@lenne.tech/cli 1.24.0 → 1.25.0

package/build/lib/dev-install-helper.js

@@ -0,0 +1,136 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInstall = runInstall;
+const caddy_1 = require("./caddy");
+const dev_service_1 = require("./dev-service");
+/**
+ * Run the one-time per-machine `lt dev` setup. Idempotent — safe to
+ * re-run. When `opts.auto` is set the heading reflects that it was
+ * triggered by another command (e.g. `lt dev init`).
+ */
+function runInstall(toolbox_1) {
+    return __awaiter(this, arguments, void 0, function* (toolbox, opts = {}) {
+        const { print: { colors, error, info, success, warning }, } = toolbox;
+        info('');
+        info(colors.bold(opts.auto ? 'Preparing this machine for lt dev (lt dev install)' : 'lt dev install — one-time per-machine setup'));
+        info(colors.dim('─'.repeat(60)));
+        const plat = (0, dev_service_1.platformSupported)();
+        if (plat === 'unsupported') {
+            error(`Service management is not supported on ${process.platform}. Only macOS and Linux are covered.`);
+            info(`  Workaround: run \`${colors.cyan(`caddy run --config ${caddy_1.paths.caddyfile}`)}\` manually.`);
+            return { blocked: true, caddyMissing: false, ok: false, unsupported: true };
+        }
+        let blocked = false;
+        // 1. caddy on PATH
+        const hasCaddy = yield (0, caddy_1.caddyAvailable)();
+        if (hasCaddy) {
+            success('caddy is on PATH');
+        }
+        else {
+            warning('caddy is not installed.');
+            info(`  → macOS: ${colors.cyan('brew install caddy')}`);
+            info(`  → Linux: ${colors.cyan('https://caddyserver.com/docs/install')}`);
+            info('  (Do NOT start it via `brew services` — `lt dev install` runs its own service.)');
+            blocked = true;
+        }
+        // 2. Caddyfile stub
+        (0, caddy_1.writeCaddyfile)('# lt dev — managed Caddyfile\n# Add per-project blocks via `lt dev up`.\n');
+        success(`Caddyfile present at ${caddy_1.paths.caddyfile}`);
+        if (!hasCaddy) {
+            info('');
+            error('Cannot continue setup until Caddy is installed. Re-run `lt dev install` afterwards.');
+            return { blocked: true, caddyMissing: true, ok: false, unsupported: false };
+        }
+        // 3. brew services conflict warning
+        const brewConflict = yield detectBrewCaddyConflict();
+        if (brewConflict) {
+            warning('A `brew services caddy` instance is registered.');
+            info(`  Stop it (it crash-loops against our Caddyfile): ${colors.cyan('brew services stop caddy')}`);
+            info('  `lt dev install` runs its own service — the brew one is no longer needed.');
+        }
+        // 4. Install our LaunchAgent / systemd unit
+        const paths = (0, dev_service_1.getServicePaths)();
+        info('');
+        info(`Installing ${plat === 'darwin' ? 'LaunchAgent' : 'systemd-user unit'} at:`);
+        info(colors.dim(`  ${paths.unitFile}`));
+        const installResult = yield (0, dev_service_1.installService)();
+        if (!installResult.ok) {
+            error(installResult.message);
+            blocked = true;
+        }
+        else if (installResult.created) {
+            success(installResult.message);
+        }
+        else {
+            info(colors.dim(installResult.message));
+        }
+        // 5. Wait for admin endpoint
+        if (installResult.ok) {
+            info(colors.dim('Waiting for Caddy admin endpoint (:2019) ...'));
+            const ready = yield (0, dev_service_1.waitForServiceReady)(8000);
+            const status = yield (0, dev_service_1.getServiceStatus)();
+            if (ready && status.daemonReachable) {
+                success(`Caddy daemon ready${status.pid ? ` (pid ${status.pid})` : ''}.`);
+            }
+            else if (status.loaded && !status.daemonReachable) {
+                warning('Service is loaded but admin endpoint did not respond within 8s.');
+                info(colors.dim(`  Logs: ${paths.logFile} / ${paths.errFile}`));
+                blocked = true;
+            }
+            else {
+                warning('Caddy daemon did not start. See logs:');
+                info(colors.dim(`  ${paths.logFile}`));
+                info(colors.dim(`  ${paths.errFile}`));
+                blocked = true;
+            }
+        }
+        // 6. Validate Caddyfile
+        if (installResult.ok) {
+            const validation = yield (0, caddy_1.validateCaddyfile)();
+            if (validation.ok)
+                success('Caddyfile validates');
+            else
+                warning(`Caddyfile validation: ${validation.stderr.split('\n').slice(0, 2).join(' / ')}`);
+        }
+        // 7. CA trust
+        info('');
+        info(colors.bold('Local CA trust'));
+        info('  Caddy creates its local CA on first run. To trust it system-wide,');
+        info('  run this once (HOME must be preserved so sudo keeps the user-scoped');
+        info('  CA, otherwise caddy looks in /var/root and fails):');
+        info(`    ${colors.cyan('sudo -E HOME="$HOME" caddy trust')}`);
+        info(`  Browsers will then accept ${colors.cyan('https://*.localhost')} without warnings.`);
+        return { blocked, caddyMissing: false, ok: installResult.ok, unsupported: false };
+    });
+}
+/**
+ * Quick `brew services list` scan for a registered caddy service.
+ * Returns true on macOS if any entry contains "caddy" — error/started
+ * alike, both are conflicts. Always returns false on non-darwin or
+ * when `brew` is unavailable (no false positives).
+ */
+function detectBrewCaddyConflict() {
+    if (process.platform !== 'darwin')
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        var _a;
+        const { spawn } = require('child_process');
+        const child = spawn('brew', ['services', 'list'], { stdio: ['ignore', 'pipe', 'ignore'] });
+        let out = '';
+        (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (out += String(b)));
+        child.on('error', () => resolve(false));
+        child.on('close', () => {
+            const conflict = /\bcaddy\b/.test(out) && !/^caddy\s+none\b/m.test(out);
+            resolve(conflict);
+        });
+    });
+}

package/build/lib/dev-migrate-helper.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.printMigrateResult = printMigrateResult;
 exports.runMigrate = runMigrate;
 /**
- * Reusable migrate logic — used by `commands/dev/migrate.ts` (interactive
- * + verbose) and `commands/fullstack/init.ts` (silent best-effort after
- * project creation).
+ * Reusable init/migrate logic — used by `commands/dev/init.ts` (interactive
+ * + verbose, also chained from `commands/dev/install.ts`) and
+ * `commands/fullstack/init.ts` (silent best-effort after project creation).
  *
  * Returns a structured result so callers can decide what to print.
  * Idempotent — safe to run multiple times.
@@ -15,6 +16,43 @@ const dev_identity_1 = require("./dev-identity");
 const dev_patches_1 = require("./dev-patches");
 const dev_project_1 = require("./dev-project");
 const dev_state_1 = require("./dev-state");
+/**
+ * Print a `runMigrate` result via the toolbox. Shared by `lt dev init`
+ * and the auto-init step of `lt dev install` so both render identically.
+ * Does NOT print Caddy-install hints — chaining handles that separately.
+ */
+function printMigrateResult(toolbox, result) {
+    const { print: { colors, info, success }, } = toolbox;
+    info('');
+    info(colors.bold(`Initializing "${result.identity.slug}" for lt dev`));
+    info(colors.dim('─'.repeat(60)));
+    if (result.identity.subdomains.app)
+        info(`  App URL: https://${result.identity.subdomains.app.hostname}`);
+    if (result.identity.subdomains.api)
+        info(`  API URL: https://${result.identity.subdomains.api.hostname}`);
+    info(`  DB:      mongodb://127.0.0.1/${result.dbName}`);
+    info('');
+    if (result.codePatches.length > 0) {
+        for (const r of result.codePatches) {
+            if (r.patched)
+                success(`patched ${r.replacements}× in ${r.file}`);
+            else
+                info(colors.dim(`already patched: ${r.file}`));
+        }
+    }
+    else {
+        info(colors.dim('  patches: not needed (already env-aware)'));
+    }
+    result.claudePatches.filter((r) => r.patched).forEach((r) => success(`updated CLAUDE.md URL block: ${r.file}`));
+    if (result.registryUpdated) {
+        success(`registered in ${process.env.LT_DEV_REGISTRY_PATH || '~/.lenneTech/projects.json'}`);
+    }
+    if (result.addedGitignoreEntry)
+        success('added `.lt-dev/` to .gitignore');
+    if (result.alreadyMigrated) {
+        info(colors.dim('  Project was already initialized — nothing changed.'));
+    }
+}
 /**
  * Run all migration steps for a resolved project.
  *

package/build/lib/dev-patches.js

@@ -7,7 +7,7 @@ exports.patchClaudeMd = patchClaudeMd;
 exports.patchNuxtConfig = patchNuxtConfig;
 exports.patchPlaywrightConfig = patchPlaywrightConfig;
 /**
- * Idempotent patches applied by `lt dev migrate`.
+ * Idempotent patches applied by `lt dev init`.
  *
  * Goal: take a project that still has hardcoded `localhost:3000`
  * defaults and make it env-aware so it can be served behind Caddy
@@ -40,16 +40,32 @@ function autoPatch(file) {
         return patchPlaywrightConfig(file);
     return { file, patched: false, replacements: 0 };
 }
-/** API: `port: 3000,` → `port: Number(process.env.PORT) || 3000,`. */
+/**
+ * API: make the server listen port honour `process.env.PORT` (injected by
+ * `lt dev up` for its Caddy upstream). Handles two patterns found in
+ * nest-server `config.env.ts` files:
+ *
+ *  - the legacy literal `port: 3000,` (e.g. in `deployedConfig()`)
+ *  - the offers-pattern `port: process.env.NSC__PORT ? parseInt(process.env.NSC__PORT, 10) : 3000`
+ *    found in `localConfig()` — `lt dev` runs the API in local mode, so this
+ *    line MUST be patched too or the API ignores the assigned port.
+ *
+ * Idempotent — lines that already read `process.env.PORT` are left untouched.
+ */
 function patchApiConfig(file) {
     if (!(0, fs_1.existsSync)(file))
         return { file, patched: false, replacements: 0 };
     const before = (0, fs_1.readFileSync)(file, 'utf8');
     let count = 0;
-    const after = before.replace(/^(\s*)port:\s*3000\s*,$/gm, (_m, indent) => {
+    let after = before.replace(/^(\s*)port:\s*3000\s*,$/gm, (_m, indent) => {
         count++;
         return `${indent}port: Number(process.env.PORT) || 3000,`;
     });
+    // localConfig() keeps the NSC__PORT operator override; PORT (lt dev) wins.
+    after = after.replace(/^(\s*)port:\s*process\.env\.NSC__PORT\s*\?[^\n]*:\s*3000\s*,$/gm, (_m, indent) => {
+        count++;
+        return `${indent}port: Number(process.env.PORT) || (process.env.NSC__PORT ? parseInt(process.env.NSC__PORT, 10) : 3000),`;
+    });
     if (count === 0)
         return { file, patched: false, replacements: 0 };
     (0, fs_1.writeFileSync)(file, after, 'utf8');
@@ -69,6 +85,7 @@ function patchClaudeMd(file, options) {
     const appSub = identity.subdomains.app;
     const lines = [
         startMarker,
+        '',
         '## Local Development (lt dev)',
         '',
         `This project is registered with \`lt dev\` (slug: \`${identity.slug}\`). Use these commands to run alongside other lt projects without cross-wiring or port collisions:`,
@@ -77,9 +94,12 @@ function patchClaudeMd(file, options) {
         'lt dev up        # Start API + App behind Caddy with project-specific URLs',
         'lt dev down      # Stop the detached processes + remove Caddy block',
         'lt dev status    # Show running PIDs + bound URLs',
+        'lt dev test      # Ensure up + run the E2E suite with project URLs injected',
         'lt dev doctor    # Diagnose Caddy/CA/DNS/port issues',
         '```',
         '',
+        '**Start and test local apps via `lt dev`** — never `pnpm dev` / `pnpm start` / a bare `playwright test` directly; those bind the framework default ports (3000/3001) and collide with parallel projects.',
+        '',
         '**Active URLs for THIS project:**',
         '',
     ];
@@ -88,7 +108,7 @@ function patchClaudeMd(file, options) {
     if (apiSub)
         lines.push(`- API: \`https://${apiSub.hostname}\``);
     if (dbName)
-        lines.push(`- DB:  \`mongodb://127.0.0.1/${dbName}\``);
+        lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
     lines.push('');
     lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
     lines.push('');
@@ -159,30 +179,52 @@ function patchPlaywrightConfig(file) {
             return `${key}: process.env.NUXT_PUBLIC_SITE_URL || 'http://localhost:3001'`;
         });
     }
-    // 2. Top-of-file dotenv bridge — only inject if not already present.
+    // 2. Top-of-file dotenv bridge — inject it, or replace an outdated block.
+    //    The loader walks UP from cwd to find `.lt-dev/.env`: that file lives
+    //    at the repo root, while playwright.config.ts (and the process cwd of
+    //    a direct `playwright test` run) usually sit in `projects/app`. The
+    //    original cwd-only resolve missed it, so direct runs fell back to
+    //    `localhost:3001` and could collide with a parallel project.
     const bridgeStart = '// >>> lt-dev:bridge >>>';
     const bridgeEnd = '// <<< lt-dev:bridge <<<';
-    if (!after.includes(bridgeStart)) {
-        const bridgeBlock = [
-            bridgeStart,
-            '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
-            '// external test runners (CLI, IDE, VS Code Playwright Extension)',
-            '// pick up project URLs + Caddy CA without inheriting the parent shell.',
-            "import { existsSync as __ltDevExists, readFileSync as __ltDevRead } from 'node:fs';",
-            "import { resolve as __ltDevResolve } from 'node:path';",
-            "const __ltDevEnvFile = __ltDevResolve(process.cwd(), '.lt-dev/.env');",
-            'if (__ltDevExists(__ltDevEnvFile)) {',
-            '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
-            '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
-            '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
-            '  }',
-            '}',
-            bridgeEnd,
-            '',
-        ].join('\n');
-        after = bridgeBlock + after;
+    const bridgeBlock = [
+        bridgeStart,
+        '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
+        '// external test runners (CLI, IDE, VS Code Playwright Extension)',
+        '// pick up project URLs + Caddy CA without inheriting the parent shell.',
+        '// Searches upward from cwd because `.lt-dev/` sits at the repo root',
+        '// while playwright.config.ts (and cwd) usually sit in projects/app.',
+        "import { existsSync as __ltDevExists, readFileSync as __ltDevRead } from 'node:fs';",
+        "import { dirname as __ltDevDirname, resolve as __ltDevResolve } from 'node:path';",
+        "let __ltDevEnvFile = '';",
+        'for (let __ltDevDir = process.cwd(), __i = 0; __i < 6; __i++) {',
+        "  const __candidate = __ltDevResolve(__ltDevDir, '.lt-dev/.env');",
+        '  if (__ltDevExists(__candidate)) { __ltDevEnvFile = __candidate; break; }',
+        '  const __parent = __ltDevDirname(__ltDevDir);',
+        '  if (__parent === __ltDevDir) break;',
+        '  __ltDevDir = __parent;',
+        '}',
+        'if (__ltDevEnvFile) {',
+        '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
+        '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
+        '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
+        '  }',
+        '}',
+        bridgeEnd,
+    ].join('\n');
+    const bridgeStartIdx = after.indexOf(bridgeStart);
+    const bridgeEndIdx = after.indexOf(bridgeEnd);
+    if (bridgeStartIdx === -1) {
+        after = `${bridgeBlock}\n${after}`;
         count++;
     }
+    else if (bridgeEndIdx !== -1) {
+        const rebuilt = after.slice(0, bridgeStartIdx) + bridgeBlock + after.slice(bridgeEndIdx + bridgeEnd.length);
+        if (rebuilt !== after) {
+            after = rebuilt;
+            count++;
+        }
+    }
     if (count === 0)
         return { file, patched: false, replacements: 0 };
     (0, fs_1.writeFileSync)(file, after, 'utf8');

package/build/lib/hoist-workspace-pnpm-config.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+const fs_1 = require("fs");
+const js_yaml_1 = require("js-yaml");
 /**
  * pnpm workspace-scoped fields that must live at the workspace root.
  * When present in sub-project package.json files, pnpm emits:
@@ -15,6 +17,16 @@ exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
  * and the actual dependency-resolution behavior.
  */
 const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ignoredOptionalDependencies'];
+/**
+ * pnpm 11 renamed `onlyBuiltDependencies` (string array) to `allowBuilds`
+ * (a `{ pkg: boolean }` map). A migrated sub-project pnpm-workspace.yaml
+ * usually carries BOTH for cross-version compatibility, but we must not
+ * rely on the array twin always being present: we normalise `allowBuilds`
+ * back into `onlyBuiltDependencies` before hoisting (see
+ * `normalizeAllowBuilds`) so the build-allowlist survives into the pnpm-10
+ * monorepo root even when the file only carries the pnpm-11 object form.
+ */
+const PNPM11_BUILD_KEY = 'allowBuilds';
 /**
  * Hoist workspace-scoped pnpm config from sub-projects into the root
  * package.json. After this runs, sub-project package.json files no
@@ -22,6 +34,27 @@ const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ign
  * `ignoredOptionalDependencies`, and the root package.json contains
  * the merged union.
  *
+ * Two sources are read per sub-project, because the two starters store
+ * their pnpm config differently:
+ *
+ *   1. `<sub>/package.json` `pnpm` block — nest-server-starter, and
+ *      nuxt-base-template before its pnpm-11 migration.
+ *   2. `<sub>/pnpm-workspace.yaml` — nuxt-base-template after the
+ *      migration. pnpm 11 silently ignores the `pnpm` block in
+ *      package.json, so the template moved overrides into
+ *      pnpm-workspace.yaml. Inside a monorepo that nested file would
+ *      (a) not be hoisted by the old package.json-only logic, regressing
+ *      the CVE overrides, and (b) declare a nested workspace root that
+ *      conflicts with the monorepo's own pnpm-workspace.yaml. We hoist
+ *      its fields into the root package.json (the lt-monorepo root pins
+ *      pnpm@10 via `packageManager`, where package.json#pnpm IS honored)
+ *      and remove the now-redundant nested file.
+ *
+ * Symlinked sub-projects are skipped entirely: in `--frontend-link` /
+ * `--api-link` mode `projects/app` (or `projects/api`) points at the
+ * user's local framework checkout, and stripping its config or deleting
+ * its pnpm-workspace.yaml would corrupt that source repo.
+ *
  * Idempotent: running twice has the same effect as running once.
  *
  * @param options.filesystem  Gluegun filesystem tool
@@ -38,36 +71,106 @@ function hoistWorkspacePnpmConfig(options) {
     if (!rootPkg)
         return;
     (_a = rootPkg.pnpm) !== null && _a !== void 0 ? _a : (rootPkg.pnpm = {});
+    const rootPnpm = rootPkg.pnpm;
     let rootChanged = false;
     for (const subDir of subProjects) {
-        const subPkgPath = `${projectDir}/${subDir}/package.json`;
-        if (!filesystem.exists(subPkgPath))
+        const subPath = `${projectDir}/${subDir}`;
+        if (!filesystem.exists(subPath))
             continue;
-        const subPkg = filesystem.read(subPkgPath, 'json');
-        if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+        // Never mutate a symlinked sub-project — it points at the user's own
+        // checkout in link mode.
+        if (isSymlink(subPath))
             continue;
-        let subChanged = false;
-        for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
-            const subValue = subPkg.pnpm[field];
-            if (subValue === undefined)
-                continue;
-            rootPkg.pnpm[field] = mergePnpmFieldValue(field, rootPkg.pnpm[field], subValue);
+        if (hoistFromSubPackageJson({ filesystem, rootPnpm, subPath })) {
             rootChanged = true;
-            delete subPkg.pnpm[field];
-            subChanged = true;
         }
-        if (subChanged) {
-            // If the sub-project's pnpm section is now empty, drop it entirely.
-            if (subPkg.pnpm && Object.keys(subPkg.pnpm).length === 0) {
-                delete subPkg.pnpm;
-            }
-            filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+        if (hoistFromSubWorkspaceYaml({ filesystem, rootPnpm, subPath })) {
+            rootChanged = true;
         }
     }
     if (rootChanged) {
         filesystem.write(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
     }
 }
+/**
+ * Move the workspace-scoped pnpm fields from `source` into `rootPnpm`,
+ * deleting each moved field from `source`. Returns true if anything moved.
+ */
+function hoistFields(rootPnpm, source) {
+    let changed = false;
+    for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
+        if (source[field] === undefined)
+            continue;
+        rootPnpm[field] = mergePnpmFieldValue(field, rootPnpm[field], source[field]);
+        delete source[field];
+        changed = true;
+    }
+    return changed;
+}
+/** Source 1: the sub-project's package.json `pnpm` block. */
+function hoistFromSubPackageJson(options) {
+    const { filesystem, rootPnpm, subPath } = options;
+    const subPkgPath = `${subPath}/package.json`;
+    if (!filesystem.exists(subPkgPath))
+        return false;
+    const subPkg = filesystem.read(subPkgPath, 'json');
+    if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+        return false;
+    if (!hoistFields(rootPnpm, subPkg.pnpm))
+        return false;
+    // If the sub-project's pnpm section is now empty, drop it entirely.
+    if (Object.keys(subPkg.pnpm).length === 0) {
+        delete subPkg.pnpm;
+    }
+    filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+    return true;
+}
+/** Source 2: the sub-project's pnpm-workspace.yaml (pnpm-11 layout). */
+function hoistFromSubWorkspaceYaml(options) {
+    const { filesystem, rootPnpm, subPath } = options;
+    const subWsPath = `${subPath}/pnpm-workspace.yaml`;
+    if (!filesystem.exists(subWsPath))
+        return false;
+    const raw = filesystem.read(subWsPath);
+    if (!raw)
+        return false;
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(raw);
+    }
+    catch (_a) {
+        // Malformed YAML — leave it untouched rather than risk data loss.
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return false;
+    const ws = parsed;
+    // Fold the pnpm-11 `allowBuilds` map into `onlyBuiltDependencies` so it is
+    // hoisted rather than discarded — even when the array twin is absent.
+    normalizeAllowBuilds(ws);
+    if (!hoistFields(rootPnpm, ws))
+        return false;
+    // A settings-only file (no `packages:`) exists solely to carry these
+    // hoisted keys — once emptied it would only declare a nested workspace
+    // root, so remove it. A file that declares `packages:` is a real (rare)
+    // nested workspace; keep it minus the hoisted keys.
+    if (Array.isArray(ws.packages) && ws.packages.length > 0) {
+        filesystem.write(subWsPath, (0, js_yaml_1.dump)(ws));
+    }
+    else {
+        filesystem.remove(subWsPath);
+    }
+    return true;
+}
+/** Whether `path` is a symbolic link (false on any stat error). */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
 /**
  * Merge two values for a pnpm workspace-scoped field.
  *
@@ -95,3 +198,26 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
     const merged = Object.assign(Object.assign({}, rootObj), subObj);
     return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
 }
+/**
+ * Fold a pnpm-11 `allowBuilds: { pkg: boolean }` map into the pnpm-10
+ * `onlyBuiltDependencies: string[]` form (packages whose value is `true`),
+ * unioned with any existing array, then remove the `allowBuilds` key so the
+ * redundant object form does not linger. Mutates `ws` in place.
+ *
+ * No-op when `allowBuilds` is absent or not an object map — an unexpected
+ * shape is left untouched rather than risk silent data loss.
+ */
+function normalizeAllowBuilds(ws) {
+    const raw = ws[PNPM11_BUILD_KEY];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return;
+    const allowed = Object.entries(raw)
+        .filter(([, enabled]) => enabled === true)
+        .map(([pkg]) => pkg);
+    if (allowed.length > 0) {
+        const existing = Array.isArray(ws.onlyBuiltDependencies) ? ws.onlyBuiltDependencies : [];
+        // Order here is irrelevant — mergePnpmFieldValue sorts the union on hoist.
+        ws.onlyBuiltDependencies = Array.from(new Set([...allowed, ...existing]));
+    }
+    delete ws[PNPM11_BUILD_KEY];
+}

package/build/lib/package-name.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setPackageName = setPackageName;
+/**
+ * Set the `name` field of a package.json on disk.
+ *
+ * Used by `lt fullstack init` to rename the cloned monorepo's root package
+ * so each project gets a unique `lt dev` slug (the slug is derived from
+ * package.json `name`; without a rename every lt-monorepo-based project would
+ * register as `lt-monorepo` and collide on `https://lt-monorepo.localhost`).
+ *
+ * IMPORTANT: this reads/writes the file as parsed JSON rather than running a
+ * string regex through `patching.update`. Gluegun's `patching.update` hands
+ * the callback a *parsed object* for any `.json` file, so a String-based
+ * `content.replace(...)` callback throws `content.replace is not a function`
+ * at runtime. Going through parsed JSON here is both correct and robust: it
+ * adds a `name` field if one is missing instead of silently no-op'ing.
+ *
+ * Idempotent: if the name already equals `name`, the file is left untouched
+ * and the function returns false.
+ *
+ * @param options.filesystem      Gluegun filesystem tool
+ * @param options.name            New value for the `name` field
+ * @param options.packageJsonPath Absolute path to the package.json
+ * @returns true if the file was written, false otherwise (missing/unreadable/unchanged)
+ */
+function setPackageName(options) {
+    const { filesystem, name, packageJsonPath } = options;
+    if (!filesystem.exists(packageJsonPath))
+        return false;
+    const pkg = filesystem.read(packageJsonPath, 'json');
+    if (!pkg || typeof pkg !== 'object' || Array.isArray(pkg))
+        return false;
+    if (pkg.name === name)
+        return false;
+    pkg.name = name;
+    filesystem.write(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    return true;
+}

package/build/lib/workspace-integration.js

@@ -40,6 +40,7 @@ exports.detectSubProjectContext = detectSubProjectContext;
 exports.detectWorkspaceLayout = detectWorkspaceLayout;
 exports.findWorkspaceRoot = findWorkspaceRoot;
 exports.isNonInteractive = isNonInteractive;
+exports.reconfigureUpstreamForDownstream = reconfigureUpstreamForDownstream;
 exports.runExperimentalNestBaseRename = runExperimentalNestBaseRename;
 exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
@@ -140,6 +141,60 @@ function isNonInteractive(noConfirmFlag) {
     // process.stdin may be undefined in some test runners — guard.
     return Boolean(process.stdin && process.stdin.isTTY === false);
 }
+/**
+ * Reconfigure the cloned nest-base template's `.claude/upstream.json`
+ * into its downstream shape.
+ *
+ * WHY: nest-base ships `.claude/upstream.json` with `isTemplate: true`
+ * and `upstream: null` — the template-self default. The `/upstream-pr`
+ * slash command and the `contributing-upstream` skill key off
+ * `isTemplate` and refuse to open upstream PRs when it is still `true`
+ * ("this repo IS the template"). The template's own notes document a
+ * manual post-fork step (flip `isTemplate` to false, fill `upstream`)
+ * that humans and agents both forget. The `bun run rename` step only
+ * rewrites four files and never touches this one, so without this
+ * helper every scaffolded project keeps `isTemplate: true` and can
+ * never contribute core fixes back to nest-base.
+ *
+ * Behaviour:
+ *   - Missing file (or unparseable JSON) → `{ updated: false }`, no
+ *     throw. Older templates may not ship the file at all; that is not
+ *     an error, just nothing to do.
+ *   - Otherwise sets `isTemplate = false` and
+ *     `upstream = { repo, branch }`, preserving `$schema` and
+ *     `syncedPaths` exactly as the template defined them.
+ *
+ * Idempotent: running twice yields identical output.
+ */
+function reconfigureUpstreamForDownstream(options) {
+    const { apiDir, filesystem, upstreamBranch, upstreamRepo } = options;
+    const upstreamPath = filesystem.path(apiDir, '.claude', 'upstream.json');
+    // Non-fatal when absent — older templates may not ship the file.
+    if (filesystem.exists(upstreamPath) !== 'file') {
+        return { updated: false };
+    }
+    const current = filesystem.read(upstreamPath, 'json');
+    if (!current) {
+        // Unparseable / empty JSON — leave it untouched rather than risk
+        // clobbering hand-edited content with a guessed shape.
+        return { updated: false };
+    }
+    const next = Object.assign(Object.assign({}, current), { 
+        // The whole point of the fix: this is a fork, not the template.
+        isTemplate: false, 
+        // Replace the template-self notes (no longer applicable) with a
+        // short downstream-appropriate marker. Kept as a fixed array so the
+        // operation is idempotent.
+        notes: [
+            'Downstream project forked from the nest-base template.',
+            'Core fixes flow back upstream via the /upstream-pr command.',
+        ], upstream: {
+            branch: upstreamBranch !== null && upstreamBranch !== void 0 ? upstreamBranch : 'main',
+            repo: upstreamRepo !== null && upstreamRepo !== void 0 ? upstreamRepo : 'lenneTech/nest-base',
+        } });
+    filesystem.write(upstreamPath, next, { jsonIndent: 2 });
+    return { updated: true };
+}
 /**
  * Run the experimental `bun run rename <projectDir>` step. Only relevant
  * for the `--next` nest-base template (it ships hard-coded `nest-base`