@lenne.tech/cli 1.41.3 → 1.42.0

package/build/lib/heal-vendor-migrate-store.js

@@ -0,0 +1,285 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.healVendorMigrateStore = healVendorMigrateStore;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const ts = __importStar(require("typescript"));
+/**
+ * Idempotently repair a vendor-mode project's migration store
+ * (`migrations-utils/migrate.js`).
+ *
+ * ## The defect this heals
+ *
+ * The store is generated ONCE, during `convertCloneToVendored()`. Projects that
+ * were converted before the template learned its lesson keep the old file
+ * forever: `migrations-utils/` is project scaffolding, not `src/core/`, so
+ * neither the core updater nor any other update path ever touches it again.
+ *
+ * The old variant registers the ts-node bootstrap UNCONDITIONALLY:
+ *
+ * ```js
+ * require('./ts-compiler');   // -> require('ts-node')
+ * ```
+ *
+ * `ts-node` is a devDependency that the production Dockerfile prunes with
+ * `pnpm install --prod`, while the image needs no transpiler at all (everything
+ * next to the store is already compiled). So every deployed container dies with
+ * `Cannot find module 'ts-node'` before applying a single migration.
+ *
+ * It stays invisible because `docker-entrypoint.sh` degrades a migration failure
+ * to a warning on purpose — a bad migration must not crash-loop the container and
+ * leave the orchestrator serving a stale build. The container reports healthy,
+ * nothing is migrated, and nobody notices.
+ *
+ * ## Why the detection is inverted — the expensive lesson
+ *
+ * This function replaces the file WHOLESALE, and the replacement is not
+ * behaviour-neutral: the bundled template hardcodes the collection name
+ * (`'migrations'`) and takes its URI from `./mongo-uri`. A project that used a
+ * different collection therefore gets an EMPTY migration ledger — and the next
+ * `migrate:up` re-runs every historical migration against the live database. A
+ * project that never had `./mongo-uri` crashes outright.
+ *
+ * The first implementation asked "can I SEE a guard?" and treated the answer
+ * "no" as proof that none exists. It recognised exactly two shapes — a
+ * `require.resolve` probe and a `try {` — so a perfectly production-safe
+ * `if (!fs.existsSync(compiled)) require('./ts-compiler')` read as broken and
+ * was destroyed, together with its collection name.
+ *
+ * So the question is inverted: heal ONLY when the hazard is positively proven,
+ * i.e. the require sits as a TOP-LEVEL, unconditional statement — the one shape
+ * that genuinely cannot survive a pruned image. Every other shape (inside `try`,
+ * `if`, a function, a ternary, a block) is by construction conditional, hence
+ * the project's own solution, and is left alone. "I did not recognise a guard"
+ * is no longer evidence that there is none.
+ *
+ * Detection runs on the TypeScript AST, not on regex-stripped text. A regex
+ * "lexer" has no string/template/regex-literal state, so a `/*` or `//` inside a
+ * literal earlier in the file silently erased the guard and triggered the very
+ * overwrite this function must avoid. `lib/strip-comments.ts` solves the comment
+ * half properly (TS scanner) and would have been the right reuse; the AST solves
+ * comments AND nesting in one step, and recognises a backtick require for free.
+ *
+ * ## Recoverability
+ *
+ * An overwrite is only acceptable when it can be undone. `git status --porcelain`
+ * returning nothing does NOT mean "committed" — it also means untracked-and-
+ * ignored, or not a git repo at all, i.e. exactly the cases where nothing can be
+ * recovered. The guard therefore establishes tracked-ness directly
+ * (`git ls-files --error-unmatch`) and writes a `.bak` whenever it cannot prove
+ * git has a copy. A file with UNCOMMITTED modifications is never overwritten —
+ * that would destroy work which exists nowhere else — and is reported as skipped.
+ *
+ * @param apiDir    Absolute path to the api project (the directory holding `src/core`).
+ * @param assetPath Absolute path to the bundled `templates/vendor-scripts/migrate-store.js`.
+ * @returns Changed paths relative to `apiDir`; empty when nothing needed healing.
+ */
+function healVendorMigrateStore(apiDir, assetPath) {
+    const changed = [];
+    // Vendor mode only. In npm mode the store requires the compiled
+    // `@lenne.tech/nest-server` package and never needs a transpiler.
+    if (!(0, fs_1.existsSync)((0, path_1.join)(apiDir, 'src', 'core', 'VENDOR.md'))) {
+        return changed;
+    }
+    const rel = 'migrations-utils/migrate.js';
+    const storePath = (0, path_1.join)(apiDir, 'migrations-utils', 'migrate.js');
+    if (!(0, fs_1.existsSync)(storePath) || !(0, fs_1.existsSync)(assetPath)) {
+        return changed;
+    }
+    // Never write THROUGH a symlink: the target may live anywhere, and the caller
+    // asked us to repair a store, not to overwrite whatever it points at.
+    if (isSymbolicLink(storePath)) {
+        changed.push(`${rel} (skipped: is a symlink — repair the file it points at instead)`);
+        return changed;
+    }
+    let current;
+    try {
+        current = (0, fs_1.readFileSync)(storePath, 'utf8');
+    }
+    catch (_a) {
+        return changed;
+    }
+    if (!hasTopLevelTsCompilerRequire(current)) {
+        return changed;
+    }
+    const recoverability = gitRecoverability(apiDir, rel);
+    if (recoverability === 'dirty') {
+        changed.push(`${rel} (skipped: uncommitted changes — commit or discard them, then re-run)`);
+        return changed;
+    }
+    let template;
+    try {
+        template = (0, fs_1.readFileSync)(assetPath, 'utf8');
+    }
+    catch (_b) {
+        return changed;
+    }
+    // No git copy to fall back on (untracked, ignored, or not a repo at all), so
+    // leave one on disk before touching the file.
+    let note = '';
+    if (recoverability === 'unknown') {
+        const backupPath = `${storePath}.bak`;
+        try {
+            if (!(0, fs_1.existsSync)(backupPath)) {
+                (0, fs_1.copyFileSync)(storePath, backupPath);
+            }
+            note = ` — previous version saved to ${rel}.bak`;
+        }
+        catch (_c) {
+            changed.push(`${rel} (skipped: git has no copy and the .bak could not be written)`);
+            return changed;
+        }
+    }
+    // Atomic: a crash between write and rename leaves the original intact rather
+    // than a truncated store the migrate CLI would then fail to parse.
+    if (!writeAtomic(storePath, template)) {
+        changed.push(`${rel} (skipped: write failed)`);
+        return changed;
+    }
+    changed.push(`${rel} (migrations never ran in deployed containers — see the file header)${note}`);
+    return changed;
+}
+/**
+ * Whether git holds a recoverable copy of `relPath`.
+ *
+ * - `recoverable` — tracked and unmodified: an overwrite is undoable via git.
+ * - `dirty`       — tracked with uncommitted edits: must not be overwritten.
+ * - `unknown`     — untracked, ignored, no repo, or no `git` on PATH. Git can
+ *                   recover nothing here, so the caller must back up itself.
+ *
+ * Deliberately does NOT infer "committed" from empty `status --porcelain`
+ * output: an ignored or untracked file is equally silent there, and treating
+ * that silence as safety is what made the overwrite unrecoverable.
+ */
+function gitRecoverability(projectRoot, relPath) {
+    try {
+        // Throws unless the path is TRACKED — the property we actually depend on.
+        (0, child_process_1.execFileSync)('git', ['-C', projectRoot, 'ls-files', '--error-unmatch', '--', relPath], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+    }
+    catch (_a) {
+        return 'unknown';
+    }
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['-C', projectRoot, 'status', '--porcelain', '--', relPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.trim().length > 0 ? 'dirty' : 'recoverable';
+    }
+    catch (_b) {
+        return 'unknown';
+    }
+}
+/**
+ * True when the file requires the ts-node bootstrap as a TOP-LEVEL, unconditional
+ * statement — the only shape that provably breaks in a production image where
+ * ts-node has been pruned.
+ *
+ * Anything nested is conditional by construction and therefore the project's own
+ * (working) solution — both of these are left alone, as is any other guard shape
+ * someone invents:
+ *
+ * ```js
+ * try { require.resolve(`${HELPER}.js`) } catch { require('./ts-compiler') }
+ * if (!fs.existsSync(compiled)) { require('./ts-compiler') }
+ * ```
+ *
+ * Uses the AST rather than text matching, so comments, string literals, template
+ * literals and regex literals cannot fake — or hide — a match.
+ */
+function hasTopLevelTsCompilerRequire(source) {
+    let sourceFile;
+    try {
+        sourceFile = ts.createSourceFile('migrate.js', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+    }
+    catch (_a) {
+        // Unparseable: we cannot prove the hazard, so we must not act.
+        return false;
+    }
+    return sourceFile.statements.some((statement) => {
+        if (!ts.isExpressionStatement(statement)) {
+            return false;
+        }
+        return isTsCompilerRequireCall(statement.expression);
+    });
+}
+/** True when `path` is a symlink (never follows it). */
+function isSymbolicLink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True for `require('./ts-compiler')` — single string or backtick argument. */
+function isTsCompilerRequireCall(node) {
+    if (!ts.isCallExpression(node)) {
+        return false;
+    }
+    if (!ts.isIdentifier(node.expression) || node.expression.text !== 'require') {
+        return false;
+    }
+    if (node.arguments.length !== 1) {
+        return false;
+    }
+    const arg = node.arguments[0];
+    const isLiteral = ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg);
+    return isLiteral && arg.text === './ts-compiler';
+}
+/** Write via temp file + rename so a crash cannot leave a truncated store. */
+function writeAtomic(target, content) {
+    const tmp = `${target}.lt-tmp`;
+    try {
+        (0, fs_1.writeFileSync)(tmp, content);
+        (0, fs_1.renameSync)(tmp, target);
+        return true;
+    }
+    catch (_a) {
+        try {
+            if ((0, fs_1.existsSync)(tmp)) {
+                (0, fs_1.unlinkSync)(tmp);
+            }
+        }
+        catch (_b) {
+            /* best effort */
+        }
+        return false;
+    }
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -22,11 +22,26 @@ const fs_utils_1 = require("./fs-utils");
  * is hoisted too so a sub-project's first-party exemption (e.g.
  * `@lenne.tech/*`) keeps working in the monorepo — otherwise the
  * minimum-release-age gate would block freshly published own packages.
+ *
+ * `auditConfig` is nested (`{ ignoreGhsas: [...], ignoreCves: [...] }`), so it
+ * needs a one-level-deeper merge than the flat object fields. It MUST be hoisted:
+ * the CI audit job is deploy-blocking, and a settings-only sub-workspace file is
+ * deleted after hoisting (see hoistFromSubWorkspaceYaml). Without this the
+ * starter's assessed-advisory allowlist is destroyed rather than merely ignored,
+ * and the generated project's very first pipeline goes red on an advisory that
+ * was already justified upstream.
  */
 const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
-const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS];
+/** Objects whose values are arrays to be unioned, not replaced. */
+const NESTED_ARRAY_FIELDS = ['auditConfig'];
+/** Provenance note written above a hoisted `auditConfig` — see `annotateAuditConfig`. */
+const AUDIT_CONFIG_NOTE = '# Hoisted from the sub-projects by the lt CLI. These advisory suppressions now\n' +
+    '# apply to EVERY package in this workspace, not just the one that justified\n' +
+    '# them — review before adding, and drop entries once the advisory is fixed.';
+const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
 const isArrayField = (field) => ARRAY_FIELDS.includes(field);
+const isNestedArrayField = (field) => NESTED_ARRAY_FIELDS.includes(field);
 /**
  * Hoist the Corepack `packageManager` pin from sub-projects into the monorepo
  * root `package.json`, keeping the highest version and stripping the pin from
@@ -169,9 +184,31 @@ function hoistWorkspacePnpmConfig(options) {
         // Keep allowBuilds (pnpm 11) and onlyBuiltDependencies (pnpm 10) in sync so
         // the build-script allowlist survives regardless of which key pnpm reads.
         syncBuildAllowlists(rootWs);
-        filesystem.write(rootWsPath, (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false }));
+        filesystem.write(rootWsPath, annotateAuditConfig((0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false })));
     }
 }
+/**
+ * Mark a hoisted `auditConfig` as workspace-wide, in the file itself.
+ *
+ * `auditConfig.ignoreGhsas` / `.ignoreCves` are not ordinary settings — they
+ * SUPPRESS vulnerability findings, and the CI audit job is deploy-blocking.
+ * Hoisting changes their blast radius: an advisory a sub-project justified for
+ * one dev-only transitive dep now also silences that same advisory when it turns
+ * up in a sibling's RUNTIME tree, and pnpm's `auditConfig` has no expiry. That is
+ * the correct trade (the alternative — deleting the settings-only sub file
+ * unhoisted — destroys the allowlist and reddens the first pipeline), but it must
+ * not be invisible.
+ *
+ * A comment in the YAML is where a reviewer actually looks: it survives in the
+ * file, shows up in the `git diff` that introduces it, and needs no plumbing
+ * through the void-returning scaffolding call chain.
+ */
+function annotateAuditConfig(yaml) {
+    if (!/^auditConfig:/m.test(yaml) || yaml.includes(AUDIT_CONFIG_NOTE)) {
+        return yaml;
+    }
+    return yaml.replace(/^auditConfig:/m, `${AUDIT_CONFIG_NOTE}\nauditConfig:`);
+}
 /**
  * Compare the versions of two `packageManager` pins (`pnpm@11.13.1+sha512.…`).
  * Returns >0 if `a` is newer, <0 if older, 0 if equal. Numeric segment-wise
@@ -265,6 +302,26 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
         const subArr = Array.isArray(subValue) ? subValue : [];
         return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
     }
+    // Nested (`auditConfig.ignoreGhsas` / `.ignoreCves`): union each inner array
+    // instead of letting the sub-project's object replace the root's. A plain
+    // key-by-key merge would drop every advisory the root had already justified.
+    if (isNestedArrayField(field)) {
+        const asObj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+        const rootObj = asObj(rootValue);
+        const subObj = asObj(subValue);
+        const merged = Object.assign({}, rootObj);
+        for (const [key, value] of Object.entries(subObj)) {
+            if (Array.isArray(value) || Array.isArray(merged[key])) {
+                const a = Array.isArray(merged[key]) ? merged[key] : [];
+                const b = Array.isArray(value) ? value : [];
+                merged[key] = Array.from(new Set([...a, ...b])).sort((x, y) => x.localeCompare(y));
+            }
+            else {
+                merged[key] = value;
+            }
+        }
+        return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+    }
     const rootObj = rootValue && typeof rootValue === 'object' && !Array.isArray(rootValue)
         ? rootValue
         : {};