspace-scoped pnpm config from sub-projects into the root
+ * package.json. After this runs, sub-project package.json files no
+ * longer have `overrides`, `onlyBuiltDependencies`, or
+ * `ignoredOptionalDependencies`, and the root package.json contains
+ * the merged union.
+ *
+ * Idempotent: running twice has the same effect as running once.
+ *
+ * @param options.filesystem  Gluegun filesystem tool
+ * @param options.projectDir  Workspace root (contains pnpm-workspace.yaml)
+ * @param options.subProjects Sub-project dirs relative to projectDir
+ */
+function hoistWorkspacePnpmConfig(options) {
+    var _a;
+    const { filesystem, projectDir, subProjects } = options;
+    const rootPkgPath = `${projectDir}/package.json`;
+    if (!filesystem.exists(rootPkgPath))
+        return;
+    const rootPkg = filesystem.read(rootPkgPath, 'json');
+    if (!rootPkg)
+        return;
+    (_a = rootPkg.pnpm) !== null && _a !== void 0 ? _a : (rootPkg.pnpm = {});
+    let rootChanged = false;
+    for (const subDir of subProjects) {
+        const subPkgPath = `${projectDir}/${subDir}/package.json`;
+        if (!filesystem.exists(subPkgPath))
+            continue;
+        const subPkg = filesystem.read(subPkgPath, 'json');
+        if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+            continue;
+        let subChanged = false;
+        for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
+            const subValue = subPkg.pnpm[field];
+            if (subValue === undefined)
+                continue;
+            rootPkg.pnpm[field] = mergePnpmFieldValue(field, rootPkg.pnpm[field], subValue);
+            rootChanged = true;
+            delete subPkg.pnpm[field];
+            subChanged = true;
+        }
+        if (subChanged) {
+            // If the sub-project's pnpm section is now empty, drop it entirely.
+            if (subPkg.pnpm && Object.keys(subPkg.pnpm).length === 0) {
+                delete subPkg.pnpm;
+            }
+            filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+        }
+    }
+    if (rootChanged) {
+        filesystem.write(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
+    }
+}
+/**
+ * Merge two values for a pnpm workspace-scoped field.
+ *
+ * pnpm expects:
+ * - `overrides` → object ({pkg: version})
+ * - `onlyBuiltDependencies` → array of strings
+ * - `ignoredOptionalDependencies` → array of strings
+ *
+ * Arrays: deduplicated, alphabetically sorted union.
+ * Objects: sub-project values take precedence over root (sub-projects
+ * like nest-server-starter own the authoritative CVE override list for
+ * their transitive deps; the root usually only seeds cross-cutting
+ * handlebars/minimatch patches).
+ */
+function mergePnpmFieldValue(field, rootValue, subValue) {
+    if (field === 'onlyBuiltDependencies' || field === 'ignoredOptionalDependencies') {
+        const rootArr = Array.isArray(rootValue) ? rootValue : [];
+        const subArr = Array.isArray(subValue) ? subValue : [];
+        return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
+    }
+    const rootObj = rootValue && typeof rootValue === 'object' && !Array.isArray(rootValue)
+        ? rootValue
+        : {};
+    const subObj = subValue && typeof subValue === 'object' && !Array.isArray(subValue) ? subValue : {};
+    const merged = Object.assign(Object.assign({}, rootObj), subObj);
+    return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+}

package/build/lib/markdown-table.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatMarkdownTable = formatMarkdownTable;
+/**
+ * Build an oxfmt-compatible Markdown table with padded columns so that the
+ * generated file passes `oxfmt --check` without a reformat pass.
+ *
+ * Column width = max(header length, longest cell length, 3). Cells are
+ * padded with trailing spaces; the separator row uses `-` characters of
+ * the same width.
+ *
+ * Character width note: uses JavaScript `.length` (UTF-16 code units),
+ * which matches oxfmt's own accounting for typical BMP characters used
+ * in VENDOR.md generation (em-dash `—`, backticks, version strings).
+ *
+ * @param headers Column headers (top row)
+ * @param rows    Data rows; each row must have `headers.length` cells
+ * @returns       Lines ready to concatenate with `\n`
+ */
+function formatMarkdownTable(headers, rows) {
+    const columnCount = headers.length;
+    const widths = headers.map((h, i) => {
+        const cellMax = rows.reduce((max, row) => { var _a; return Math.max(max, ((_a = row[i]) !== null && _a !== void 0 ? _a : '').length); }, 0);
+        return Math.max(h.length, cellMax, 3);
+    });
+    const formatRow = (cells) => `| ${cells.map((cell, i) => cell.padEnd(widths[i])).join(' | ')} |`;
+    const lines = [formatRow(headers), `| ${widths.map((w) => '-'.repeat(w)).join(' | ')} |`];
+    for (const row of rows) {
+        const padded = Array.from({ length: columnCount }, (_, i) => { var _a; return (_a = row[i]) !== null && _a !== void 0 ? _a : ''; });
+        lines.push(formatRow(padded));
+    }
+    return lines;
+}