@lenne.tech/cli 1.34.0 → 1.35.0

package/build/lib/dev-test-session.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_INITIAL_ADMIN_ENV = void 0;
 exports.autoShardCount = autoShardCount;
 exports.bringUpTestSession = bringUpTestSession;
 exports.hasTestSession = hasTestSession;
@@ -57,6 +58,25 @@ const TEST_APP_LOG = 'app.test.log';
 const TEST_BRIDGE_FILE = '.env.test';
 /** Internal port band for the test stack — distinct from the dev band (4000+). */
 const TEST_PORT_BASE = 4500;
+/**
+ * Throwaway initial-admin credentials for the isolated `lt dev test` database.
+ *
+ * The nest-server core auto-parses these `NSC__…` vars into
+ * `systemSetup.initialAdmin.*` and seeds the admin ONCE on an empty DB (it never
+ * overwrites an existing admin), so a set-up system exists before the suite runs.
+ * A fresh template project's standard auth E2E specs assume such a system — they
+ * do no self-setup — so without this they fail LOCALLY on the empty per-run DB.
+ * These are the exact values the lt-monorepo template CI uses
+ * (`.gitlab-ci.yml` / `.github/workflows/test.yml`), keeping CI ↔ local parity.
+ *
+ * Injected ONLY into the `lt dev test` API process (its DB is fresh + discarded
+ * per run), NEVER into `lt dev up` — no surprise admin in the persistent dev DB.
+ */
+exports.TEST_INITIAL_ADMIN_ENV = {
+    NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL: 'ci-admin@test.com',
+    NSC__SYSTEM_SETUP__INITIAL_ADMIN__NAME: 'CI Admin',
+    NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD: 'CiThrowawayAdmin123!',
+};
 /**
  * Heuristic for the default local shard count (`--shard auto` / bare `--shard`).
  *
@@ -205,7 +225,12 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             const entry = ['dist/src/main.js', 'dist/main.js']
                 .map((rel) => (0, path_1.join)(layout.apiDir, rel))
                 .find((p) => (0, fs_1.existsSync)(p));
-            const apiEnv = Object.assign(Object.assign({}, devEnv.api.env), { NODE_ENV: 'local' });
+            // Seed a throwaway initial admin into the fresh, isolated test DB so the
+            // standard auth E2E specs run against a set-up system — locally exactly like
+            // the lt-monorepo template CI. Defaults first so an explicitly inherited
+            // `NSC__…INITIAL_ADMIN__…` still wins (deliberate override respected). Only
+            // reached from `lt dev test` — `lt dev up` never calls bringUpTestSession.
+            const apiEnv = Object.assign(Object.assign(Object.assign({}, exports.TEST_INITIAL_ADMIN_ENV), devEnv.api.env), { NODE_ENV: 'local' });
             let apiSpawn;
             if (build === 0 && entry) {
                 apiSpawn = (0, dev_process_1.spawnDetached)('node', [entry], {
@@ -288,7 +313,10 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             if (!apiReady)
                 log.warn(`Test API did not answer 2xx on ${apiUrl}/meta within 120s — the first specs may skip.`);
         }
-        return { apiUrl, appEnv: devEnv.app.env, appUrl, dbName, pids, testIdentity };
+        // Expose THIS stack's API log path so the caller can point the auth E2E specs
+        // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
+        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
+        return { apiLogPath, apiUrl, appEnv: devEnv.app.env, appUrl, dbName, pids, testIdentity };
     });
 }
 /** True when a test session file exists (used by status/down). */
@@ -345,7 +373,7 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
             // suite runs under concurrent sharded load, so it can relax navigation /
             // test timeouts (N built SSR servers + N Chromium saturate the CPU and slow
             // every navigation) without loosening them for serial runs.
-            const env = Object.assign(Object.assign({}, ctx.appEnv), { LT_DEV_TEST_SHARDS: String(total), MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` });
+            const env = Object.assign(Object.assign(Object.assign({}, ctx.appEnv), { LT_DEV_TEST_SHARDS: String(total), MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` }), (ctx.apiLogPath ? { NEST_SERVER_LOG: ctx.apiLogPath } : {}));
             const logFile = (0, path_1.join)(layout.root, '.lt-dev', `shard.${index}.test.log`);
             // Invoke Playwright DIRECTLY via the manager's `exec` (NOT `<pm> run
             // test:e2e -- …`): forwarding option flags through `<pm> run`'s `--`

package/build/lib/ensure-root-dockerignore.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureRootDockerignore = ensureRootDockerignore;
+// Docker resolves `.dockerignore` patterns against the build CONTEXT ROOT, and
+// it only ever reads the file at that root (or `<dockerfile>.dockerignore` next
+// to the Dockerfile). A monorepo builds its images from the workspace root
+// (`context: .`, `dockerfile: projects/app/Dockerfile`), so the starters' own
+// `projects/app/.dockerignore` and `projects/api/.dockerignore` are never
+// consulted — the workspace root needs its own file.
+//
+// The same rule bites the patterns: a bare `node_modules` matches only
+// `./node_modules`, never `projects/app/node_modules`. Every pattern that must
+// hit a sub-project therefore needs a globstar prefix. A root `.dockerignore`
+// that looks complete but uses bare patterns silently ships a developer's local
+// `.output` and `.env` into the image — and `nuxt build` reads `.env`, so the
+// bundle itself changes.
+const REQUIRED_PATTERNS = [
+    '**/node_modules',
+    '**/.output',
+    '**/.nuxt',
+    '**/dist',
+    // `**/.env` matches a path component EXACTLY, so it does NOT cover
+    // `.env.production` / `.env.staging` / `.env.test` — all of which routinely
+    // hold real secrets and would otherwise be copied into the build context.
+    // `**/.env.*` closes that gap (it also subsumes the old `.env.local` /
+    // `.env.*.local`); the trailing `!**/.env.example` re-includes the safe
+    // placeholder template and MUST stay after the broad glob to win.
+    '**/.env',
+    '**/.env.*',
+    '!**/.env.example',
+    // `.lt-dev/` holds the ENV bridge (`.env.test`, same DB/URLs) and session
+    // logs that contain email-verification tokens — never ship them.
+    '**/.lt-dev',
+    '**/coverage',
+    '**/test-results',
+    '**/playwright-report',
+    '**/*.log',
+    '.pnpm-store',
+    '.git',
+];
+const HEADER = `# Docker resolves these patterns against the build CONTEXT ROOT — this directory
+# — and never against a Dockerfile's own directory. The starters ship a
+# projects/*/.dockerignore for standalone builds; those are NOT read when
+# building from here (see docker-compose.yml: \`context: .\`).
+#
+# For the same reason a bare \`node_modules\` would only match ./node_modules;
+# every pattern that must also hit projects/* needs a globstar prefix. Without
+# them a local .output would be copied into the image, and \`nuxt build\` would
+# read a local .env and bake it into the bundle.
+#
+# Managed by \`lt fullstack init\` / \`add-api\` / \`add-app\`: missing entries are
+# appended, existing ones are never removed. Add project-specific ignores freely.
+`;
+const MANAGED_MARKER = '# --- required by lt (depth-independent globs) ---';
+/**
+ * Guarantee a workspace-root `.dockerignore` that keeps host artefacts and
+ * secrets out of every image built from this context.
+ *
+ * Creates the file when missing. When it exists, appends only the required
+ * patterns it does not already contain — an existing bare `node_modules` does
+ * not satisfy the globstar variant, so both may end up present, which is
+ * correct and harmless. Never removes or reorders what the project wrote.
+ *
+ * Idempotent: a second run on an unchanged file adds nothing.
+ *
+ * @param options.filesystem  gluegun filesystem toolbox member
+ * @param options.projectDir  workspace root (the docker build context)
+ * @returns which patterns were added, and whether the file had to be created
+ */
+function ensureRootDockerignore(options) {
+    const { filesystem, projectDir } = options;
+    const path = `${projectDir}/.dockerignore`;
+    if (!filesystem.exists(path)) {
+        filesystem.write(path, `${HEADER}\n${REQUIRED_PATTERNS.join('\n')}\n`);
+        return { added: [...REQUIRED_PATTERNS], created: true };
+    }
+    const content = filesystem.read(path) || '';
+    const present = activePatterns(content);
+    const missing = REQUIRED_PATTERNS.filter((pattern) => !present.has(pattern));
+    if (missing.length === 0)
+        return { added: [], created: false };
+    const separator = content.endsWith('\n') ? '' : '\n';
+    filesystem.write(path, `${content}${separator}\n${MANAGED_MARKER}\n${missing.join('\n')}\n`);
+    return { added: missing, created: false };
+}
+/** Non-empty, non-comment lines, trimmed — the patterns actually in effect. */
+function activePatterns(content) {
+    return new Set(content
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith('#')));
+}

package/build/lib/fs-utils.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSymlink = isSymlink;
+const fs_1 = require("fs");
+/**
+ * Whether `path` is a symbolic link (false on any stat error).
+ *
+ * Shared by the workspace-normalization helpers that must not mutate a
+ * `--api-link` / `--frontend-link` sub-project pointing at the user's own
+ * checkout.
+ */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
-const fs_1 = require("fs");
 const js_yaml_1 = require("js-yaml");
+const fs_utils_1 = require("./fs-utils");
 /**
  * pnpm workspace-scoped fields that must live at the workspace root.
  * When present in sub-project package.json files, pnpm emits:
@@ -77,7 +77,7 @@ function hoistWorkspacePnpmConfig(options) {
             continue;
         // Never mutate a symlinked sub-project — it points at the user's own
         // checkout in link mode.
-        if (isSymlink(subPath))
+        if ((0, fs_utils_1.isSymlink)(subPath))
             continue;
         if (hoistFromSubPackageJson({ filesystem, rootWs, subPath })) {
             rootChanged = true;
@@ -149,15 +149,6 @@ function hoistFromSubWorkspaceYaml(options) {
     }
     return true;
 }
-/** Whether `path` is a symbolic link (false on any stat error). */
-function isSymlink(path) {
-    try {
-        return (0, fs_1.lstatSync)(path).isSymbolicLink();
-    }
-    catch (_a) {
-        return false;
-    }
-}
 /**
  * Merge two values for a pnpm workspace-scoped field.
  *

package/build/lib/remove-nested-lockfiles.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeNestedLockfiles = removeNestedLockfiles;
+const fs_utils_1 = require("./fs-utils");
+// In a pnpm workspace only the ROOT pnpm-lock.yaml is read, resolved and
+// updated. A `pnpm-lock.yaml` that a starter brought along from its standalone
+// life keeps sitting in projects/api or projects/app, never gets refreshed, and
+// silently drifts away from the root lockfile — in one project it was a month
+// old and 11k lines shorter.
+//
+// Dead weight would be harmless; the file is worse than that, because anything
+// that builds with the sub-project as its context (an old `Dockerfile.dev`, an
+// ad-hoc `pnpm install --frozen-lockfile` inside projects/app) installs that
+// stale tree instead of the workspace's. Removing it makes the workspace root
+// the single source of truth.
+//
+// Only pnpm lockfiles are removed. `yarn.lock` / `package-lock.json` mark a
+// sub-project that deliberately uses another package manager, and `lt dev`
+// reads them to pick the right binary per project dir. A pnpm sub-project loses
+// nothing: `pickPackageManager()` falls back to pnpm when no lockfile is found.
+const PNPM_LOCKFILE = 'pnpm-lock.yaml';
+/**
+ * Delete sub-project `pnpm-lock.yaml` files that the workspace root supersedes.
+ *
+ * No-op unless `projectDir` really is a pnpm workspace root (it must carry a
+ * `pnpm-workspace.yaml`) — outside one a nested lockfile may be the only one.
+ * Symlinked sub-projects are skipped: in `--api-link` / `--frontend-link` mode
+ * they point at the user's own checkout, which must not be mutated.
+ *
+ * @param options.filesystem   gluegun filesystem toolbox member
+ * @param options.projectDir   workspace root
+ * @param options.subProjects  paths relative to the root, e.g. `projects/api`
+ * @returns the sub-project dirs whose lockfile was removed
+ */
+function removeNestedLockfiles(options) {
+    const { filesystem, projectDir, subProjects } = options;
+    if (!filesystem.exists(`${projectDir}/pnpm-workspace.yaml`))
+        return { removed: [] };
+    const removed = [];
+    for (const subDir of subProjects) {
+        const subPath = `${projectDir}/${subDir}`;
+        if (!filesystem.exists(subPath))
+            continue;
+        if ((0, fs_utils_1.isSymlink)(subPath))
+            continue;
+        const lockfile = `${subPath}/${PNPM_LOCKFILE}`;
+        if (!filesystem.exists(lockfile))
+            continue;
+        filesystem.remove(lockfile);
+        removed.push(subDir);
+    }
+    return { removed };
+}

package/build/lib/turboops-config.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_SLUG_PATTERN = exports.DOMAIN_PATTERN = void 0;
+exports.isValidDomain = isValidDomain;
+exports.isValidProjectSlug = isValidProjectSlug;
+exports.mergeTurboOpsConfig = mergeTurboOpsConfig;
+exports.optionString = optionString;
+exports.readJsonObject = readJsonObject;
+/**
+ * A plausible multi-label hostname (e.g. `myproject.lenne.tech`).
+ *
+ * The deploy `domain` is written VERBATIM into generated Angular
+ * `environment.*.ts` (which `ng build` bakes into the browser bundle) and into
+ * copy-paste checklist lines. A stray quote / `$` / `;` / whitespace would break
+ * out of the generated string literal (code injection into the bundle) or emit a
+ * non-compiling config, so the value is restricted to hostname characters at the
+ * input boundary.
+ */
+exports.DOMAIN_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+/**
+ * TurboOps project slugs are the registry namespace + the `docker login` user,
+ * so `registry.turbo-ops.de/<project>` and `docker login -u "$TURBOOPS_PROJECT"`
+ * only accept a lowercase dash-separated slug.
+ */
+exports.PROJECT_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+/** True when `domain` is a plausible multi-label hostname. */
+function isValidDomain(domain) {
+    return exports.DOMAIN_PATTERN.test(domain);
+}
+/** True when `slug` is a usable TurboOps project slug. */
+function isValidProjectSlug(slug) {
+    return exports.PROJECT_SLUG_PATTERN.test(slug);
+}
+/**
+ * Compute the merged `.turboops.json` content for a target `project` slug,
+ * WITHOUT any I/O. The file is committed and a user may have added keys by hand,
+ * so a re-run must MERGE, never clobber:
+ *
+ * - no existing config → a fresh `{ project }`;
+ * - existing config that is already exactly `{ project }` → `changed: false`
+ *   (caller skips the write and reports "up to date");
+ * - otherwise → `{ ...existing, project }` with `changed: true` (user keys kept).
+ *
+ * `previousProject` is the prior `project` value when it was a string, so the
+ * caller can warn on a project rename.
+ */
+function mergeTurboOpsConfig(existing, project) {
+    if (!existing) {
+        return { changed: true, config: { project } };
+    }
+    const previousProject = typeof existing.project === 'string' ? existing.project : undefined;
+    const upToDate = existing.project === project && Object.keys(existing).length === 1;
+    if (upToDate) {
+        return { changed: false, config: existing, previousProject };
+    }
+    return { changed: true, config: Object.assign(Object.assign({}, existing), { project }), previousProject };
+}
+/**
+ * Read a CLI option as a string. gluegun parses a valueless `--project` as the
+ * boolean `true`; passing that straight through would write `{"project":"true"}`
+ * and point the pipeline at the registry namespace `true`. Whitespace-only is
+ * treated as absent.
+ */
+function optionString(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Read a JSON file without throwing. gluegun's `filesystem.read(path, 'json')`
+ * THROWS on malformed JSON (it does NOT return undefined), so every read of a
+ * hand-editable file has to guard for it or the whole command crashes with an
+ * uncaught stack trace mid-spinner.
+ *
+ * `found` distinguishes "file is absent" from "file exists but is unusable";
+ * `value` is only set when the file parsed into a plain object (a bare `null`,
+ * number, or array is valid JSON but cannot hold our keys, so it counts as
+ * unusable, not as a config).
+ */
+function readJsonObject(filesystem, path) {
+    if (filesystem.exists(path) !== 'file')
+        return { found: false };
+    try {
+        const value = filesystem.read(path, 'json');
+        return value && typeof value === 'object' && !Array.isArray(value)
+            ? { found: true, value: value }
+            : { found: true };
+    }
+    catch (_a) {
+        return { found: true };
+    }
+}

package/build/lib/workspace-integration.js

@@ -26,6 +26,39 @@
  * add-app run on an already-installed workspace and only need to wire
  * in the new sub-project plus run a workspace-wide install.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -38,6 +71,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectSubProjectContext = detectSubProjectContext;
 exports.detectWorkspaceLayout = detectWorkspaceLayout;
+exports.finalizeWorkspaceRoot = finalizeWorkspaceRoot;
 exports.findWorkspaceRoot = findWorkspaceRoot;
 exports.isNonInteractive = isNonInteractive;
 exports.reconfigureUpstreamForDownstream = reconfigureUpstreamForDownstream;
@@ -45,6 +79,10 @@ exports.runExperimentalNestBaseRename = runExperimentalNestBaseRename;
 exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
 exports.writeApiConfig = writeApiConfig;
+const yaml = __importStar(require("js-yaml"));
+const ensure_root_dockerignore_1 = require("./ensure-root-dockerignore");
+const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
+const remove_nested_lockfiles_1 = require("./remove-nested-lockfiles");
 /**
  * Detect whether the current working directory IS a sub-project of an
  * lt-monorepo workspace (i.e. cwd is `projects/api/` or `projects/app/`,
@@ -95,6 +133,27 @@ function detectWorkspaceLayout(workspaceDir, filesystem) {
     const hasApp = filesystem.exists(`${appDir}/package.json`) === 'file';
     return { hasApi, hasApp, hasWorkspace, workspaceDir };
 }
+/**
+ * Normalize a freshly-populated workspace root after adding or removing a
+ * sub-project. Runs the three idempotent workspace-hygiene steps that
+ * `fullstack init`, `add-api`, and `add-app` all need:
+ *
+ *   1. hoist pnpm workspace-scoped config (`overrides`, `allowBuilds`, …) out
+ *      of the sub-projects into the root — pnpm only honours it at the root;
+ *   2. remove nested `pnpm-lock.yaml` files the root lockfile supersedes;
+ *   3. guarantee a workspace-root `.dockerignore` (Docker never reads a
+ *      sub-project's own `.dockerignore` when building from the root context).
+ *
+ * Each step is a no-op when there is nothing to do, so re-runs are safe.
+ */
+function finalizeWorkspaceRoot(options) {
+    var _a;
+    const { filesystem, projectDir } = options;
+    const subProjects = (_a = options.subProjects) !== null && _a !== void 0 ? _a : ['projects/api', 'projects/app'];
+    (0, hoist_workspace_pnpm_config_1.hoistWorkspacePnpmConfig)({ filesystem, projectDir, subProjects });
+    (0, remove_nested_lockfiles_1.removeNestedLockfiles)({ filesystem, projectDir, subProjects });
+    (0, ensure_root_dockerignore_1.ensureRootDockerignore)({ filesystem, projectDir });
+}
 /**
  * Walk up from `startDir` until a workspace marker is found or the
  * filesystem root is reached. Limited to 6 levels to avoid pathological
@@ -374,8 +433,8 @@ function writeApiConfig(options) {
  * `detectWorkspaceLayout` and `findWorkspaceRoot`.
  *
  * Recognised markers (any one is sufficient):
- *   - `pnpm-workspace.yaml`           — pnpm workspace
- *   - `package.json` with `workspaces` field — npm/yarn/bun workspaces
+ *   - `pnpm-workspace.yaml` that declares a non-empty `packages:` list
+ *   - `package.json` with a non-empty `workspaces` field — npm/yarn/bun
  *   - `projects/` directory           — lt-monorepo convention
  *
  * Returns false for `node_modules`-style directories that may contain
@@ -383,7 +442,7 @@ function writeApiConfig(options) {
  */
 function hasWorkspaceMarker(dir, filesystem) {
     var _a;
-    if (filesystem.exists(`${dir}/pnpm-workspace.yaml`) === 'file')
+    if (pnpmWorkspaceDeclaresPackages(`${dir}/pnpm-workspace.yaml`, filesystem))
         return true;
     if (filesystem.exists(`${dir}/projects`) === 'dir')
         return true;
@@ -404,3 +463,37 @@ function hasWorkspaceMarker(dir, filesystem) {
     }
     return false;
 }
+/**
+ * True only when `pnpm-workspace.yaml` actually declares member packages.
+ *
+ * The file's mere existence is NOT a workspace marker. Since pnpm 10/11 it
+ * is also the canonical home for workspace-scoped *settings* (`overrides`,
+ * `allowBuilds`, `onlyBuiltDependencies`, `minimumReleaseAge*`) — pnpm 11
+ * silently ignores those keys in package.json's `pnpm` block. Both
+ * nest-server-starter and nuxt-base-starter therefore ship a settings-only
+ * `pnpm-workspace.yaml` (no `packages:`) while being plain single-package
+ * projects.
+ *
+ * Treating existence as the marker made every standalone starter look like a
+ * monorepo: `resolveLayout` searched for `projects/api` + `projects/app`,
+ * found neither, and `lt dev up` / `lt dev init` aborted with
+ * "No API or App project detected at this path".
+ *
+ * Unparseable YAML yields false so the remaining markers still decide,
+ * rather than guessing "workspace" from a file we could not read.
+ */
+function pnpmWorkspaceDeclaresPackages(path, filesystem) {
+    if (filesystem.exists(path) !== 'file')
+        return false;
+    const content = filesystem.read(path);
+    if (!content)
+        return false;
+    try {
+        const doc = yaml.load(content);
+        const packages = doc === null || doc === void 0 ? void 0 : doc.packages;
+        return Array.isArray(packages) && packages.length > 0;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/build/templates/deployment/turboops.json.ejs

@@ -0,0 +1,3 @@
+{
+  "project": <%- JSON.stringify(props.project) %>
+}

package/build/templates/vendor-scripts/migrate-store.js

@@ -0,0 +1,25 @@
+// Migration store. Loaded by the migrate CLI via `--store`.
+//
+// Runs from two layouts:
+//   - Repo:  migrations-utils/migrate.js  → vendored core is TypeScript-only, so
+//            ts-node has to be registered before requiring any vendor module.
+//   - Image: dist/migrations-utils/migrate.js → everything next to it is compiled
+//            JS and ts-node is NOT installed. Requiring it would crash the
+//            entrypoint (`set -e`) before the server ever starts.
+//
+// So probe for the compiled helper first and only fall back to ts-node.
+const HELPER = '../src/core/modules/migrate/helpers/migration.helper';
+
+try {
+  require.resolve(`${HELPER}.js`);
+} catch {
+  require('./ts-compiler');
+}
+
+const { createMigrationStore } = require(HELPER);
+const { resolveMongoUri } = require('./mongo-uri');
+
+module.exports = createMigrationStore(
+  resolveMongoUri(),
+  'migrations', // optional, default is 'migrations'
+);

package/docs/LT-ECOSYSTEM-GUIDE.md

@@ -247,7 +247,7 @@ Monorepo Subprojects:
 | **MongoDB** | `lt mongodb collection-export`, `mongodb s3-restore` |
 | **Qdrant** | `lt qdrant stats`, `qdrant delete` |
 | **Directus** | `lt directus docker-setup`, `directus typegen`, `directus remove` |
-| **Deployment** | `lt deployment create` (GitHub/GitLab pipelines) |
+| **Deployment** | `lt deployment create` (TurboOps config + GitLab pipeline) |
 | **Blocks/Components** | `lt blocks add`, `lt components add` |
 | **Tools** | `lt tools regex`, `tools sha256`, `tools jwt-read`, `tools crypt`, `tools install-scripts` |
 | **Docs** | `lt docs open` |

package/docs/commands.md

@@ -1052,24 +1052,45 @@ For mode-aware update workflows after conversion, use:
 
 ### `lt deployment create`
 
-Creates deployment configuration for a monorepo.
+Creates the TurboOps deployment config (`.turboops.json`) in the workspace root and
+prints the one-time TurboOps setup checklist (project, stages, CI/CD variables, DNS,
+stage env vars).
+
+The Dockerfiles, `docker-compose.yml` and `.gitlab-ci.yml` already ship with the
+lt-monorepo template, so nothing else is generated. An existing `.turboops.json` is
+merged, not overwritten — hand-added keys survive a re-run.
+
+**Angular apps** additionally get their environment files pointed at the deployed
+stage URLs, because Angular bakes them into the bundle at build time (Nuxt reads
+them from the TurboOps stage env at runtime, so nothing is patched there):
+
+| File | Stage | API URL | App URL |
+|------|-------|---------|---------|
+| `environment.prod.ts` | `production` | `api.<domain>` | `<domain>` |
+| `environment.develop.ts` | `dev` | `api.dev.<domain>` | `dev.<domain>` |
+| `environment.test.ts` | `dev` | `api.dev.<domain>` | `dev.<domain>` |
+
+`environment.ts` (local dev) is never touched. Only the URL origin is replaced, so
+custom paths (`/v2/graphql`) survive and a re-run with a new domain updates them.
 
 **Usage:**
 ```bash
-lt deployment create [name] [options]
+lt deployment create [name] [domain] [options]
 ```
 
 **Options:**
 | Option | Description |
 |--------|-------------|
-| `--domain <domain>` | Main domain for the project |
-| `--gitHub` | Enable GitHub pipeline |
-| `--gitLab` | Enable GitLab pipeline |
-| `--testRunner <tag>` | GitLab test runner tag |
-| `--prodRunner <tag>` | GitLab production runner tag |
-| `--noConfirm` | Skip confirmation prompts |
+| `--domain <domain>` | Main domain for the project (default: `<name>.lenne.tech`) |
+| `--project <slug>` | TurboOps project slug = registry namespace + login user (default: kebab-case name) |
+| `--noConfirm` | Skip prompts; resolve every value from flags, `lt.config`, or defaults |
+
+**Configuration:** `commands.deployment.domain`, `commands.deployment.noConfirm`, `defaults.domain`, `defaults.noConfirm`
 
-**Configuration:** `commands.deployment.*`, `defaults.domain`, `defaults.noConfirm`
+> **Upgrading from the Docker-Swarm generator:** the old
+> `commands.deployment.gitHub`, `gitLab`, `prodRunner`, and `testRunner` config
+> keys were removed with the switch to TurboOps. They are now flagged as unknown
+> by `lt config validate` — delete them from your `lt.config` if present.
 
 ---