@lenne.tech/cli 1.41.3 → 1.43.0

package/build/lib/heal-vendor-migrate-store.js

@@ -0,0 +1,285 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.healVendorMigrateStore = healVendorMigrateStore;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const ts = __importStar(require("typescript"));
+/**
+ * Idempotently repair a vendor-mode project's migration store
+ * (`migrations-utils/migrate.js`).
+ *
+ * ## The defect this heals
+ *
+ * The store is generated ONCE, during `convertCloneToVendored()`. Projects that
+ * were converted before the template learned its lesson keep the old file
+ * forever: `migrations-utils/` is project scaffolding, not `src/core/`, so
+ * neither the core updater nor any other update path ever touches it again.
+ *
+ * The old variant registers the ts-node bootstrap UNCONDITIONALLY:
+ *
+ * ```js
+ * require('./ts-compiler');   // -> require('ts-node')
+ * ```
+ *
+ * `ts-node` is a devDependency that the production Dockerfile prunes with
+ * `pnpm install --prod`, while the image needs no transpiler at all (everything
+ * next to the store is already compiled). So every deployed container dies with
+ * `Cannot find module 'ts-node'` before applying a single migration.
+ *
+ * It stays invisible because `docker-entrypoint.sh` degrades a migration failure
+ * to a warning on purpose — a bad migration must not crash-loop the container and
+ * leave the orchestrator serving a stale build. The container reports healthy,
+ * nothing is migrated, and nobody notices.
+ *
+ * ## Why the detection is inverted — the expensive lesson
+ *
+ * This function replaces the file WHOLESALE, and the replacement is not
+ * behaviour-neutral: the bundled template hardcodes the collection name
+ * (`'migrations'`) and takes its URI from `./mongo-uri`. A project that used a
+ * different collection therefore gets an EMPTY migration ledger — and the next
+ * `migrate:up` re-runs every historical migration against the live database. A
+ * project that never had `./mongo-uri` crashes outright.
+ *
+ * The first implementation asked "can I SEE a guard?" and treated the answer
+ * "no" as proof that none exists. It recognised exactly two shapes — a
+ * `require.resolve` probe and a `try {` — so a perfectly production-safe
+ * `if (!fs.existsSync(compiled)) require('./ts-compiler')` read as broken and
+ * was destroyed, together with its collection name.
+ *
+ * So the question is inverted: heal ONLY when the hazard is positively proven,
+ * i.e. the require sits as a TOP-LEVEL, unconditional statement — the one shape
+ * that genuinely cannot survive a pruned image. Every other shape (inside `try`,
+ * `if`, a function, a ternary, a block) is by construction conditional, hence
+ * the project's own solution, and is left alone. "I did not recognise a guard"
+ * is no longer evidence that there is none.
+ *
+ * Detection runs on the TypeScript AST, not on regex-stripped text. A regex
+ * "lexer" has no string/template/regex-literal state, so a `/*` or `//` inside a
+ * literal earlier in the file silently erased the guard and triggered the very
+ * overwrite this function must avoid. `lib/strip-comments.ts` solves the comment
+ * half properly (TS scanner) and would have been the right reuse; the AST solves
+ * comments AND nesting in one step, and recognises a backtick require for free.
+ *
+ * ## Recoverability
+ *
+ * An overwrite is only acceptable when it can be undone. `git status --porcelain`
+ * returning nothing does NOT mean "committed" — it also means untracked-and-
+ * ignored, or not a git repo at all, i.e. exactly the cases where nothing can be
+ * recovered. The guard therefore establishes tracked-ness directly
+ * (`git ls-files --error-unmatch`) and writes a `.bak` whenever it cannot prove
+ * git has a copy. A file with UNCOMMITTED modifications is never overwritten —
+ * that would destroy work which exists nowhere else — and is reported as skipped.
+ *
+ * @param apiDir    Absolute path to the api project (the directory holding `src/core`).
+ * @param assetPath Absolute path to the bundled `templates/vendor-scripts/migrate-store.js`.
+ * @returns Changed paths relative to `apiDir`; empty when nothing needed healing.
+ */
+function healVendorMigrateStore(apiDir, assetPath) {
+    const changed = [];
+    // Vendor mode only. In npm mode the store requires the compiled
+    // `@lenne.tech/nest-server` package and never needs a transpiler.
+    if (!(0, fs_1.existsSync)((0, path_1.join)(apiDir, 'src', 'core', 'VENDOR.md'))) {
+        return changed;
+    }
+    const rel = 'migrations-utils/migrate.js';
+    const storePath = (0, path_1.join)(apiDir, 'migrations-utils', 'migrate.js');
+    if (!(0, fs_1.existsSync)(storePath) || !(0, fs_1.existsSync)(assetPath)) {
+        return changed;
+    }
+    // Never write THROUGH a symlink: the target may live anywhere, and the caller
+    // asked us to repair a store, not to overwrite whatever it points at.
+    if (isSymbolicLink(storePath)) {
+        changed.push(`${rel} (skipped: is a symlink — repair the file it points at instead)`);
+        return changed;
+    }
+    let current;
+    try {
+        current = (0, fs_1.readFileSync)(storePath, 'utf8');
+    }
+    catch (_a) {
+        return changed;
+    }
+    if (!hasTopLevelTsCompilerRequire(current)) {
+        return changed;
+    }
+    const recoverability = gitRecoverability(apiDir, rel);
+    if (recoverability === 'dirty') {
+        changed.push(`${rel} (skipped: uncommitted changes — commit or discard them, then re-run)`);
+        return changed;
+    }
+    let template;
+    try {
+        template = (0, fs_1.readFileSync)(assetPath, 'utf8');
+    }
+    catch (_b) {
+        return changed;
+    }
+    // No git copy to fall back on (untracked, ignored, or not a repo at all), so
+    // leave one on disk before touching the file.
+    let note = '';
+    if (recoverability === 'unknown') {
+        const backupPath = `${storePath}.bak`;
+        try {
+            if (!(0, fs_1.existsSync)(backupPath)) {
+                (0, fs_1.copyFileSync)(storePath, backupPath);
+            }
+            note = ` — previous version saved to ${rel}.bak`;
+        }
+        catch (_c) {
+            changed.push(`${rel} (skipped: git has no copy and the .bak could not be written)`);
+            return changed;
+        }
+    }
+    // Atomic: a crash between write and rename leaves the original intact rather
+    // than a truncated store the migrate CLI would then fail to parse.
+    if (!writeAtomic(storePath, template)) {
+        changed.push(`${rel} (skipped: write failed)`);
+        return changed;
+    }
+    changed.push(`${rel} (migrations never ran in deployed containers — see the file header)${note}`);
+    return changed;
+}
+/**
+ * Whether git holds a recoverable copy of `relPath`.
+ *
+ * - `recoverable` — tracked and unmodified: an overwrite is undoable via git.
+ * - `dirty`       — tracked with uncommitted edits: must not be overwritten.
+ * - `unknown`     — untracked, ignored, no repo, or no `git` on PATH. Git can
+ *                   recover nothing here, so the caller must back up itself.
+ *
+ * Deliberately does NOT infer "committed" from empty `status --porcelain`
+ * output: an ignored or untracked file is equally silent there, and treating
+ * that silence as safety is what made the overwrite unrecoverable.
+ */
+function gitRecoverability(projectRoot, relPath) {
+    try {
+        // Throws unless the path is TRACKED — the property we actually depend on.
+        (0, child_process_1.execFileSync)('git', ['-C', projectRoot, 'ls-files', '--error-unmatch', '--', relPath], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+    }
+    catch (_a) {
+        return 'unknown';
+    }
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['-C', projectRoot, 'status', '--porcelain', '--', relPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.trim().length > 0 ? 'dirty' : 'recoverable';
+    }
+    catch (_b) {
+        return 'unknown';
+    }
+}
+/**
+ * True when the file requires the ts-node bootstrap as a TOP-LEVEL, unconditional
+ * statement — the only shape that provably breaks in a production image where
+ * ts-node has been pruned.
+ *
+ * Anything nested is conditional by construction and therefore the project's own
+ * (working) solution — both of these are left alone, as is any other guard shape
+ * someone invents:
+ *
+ * ```js
+ * try { require.resolve(`${HELPER}.js`) } catch { require('./ts-compiler') }
+ * if (!fs.existsSync(compiled)) { require('./ts-compiler') }
+ * ```
+ *
+ * Uses the AST rather than text matching, so comments, string literals, template
+ * literals and regex literals cannot fake — or hide — a match.
+ */
+function hasTopLevelTsCompilerRequire(source) {
+    let sourceFile;
+    try {
+        sourceFile = ts.createSourceFile('migrate.js', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+    }
+    catch (_a) {
+        // Unparseable: we cannot prove the hazard, so we must not act.
+        return false;
+    }
+    return sourceFile.statements.some((statement) => {
+        if (!ts.isExpressionStatement(statement)) {
+            return false;
+        }
+        return isTsCompilerRequireCall(statement.expression);
+    });
+}
+/** True when `path` is a symlink (never follows it). */
+function isSymbolicLink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True for `require('./ts-compiler')` — single string or backtick argument. */
+function isTsCompilerRequireCall(node) {
+    if (!ts.isCallExpression(node)) {
+        return false;
+    }
+    if (!ts.isIdentifier(node.expression) || node.expression.text !== 'require') {
+        return false;
+    }
+    if (node.arguments.length !== 1) {
+        return false;
+    }
+    const arg = node.arguments[0];
+    const isLiteral = ts.isStringLiteral(arg) || ts.isNoSubstitutionTemplateLiteral(arg);
+    return isLiteral && arg.text === './ts-compiler';
+}
+/** Write via temp file + rename so a crash cannot leave a truncated store. */
+function writeAtomic(target, content) {
+    const tmp = `${target}.lt-tmp`;
+    try {
+        (0, fs_1.writeFileSync)(tmp, content);
+        (0, fs_1.renameSync)(tmp, target);
+        return true;
+    }
+    catch (_a) {
+        try {
+            if ((0, fs_1.existsSync)(tmp)) {
+                (0, fs_1.unlinkSync)(tmp);
+            }
+        }
+        catch (_b) {
+            /* best effort */
+        }
+        return false;
+    }
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractKeyComments = extractKeyComments;
+exports.reattachKeyComments = reattachKeyComments;
 exports.hoistPackageManager = hoistPackageManager;
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
 const js_yaml_1 = require("js-yaml");
@@ -22,11 +24,177 @@ const fs_utils_1 = require("./fs-utils");
  * is hoisted too so a sub-project's first-party exemption (e.g.
  * `@lenne.tech/*`) keeps working in the monorepo — otherwise the
  * minimum-release-age gate would block freshly published own packages.
+ *
+ * `auditConfig` is nested (`{ ignoreGhsas: [...], ignoreCves: [...] }`), so it
+ * needs a one-level-deeper merge than the flat object fields. It MUST be hoisted:
+ * the CI audit job is deploy-blocking, and a settings-only sub-workspace file is
+ * deleted after hoisting (see hoistFromSubWorkspaceYaml). Without this the
+ * starter's assessed-advisory allowlist is destroyed rather than merely ignored,
+ * and the generated project's very first pipeline goes red on an advisory that
+ * was already justified upstream.
  */
 const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
-const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS];
+/** Objects whose values are arrays to be unioned, not replaced. */
+const NESTED_ARRAY_FIELDS = ['auditConfig'];
+/** The union of all three, in declaration order. Declared here, with its inputs,
+ * because the comment-carrying helpers below default their `fields` parameter to it. */
+const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
+/**
+ * Separator for the composite map key.
+ *
+ * `\0` rather than a space, because a YAML mapping key may legally contain
+ * spaces — `overrides` selectors like `minimatch@>=5.0.0 <10.2.6` do — and a
+ * space would let two different (field, key) pairs collide on one entry,
+ * silently attaching one entry's reasoning to another's. Written as an escape
+ * rather than a literal control character: a raw NUL in the source makes git
+ * treat this file as binary, which costs every future reviewer the diff.
+ */
+const KEY_SEPARATOR = '\0';
+/**
+ * Control characters that must never survive into an emitted YAML comment.
+ *
+ * Everything below U+0020 except TAB (U+0009) and LF (U+000A) — CR included,
+ * deliberately: it is the one that reads as whitespace and parses as a line
+ * break. LF cannot appear here (the harvest splits on it) and TAB is harmless.
+ */
+const CONTROL_CHARS = /[\u0000-\u0008\u000B-\u001F\u007F]/;
+const commentKey = (field, key) => `${field}${KEY_SEPARATOR}${key}`;
+/**
+ * Comment blocks attached to the entries of each top-level mapping in `raw`.
+ *
+ * Only contiguous `#` lines DIRECTLY above an entry are taken, and a blank line
+ * ends the block — a comment separated from a key by an empty line belongs to the
+ * section, not to that key, and re-attaching it would silently move a section
+ * header onto whichever entry happened to come first.
+ */
+function extractKeyComments(raw, fields = WORKSPACE_SCOPED_PNPM_FIELDS) {
+    const out = new Map();
+    if (!raw)
+        return out;
+    const lines = raw.split('\n');
+    let field = null;
+    let fieldIndent = 0;
+    let pending = [];
+    for (const line of lines) {
+        const topLevel = /^([A-Za-z_][\w-]*):\s*$/.exec(line);
+        if (topLevel) {
+            field = fields.includes(topLevel[1]) ? topLevel[1] : null;
+            fieldIndent = 0;
+            pending = [];
+            continue;
+        }
+        if (field === null)
+            continue;
+        if (/^\s*$/.test(line)) {
+            pending = [];
+            continue;
+        }
+        const indent = line.search(/\S/);
+        // Back at column 0 → the mapping is over (a new top-level key or a list item).
+        if (indent === 0) {
+            field = null;
+            pending = [];
+            continue;
+        }
+        if (/^\s*#/.test(line)) {
+            // A bare CR is NOT a line break to `String.split('\n')` but IS one to every
+            // YAML parser. So a comment containing one is re-emitted verbatim, and
+            // everything after the CR becomes real YAML at a column of its author's
+            // choosing. Verified against pnpm 11: a comment carrying
+            // `\r  left-pad: 9.9.9` installs as a workspace-wide `overrides` entry —
+            // an arbitrary version force in every generated project — while the line
+            // still renders as an ordinary comment in editors and diffs.
+            //
+            // Dropping the whole block is the right response rather than sanitising it:
+            // a rationale nobody can read is worth less than the risk of guessing what
+            // the author meant.
+            if (CONTROL_CHARS.test(line)) {
+                pending = [];
+                continue;
+            }
+            pending.push(line.trimStart());
+            continue;
+        }
+        const entry = /^\s*((?:'[^']*')|(?:"[^"]*")|(?:[^\s:#][^:]*?))\s*:/.exec(line);
+        if (!entry) {
+            pending = [];
+            continue;
+        }
+        // Nested deeper than the first entry level (e.g. `auditConfig.ignoreGhsas`
+        // items) — the block belongs to the inner key, which this pass does not carry.
+        if (fieldIndent === 0)
+            fieldIndent = indent;
+        if (indent === fieldIndent && pending.length) {
+            out.set(commentKey(field, unquoteYamlKey(entry[1])), pending.join('\n'));
+        }
+        pending = [];
+    }
+    return out;
+}
+/**
+ * Put the harvested comment blocks back above their keys in dumped YAML.
+ *
+ * A key whose comment is already present is left alone, so re-running the hoist
+ * over an already-annotated file is idempotent rather than stuttering.
+ */
+function reattachKeyComments(yaml, comments, fields = WORKSPACE_SCOPED_PNPM_FIELDS) {
+    var _a;
+    if (comments.size === 0)
+        return yaml;
+    const lines = yaml.split('\n');
+    const out = [];
+    let field = null;
+    let fieldIndent = 0;
+    for (const line of lines) {
+        const topLevel = /^([A-Za-z_][\w-]*):\s*$/.exec(line);
+        if (topLevel) {
+            field = fields.includes(topLevel[1]) ? topLevel[1] : null;
+            fieldIndent = 0;
+            out.push(line);
+            continue;
+        }
+        if (field !== null && !/^\s*$/.test(line)) {
+            const indent = line.search(/\S/);
+            if (indent === 0) {
+                field = null;
+            }
+            else {
+                const entry = /^\s*((?:'[^']*')|(?:"[^"]*")|(?:[^\s:#][^:]*?))\s*:/.exec(line);
+                if (entry) {
+                    if (fieldIndent === 0)
+                        fieldIndent = indent;
+                    if (indent === fieldIndent) {
+                        const block = comments.get(commentKey(field, unquoteYamlKey(entry[1])));
+                        // `out[out.length - 1]`, not `.at(-1)`: this project's tsconfig lib
+                        // predates ES2022.
+                        const already = ((_a = out[out.length - 1]) !== null && _a !== void 0 ? _a : '').trim().startsWith('#');
+                        // Second gate on purpose: harvest is one source of blocks today, and a
+                        // control character reaching the emitted file is the whole exploit.
+                        if (block && !already && !CONTROL_CHARS.test(block)) {
+                            const pad = ' '.repeat(indent);
+                            out.push(...block.split('\n').map((l) => `${pad}${l}`));
+                        }
+                    }
+                }
+            }
+        }
+        out.push(line);
+    }
+    return out.join('\n');
+}
+/** `'msgpackr-extract'` / `"foo"` / `foo` all denote the same mapping key. */
+function unquoteYamlKey(raw) {
+    const trimmed = raw.trim();
+    const quoted = /^(['"])([\s\S]*)\1$/.exec(trimmed);
+    return quoted ? quoted[2] : trimmed;
+}
+/** Provenance note written above a hoisted `auditConfig` — see `annotateAuditConfig`. */
+const AUDIT_CONFIG_NOTE = '# Hoisted from the sub-projects by the lt CLI. These advisory suppressions now\n' +
+    '# apply to EVERY package in this workspace, not just the one that justified\n' +
+    '# them — review before adding, and drop entries once the advisory is fixed.';
 const isArrayField = (field) => ARRAY_FIELDS.includes(field);
+const isNestedArrayField = (field) => NESTED_ARRAY_FIELDS.includes(field);
 /**
  * Hoist the Corepack `packageManager` pin from sub-projects into the monorepo
  * root `package.json`, keeping the highest version and stripping the pin from
@@ -142,13 +310,18 @@ function hoistPackageManager(options) {
  * @param options.subProjects Sub-project dirs relative to projectDir
  */
 function hoistWorkspacePnpmConfig(options) {
-    var _a;
+    var _a, _b;
     const { filesystem, projectDir, subProjects } = options;
     const rootWsPath = `${projectDir}/pnpm-workspace.yaml`;
     // The root pnpm-workspace.yaml is the destination. It normally exists (the
     // lt-monorepo clone ships one declaring `packages:`); start from it so
     // `packages:` and any root-owned settings are preserved.
     const rootWs = (_a = readYaml(filesystem, rootWsPath)) !== null && _a !== void 0 ? _a : {};
+    // Why the reasons are harvested rather than regenerated: they are prose written
+    // by whoever added the entry, and no rule can reconstruct them. The root's own
+    // comments are collected FIRST so that where two sources annotate the same key,
+    // the root's wording wins — it is the file a maintainer of THIS workspace edits.
+    const comments = extractKeyComments((_b = filesystem.read(rootWsPath)) !== null && _b !== void 0 ? _b : '');
     let rootChanged = false;
     for (const subDir of subProjects) {
         const subPath = `${projectDir}/${subDir}`;
@@ -161,7 +334,7 @@ function hoistWorkspacePnpmConfig(options) {
         if (hoistFromSubPackageJson({ filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
-        if (hoistFromSubWorkspaceYaml({ filesystem, rootWs, subPath })) {
+        if (hoistFromSubWorkspaceYaml({ comments, filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
     }
@@ -169,8 +342,31 @@ function hoistWorkspacePnpmConfig(options) {
         // Keep allowBuilds (pnpm 11) and onlyBuiltDependencies (pnpm 10) in sync so
         // the build-script allowlist survives regardless of which key pnpm reads.
         syncBuildAllowlists(rootWs);
-        filesystem.write(rootWsPath, (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false }));
+        const dumped = (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false });
+        filesystem.write(rootWsPath, annotateAuditConfig(reattachKeyComments(dumped, comments)));
+    }
+}
+/**
+ * Mark a hoisted `auditConfig` as workspace-wide, in the file itself.
+ *
+ * `auditConfig.ignoreGhsas` / `.ignoreCves` are not ordinary settings — they
+ * SUPPRESS vulnerability findings, and the CI audit job is deploy-blocking.
+ * Hoisting changes their blast radius: an advisory a sub-project justified for
+ * one dev-only transitive dep now also silences that same advisory when it turns
+ * up in a sibling's RUNTIME tree, and pnpm's `auditConfig` has no expiry. That is
+ * the correct trade (the alternative — deleting the settings-only sub file
+ * unhoisted — destroys the allowlist and reddens the first pipeline), but it must
+ * not be invisible.
+ *
+ * A comment in the YAML is where a reviewer actually looks: it survives in the
+ * file, shows up in the `git diff` that introduces it, and needs no plumbing
+ * through the void-returning scaffolding call chain.
+ */
+function annotateAuditConfig(yaml) {
+    if (!/^auditConfig:/m.test(yaml) || yaml.includes(AUDIT_CONFIG_NOTE)) {
+        return yaml;
     }
+    return yaml.replace(/^auditConfig:/m, `${AUDIT_CONFIG_NOTE}\nauditConfig:`);
 }
 /**
  * Compare the versions of two `packageManager` pins (`pnpm@11.13.1+sha512.…`).
@@ -227,13 +423,22 @@ function hoistFromSubPackageJson(options) {
 }
 /** Source 2: the sub-project's pnpm-workspace.yaml. */
 function hoistFromSubWorkspaceYaml(options) {
-    const { filesystem, rootWs, subPath } = options;
+    var _a;
+    const { comments, filesystem, rootWs, subPath } = options;
     const subWsPath = `${subPath}/pnpm-workspace.yaml`;
     if (!filesystem.exists(subWsPath))
         return false;
+    const raw = (_a = filesystem.read(subWsPath)) !== null && _a !== void 0 ? _a : '';
     const ws = readYaml(filesystem, subWsPath);
     if (!ws)
         return false;
+    // Harvest BEFORE hoisting: this file is about to be deleted (or stripped of
+    // exactly these keys), and with it the only copy of the reasoning. An entry
+    // already annotated by the root keeps the root's wording.
+    for (const [key, block] of extractKeyComments(raw)) {
+        if (!comments.has(key))
+            comments.set(key, block);
+    }
     if (!hoistFields(rootWs, ws))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these
@@ -265,6 +470,26 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
         const subArr = Array.isArray(subValue) ? subValue : [];
         return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
     }
+    // Nested (`auditConfig.ignoreGhsas` / `.ignoreCves`): union each inner array
+    // instead of letting the sub-project's object replace the root's. A plain
+    // key-by-key merge would drop every advisory the root had already justified.
+    if (isNestedArrayField(field)) {
+        const asObj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+        const rootObj = asObj(rootValue);
+        const subObj = asObj(subValue);
+        const merged = Object.assign({}, rootObj);
+        for (const [key, value] of Object.entries(subObj)) {
+            if (Array.isArray(value) || Array.isArray(merged[key])) {
+                const a = Array.isArray(merged[key]) ? merged[key] : [];
+                const b = Array.isArray(value) ? value : [];
+                merged[key] = Array.from(new Set([...a, ...b])).sort((x, y) => x.localeCompare(y));
+            }
+            else {
+                merged[key] = value;
+            }
+        }
+        return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+    }
     const rootObj = rootValue && typeof rootValue === 'object' && !Array.isArray(rootValue)
         ? rootValue
         : {};