@lenne.tech/cli 1.21.0 → 1.23.0

package/build/lib/dev-env-bridge.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearEnvBridge = clearEnvBridge;
+exports.detectCaddyRootCa = detectCaddyRootCa;
+exports.envBridgePath = envBridgePath;
+exports.writeEnvBridge = writeEnvBridge;
+/**
+ * ENV bridge file at `<root>/.lt-dev/.env` — written by `lt dev up`,
+ * removed by `lt dev down`. External tools (Playwright, custom scripts,
+ * IDE test runners) load this file via dotenv to pick up the URLs and
+ * the Caddy root CA path without depending on the parent shell.
+ *
+ * Why a file (not just inherited env): the typical workflow is
+ *   1. `lt dev up`    (in shell A)
+ *   2. `pnpm test:e2e` (in shell B, IDE, or VS Code task)
+ * Shell B does not inherit shell A's exports. Reading a file solves
+ * this without polluting global state.
+ *
+ * The file is gitignored via `.lt-dev/`. It contains only public URLs +
+ * the local CA path — no secrets. Format: standard dotenv KEY=VALUE.
+ */
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const HEADER = `# Managed by \`lt dev up\` — do NOT edit, will be overwritten.\n# Removed by \`lt dev down\`. Loaded by Playwright + other tools.\n`;
+/** Remove the ENV bridge file. No-op if missing. */
+function clearEnvBridge(projectRoot) {
+    const file = envBridgePath(projectRoot);
+    if (!(0, fs_1.existsSync)(file))
+        return false;
+    try {
+        (0, fs_1.rmSync)(file);
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Detect the local Caddy root CA certificate path.
+ *
+ * Caddy stores its locally-signed root CA at a platform-specific
+ * data dir. We probe the common locations first; if none exists,
+ * we fall back to `caddy environ` (slow but authoritative).
+ */
+function detectCaddyRootCa() {
+    const candidates = [];
+    if ((0, os_1.platform)() === 'darwin') {
+        candidates.push((0, path_1.join)((0, os_1.homedir)(), 'Library/Application Support/Caddy/pki/authorities/local/root.crt'));
+    }
+    // Linux + fallback
+    candidates.push((0, path_1.join)((0, os_1.homedir)(), '.local/share/caddy/pki/authorities/local/root.crt'));
+    // XDG_DATA_HOME override
+    if (process.env.XDG_DATA_HOME) {
+        candidates.push((0, path_1.join)(process.env.XDG_DATA_HOME, 'caddy/pki/authorities/local/root.crt'));
+    }
+    for (const c of candidates) {
+        if ((0, fs_1.existsSync)(c))
+            return c;
+    }
+    return null;
+}
+/** Resolve the path to the ENV bridge file for a project. */
+function envBridgePath(projectRoot) {
+    return (0, path_1.join)(projectRoot, '.lt-dev', '.env');
+}
+/**
+ * Write the ENV bridge file. Idempotent — same content = no rewrite.
+ *
+ * Returns the absolute path that was written.
+ */
+function writeEnvBridge(projectRoot, devEnv, dbName) {
+    const file = envBridgePath(projectRoot);
+    const lines = [];
+    // The App-side env is the more "external" one (Playwright, browser tools).
+    // We expose every URL/storage/api key the App env carries.
+    const exported = [
+        'BASE_URL',
+        'APP_URL',
+        'NSC__BASE_URL',
+        'NSC__APP_URL',
+        'NUXT_API_URL',
+        'NUXT_PUBLIC_API_URL',
+        'NUXT_PUBLIC_SITE_URL',
+        'NUXT_PUBLIC_STORAGE_PREFIX',
+        'NUXT_PUBLIC_API_PROXY',
+        'NSC__MONGOOSE__URI',
+        'DATABASE_URL',
+        // Legacy aliases — see dev-env.ts for the rationale.
+        'API_URL',
+        'SITE_URL',
+    ];
+    for (const key of exported) {
+        const v = devEnv.app.env[key];
+        if (v !== undefined && v !== '')
+            lines.push(`${String(key)}=${v}`);
+    }
+    // Marker so consumers can detect "lt dev mode" reliably.
+    lines.push(`LT_DEV_ACTIVE=true`);
+    if (dbName)
+        lines.push(`LT_DEV_DB_NAME=${dbName}`);
+    // Caddy root CA — Playwright/Chromium use NODE_EXTRA_CA_CERTS to trust it.
+    const caPath = detectCaddyRootCa();
+    if (caPath)
+        lines.push(`NODE_EXTRA_CA_CERTS=${caPath}`);
+    const content = `${HEADER}${lines.join('\n')}\n`;
+    if ((0, fs_1.existsSync)(file) && (0, fs_1.readFileSync)(file, 'utf8') === content)
+        return file;
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(file), { recursive: true });
+    (0, fs_1.writeFileSync)(file, content, 'utf8');
+    return file;
+}

package/build/lib/dev-env.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDevEnv = buildDevEnv;
+/**
+ * Build environment variables for `lt dev up`.
+ *
+ * URL-first: API and App processes receive complete URLs (not just ports)
+ * so they can configure CORS, BetterAuth trusted origins, OpenAPI servers,
+ * Vite proxies and storage prefixes consistently — without ever needing
+ * to know which internal port Caddy proxies them to.
+ *
+ * Cross-wiring protection:
+ * - `BASE_URL`/`APP_URL` lock the API to its own App origin (CORS + BetterAuth)
+ * - `NUXT_PUBLIC_*` lock the App to its own API
+ * - `NUXT_PUBLIC_STORAGE_PREFIX` namespaces localStorage/sessionStorage
+ * - `NSC__MONGOOSE__URI` / `DATABASE_URL` namespace the database per project
+ *
+ * CA trust for SSR fetches:
+ * - Both API and App receive `NODE_EXTRA_CA_CERTS` pointing at the
+ *   Caddy local root CA so server-side fetches between the two
+ *   subdomains succeed. Without this Nuxt SSR fails with "unable to
+ *   get local issuer certificate" when the app calls its own API.
+ */
+const dev_env_bridge_1 = require("./dev-env-bridge");
+/**
+ * Build the environment maps for both API and App processes.
+ *
+ * Both processes inherit `baseEnv` (typically `process.env`) so user-set
+ * vars survive. `lt dev`-managed keys win on top.
+ */
+function buildDevEnv(input) {
+    const { apiInternalPort, appInternalPort, baseEnv = {}, dbName, identity } = input;
+    const apiSub = identity.subdomains.api;
+    const appSub = identity.subdomains.app;
+    const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
+    const appUrl = appSub ? `https://${appSub.hostname}` : '';
+    const caPath = (0, dev_env_bridge_1.detectCaddyRootCa)();
+    const sharedKeys = Object.assign(Object.assign(Object.assign(Object.assign({}, (apiUrl ? { BASE_URL: apiUrl, NSC__BASE_URL: apiUrl } : {})), (appUrl ? { APP_URL: appUrl, NSC__APP_URL: appUrl } : {})), (dbName ? { DATABASE_URL: buildPostgresUrl(dbName), NSC__MONGOOSE__URI: `mongodb://127.0.0.1/${dbName}` } : {})), (caPath ? { NODE_EXTRA_CA_CERTS: caPath } : {}));
+    return {
+        api: {
+            env: Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+                // Force IPv4 loopback binding so Caddy's `127.0.0.1` upstream
+                // (see `caddy.ts#renderProjectBlock`) always matches the
+                // listener. Without this, Nuxt + Nest sometimes bind to
+                // `[::1]` only, and Caddy gets connection-refused on IPv4.
+                HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1', PORT: String(apiInternalPort) }),
+            internalPort: apiInternalPort,
+        },
+        app: {
+            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+                // See API note above: pin the dev server to IPv4 so Caddy's
+                // `127.0.0.1` upstream is unambiguous.
+                HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
+                // Vite-API-Proxy is OFF by default in lt dev mode — Caddy serves
+                // both subdomains under HTTPS with shared cookie domain, so
+                // same-origin trickery is no longer required.
+                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug, PORT: String(appInternalPort) }),
+            internalPort: appInternalPort,
+        },
+    };
+}
+/** Postgres convenience URL — used by Postgres-based projects (e.g. nest-base). */
+function buildPostgresUrl(dbName) {
+    return `postgresql://${dbName}:${dbName}@localhost:5432/${dbName}`;
+}

package/build/lib/dev-identity.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIdentity = buildIdentity;
+exports.projectSlug = projectSlug;
+exports.slugify = slugify;
+/**
+ * Project identity for `lt dev`.
+ *
+ * URL-first: every project has a slug derived from its package.json
+ * "name", and a deterministic set of subdomains under `*.localhost`.
+ *
+ * Convention:
+ * - `<slug>.localhost`         → primary App
+ * - `api.<slug>.localhost`     → API
+ * - `<other>.<slug>.localhost` → optional additional services
+ *
+ * The internal port behind each subdomain is opaque — Caddy proxies
+ * arbitrary local ports. Developers and Claude only ever see the URL.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Build a complete identity from a project root.
+ *
+ * Detects monorepo subprojects under `projects/` automatically:
+ * - `projects/api` → `api.<slug>.localhost`
+ * - `projects/app` → `<slug>.localhost` (primary)
+ * - `projects/<other>` → `<other>.<slug>.localhost`
+ *
+ * For standalone projects (single repo, no `projects/` directory):
+ * - API project (config.env.ts present) → `api.<slug>.localhost`
+ * - App project (nuxt.config.ts present) → `<slug>.localhost`
+ */
+function buildIdentity(root) {
+    const slug = projectSlug(root);
+    const subdomains = {};
+    const projectsDir = (0, path_1.join)(root, 'projects');
+    if ((0, fs_1.existsSync)(projectsDir)) {
+        // Monorepo: enumerate projects/* subdirectories.
+        const apiDir = (0, path_1.join)(projectsDir, 'api');
+        const appDir = (0, path_1.join)(projectsDir, 'app');
+        if ((0, fs_1.existsSync)(apiDir)) {
+            subdomains.api = {
+                hostname: `api.${slug}.localhost`,
+                isPrimaryApp: false,
+                subdir: 'projects/api',
+            };
+        }
+        if ((0, fs_1.existsSync)(appDir)) {
+            subdomains.app = {
+                hostname: `${slug}.localhost`,
+                isPrimaryApp: true,
+                subdir: 'projects/app',
+            };
+        }
+    }
+    else {
+        // Standalone — derive from project shape.
+        const isApi = (0, fs_1.existsSync)((0, path_1.join)(root, 'src', 'config.env.ts')) || (0, fs_1.existsSync)((0, path_1.join)(root, 'nest-cli.json'));
+        const isApp = (0, fs_1.existsSync)((0, path_1.join)(root, 'nuxt.config.ts'));
+        if (isApi) {
+            subdomains.api = { hostname: `api.${slug}.localhost`, isPrimaryApp: false, subdir: null };
+        }
+        if (isApp) {
+            subdomains.app = { hostname: `${slug}.localhost`, isPrimaryApp: true, subdir: null };
+        }
+    }
+    return { root, slug, subdomains };
+}
+/**
+ * Read the bare project name from package.json (scope stripped).
+ * Falls back to directory basename if no package.json or no `name`.
+ */
+function projectSlug(root) {
+    const fromPkg = readPackageName(root);
+    const raw = fromPkg || (0, path_1.basename)(root);
+    return slugify(raw);
+}
+/** Lowercase, alphanumerics + dashes only, trimmed dashes. */
+function slugify(input) {
+    return input
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/** Read `name` from package.json, scope-stripped (e.g. `@lenne.tech/foo` → `foo`). */
+function readPackageName(dir) {
+    const pkgPath = (0, path_1.join)(dir, 'package.json');
+    if (!(0, fs_1.existsSync)(pkgPath))
+        return null;
+    try {
+        const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf8'));
+        if (!pkg.name)
+            return null;
+        return pkg.name.includes('/') ? pkg.name.split('/').pop() : pkg.name;
+    }
+    catch (_a) {
+        return null;
+    }
+}

package/build/lib/dev-migrate-helper.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runMigrate = runMigrate;
+/**
+ * Reusable migrate logic — used by `commands/dev/migrate.ts` (interactive
+ * + verbose) and `commands/fullstack/init.ts` (silent best-effort after
+ * project creation).
+ *
+ * Returns a structured result so callers can decide what to print.
+ * Idempotent — safe to run multiple times.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const dev_identity_1 = require("./dev-identity");
+const dev_patches_1 = require("./dev-patches");
+const dev_project_1 = require("./dev-project");
+const dev_state_1 = require("./dev-state");
+/**
+ * Run all migration steps for a resolved project.
+ *
+ * Idempotent — re-running with no changes returns `alreadyMigrated: true`.
+ */
+function runMigrate(input) {
+    const { layout } = input;
+    const identity = (0, dev_identity_1.buildIdentity)(layout.root);
+    const dbName = (0, dev_project_1.deriveDbName)(layout.apiDir, identity.slug);
+    // 1. Code patches (config.env.ts, nuxt.config.ts, playwright.config.ts).
+    const filesToPatch = [];
+    if (layout.apiDir) {
+        const f = (0, dev_project_1.apiNeedsPortPatch)(layout.apiDir);
+        if (f)
+            filesToPatch.push(f);
+    }
+    if (layout.appDir)
+        filesToPatch.push(...(0, dev_project_1.appNeedsPortPatch)(layout.appDir));
+    const codePatches = filesToPatch.map((f) => (0, dev_patches_1.autoPatch)(f));
+    // 2. CLAUDE.md URL block (root + each subproject — only patches existing files).
+    const claudeCandidates = [
+        (0, path_1.join)(layout.root, 'CLAUDE.md'),
+        ...(layout.apiDir ? [(0, path_1.join)(layout.apiDir, 'CLAUDE.md')] : []),
+        ...(layout.appDir ? [(0, path_1.join)(layout.appDir, 'CLAUDE.md')] : []),
+    ];
+    const claudePatches = claudeCandidates
+        .filter((f) => (0, fs_1.existsSync)(f))
+        .map((f) => (0, dev_patches_1.patchClaudeMd)(f, { dbName, identity }));
+    // 3. Registry — only write when something actually changed.
+    const reg = (0, dev_state_1.loadRegistry)();
+    const subdomainMap = {};
+    for (const [k, v] of Object.entries(identity.subdomains))
+        subdomainMap[k] = v.hostname;
+    const existing = reg.projects[identity.slug];
+    const next = {
+        dbName,
+        internalPorts: (existing === null || existing === void 0 ? void 0 : existing.internalPorts) || {},
+        lastUsedAt: existing === null || existing === void 0 ? void 0 : existing.lastUsedAt,
+        path: layout.root,
+        subdomains: subdomainMap,
+    };
+    const registryChanged = !existing ||
+        existing.path !== next.path ||
+        existing.dbName !== next.dbName ||
+        JSON.stringify(existing.subdomains) !== JSON.stringify(next.subdomains);
+    if (registryChanged) {
+        reg.projects[identity.slug] = next;
+        (0, dev_state_1.saveRegistry)(reg);
+    }
+    // 4. .gitignore
+    const addedGitignoreEntry = (0, dev_patches_1.addToGitignore)(layout.root, '.lt-dev/');
+    const codePatched = codePatches.filter((r) => r.patched).length > 0;
+    const claudePatched = claudePatches.filter((r) => r.patched).length > 0;
+    const alreadyMigrated = !codePatched && !claudePatched && !registryChanged && !addedGitignoreEntry;
+    return {
+        addedGitignoreEntry,
+        alreadyMigrated,
+        claudePatches,
+        codePatches,
+        dbName,
+        identity,
+        registryUpdated: registryChanged,
+    };
+}

package/build/lib/dev-patches.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addToGitignore = addToGitignore;
+exports.autoPatch = autoPatch;
+exports.patchApiConfig = patchApiConfig;
+exports.patchClaudeMd = patchClaudeMd;
+exports.patchNuxtConfig = patchNuxtConfig;
+exports.patchPlaywrightConfig = patchPlaywrightConfig;
+/**
+ * Idempotent patches applied by `lt dev migrate`.
+ *
+ * Goal: take a project that still has hardcoded `localhost:3000`
+ * defaults and make it env-aware so it can be served behind Caddy
+ * under `https://<slug>.localhost`.
+ *
+ * Each patch is a regex-based replace that matches only the legacy
+ * form. Already-patched files are no-ops.
+ */
+const fs_1 = require("fs");
+/** Append entry to .gitignore if not already present. */
+function addToGitignore(root, entry) {
+    const path = `${root}/.gitignore`;
+    let content = '';
+    if ((0, fs_1.existsSync)(path))
+        content = (0, fs_1.readFileSync)(path, 'utf8');
+    const lines = content.split(/\r?\n/);
+    if (lines.some((l) => l.trim() === entry || l.trim() === entry.replace(/\/$/, '')))
+        return false;
+    const ensured = `${(content.endsWith('\n') || content.length === 0 ? content : `${content}\n`) + entry}\n`;
+    (0, fs_1.writeFileSync)(path, ensured, 'utf8');
+    return true;
+}
+/** Run the appropriate patch based on filename. */
+function autoPatch(file) {
+    if (file.endsWith('config.env.ts'))
+        return patchApiConfig(file);
+    if (file.endsWith('nuxt.config.ts'))
+        return patchNuxtConfig(file);
+    if (file.endsWith('playwright.config.ts'))
+        return patchPlaywrightConfig(file);
+    return { file, patched: false, replacements: 0 };
+}
+/** API: `port: 3000,` → `port: Number(process.env.PORT) || 3000,`. */
+function patchApiConfig(file) {
+    if (!(0, fs_1.existsSync)(file))
+        return { file, patched: false, replacements: 0 };
+    const before = (0, fs_1.readFileSync)(file, 'utf8');
+    let count = 0;
+    const after = before.replace(/^(\s*)port:\s*3000\s*,$/gm, (_m, indent) => {
+        count++;
+        return `${indent}port: Number(process.env.PORT) || 3000,`;
+    });
+    if (count === 0)
+        return { file, patched: false, replacements: 0 };
+    (0, fs_1.writeFileSync)(file, after, 'utf8');
+    return { file, patched: true, replacements: count };
+}
+/**
+ * Inject a "Local Development (lt dev)" block with the project's
+ * concrete URLs into CLAUDE.md. Idempotent — re-running with the same
+ * URLs is a no-op; re-running with different URLs replaces the block
+ * in place.
+ */
+function patchClaudeMd(file, options) {
+    const { dbName, identity } = options;
+    const startMarker = '<!-- lt-dev:url-block:start -->';
+    const endMarker = '<!-- lt-dev:url-block:end -->';
+    const apiSub = identity.subdomains.api;
+    const appSub = identity.subdomains.app;
+    const lines = [
+        startMarker,
+        '## Local Development (lt dev)',
+        '',
+        `This project is registered with \`lt dev\` (slug: \`${identity.slug}\`). Use these commands to run alongside other lt projects without cross-wiring or port collisions:`,
+        '',
+        '```bash',
+        'lt dev up        # Start API + App behind Caddy with project-specific URLs',
+        'lt dev down      # Stop the detached processes + remove Caddy block',
+        'lt dev status    # Show running PIDs + bound URLs',
+        'lt dev doctor    # Diagnose Caddy/CA/DNS/port issues',
+        '```',
+        '',
+        '**Active URLs for THIS project:**',
+        '',
+    ];
+    if (appSub)
+        lines.push(`- App: \`https://${appSub.hostname}\``);
+    if (apiSub)
+        lines.push(`- API: \`https://${apiSub.hostname}\``);
+    if (dbName)
+        lines.push(`- DB:  \`mongodb://127.0.0.1/${dbName}\``);
+    lines.push('');
+    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
+    lines.push('');
+    lines.push(endMarker);
+    const block = lines.join('\n');
+    if (!(0, fs_1.existsSync)(file))
+        return { file, patched: false, replacements: 0 };
+    const content = (0, fs_1.readFileSync)(file, 'utf8');
+    const startIdx = content.indexOf(startMarker);
+    const endIdx = content.indexOf(endMarker);
+    let next;
+    if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
+        const before = content.slice(0, startIdx);
+        const after = content.slice(endIdx + endMarker.length);
+        next = before + block + after;
+    }
+    else {
+        const sep = content.endsWith('\n\n') ? '' : content.endsWith('\n') ? '\n' : '\n\n';
+        next = `${content}${sep}${block}\n`;
+    }
+    if (next === content)
+        return { file, patched: false, replacements: 0 };
+    (0, fs_1.writeFileSync)(file, next, 'utf8');
+    return { file, patched: true, replacements: 1 };
+}
+/** App: hardcoded port + vite-proxy target → env-aware. */
+function patchNuxtConfig(file) {
+    if (!(0, fs_1.existsSync)(file))
+        return { file, patched: false, replacements: 0 };
+    const before = (0, fs_1.readFileSync)(file, 'utf8');
+    let count = 0;
+    let after = before.replace(/^(\s*)port:\s*3001\s*,$/gm, (_m, indent) => {
+        count++;
+        return `${indent}port: Number(process.env.PORT) || 3001,`;
+    });
+    after = after.replace(/target:\s*'http:\/\/localhost:3000'/g, () => {
+        count++;
+        return `target: process.env.NUXT_API_URL || 'http://localhost:3000'`;
+    });
+    if (count === 0)
+        return { file, patched: false, replacements: 0 };
+    (0, fs_1.writeFileSync)(file, after, 'utf8');
+    return { file, patched: true, replacements: count };
+}
+/**
+ * Playwright: hardcoded baseURL/host/url → env-aware, plus a top-of-file
+ * dotenv-load of `.lt-dev/.env` so external test runners (CLI, IDE, VS
+ * Code Playwright Extension) automatically pick up `lt dev up`'s URLs
+ * and the local Caddy CA — without requiring the parent shell to inherit
+ * any env.
+ *
+ * Patches applied (each idempotent):
+ *   1. Top-of-file: `if (existsSync('.lt-dev/.env')) loadEnv(...)` block,
+ *      bracketed by `// >>> lt-dev:bridge >>>` markers.
+ *   2. Hardcoded baseURL/host/url for `http://localhost:3001` →
+ *      `process.env.NUXT_PUBLIC_SITE_URL || 'http://localhost:3001'`.
+ */
+function patchPlaywrightConfig(file) {
+    if (!(0, fs_1.existsSync)(file))
+        return { file, patched: false, replacements: 0 };
+    const before = (0, fs_1.readFileSync)(file, 'utf8');
+    let count = 0;
+    let after = before;
+    // 1. URL-Patches.
+    for (const key of ['baseURL', 'host', 'url']) {
+        after = after.replace(new RegExp(`${key}:\\s*'http://localhost:3001'`, 'g'), () => {
+            count++;
+            return `${key}: process.env.NUXT_PUBLIC_SITE_URL || 'http://localhost:3001'`;
+        });
+    }
+    // 2. Top-of-file dotenv bridge — only inject if not already present.
+    const bridgeStart = '// >>> lt-dev:bridge >>>';
+    const bridgeEnd = '// <<< lt-dev:bridge <<<';
+    if (!after.includes(bridgeStart)) {
+        const bridgeBlock = [
+            bridgeStart,
+            '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
+            '// external test runners (CLI, IDE, VS Code Playwright Extension)',
+            '// pick up project URLs + Caddy CA without inheriting the parent shell.',
+            "import { existsSync as __ltDevExists, readFileSync as __ltDevRead } from 'node:fs';",
+            "import { resolve as __ltDevResolve } from 'node:path';",
+            "const __ltDevEnvFile = __ltDevResolve(process.cwd(), '.lt-dev/.env');",
+            'if (__ltDevExists(__ltDevEnvFile)) {',
+            '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
+            '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
+            '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
+            '  }',
+            '}',
+            bridgeEnd,
+            '',
+        ].join('\n');
+        after = bridgeBlock + after;
+        count++;
+    }
+    if (count === 0)
+        return { file, patched: false, replacements: 0 };
+    (0, fs_1.writeFileSync)(file, after, 'utf8');
+    return { file, patched: true, replacements: count };
+}