@lenne.tech/cli 1.40.0 → 1.41.1

package/build/commands/dev/status.js

@@ -58,25 +58,38 @@ const StatusCommand = {
                     // port) count toward the health summary.
                     const comps = [];
                     if (e.internalPorts.api) {
-                        comps.push((0, dev_state_1.classifyComponentHealth)({ pid: session === null || session === void 0 ? void 0 : session.pids.api, portBound: snap.has(e.internalPorts.api) }));
+                        comps.push((0, dev_state_1.classifyComponentHealth)({
+                            pid: session === null || session === void 0 ? void 0 : session.pids.api,
+                            portBound: snap.has(e.internalPorts.api),
+                            startedAt: session === null || session === void 0 ? void 0 : session.startedAt,
+                        }));
                     }
                     if (e.internalPorts.app) {
-                        comps.push((0, dev_state_1.classifyComponentHealth)({ pid: session === null || session === void 0 ? void 0 : session.pids.app, portBound: snap.has(e.internalPorts.app) }));
+                        comps.push((0, dev_state_1.classifyComponentHealth)({
+                            pid: session === null || session === void 0 ? void 0 : session.pids.app,
+                            portBound: snap.has(e.internalPorts.app),
+                            startedAt: session === null || session === void 0 ? void 0 : session.startedAt,
+                        }));
                     }
-                    const allRunning = comps.length > 0 && comps.every((h) => h === 'running');
-                    const anyRunning = comps.some((h) => h === 'running');
-                    const anyCrashed = comps.some((h) => h === 'crashed');
+                    // Aggregate the per-component health into one honest stack glyph
+                    // (pure, unit-tested in dev-state). Presentation (glyph + note) stays here.
+                    const stack = (0, dev_state_1.summarizeStackHealth)(comps);
                     let status;
                     let note = '';
-                    if (allRunning) {
+                    if (stack === 'running') {
                         status = colors.green('●');
                     }
-                    else if (anyRunning) {
+                    else if (stack === 'degraded') {
                         // Some up, some down — honest "partially up" rather than green.
                         status = colors.yellow('◐');
                         note = colors.yellow('  degraded — `lt dev up` to restart the down half');
                     }
-                    else if (anyCrashed) {
+                    else if (stack === 'starting') {
+                        // Still booting after a recent `lt dev up` — not crashed, give it a moment.
+                        status = colors.cyan('◐');
+                        note = colors.dim('  starting — booting, give it a moment');
+                    }
+                    else if (stack === 'crashed') {
                         status = colors.yellow('◐');
                         note = colors.yellow('  crashed — `lt dev up` to restart');
                     }
@@ -177,16 +190,20 @@ const StatusCommand = {
             const apiHealth = (0, dev_state_1.classifyComponentHealth)({
                 pid: session.pids.api,
                 portBound: entry.internalPorts.api ? snap.has(entry.internalPorts.api) : false,
+                startedAt: session.startedAt,
             });
             const appHealth = (0, dev_state_1.classifyComponentHealth)({
                 pid: session.pids.app,
                 portBound: entry.internalPorts.app ? snap.has(entry.internalPorts.app) : false,
+                startedAt: session.startedAt,
             });
             const label = (health) => health === 'running'
                 ? colors.green('running')
-                : health === 'crashed'
-                    ? colors.yellow('crashed (supervisor up, port not listening)')
-                    : colors.red('dead');
+                : health === 'starting'
+                    ? colors.cyan('starting (booting — port not bound yet)')
+                    : health === 'crashed'
+                        ? colors.yellow('crashed (supervisor up, port not listening)')
+                        : colors.red('dead');
             if (session.pids.api !== undefined || entry.internalPorts.api) {
                 info(`  api: ${label(apiHealth)} (pid ${(_a = session.pids.api) !== null && _a !== void 0 ? _a : '-'})`);
             }
@@ -208,10 +225,17 @@ const StatusCommand = {
             // half and leaves the healthy one running.
             const apiPresent = session.pids.api !== undefined || !!entry.internalPorts.api;
             const appPresent = session.pids.app !== undefined || !!entry.internalPorts.app;
-            const down = [
-                apiPresent && apiHealth !== 'running' ? 'api' : null,
-                appPresent && appHealth !== 'running' ? 'app' : null,
-            ].filter((c) => c !== null);
+            // A `starting` component is booting, not down — don't tell the user to
+            // restart a healthy stack that just needs a few more seconds. Partition is
+            // pure + unit-tested in dev-state.
+            const { down, starting } = (0, dev_state_1.partitionComponentStates)([
+                { health: apiHealth, name: 'api', present: apiPresent },
+                { health: appHealth, name: 'app', present: appPresent },
+            ]);
+            if (starting.length > 0) {
+                info('');
+                info(colors.cyan(`  ${starting.join(' + ')} still booting — give it a few seconds, then re-run \`lt dev status\`.`));
+            }
             if (down.length > 0) {
                 const crashed = (apiPresent && apiHealth === 'crashed') || (appPresent && appHealth === 'crashed');
                 info('');

package/build/commands/dev/up.js

@@ -86,7 +86,7 @@ const UpCommand = {
     hidden: false,
     name: 'up',
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
         const { filesystem, parameters, print: { colors, error, info, success, warning }, } = toolbox;
         const layout = (0, dev_project_1.resolveLayout)(filesystem.cwd(), filesystem);
         if (!layout.apiDir && !layout.appDir) {
@@ -260,16 +260,33 @@ const UpCommand = {
         // ── Health-aware (re)start decision ──────────────────────────────────────
         // Probe the just-resolved ports so we can tell a still-serving component
         // from a crashed one (supervisor PID alive, port free). Only dead/crashed
-        // components get (re)started; a healthy one keeps running untouched.
+        // components get (re)started; a running one keeps serving untouched — and a
+        // still-BOOTING one (`starting`: PID alive, port not bound yet, within the
+        // startup grace window after a recent `up`) is ALSO kept, not force-restarted.
+        // Passing `startedAt` is what lets the classifier distinguish that boot window
+        // from a real crash — otherwise a re-run of `lt dev up` during the API's slow
+        // boot would kill the still-booting component and reset its progress (the very
+        // false-positive the `starting` state exists to prevent).
         const hasApi = Boolean(layout.apiDir && (0, fs_1.existsSync)((0, path_1.join)(layout.apiDir, 'package.json')) && apiPort);
         const hasApp = Boolean(layout.appDir && (0, fs_1.existsSync)((0, path_1.join)(layout.appDir, 'package.json')) && appPort);
         const healthSnap = yield (0, dev_process_1.listenSnapshot)([apiPort, appPort].filter((p) => typeof p === 'number'));
         const apiHealth = hasApi
-            ? (0, dev_state_1.classifyComponentHealth)({ pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api, portBound: !!apiPort && healthSnap.has(apiPort) })
+            ? (0, dev_state_1.classifyComponentHealth)({
+                pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api,
+                portBound: !!apiPort && healthSnap.has(apiPort),
+                startedAt: existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt,
+            })
             : undefined;
         const appHealth = hasApp
-            ? (0, dev_state_1.classifyComponentHealth)({ pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app, portBound: !!appPort && healthSnap.has(appPort) })
+            ? (0, dev_state_1.classifyComponentHealth)({
+                pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app,
+                portBound: !!appPort && healthSnap.has(appPort),
+                startedAt: existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt,
+            })
             : undefined;
+        // A component we leave running untouched is either serving (`running`) or
+        // still within its boot grace window (`starting`).
+        const isKeepable = (h) => h === 'running' || h === 'starting';
         // All present components already serving → nothing to do.
         const presentHealth = [apiHealth, appHealth].filter((h) => h !== undefined);
         if (presentHealth.length > 0 && presentHealth.every((h) => h === 'running')) {
@@ -289,18 +306,21 @@ const UpCommand = {
                 process.exit();
             return 'dev up: already running';
         }
-        // Partial restart — at least one component is healthy and at least one is
-        // down. Announce what we keep vs. restart so the user sees the honest state.
-        const partialRestart = presentHealth.some((h) => h === 'running');
+        // Partial restart — at least one component is kept (running or still booting)
+        // and at least one is down. Announce what we keep vs. restart so the user sees
+        // the honest state. A `starting` component is kept (booting), NOT restarted.
+        const partialRestart = presentHealth.some(isKeepable);
         if (partialRestart) {
-            if (apiHealth === 'running')
-                info(colors.dim(`api healthy (pid ${existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api}) → keeping`));
-            else if (apiHealth)
-                warning(`api ${apiHealth} (port ${apiPort} not serving) → restarting`);
-            if (appHealth === 'running')
-                info(colors.dim(`app healthy (pid ${existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app}) → keeping`));
-            else if (appHealth)
-                warning(`app ${appHealth} (port ${appPort} not serving) → restarting`);
+            const announceDecision = (name, h, pid, port) => {
+                if (h === 'running')
+                    info(colors.dim(`${name} healthy (pid ${pid}) → keeping`));
+                else if (h === 'starting')
+                    info(colors.cyan(`${name} still booting (pid ${pid}) → keeping (grace window)`));
+                else if (h)
+                    warning(`${name} ${h} (port ${port} not serving) → restarting`);
+            };
+            announceDecision('api', apiHealth, existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api, apiPort);
+            announceDecision('app', appHealth, existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app, appPort);
         }
         // Caddy block + reload.
         const routes = [];
@@ -356,14 +376,15 @@ const UpCommand = {
                 yield (0, dev_process_1.terminateProcessGroup)(bound.pid);
         });
         if (hasApi && layout.apiDir && apiPort) {
-            if (apiHealth === 'running') {
+            if (isKeepable(apiHealth)) {
                 pids.api = existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api;
                 kept.push('api');
-                // `--api-compiled` only takes effect when the API (re)starts; a healthy API is
-                // kept as-is (force-restarting it would contradict the keep logic), so tell the
-                // user how to switch a currently-running ts-node API to compiled.
+                // `--api-compiled` only takes effect when the API (re)starts; a running or
+                // still-booting API is kept as-is (force-restarting it would contradict the
+                // keep logic), so tell the user how to switch a currently-live ts-node API
+                // to compiled.
                 if (apiCompiled)
-                    info(colors.dim('  --api-compiled: API already running — `lt dev down` first to switch it.'));
+                    info(colors.dim('  --api-compiled: API already running/booting — `lt dev down` first to switch it.'));
             }
             else {
                 yield reclaimPort(existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api, apiPort, apiHealth !== null && apiHealth !== void 0 ? apiHealth : 'dead');
@@ -396,7 +417,7 @@ const UpCommand = {
             }
         }
         if (hasApp && layout.appDir && appPort) {
-            if (appHealth === 'running') {
+            if (isKeepable(appHealth)) {
                 pids.app = existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app;
                 kept.push('app');
             }
@@ -417,28 +438,38 @@ const UpCommand = {
                 }
             }
         }
-        // Persist the session (PIDs) — merging kept (healthy) + freshly started PIDs.
-        // The registry entry (ports) was already reserved atomically above. On a
-        // partial restart we preserve the original session start time.
-        const startedAt = existingSession && kept.length > 0 ? existingSession.startedAt : new Date().toISOString();
+        // Persist the session (PIDs) — merging kept (running/booting) + freshly
+        // started PIDs. The registry entry (ports) was already reserved atomically
+        // above. Reset the session clock ONLY when something was actually (re)started:
+        //   - A freshly restarted component MUST get "now" so its startup grace window
+        //     is measured from its real start — inheriting a stale `startedAt` would
+        //     make a just-restarted, still-booting component read as `crashed` during
+        //     its own boot (a kept `running` component is classified by port-bound, not
+        //     `startedAt`, so a fresh timestamp never mis-ages it).
+        //   - When nothing was started (all kept — e.g. both still booting), preserve
+        //     the original so repeated `up` during a boot can't keep extending the
+        //     grace window indefinitely.
+        const startedAt = started.length > 0 ? new Date().toISOString() : ((_h = existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt) !== null && _h !== void 0 ? _h : new Date().toISOString());
         (0, dev_state_1.saveSession)(layout.root, { pids, startedAt });
         // Write the ENV bridge so external tools (Playwright, IDE test runners,
         // custom shell scripts) can pick up the URLs without inheriting our shell.
         const bridgePath = (0, dev_env_bridge_1.writeEnvBridge)(layout.root, devEnv, dbName);
         info(colors.dim(`ENV bridge: ${bridgePath}`));
         const summary = started.length === 0
-            ? 'Nothing restarted'
+            ? kept.length > 0
+                ? `Kept ${kept.join('+')} (already running or booting)`
+                : 'Nothing restarted'
             : kept.length > 0
                 ? `Restarted ${started.join('+')} (kept ${kept.join('+')})`
                 : `Started ${started.join('+')}`;
-        success(`${summary}: api pid=${(_h = pids.api) !== null && _h !== void 0 ? _h : '-'}, app pid=${(_j = pids.app) !== null && _j !== void 0 ? _j : '-'}`);
+        success(`${summary}: api pid=${(_j = pids.api) !== null && _j !== void 0 ? _j : '-'}, app pid=${(_k = pids.app) !== null && _k !== void 0 ? _k : '-'}`);
         // Echo the bound URLs next to the PIDs as well — the "Starting" block
         // prints them before the spawn, but on a long boot log they scroll out
         // of view, so repeating them here keeps PID + URL visually grouped.
         printProjectUrls(info, {
-            apiHostname: (_k = identity.subdomains.api) === null || _k === void 0 ? void 0 : _k.hostname,
+            apiHostname: (_l = identity.subdomains.api) === null || _l === void 0 ? void 0 : _l.hostname,
             apiUpstreamPort: apiPort,
-            appHostname: (_l = identity.subdomains.app) === null || _l === void 0 ? void 0 : _l.hostname,
+            appHostname: (_m = identity.subdomains.app) === null || _m === void 0 ? void 0 : _m.hostname,
             appUpstreamPort: appPort,
             dbName: identity.subdomains.api ? dbName : undefined,
         });
@@ -466,7 +497,7 @@ const UpCommand = {
                 try {
                     mainRepoRoot = (0, dev_ticket_1.gitMainRepoRoot)(layout.root);
                 }
-                catch (_m) {
+                catch (_o) {
                     /* not a git repo — registry prune still applies */
                 }
                 const mainLayout = (0, dev_project_1.resolveLayout)(mainRepoRoot, filesystem);
@@ -513,7 +544,7 @@ const UpCommand = {
                     }
                 }
             }
-            catch (_o) {
+            catch (_p) {
                 /* never block `up` on cleanup */
             }
         }

package/build/extensions/frontend-helper.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -813,7 +814,11 @@ class FrontendHelper {
         for (const absFile of allFiles) {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
-            const content = filesystem.read(absFile) || '';
+            // Strip comments first — a docblock that DOCUMENTS the conversion legitimately quotes the
+            // very import syntax this looks for, and would otherwise be reported as a file the user has
+            // to fix by hand. Same false-positive class that hit the backend detector on
+            // nest-server-starter's bootstrap-diagnostics.spec.ts.
+            const content = (0, strip_comments_1.stripComments)(filesystem.read(absFile) || '');
             const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
             if (matches) {
                 stale.push(absFile.replace(`${appDir}/`, ''));

package/build/extensions/server.js

@@ -48,6 +48,7 @@ const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -2494,7 +2495,14 @@ class Server {
                 recursive: true,
             }) || [];
             for (const file of files) {
-                const content = this.filesystem.read(file) || '';
+                const raw = this.filesystem.read(file) || '';
+                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
+                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
+                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
+                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
+                // and told the user to rewrite imports that file does not have. A detector that reads
+                // comments as code produces false alarms on exactly the files that explain it best.
+                const content = (0, strip_comments_1.stripComments)(raw);
                 if (pattern ? pattern.test(content) : content.includes(needle)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }

package/build/lib/dev-process.js

@@ -223,7 +223,27 @@ function spawnDetached(cmd, args, opts) {
     const out = (0, fs_1.openSync)(opts.logFile, 'a');
     let child;
     try {
-        child = (0, child_process_1.spawn)(cmd, args, {
+        // Raise the soft file-descriptor limit before exec-ing the real command.
+        // macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
+        // by the terminal that runs `lt dev up` and therefore by these detached children
+        // — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
+        // The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
+        // monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
+        // that force a manual `lt dev up`. We wrap the command in `sh -c "ulimit …; exec …"`:
+        //   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
+        //     process group are still the real process (PID tracking + group-kill in
+        //     `terminateProcessGroup` keep working).
+        //   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
+        //   - the cascade tries a high limit first, falling back on machines with a
+        //     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
+        // Note: because the outer `spawn('/bin/sh', …)` almost always succeeds, a bogus
+        // `cmd` no longer surfaces as `pid === undefined` here — the inner `exec` fails
+        // (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
+        // `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
+        // deliberately don't watch for that here: a detached, unref'd child's 127 exit is
+        // racy to observe, and callers must be self-correcting against real crashes anyway.
+        const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
+        child = (0, child_process_1.spawn)('/bin/sh', ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], {
             cwd: opts.cwd,
             detached: true,
             env: opts.env,

package/build/lib/dev-state.js

@@ -9,8 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.paths = exports.TEST_SESSION_FILE = void 0;
+exports.paths = exports.TEST_SESSION_FILE = exports.STARTUP_GRACE_MS = void 0;
 exports.classifyComponentHealth = classifyComponentHealth;
+exports.partitionComponentStates = partitionComponentStates;
+exports.summarizeStackHealth = summarizeStackHealth;
 exports.allocateInternalPort = allocateInternalPort;
 exports.clearSession = clearSession;
 exports.detectSlugConflict = detectSlugConflict;
@@ -38,16 +40,66 @@ exports.withRegistryLock = withRegistryLock;
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+/**
+ * How long after `lt dev up` a not-yet-bound-but-PID-alive component is treated
+ * as `starting` (booting) rather than `crashed`. Covers the slow API boot
+ * (compile + Mongo + Better Auth + AI tools + migrations) with headroom.
+ */
+exports.STARTUP_GRACE_MS = 60000;
 /**
  * Classify a component's true health from its recorded wrapper PID plus whether
  * its internal port is actually bound (caller provides the port probe result,
  * typically from a single {@link import('./dev-process').listenSnapshot} call).
+ *
+ * When `startedAt` is supplied, a PID-alive-but-port-unbound component is reported
+ * as `starting` (booting) rather than `crashed` for the first {@link STARTUP_GRACE_MS}
+ * after `lt dev up` — see the {@link ComponentHealth} doc block for the full state
+ * model and the false-positive it prevents.
  */
 function classifyComponentHealth(opts) {
+    var _a;
     const wrapperAlive = typeof opts.pid === 'number' && isPidAlive(opts.pid);
     if (!wrapperAlive)
         return 'dead';
-    return opts.portBound ? 'running' : 'crashed';
+    if (opts.portBound)
+        return 'running';
+    // Wrapper alive but the port is not bound. Within the startup grace window after
+    // `lt dev up` this is a still-BOOTING component, not a crash (avoids the
+    // false-positive that told users to restart a healthy, still-booting stack).
+    const graceMs = (_a = opts.startupGraceMs) !== null && _a !== void 0 ? _a : exports.STARTUP_GRACE_MS;
+    if (opts.startedAt) {
+        const ageMs = Date.now() - new Date(opts.startedAt).getTime();
+        if (Number.isFinite(ageMs) && ageMs >= 0 && ageMs < graceMs)
+            return 'starting';
+    }
+    return 'crashed';
+}
+/**
+ * Split present components into those still booting (`starting`) vs. genuinely
+ * down (present, not running, not starting). A `starting` component is booting,
+ * not down — it must NEVER appear in the "restart the down half" hint, otherwise
+ * the user is told to restart a healthy, still-booting stack.
+ */
+function partitionComponentStates(components) {
+    const starting = components.filter((c) => c.present && c.health === 'starting').map((c) => c.name);
+    const down = components
+        .filter((c) => c.present && c.health !== 'running' && c.health !== 'starting')
+        .map((c) => c.name);
+    return { down, starting };
+}
+/** See {@link StackHealth} for the precedence rules this implements. */
+function summarizeStackHealth(components) {
+    if (components.length === 0)
+        return 'stopped';
+    if (components.every((h) => h === 'running'))
+        return 'running';
+    if (components.some((h) => h === 'running'))
+        return 'degraded';
+    if (components.some((h) => h === 'starting'))
+        return 'starting';
+    if (components.some((h) => h === 'crashed'))
+        return 'crashed';
+    return 'stopped';
 }
 const REGISTRY_PATH = process.env.LT_DEV_REGISTRY_PATH || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech', 'projects.json');
 const SESSION_DIR = '.lt-dev';

package/build/lib/strip-comments.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripComments = stripComments;
+const ts = __importStar(require("typescript"));
+/**
+ * Removes comments from TypeScript/JavaScript source, preserving everything else verbatim.
+ *
+ * Exists because detectors that search source for import specifiers must not read comments as
+ * code. A keyword-anchored regex is not sufficient on its own: a docblock that DOCUMENTS an import
+ * rewrite legitimately quotes the exact syntax the detector looks for. nest-server-starter's
+ * `tests/unit/bootstrap-diagnostics.spec.ts` contains
+ *
+ *   * CLI's vendor conversion rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path
+ *
+ * which matched `/(?:from|import|…)\s*['"]@lenne\.tech\/nest-server['"]/` and made
+ * `lt fullstack init --framework-mode vendor` warn about imports that file does not have.
+ *
+ * Uses the TypeScript scanner rather than a regex, so string literals, template literals and
+ * regex literals containing `//` or `/*` are handled correctly by construction — a hand-rolled
+ * stripper trips over `'https://…'` and over `/* ` inside a string.
+ *
+ * Comment characters are replaced with spaces instead of being deleted, so byte offsets and line
+ * numbers of the surrounding code stay unchanged — a caller can still report a meaningful
+ * position from a match.
+ *
+ * @param source - TypeScript or JavaScript source text
+ * @returns The source with every comment blanked out
+ *
+ * @example
+ * stripComments("// from 'pkg'\nimport x from 'pkg';")
+ * // => "             \nimport x from 'pkg';"
+ */
+function stripComments(source) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, /* skipTrivia */ false, ts.LanguageVariant.Standard, source);
+    let result = '';
+    let token = scanner.scan();
+    while (token !== ts.SyntaxKind.EndOfFileToken) {
+        const text = scanner.getTokenText();
+        const isComment = token === ts.SyntaxKind.SingleLineCommentTrivia || token === ts.SyntaxKind.MultiLineCommentTrivia;
+        // Keep newlines so line numbers survive; blank everything else in the comment.
+        result += isComment ? text.replace(/[^\n]/g, ' ') : text;
+        token = scanner.scan();
+    }
+    return result;
+}

package/docs/commands.md

@@ -467,8 +467,11 @@ a still-serving component from a *crashed* one (the supervisor / nodemon survive
 ts-node crash and the recorded PID stays alive while nothing listens on the port).
 Behaviour:
 - **All present components truly serving** → no-op, exits 0 with "already running".
-- **Some serving, some down** → restarts ONLY the down component(s); a healthy one
-  keeps running untouched and its PID is preserved in the session.
+- **Still booting** (PID alive, port not bound yet, within the 60 s startup grace
+  window) → KEPT, not restarted. Re-running `lt dev up` while the API is still
+  booting must not kill and restart the still-booting component.
+- **Some serving, some down** → restarts ONLY the down (`crashed`/`dead`)
+  component(s); a running or still-booting one keeps its PID untouched.
 - Before respawning a crashed component it terminates that supervisor's whole
   process group (so its idle `nodemon` doesn't leak / stack a second one) and
   reclaims any orphaned listener still squatting the reused port.
@@ -534,12 +537,17 @@ lt dev status --all   # every project in the registry
 The current-project view shows subdomains → upstream ports, db URI, per-component
 health, and live `lsof` state. **Health is honest:** a component is reported
 `running` only when its supervisor PID is alive AND its internal port is actually
-bound. A supervisor that survived a ts-node crash (PID alive, port free) is shown
-as `crashed (supervisor up, port not listening)` instead of the old misleading
-`running`, with a hint to run `lt dev up` to restart just that one.
+bound. A component that is PID-alive but not yet bound is `starting (booting — port
+not bound yet)` during the first 60 s after `lt dev up` (the slow API boot: swc
+compile + Mongo + Better Auth + migrations) — booting, not down, so no restart is
+suggested. Once that grace window elapses with the port still free, a supervisor
+that survived a ts-node crash (PID alive, port free) is shown as `crashed
+(supervisor up, port not listening)` instead of the old misleading `running`, with
+a hint to run `lt dev up` to restart just that one.
 
 The `--all` view lists every project with a single indicator:
 - `●` (green) — all present components serving
+- `◐` (cyan) — `starting` (booting within the startup grace window — give it a moment)
 - `◐` (yellow) — `degraded` (some up, some down) or `crashed` (supervisor up, port free)
 - `○` (dim) — stopped
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.40.0",
+  "version": "1.41.1",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -100,10 +100,16 @@
     "ts-jest": "29.4.11"
   },
   "//overrides": {
-    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
+    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
+    "brace-expansion@<1.1.16": "DoS via exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
+    "brace-expansion@>=2.0.0 <2.1.2": "Same advisory, 2.x line.",
+    "brace-expansion@>=5.0.0 <5.0.7": "Same advisory, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors."
   },
   "overrides": {
-    "semver@*": "7.8.5"
+    "semver@*": "7.8.5",
+    "brace-expansion@<1.1.16": "1.1.16",
+    "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+    "brace-expansion@>=5.0.0 <5.0.7": "5.0.7"
   },
   "jest": {
     "testEnvironment": "node",