@lenne.tech/cli 1.37.1 → 1.38.0

package/build/commands/dev/prune.js

@@ -26,7 +26,12 @@ const workspace_integration_1 = require("../../lib/workspace-integration");
  *      `lt ticket stop --keep-db` are never touched.
  *   2. STALE SHARD TEST DATABASES (`<base>-test-<n>` from `lt dev test --shard`)
  *      when no test session is running — they are reset on every run anyway.
- *   3. DEAD REGISTRY ENTRIES (all projects): path no longer exists → the entry and
+ *   3. ORPHANED SMOKE-TEST DATABASES (global): the `/lt-dev:fullstack:smoke-test`
+ *      throwaway projects use the reserved `lt-smoke-test` slug; their DBs are
+ *      ephemeral by convention. Leftovers (e.g. a blocked drop during the run's
+ *      cleanup) would be REUSED by the next run's stack and leak state between
+ *      test runs — swept here whenever no live smoke-test run is registered.
+ *   4. DEAD REGISTRY ENTRIES (all projects): path no longer exists → the entry and
  *      its reserved ports are reclaimed. Databases of dead MAIN projects are NEVER
  *      dropped (a deleted folder is not consent to destroy data).
  *
@@ -62,9 +67,9 @@ const PruneCommand = {
             projectDevDb,
             slug,
         });
-        const dbTargets = [...new Set([...plan.orphan.targets, ...plan.shardTargets])];
+        const dbTargets = [...new Set([...plan.orphan.targets, ...plan.shardTargets, ...plan.smokeTargets])];
         if (dbTargets.length === 0 && plan.registryPrune.length === 0) {
-            success('Nothing to prune — no orphaned ticket DBs, no stale shard DBs, no dead registry entries.');
+            success('Nothing to prune — no orphaned ticket DBs, no stale shard DBs, no smoke-test DBs, no dead registry entries.');
             if (plan.orphan.protected.length > 0) {
                 info(colors.dim(`  kept (registry keptDbs / referenced): ${plan.orphan.protected.join(', ')}`));
             }
@@ -80,6 +85,10 @@ const PruneCommand = {
             info(colors.bold('Stale shard test databases (no test session running):'));
             plan.shardTargets.forEach((db) => info(colors.dim(`  • ${db}`)));
         }
+        if (plan.smokeTargets.length > 0) {
+            info(colors.bold('Orphaned smoke-test databases (reserved lt-smoke-test prefix, no live run):'));
+            plan.smokeTargets.forEach((db) => info(colors.dim(`  • ${db}`)));
+        }
         if (plan.orphan.protected.length > 0) {
             info(colors.dim(`Kept (recorded via --keep-db or still referenced): ${plan.orphan.protected.join(', ')}`));
         }

package/build/commands/dev/up.js

@@ -458,7 +458,7 @@ const UpCommand = {
                     projectDevDb: (0, dev_project_1.deriveDbName)(mainLayout.apiDir, baseSlug),
                     slug: baseSlug,
                 });
-                const dbTargets = [...new Set([...plan.orphan.targets, ...plan.shardTargets])];
+                const dbTargets = [...new Set([...plan.orphan.targets, ...plan.shardTargets, ...plan.smokeTargets])];
                 if (dbTargets.length > 0) {
                     const { dropped, reason } = (0, dev_ticket_1.dropDatabases)(dbTargets, undefined, [mainLayout.apiDir, mainRepoRoot]);
                     if (dropped.length > 0) {

package/build/lib/dev-prune.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMOKE_TEST_DB_PREFIX = void 0;
 exports.collectDevPrunePlan = collectDevPrunePlan;
 exports.listLiveTicketIds = listLiveTicketIds;
 exports.listPastTicketIds = listPastTicketIds;
 exports.planOrphanTicketDbSweep = planOrphanTicketDbSweep;
 exports.planRegistryPrune = planRegistryPrune;
+exports.planSmokeTestDbSweep = planSmokeTestDbSweep;
 exports.planStaleShardDbSweep = planStaleShardDbSweep;
 /**
  * Garbage collection for `lt dev` / `lt ticket` leftovers.
@@ -44,6 +46,13 @@ const dev_project_1 = require("./dev-project");
 const dev_ticket_1 = require("./dev-ticket");
 /** Branch prefix `lt ticket start` creates worktrees on. */
 const TICKET_BRANCH_PREFIX = 'feat/';
+/**
+ * Slug convention of the lt-dev fullstack smoke test (`/lt-dev:fullstack:smoke-test`).
+ * Its throwaway projects are named `lt-smoke-test`, so every database under this
+ * prefix is ephemeral BY CONVENTION — reserve the prefix for smoke-test runs and
+ * never name a real project like this.
+ */
+exports.SMOKE_TEST_DB_PREFIX = 'lt-smoke-test';
 /**
  * Collect the full prune plan for one project. Reads the registry and the Mongo
  * database listing; performs NO destructive action.
@@ -66,6 +75,7 @@ function collectDevPrunePlan(args) {
             projectDevDb,
             projectRoot: mainRepoRoot,
         }),
+        smokeTargets: planSmokeTestDbSweep({ observedDbNames, registry }),
     };
 }
 /** Ticket ids that still have a live environment (worktree and/or live registry entry). */
@@ -182,6 +192,47 @@ function planRegistryPrune(registry) {
         .filter(([, entry]) => entry.path && !(0, fs_1.existsSync)(entry.path))
         .map(([key]) => key);
 }
+/**
+ * Orphaned smoke-test databases. The `/lt-dev:fullstack:smoke-test` command
+ * scaffolds throwaway projects under the reserved {@link SMOKE_TEST_DB_PREFIX}
+ * slug; their databases (`lt-smoke-test-local`, `lt-smoke-test-test`, ticket
+ * variants, …) are ephemeral by convention. When the run's cleanup could not
+ * drop them (e.g. a blocking policy hook) they linger and — worse — get
+ * REUSED by the next run's stack, leaking state between test runs (observed:
+ * a previous run's user made a fresh sign-up probe fail with
+ * "Email already registered").
+ *
+ * Fail-closed gates, in line with the rest of this module:
+ *   - No server listing → empty plan.
+ *   - A LIVE registry entry under the prefix (path exists ⇒ a smoke test is
+ *     running right now) → empty plan; never pull the DB out from under an
+ *     active run.
+ *   - Names recorded as kept (`keptDbs`) or referenced by any live entry's
+ *     `dbName` are never touched.
+ */
+function planSmokeTestDbSweep(args) {
+    var _a;
+    const { observedDbNames, registry } = args;
+    if (!observedDbNames || observedDbNames.length === 0)
+        return [];
+    const entries = Object.entries(registry.projects);
+    const smokeRunLive = entries.some(([key, entry]) => (key === exports.SMOKE_TEST_DB_PREFIX || key.startsWith(`${exports.SMOKE_TEST_DB_PREFIX}-`)) &&
+        entry.path &&
+        (0, fs_1.existsSync)(entry.path));
+    if (smokeRunLive)
+        return [];
+    const protectedNames = new Set();
+    for (const [, entry] of entries) {
+        if (entry.dbName && entry.path && (0, fs_1.existsSync)(entry.path)) {
+            protectedNames.add(entry.dbName);
+            protectedNames.add((0, dev_project_1.deriveTestDbName)(entry.dbName));
+        }
+        for (const kept of (_a = entry.keptDbs) !== null && _a !== void 0 ? _a : []) {
+            protectedNames.add(kept);
+        }
+    }
+    return observedDbNames.filter((name) => (name === exports.SMOKE_TEST_DB_PREFIX || name.startsWith(`${exports.SMOKE_TEST_DB_PREFIX}-`)) && !protectedNames.has(name));
+}
 /**
  * Stale sharded-test databases of the project itself (`<base>-test-<n>` from
  * `lt dev test --shard`). They are ephemeral by definition — every shard run

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.37.1",
+  "version": "1.38.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -61,19 +61,19 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/client-s3": "3.1090.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
-    "axios": "1.16.1",
+    "axios": "1.18.1",
     "bcrypt": "6.0.0",
-    "defuddle": "0.18.1",
+    "defuddle": "0.19.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "0.11.1",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "jsdom": "29.1.1",
     "lodash": "4.18.1",
     "open": "11.0.0",
-    "playwright-core": "1.60.0",
+    "playwright-core": "1.61.1",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -88,9 +88,9 @@
     "@types/js-yaml": "4.0.9",
     "@types/jsdom": "28.0.1",
     "@types/lodash": "4.17.24",
-    "@types/node": "25.9.1",
+    "@types/node": "26.1.1",
     "@types/turndown": "5.0.6",
-    "ejs": "5.0.2",
+    "ejs": "6.0.1",
     "eslint": "9.39.4",
     "husky": "9.1.7",
     "jest": "30.4.2",
@@ -100,20 +100,10 @@
     "ts-jest": "29.4.11"
   },
   "//overrides": {
-    "brace-expansion@5.0.2 - 5.0.5": "Security fix: GHSA-jxxr-4gwj-5jf2 (large numeric range defeats max DoS protection) in brace-expansion 5.0.2-5.0.5 - transitive via minimatch under glob, @ts-morph/common, @typescript-eslint/typescript-estree. Remove once those parents resolve minimatch to a brace-expansion >=5.0.6.",
-    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
-    "js-yaml": "Security fix: GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling) in js-yaml <=4.1.1. Forces 4.2.0 everywhere, incl. the 3.14.2 pulled transitively by @istanbuljs/load-nyc-config under babel-plugin-istanbul (jest coverage); that loader only runs js-yaml when reading a YAML nyc config, which this project does not use. Remove once the jest toolchain resolves js-yaml >=4.2.0 itself.",
-    "form-data": "Security fix: GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped multipart field names) in form-data 4.0.0-4.0.5 - transitive via axios. Remove once axios pins form-data >=4.0.6.",
-    "@babel/core": "Security fix: GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL) in @babel/core <=7.29.0 - transitive via the jest toolchain. Remove once jest resolves @babel/core >=7.29.6.",
-    "undici": "Security fix: GHSA-vmh5-mc38-953g (TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent) and GHSA-pr7r-676h-xcf6 (cross-user info disclosure via shared cache whitespace bypass) in undici 7.0.0-7.27.2 - transitive via jsdom (jest test environment). Forces 7.28.0, which satisfies jsdom's ^7.25.0 range. Remove once jsdom resolves undici >=7.28.0."
+    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
   },
   "overrides": {
-    "@babel/core": "7.29.7",
-    "brace-expansion@5.0.2 - 5.0.5": "5.0.6",
-    "form-data": "4.0.6",
-    "js-yaml": "4.2.0",
-    "semver@*": "7.8.1",
-    "undici": "7.28.0"
+    "semver@*": "7.8.5"
   },
   "jest": {
     "testEnvironment": "node",
@@ -130,36 +120,5 @@
         }
       ]
     }
-  },
-  "pnpm": {
-    "overrides": {
-      "@apollo/server": "5.5.1",
-      "@babel/plugin-transform-modules-systemjs": "7.29.4",
-      "@hono/node-server": "1.19.14",
-      "@protobufjs/utf8": "1.1.1",
-      "ajv": "8.20.0",
-      "axios": "1.16.0",
-      "brace-expansion@<1.1.13": "1.1.14",
-      "brace-expansion@>=2.0.0 <2.0.3": "2.1.0",
-      "brace-expansion@>=5.0.0 <5.0.6": "5.0.6",
-      "effect": "3.21.2",
-      "fast-uri": "3.1.2",
-      "hono": "4.12.22",
-      "lodash": "4.18.1",
-      "picomatch": "4.0.4",
-      "qs": "6.15.2",
-      "uuid": "14.0.0",
-      "vite": "8.0.10",
-      "ws@>=8.0.0 <8.20.1": "8.21.0"
-    },
-    "onlyBuiltDependencies": [
-      "@apollo/protobufjs",
-      "@compodoc/compodoc",
-      "@nestjs/core",
-      "@scarf/scarf",
-      "@swc/core",
-      "bcrypt",
-      "esbuild"
-    ]
   }
 }