@lenne.tech/cli 1.41.0 → 1.41.1

package/build/extensions/frontend-helper.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -813,7 +814,11 @@ class FrontendHelper {
         for (const absFile of allFiles) {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
-            const content = filesystem.read(absFile) || '';
+            // Strip comments first — a docblock that DOCUMENTS the conversion legitimately quotes the
+            // very import syntax this looks for, and would otherwise be reported as a file the user has
+            // to fix by hand. Same false-positive class that hit the backend detector on
+            // nest-server-starter's bootstrap-diagnostics.spec.ts.
+            const content = (0, strip_comments_1.stripComments)(filesystem.read(absFile) || '');
             const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
             if (matches) {
                 stale.push(absFile.replace(`${appDir}/`, ''));

package/build/extensions/server.js

@@ -48,6 +48,7 @@ const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -2494,7 +2495,14 @@ class Server {
                 recursive: true,
             }) || [];
             for (const file of files) {
-                const content = this.filesystem.read(file) || '';
+                const raw = this.filesystem.read(file) || '';
+                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
+                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
+                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
+                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
+                // and told the user to rewrite imports that file does not have. A detector that reads
+                // comments as code produces false alarms on exactly the files that explain it best.
+                const content = (0, strip_comments_1.stripComments)(raw);
                 if (pattern ? pattern.test(content) : content.includes(needle)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }

package/build/lib/strip-comments.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripComments = stripComments;
+const ts = __importStar(require("typescript"));
+/**
+ * Removes comments from TypeScript/JavaScript source, preserving everything else verbatim.
+ *
+ * Exists because detectors that search source for import specifiers must not read comments as
+ * code. A keyword-anchored regex is not sufficient on its own: a docblock that DOCUMENTS an import
+ * rewrite legitimately quotes the exact syntax the detector looks for. nest-server-starter's
+ * `tests/unit/bootstrap-diagnostics.spec.ts` contains
+ *
+ *   * CLI's vendor conversion rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path
+ *
+ * which matched `/(?:from|import|…)\s*['"]@lenne\.tech\/nest-server['"]/` and made
+ * `lt fullstack init --framework-mode vendor` warn about imports that file does not have.
+ *
+ * Uses the TypeScript scanner rather than a regex, so string literals, template literals and
+ * regex literals containing `//` or `/*` are handled correctly by construction — a hand-rolled
+ * stripper trips over `'https://…'` and over `/* ` inside a string.
+ *
+ * Comment characters are replaced with spaces instead of being deleted, so byte offsets and line
+ * numbers of the surrounding code stay unchanged — a caller can still report a meaningful
+ * position from a match.
+ *
+ * @param source - TypeScript or JavaScript source text
+ * @returns The source with every comment blanked out
+ *
+ * @example
+ * stripComments("// from 'pkg'\nimport x from 'pkg';")
+ * // => "             \nimport x from 'pkg';"
+ */
+function stripComments(source) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, /* skipTrivia */ false, ts.LanguageVariant.Standard, source);
+    let result = '';
+    let token = scanner.scan();
+    while (token !== ts.SyntaxKind.EndOfFileToken) {
+        const text = scanner.getTokenText();
+        const isComment = token === ts.SyntaxKind.SingleLineCommentTrivia || token === ts.SyntaxKind.MultiLineCommentTrivia;
+        // Keep newlines so line numbers survive; blank everything else in the comment.
+        result += isComment ? text.replace(/[^\n]/g, ' ') : text;
+        token = scanner.scan();
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.41.0",
+  "version": "1.41.1",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -100,10 +100,16 @@
     "ts-jest": "29.4.11"
   },
   "//overrides": {
-    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
+    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
+    "brace-expansion@<1.1.16": "DoS via exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
+    "brace-expansion@>=2.0.0 <2.1.2": "Same advisory, 2.x line.",
+    "brace-expansion@>=5.0.0 <5.0.7": "Same advisory, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors."
   },
   "overrides": {
-    "semver@*": "7.8.5"
+    "semver@*": "7.8.5",
+    "brace-expansion@<1.1.16": "1.1.16",
+    "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+    "brace-expansion@>=5.0.0 <5.0.7": "5.0.7"
   },
   "jest": {
     "testEnvironment": "node",