@lenne.tech/cli 1.44.0 → 1.46.0

package/build/commands/dev/up.js

@@ -354,6 +354,9 @@ const UpCommand = {
         // Build env per process.
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // Lets `buildDevEnv` consult the app's own `.env` for keys a project may have set
+            // itself, so `lt dev` never replaces one of its values with a derived fallback.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/commands/fullstack/add-api.js

@@ -330,7 +330,11 @@ const NewCommand = {
         // non-root level pnpm ignores), drop nested lockfiles the root supersedes,
         // and guarantee a root `.dockerignore` (Docker never reads a sub-project's
         // own when building from the root context).
-        (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir: workspaceDir });
+        // A disagreement between the two repos is not something the merge may decide
+        // silently. Reported here, and repeated in the closing block — this call site
+        // sits directly above the install output that would otherwise bury it.
+        const { conflicts } = (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir: workspaceDir });
+        (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
         // Run install + format unless explicitly skipped (CI/agents may
         // want to chain multiple add-* calls before installing once).
         if (!skipInstall && !experimental) {
@@ -357,6 +361,7 @@ const NewCommand = {
         info('');
         success(`API integrated into ${workspaceDir} in ${toolbox.helper.msToMinutesAndSeconds(timer())}m.`);
         info('');
+        (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
         info('Next:');
         if (experimental) {
             info(`  $ cd ${workspaceDir}/projects/api && bun install`);

package/build/commands/fullstack/add-app.js

@@ -259,7 +259,11 @@ const NewCommand = {
         // carry pnpm.overrides too), drop the frontend starter's standalone
         // pnpm-lock.yaml the root supersedes, and guarantee a root `.dockerignore`
         // (else the image inherits the host's node_modules, .output and .env).
-        (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir: workspaceDir });
+        // A disagreement between the two repos is not something the merge may decide
+        // silently. Reported here, and repeated in the closing block — this call site
+        // sits directly above the install output that would otherwise bury it.
+        const { conflicts } = (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir: workspaceDir });
+        (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
         if (!skipInstall) {
             const installSpinner = spin('Install workspace packages');
             try {
@@ -278,6 +282,7 @@ const NewCommand = {
         info('');
         success(`App integrated into ${workspaceDir} in ${toolbox.helper.msToMinutesAndSeconds(timer())}m.`);
         info('');
+        (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
         info('Next:');
         info(`  $ cd ${workspaceDir}`);
         info(`  $ ${toolbox.pm.run('start')}`);

package/build/commands/fullstack/init.js

@@ -653,7 +653,12 @@ const NewCommand = {
             // guarantees a root `.dockerignore` (else the images carry the host's
             // node_modules, a stale .output, and a local .env that `nuxt build`
             // bakes in).
-            (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir });
+            // Two sources setting the same pnpm key to different values is not a merge
+            // to resolve — it is a disagreement between two repos, and the merge would
+            // pick one silently. Say so here, where both halves are still visible, and
+            // again at the end (the install output below buries this one).
+            const { conflicts } = (0, workspace_integration_1.finalizeWorkspaceRoot)({ filesystem, projectDir });
+            (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
             // Install all packages
             if (!experimental) {
                 const installSpinner = spin('Install all packages');
@@ -734,6 +739,7 @@ const NewCommand = {
             info('');
             success(`Generated fullstack workspace with ${frontend} in ${projectDir} with ${name} app in ${helper.msToMinutesAndSeconds(timer())}m.`);
             info('');
+            (0, workspace_integration_1.reportWorkspaceConflicts)(conflicts, toolbox.print.warning);
             info('Next:');
             if (experimental) {
                 info(`  $ cd ${projectDir}`);

package/build/config/vendor-runtime-deps.json

@@ -1,5 +1,4 @@
 {
-  "$schema": "./vendor-runtime-deps.schema.json",
-  "description": "Upstream @lenne.tech/nest-server devDependencies that are actually needed at runtime in a consumer project. When vendoring, these entries are promoted from upstream devDependencies into the project's dependencies so production runtime has them available.",
-  "runtimeHelpers": ["find-file-up"]
+  "$comment": "Upstream @lenne.tech/nest-server DEVDEPENDENCIES that must land in a vendored project's `dependencies`. Vendoring copies upstream `dependencies` verbatim and does not read `peerDependencies` at all, so a package the framework imports at runtime while keeping it in devDependencies would never reach the production runtime. Entries here are matched against upstream `devDependencies` only — see `isVendorRuntimeDep`, consulted in the `upstreamDevDeps` loop in `extensions/server.ts` — and promoted into `dependencies`, preferring the upstream peer RANGE over the exact devDep pin where one exists, so a generated project still receives patch-level security fixes. A package that appears ONLY in upstream `peerDependencies` cannot be promoted by this list: listing it here is a silent no-op. Two live cases: `find-file-up` (imported by the config loader, devDependency only), and the better-auth trio (declared as peerDependencies AND mirrored into devDependencies upstream; the mirror is what makes the promotion fire, so this list is the fallback if the starter ever stops declaring them itself).",
+  "runtimeHelpers": ["@better-auth/core", "@better-auth/passkey", "better-auth", "find-file-up"]
 }

package/build/extensions/server.js

@@ -951,6 +951,7 @@ class Server {
      */
     convertCloneToVendored(options) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             const { dest, upstreamBranch, upstreamRepoUrl = 'https://github.com/lenneTech/nest-server.git' } = options;
             const filesystem = this.filesystem;
             const { system } = this.toolbox;
@@ -995,16 +996,22 @@ class Server {
             // transitive deps into the project's package.json (step 5 below).
             let upstreamDeps = {};
             let upstreamDevDeps = {};
+            let upstreamPeerDeps = {};
             let upstreamVersion = '';
             try {
                 const upstreamPkg = filesystem.read(`${tmpClone}/package.json`, 'json');
                 if (upstreamPkg && typeof upstreamPkg === 'object') {
                     upstreamDeps = upstreamPkg.dependencies || {};
                     upstreamDevDeps = upstreamPkg.devDependencies || {};
+                    // Read for the version RANGE only, never as a source of packages: the
+                    // promotion below still keys off devDependencies. A peer range is the
+                    // spec upstream actually supports, whereas the devDep entry beside it is
+                    // an exact pin that exists for the framework's own CI.
+                    upstreamPeerDeps = upstreamPkg.peerDependencies || {};
                     upstreamVersion = upstreamPkg.version || '';
                 }
             }
-            catch (_a) {
+            catch (_b) {
                 // Best-effort — if we can't read upstream pkg, the starter's own
                 // deps should still cover most of the framework's needs.
             }
@@ -1018,7 +1025,7 @@ class Server {
             try {
                 upstreamLockRaw = filesystem.read(`${tmpClone}/pnpm-lock.yaml`) || '';
             }
-            catch (_b) {
+            catch (_c) {
                 // Best-effort — without the lockfile, the closure step falls back to
                 // the upstream package.json ranges (still better than nothing).
             }
@@ -1034,7 +1041,7 @@ class Server {
             try {
                 upstreamWorkspaceYaml = filesystem.read(`${tmpClone}/pnpm-workspace.yaml`) || '';
             }
-            catch (_c) {
+            catch (_d) {
                 // Best-effort: an older framework revision may predate the file. The project
                 // then keeps exactly the allowlist its own template shipped.
             }
@@ -1050,7 +1057,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_d) {
+            catch (_e) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1059,7 +1066,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_e) {
+            catch (_f) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1342,7 +1349,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_f) {
+                    catch (_g) {
                         // skip unreadable file
                     }
                 }
@@ -1484,9 +1491,13 @@ class Server {
                         pkg.devDependencies = {};
                     const devDeps = pkg.devDependencies;
                     for (const [depName, depVersion] of Object.entries(upstreamDevDeps)) {
-                        // Runtime-needed devDeps → promote to dependencies
+                        // Runtime-needed devDeps → promote to dependencies. Prefer the peer
+                        // RANGE when upstream declares one: the devDep entry beside it is an
+                        // exact pin for the framework's own CI, and baking that into a
+                        // generated project means `pnpm update` never delivers a patch-level
+                        // fix — the wrong default for an auth library like better-auth.
                         if (this.isVendorRuntimeDep(depName) && !(depName in deps)) {
-                            deps[depName] = depVersion;
+                            deps[depName] = (_a = upstreamPeerDeps[depName]) !== null && _a !== void 0 ? _a : depVersion;
                             continue;
                         }
                         // @types/<pkg> where <pkg> is a runtime dep → accept as devDep

package/build/lib/dev-env-bridge.js

@@ -16,8 +16,11 @@ exports.writeEnvBridge = writeEnvBridge;
  * Shell B does not inherit shell A's exports. Reading a file solves
  * this without polluting global state.
  *
- * The file is gitignored via `.lt-dev/`. It contains only public URLs +
- * the local CA path — no secrets. Format: standard dotenv KEY=VALUE.
+ * The file is gitignored via `.lt-dev/` and written 0600, because it is no longer
+ * URLs only: `NUXT_SESSION_PASSWORD` is a session-sealing key. Usually that is the
+ * value `lt dev` derived itself, but when the project exported its own it is THAT
+ * one being copied here — so treat the file as credential-bearing, and think twice
+ * before adding a key to it. Format: standard dotenv KEY=VALUE.
  */
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -84,6 +87,11 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
         'NUXT_PUBLIC_SITE_URL',
         'NUXT_PUBLIC_STORAGE_PREFIX',
         'NUXT_PUBLIC_API_PROXY',
+        // Not needed by the runner itself, but external suites check it to tell a stack that
+        // can log in from one that will 500 on every login, and a suite that seals its own
+        // session cookie to skip the login form needs the value (see dev-env.ts). This is the
+        // one credential-shaped key in the bridge — it is why the file is written 0600.
+        'NUXT_SESSION_PASSWORD',
         'NSC__MONGOOSE__URI',
         'DATABASE_URL',
         // Legacy aliases — see dev-env.ts for the rationale.
@@ -107,6 +115,9 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
     if ((0, fs_1.existsSync)(file) && (0, fs_1.readFileSync)(file, 'utf8') === content)
         return file;
     (0, fs_1.mkdirSync)((0, path_1.dirname)(file), { recursive: true });
-    (0, fs_1.writeFileSync)(file, content, 'utf8');
+    (0, fs_1.writeFileSync)(file, content, { encoding: 'utf8', mode: 0o600 });
+    // `mode` only applies when the file is CREATED, so an existing bridge from an older
+    // lt version would keep its 0644. chmod unconditionally to heal those.
+    (0, fs_1.chmodSync)(file, 0o600);
     return file;
 }

package/build/lib/dev-env.js

@@ -14,6 +14,8 @@ exports.buildDevEnv = buildDevEnv;
  * - `NUXT_PUBLIC_*` lock the App to its own API
  * - `NUXT_PUBLIC_STORAGE_PREFIX` namespaces localStorage/sessionStorage
  * - `NSC__MONGOOSE__URI` / `DATABASE_URL` namespace the database per project
+ * - `NUXT_SESSION_PASSWORD` is keyed per slug, so a session cookie sealed by one
+ *   stack cannot be unsealed by another (dev vs. `-test` vs. `-test-N` shard)
  *
  * CA trust for SSR fetches:
  * - Both API and App receive `NODE_EXTRA_CA_CERTS` pointing at the
@@ -21,6 +23,10 @@ exports.buildDevEnv = buildDevEnv;
  *   subdomains succeed. Without this Nuxt SSR fails with "unable to
  *   get local issuer certificate" when the app calls its own API.
  */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const dev_env_bridge_1 = require("./dev-env-bridge");
 /**
  * Build the environment maps for both API and App processes.
@@ -29,7 +35,8 @@ const dev_env_bridge_1 = require("./dev-env-bridge");
  * vars survive. `lt dev`-managed keys win on top.
  */
 function buildDevEnv(input) {
-    const { apiInternalPort, appInternalPort, baseEnv = {}, dbName, identity } = input;
+    var _a;
+    const { apiInternalPort, appDir, appInternalPort, baseEnv = {}, dbName, identity } = input;
     const apiSub = identity.subdomains.api;
     const appSub = identity.subdomains.app;
     const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
@@ -52,14 +59,18 @@ function buildDevEnv(input) {
             internalPort: apiInternalPort,
         },
         app: {
-            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
                 // See API note above: pin the dev server to IPv4 so Caddy's
                 // `127.0.0.1` upstream is unambiguous.
                 HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
                 // Vite-API-Proxy is OFF by default in lt dev mode — Caddy serves
                 // both subdomains under HTTPS with shared cookie domain, so
                 // same-origin trickery is no longer required.
-                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug, PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
+                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug }), (baseEnv.NUXT_SESSION_PASSWORD
+                ? {}
+                : {
+                    NUXT_SESSION_PASSWORD: (_a = readEnvFileValue(appDir, 'NUXT_SESSION_PASSWORD')) !== null && _a !== void 0 ? _a : deriveSessionPassword(identity.slug),
+                })), { PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
             internalPort: appInternalPort,
         },
     };
@@ -68,3 +79,106 @@ function buildDevEnv(input) {
 function buildPostgresUrl(dbName) {
     return `postgresql://${dbName}:${dbName}@localhost:5432/${dbName}`;
 }
+/**
+ * Stable local session password for a project's app process.
+ *
+ * 32 hex chars — h3's floor. Deterministic per slug AND per machine: the same stack on the
+ * same machine always gets the same value, so a restart does not invalidate open sessions,
+ * while a different slug (or a different developer's machine) gets a different one.
+ *
+ * The machine salt is what makes it unguessable. Without it the only input is the slug, which
+ * the app publishes itself via `NUXT_PUBLIC_STORAGE_PREFIX`, so anyone who loaded a page —
+ * including any visitor of a `lt dev tunnel` URL — could recompute the key and forge a sealed
+ * session cookie. With it, an attacker would have to read the developer's home directory.
+ */
+function deriveSessionPassword(slug) {
+    var _a;
+    // No salt means the home directory is unwritable. Fall back to a constant key rather than a
+    // random one: determinism is the property every caller depends on, and a fresh value per run
+    // would log everybody out on every restart. The fallback is guessable — hence last resort.
+    return (0, node_crypto_1.createHmac)('sha256', (_a = machineSessionSalt()) !== null && _a !== void 0 ? _a : 'lt-dev')
+        .update(`lt-dev:session:${slug}`)
+        .digest('hex')
+        .slice(0, 32);
+}
+/**
+ * Read (or create) the machine-local salt at `~/.lenneTech/dev-session-salt`, mode 0600.
+ *
+ * Returns `null` when it can be neither read nor created — see {@link deriveSessionPassword}
+ * for what happens then.
+ */
+function machineSessionSalt() {
+    const file = sessionSaltPath();
+    try {
+        const existing = (0, node_fs_1.readFileSync)(file, 'utf8').trim();
+        if (existing) {
+            return existing;
+        }
+    }
+    catch (_a) {
+        // Not created yet — fall through and create it.
+    }
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(file), { recursive: true });
+        // `wx` fails when the file already exists, so two shards racing on a cold machine can
+        // never end up with two different salts: the loser falls into the catch and re-reads.
+        const salt = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        (0, node_fs_1.writeFileSync)(file, `${salt}\n`, { flag: 'wx', mode: 0o600 });
+        return salt;
+    }
+    catch (_b) {
+        try {
+            return (0, node_fs_1.readFileSync)(file, 'utf8').trim() || null;
+        }
+        catch (_c) {
+            return null;
+        }
+    }
+}
+/**
+ * Read one key out of `<dir>/.env` without pulling in a dotenv dependency.
+ *
+ * Deliberately minimal: no interpolation, no multi-line values, no `.env.local` cascade. It
+ * exists to answer one question — did the project set this key itself? — for a value the built
+ * Nitro server would otherwise never see.
+ */
+function readEnvFileValue(dir, key) {
+    if (!dir) {
+        return undefined;
+    }
+    let content;
+    try {
+        content = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, '.env'), 'utf8');
+    }
+    catch (_a) {
+        return undefined;
+    }
+    for (const line of content.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const eq = trimmed.indexOf('=');
+        if (eq === -1) {
+            continue;
+        }
+        if (trimmed
+            .slice(0, eq)
+            .replace(/^export\s+/, '')
+            .trim() !== key) {
+            continue;
+        }
+        const raw = trimmed.slice(eq + 1).trim();
+        const quoted = raw.length >= 2 && ((raw.startsWith('"') && raw.endsWith('"')) || (raw.startsWith("'") && raw.endsWith("'")));
+        return (quoted ? raw.slice(1, -1) : raw) || undefined;
+    }
+    return undefined;
+}
+/**
+ * Path of the machine-local salt. `LT_DEV_SESSION_SALT_PATH` overrides it, and `HOME` is read
+ * before `os.homedir()` — both so tests can redirect the write to a tmpdir, the same reason
+ * `dev-service.ts#userHome` does it.
+ */
+function sessionSaltPath() {
+    return process.env.LT_DEV_SESSION_SALT_PATH || (0, node_path_1.join)(process.env.HOME || (0, node_os_1.homedir)(), '.lenneTech', 'dev-session-salt');
+}

package/build/lib/dev-patches.js

@@ -157,7 +157,7 @@ function patchClaudeMd(file, options) {
     if (dbName)
         lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
     lines.push('');
-    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
+    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NUXT_SESSION_PASSWORD`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
     lines.push('');
     lines.push(endMarker);
     const block = lines.join('\n');

package/build/lib/dev-test-session.js

@@ -274,6 +274,9 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         log.info('');
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // The built server this stack runs reads no `.env` at all, so a key the project set
+            // there has to be forwarded explicitly — that is the whole reason this argument exists.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/lib/ensure-root-dockerignore.js

@@ -16,8 +16,15 @@ exports.ensureRootDockerignore = ensureRootDockerignore;
 // bundle itself changes.
 const REQUIRED_PATTERNS = [
     '**/node_modules',
+    // `**/.output` matches a path component EXACTLY, so the isolated build dirs of
+    // `lt dev test` (`.output-test`, `.nuxt-test`, `.nuxt-test-2`, …) need their own
+    // globs. They are built with the app's full dev env, so Nitro freezes values like
+    // `NUXT_SESSION_PASSWORD` into them as runtime-config defaults — and a `--keep`
+    // run or a crashed teardown leaves the tree on disk for the next `docker build`.
     '**/.output',
+    '**/.output-*',
     '**/.nuxt',
+    '**/.nuxt-*',
     '**/dist',
     // `**/.env` matches a path component EXACTLY, so it does NOT cover
     // `.env.production` / `.env.staging` / `.env.test` — all of which routinely

package/build/lib/hoist-workspace-pnpm-config.js

@@ -323,6 +323,15 @@ function hoistWorkspacePnpmConfig(options) {
     // the root's wording wins — it is the file a maintainer of THIS workspace edits.
     const comments = extractKeyComments((_b = filesystem.read(rootWsPath)) !== null && _b !== void 0 ? _b : '');
     let rootChanged = false;
+    // Shared across all sources: who set which key, and where two disagree.
+    const provenance = new Map();
+    const conflicts = [];
+    const rootOverrides = [];
+    const auditWidenedBy = new Set();
+    // Sub-projects that are present and eligible but hand over nothing, because an
+    // earlier run already hoisted their settings and deleted the source. They are
+    // what turns a root-vs-sub override into a sub-vs-sub disagreement.
+    const dormant = [];
     for (const subDir of subProjects) {
         const subPath = `${projectDir}/${subDir}`;
         if (!filesystem.exists(subPath))
@@ -331,13 +340,31 @@ function hoistWorkspacePnpmConfig(options) {
         // checkout in link mode.
         if ((0, fs_utils_1.isSymlink)(subPath))
             continue;
-        if (hoistFromSubPackageJson({ filesystem, rootWs, subPath })) {
+        // Labelled per FILE, not per sub-project: a repo that contradicts itself
+        // across its own two config sources is the same silent-winner bug one scope
+        // down, and a shared label hides it.
+        const fromPkg = hoistFromSubPackageJson({
+            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/package.json#pnpm` },
+            filesystem,
+            rootWs,
+            subPath,
+        });
+        const fromYaml = hoistFromSubWorkspaceYaml({
+            comments,
+            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/pnpm-workspace.yaml` },
+            filesystem,
+            rootWs,
+            subPath,
+        });
+        if (fromPkg || fromYaml) {
             rootChanged = true;
         }
-        if (hoistFromSubWorkspaceYaml({ comments, filesystem, rootWs, subPath })) {
-            rootChanged = true;
+        else {
+            dormant.push(subDir);
         }
     }
+    reportRootOverridesFromDormantSiblings(rootOverrides, dormant, conflicts);
+    reportAuditConfigWidening(auditWidenedBy, conflicts);
     if (rootChanged) {
         // Keep allowBuilds (pnpm 11) and onlyBuiltDependencies (pnpm 10) in sync so
         // the build-script allowlist survives regardless of which key pnpm reads.
@@ -345,6 +372,7 @@ function hoistWorkspacePnpmConfig(options) {
         const dumped = (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false });
         filesystem.write(rootWsPath, annotateAuditConfig(reattachKeyComments(dumped, comments)));
     }
+    return { conflicts };
 }
 /**
  * Mark a hoisted `auditConfig` as workspace-wide, in the file itself.
@@ -368,6 +396,30 @@ function annotateAuditConfig(yaml) {
     }
     return yaml.replace(/^auditConfig:/m, `${AUDIT_CONFIG_NOTE}\nauditConfig:`);
 }
+/** `false` from either side wins — an install script nobody vouched for must not run. */
+function applyDenyWins(rootValue, subValue) {
+    const isMap = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+    if (!isMap(rootValue) || !isMap(subValue))
+        return subValue;
+    const out = Object.assign({}, subValue);
+    for (const [pkg, enabled] of Object.entries(rootValue)) {
+        if (enabled === false)
+            out[pkg] = false;
+    }
+    return out;
+}
+/**
+ * Compare the value each field's own downstream normalisation will actually use.
+ *
+ * `allowBuilds` is the case that matters: js-yaml 4 follows the YAML 1.2 core
+ * schema, so `esbuild: no` parses as the STRING `'no'` while the same intent in a
+ * `package.json#pnpm` block is the BOOLEAN `false`. `syncBuildAllowlists` narrows
+ * both to `false` (`enabled === true`), so reporting them as a disagreement sends
+ * someone hunting through two repositories over two spellings of "deny".
+ */
+function canonicaliseForCompare(field, value) {
+    return field === 'allowBuilds' ? value === true : value;
+}
 /**
  * Compare the versions of two `packageManager` pins (`pnpm@11.13.1+sha512.…`).
  * Returns >0 if `a` is newer, <0 if older, 0 if equal. Numeric segment-wise
@@ -388,15 +440,100 @@ function comparePmVersions(a, b) {
     }
     return 0;
 }
+/**
+ * Structural equality, enough for the scalar/array/object shapes these fields hold.
+ *
+ * The scalar fast path is not just a shortcut: `overrides` values are version
+ * strings and `allowBuilds` values are booleans, so it answers nearly every real
+ * comparison without allocating. The `try` guards the rest — `js-yaml` resolves
+ * recursive anchors into genuinely circular objects, on which `JSON.stringify`
+ * throws, and an exception here would abort the whole hoist (and with it
+ * `lt fullstack init`). Two values we cannot compare are reported as differing:
+ * a spurious warning is recoverable, a silent merge is the thing this exists to
+ * prevent.
+ */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null)
+        return false;
+    try {
+        return JSON.stringify(a) === JSON.stringify(b);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Render a value for a warning that lands in a terminal and in CI logs.
+ *
+ * `JSON.stringify` supplies the quoting and escapes every control character, so
+ * an ESC smuggled through a version spec cannot repaint the line. The redaction
+ * covers the one shape a version spec may legitimately carry a secret in: a git
+ * or tarball URL with embedded credentials (`git+https://user:token@host/…`).
+ * It only ever leaks something already committed to a sub-project manifest, but
+ * a conflict warning should not be a new place it surfaces.
+ */
+function describeValue(value) {
+    if (typeof value !== 'string') {
+        // A recursive YAML anchor resolves to a circular object, which `stringify`
+        // refuses. Naming its shape is enough for a warning, and beats aborting the
+        // scaffold over an unprintable value.
+        try {
+            return JSON.stringify(value);
+        }
+        catch (_a) {
+            return Array.isArray(value) ? '<circular list>' : '<circular value>';
+        }
+    }
+    return JSON.stringify(value
+        .replace(/\/\/[^/@\s]+:[^/@\s]+@/, '//***:***@')
+        .replace(/([?&](?:token|access_token|auth|password)=)[^&\s]+/gi, '$1***'));
+}
+/** True when an `auditConfig` block actually suppresses something (empty lists do not). */
+function hasAuditSuppressions(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    return Object.values(value).some((v) => Array.isArray(v) && v.length > 0);
+}
 /**
  * Move the workspace-scoped pnpm fields from `source` into `rootWs`,
  * deleting each moved field from `source`. Returns true if anything moved.
+ *
+ * `context` drives conflict DETECTION for the object-valued fields. The merge
+ * itself is last-writer-wins (`{...root, ...sub}`), which is correct for
+ * root-vs-sub — a sub-project owns the authoritative list for its own transitive
+ * deps — but is a trap for sub-vs-sub: two projects pinning the same package to
+ * different versions produce one silent winner, decided by iteration order.
+ * Nothing downstream can tell that apart from a deliberate choice, so it is
+ * caught here, where both values are still visible.
+ *
+ * `allowBuilds` is the one field where detection is not enough and the merge
+ * itself is corrected — see the deny-wins block below.
  */
-function hoistFields(rootWs, source) {
+function hoistFields(rootWs, source, context) {
     let changed = false;
     for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
         if (source[field] === undefined)
             continue;
+        if (context && isObjectField(field)) {
+            recordObjectFieldProvenance(field, source[field], context);
+            recordRootOverrides(field, rootWs[field], source[field], context);
+        }
+        if (context && field === 'auditConfig' && hasAuditSuppressions(source[field])) {
+            context.auditWidenedBy.add(context.sourceLabel);
+        }
+        // A build-script allowance is the one field with a safe direction: a deny
+        // declared anywhere outranks an allow from elsewhere. Without this the
+        // last-writer-wins merge resolves the disagreement in favour of RUNNING an
+        // install script that another sub-project explicitly refused — and the
+        // warning above does not stop it. `syncBuildAllowlists` is already
+        // fail-closed across the two allowlist forms; this makes the sub-vs-sub
+        // path agree with it. No such direction exists for `overrides` (a higher
+        // version is not a safer one), so there the warning is the whole answer.
+        if (field === 'allowBuilds') {
+            source[field] = applyDenyWins(rootWs[field], source[field]);
+        }
         rootWs[field] = mergePnpmFieldValue(field, rootWs[field], source[field]);
         delete source[field];
         changed = true;
@@ -412,7 +549,7 @@ function hoistFromSubPackageJson(options) {
     const subPkg = filesystem.read(subPkgPath, 'json');
     if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
         return false;
-    if (!hoistFields(rootWs, subPkg.pnpm))
+    if (!hoistFields(rootWs, subPkg.pnpm, options.context))
         return false;
     // If the sub-project's pnpm section is now empty, drop it entirely.
     if (Object.keys(subPkg.pnpm).length === 0) {
@@ -439,7 +576,7 @@ function hoistFromSubWorkspaceYaml(options) {
         if (!comments.has(key))
             comments.set(key, block);
     }
-    if (!hoistFields(rootWs, ws))
+    if (!hoistFields(rootWs, ws, options.context))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these
     // hoisted keys — once emptied it would only declare a nested workspace
@@ -453,6 +590,10 @@ function hoistFromSubWorkspaceYaml(options) {
     }
     return true;
 }
+/** True for the fields merged key-by-key, where two sub-projects can contradict each other. */
+function isObjectField(field) {
+    return OBJECT_FIELDS.includes(field);
+}
 /**
  * Merge two values for a pnpm workspace-scoped field.
  *
@@ -525,6 +666,143 @@ function readYaml(filesystem, path) {
         return null;
     return parsed;
 }
+/**
+ * Note who set each key of an object-valued field, and flag a second source
+ * setting the same key to a different value.
+ *
+ * `sourceLabel` identifies the FILE, not the sub-project, so a sub-project that
+ * contradicts itself across its own `package.json#pnpm` and its own
+ * `pnpm-workspace.yaml` is caught too. That is not a hypothetical shape — both
+ * starters ship a settings-only `pnpm-workspace.yaml`, and a stale leftover in
+ * either file otherwise downgrades a pin with no output at all.
+ */
+function recordObjectFieldProvenance(field, value, context) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    for (const [key, incoming] of Object.entries(value)) {
+        const id = `${field}.${key}`;
+        const previous = context.provenance.get(id);
+        if (previous &&
+            previous.source !== context.sourceLabel &&
+            !deepEqual(canonicaliseForCompare(field, previous.value), canonicaliseForCompare(field, incoming))) {
+            // `allowBuilds` is resolved deterministically (deny outranks allow), so
+            // saying "one of them would silently win" there would understate what
+            // already happened and leave the reader unsure which value shipped.
+            const kept = resolveKeptValue(field, previous.value, incoming);
+            const outcome = deepEqual(kept, incoming)
+                ? 'One of them would silently win.'
+                : `The workspace keeps ${describeValue(kept)}, because a denied build script outranks an allowed one.`;
+            context.conflicts.push(`${field}: ${JSON.stringify(key)} is set to ${describeValue(previous.value)} by ${previous.source} ` +
+                `and to ${describeValue(incoming)} by ${context.sourceLabel}. ` +
+                `${outcome} Agree on a single value in BOTH repos before assembling.`);
+        }
+        context.provenance.set(id, { source: context.sourceLabel, value: incoming });
+    }
+}
+/**
+ * Remember where this source changes a value the ROOT already carried.
+ *
+ * On its own that is the documented and intended precedence — the root seeds,
+ * a sub-project owns the authoritative list for its own transitive deps — so
+ * nothing is reported here. It only becomes a disagreement once the run ends
+ * with a sub-project that contributed nothing, which is what tells us the root
+ * value was itself hoisted from that sibling on an earlier run.
+ *
+ * The `kept` value is resolved here rather than described later, because for
+ * `allowBuilds` the incoming value does NOT necessarily win: `applyDenyWins`
+ * runs a few lines further down and a deny from either side outranks an allow.
+ * A message that announced the incoming value as the winner would state the
+ * opposite of what the file ends up containing.
+ */
+function recordRootOverrides(field, rootValue, subValue, context) {
+    if (!rootValue || typeof rootValue !== 'object' || Array.isArray(rootValue))
+        return;
+    if (!subValue || typeof subValue !== 'object' || Array.isArray(subValue))
+        return;
+    const rootMap = rootValue;
+    for (const [key, incoming] of Object.entries(subValue)) {
+        if (!(key in rootMap))
+            continue;
+        if (deepEqual(canonicaliseForCompare(field, rootMap[key]), canonicaliseForCompare(field, incoming)))
+            continue;
+        context.rootOverrides.push({
+            field,
+            incoming,
+            keptValue: resolveKeptValue(field, rootMap[key], incoming),
+            key,
+            rootValue: rootMap[key],
+            source: context.sourceLabel,
+        });
+    }
+}
+/**
+ * One line, not one per advisory: say that hoisting widened the audit
+ * suppressions to the whole workspace, and name who brought them.
+ *
+ * `annotateAuditConfig` already writes this into the emitted YAML, but that note
+ * reaches whoever opens `pnpm-workspace.yaml` later — not the person running
+ * `lt fullstack init` now. In a generated project the deploy-blocking audit job
+ * is the only automated vulnerability control there is, so a suppression
+ * assessed against one package's dependency tree quietly covering the other's is
+ * worth a line on screen.
+ */
+function reportAuditConfigWidening(auditWidenedBy, conflicts) {
+    if (auditWidenedBy.size === 0)
+        return;
+    conflicts.push(`auditConfig: advisory suppressions from ${[...auditWidenedBy].join(', ')} now apply to EVERY package in ` +
+        `this workspace, not just the one they were assessed against. Review them, and drop each entry once its ` +
+        `advisory is fixed.`);
+}
+/**
+ * Turn root-vs-sub overrides into conflicts when a sibling sub-project sat out
+ * the run — the incremental `add-api` → `add-app` case.
+ *
+ * Hoisting is destructive: `hoistFields` deletes each field from the source once
+ * it reaches the root. So by the time `lt fullstack add-app` runs, the api's
+ * settings are already IN the root and gone from `projects/api/package.json`.
+ * The app's differing value then looks exactly like the documented root-vs-sub
+ * precedence, and the sub-vs-sub check never sees two values. Confirmed: api
+ * pinning `better-auth` to 1.7.1 followed later by app pinning 1.7.2 yielded no
+ * conflict and a root silently on 1.7.2.
+ *
+ * A sub-project that is present but contributed nothing is the signal that this
+ * happened. It is not proof — the root value could equally be a hand-edit or the
+ * lt-monorepo template's own seed — so the message says "if", names the sibling,
+ * and asks rather than asserts. Being present and contributing everything (the
+ * `lt fullstack init` path) leaves `dormant` empty, which is why the intended
+ * root-seed precedence stays silent there.
+ */
+function reportRootOverridesFromDormantSiblings(rootOverrides, dormant, conflicts) {
+    if (rootOverrides.length === 0 || dormant.length === 0)
+        return;
+    const siblings = dormant.join(', ');
+    for (const { field, incoming, keptValue, key, rootValue, source } of rootOverrides) {
+        // Name the value the workspace actually ends up with. For `allowBuilds` that
+        // is not the incoming one — a deny outranks an allow — and announcing the
+        // wrong winner would send the reader looking for a problem that is already
+        // resolved, while hiding the one that is not.
+        const outcome = deepEqual(keptValue, incoming)
+            ? `${describeValue(incoming)}, which now wins`
+            : `${describeValue(incoming)}; the workspace keeps ${describeValue(keptValue)}, because a denied build ` +
+                `script outranks an allowed one`;
+        conflicts.push(`${field}: ${JSON.stringify(key)} was already pinned to ${describeValue(rootValue)} in this workspace, ` +
+            `and ${source} changes it to ${outcome}. ` +
+            `If the existing value came from ${siblings} — whose settings an earlier run already hoisted — ` +
+            `the two repos disagree. Agree on a single value in BOTH before assembling.`);
+    }
+}
+/**
+ * What the workspace will actually carry once this key is merged.
+ *
+ * Mirrors `applyDenyWins` for `allowBuilds` — a deny on either side is kept —
+ * and last-writer-wins for everything else. Kept next to the merge it predicts
+ * so the two cannot drift apart silently.
+ */
+function resolveKeptValue(field, rootValue, incoming) {
+    if (field === 'allowBuilds' && (rootValue === false || incoming === false))
+        return false;
+    return incoming;
+}
 /**
  * Keep the two build-allowlist forms consistent and complete after hoisting:
  * - `allowBuilds` (pnpm 11) is a `{ pkg: boolean }` map.

package/build/lib/workspace-integration.js

@@ -75,6 +75,7 @@ exports.finalizeWorkspaceRoot = finalizeWorkspaceRoot;
 exports.findWorkspaceRoot = findWorkspaceRoot;
 exports.isNonInteractive = isNonInteractive;
 exports.reconfigureUpstreamForDownstream = reconfigureUpstreamForDownstream;
+exports.reportWorkspaceConflicts = reportWorkspaceConflicts;
 exports.runExperimentalNestBaseRename = runExperimentalNestBaseRename;
 exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
@@ -149,15 +150,30 @@ function detectWorkspaceLayout(workspaceDir, filesystem) {
  *      sub-project's own `.dockerignore` when building from the root context).
  *
  * Each step is a no-op when there is nothing to do, so re-runs are safe.
+ *
+ * Returns what step 1 found and could not resolve on its own: keys set to
+ * different values by two different sources, audit suppressions that hoisting
+ * has just widened to the whole workspace, and — in the incremental flow — a
+ * value this run changes that an earlier run had hoisted from the other
+ * sub-project. Callers should surface all of them; a contradiction here reaches
+ * every project generated from the templates.
+ *
+ * Detection is per invocation and hoisting is destructive: a field is deleted
+ * from its source once it reaches the root. So `lt fullstack init` on a fresh
+ * directory, where both halves are still unhoisted, is the only path that sees
+ * two competing values directly. `add-api` → `add-app` is covered by the weaker
+ * "the root already pinned this, and a sibling contributed nothing" signal,
+ * which names the sibling and asks rather than asserts.
  */
 function finalizeWorkspaceRoot(options) {
     var _a;
     const { filesystem, projectDir } = options;
     const subProjects = (_a = options.subProjects) !== null && _a !== void 0 ? _a : ['projects/api', 'projects/app'];
-    (0, hoist_workspace_pnpm_config_1.hoistWorkspacePnpmConfig)({ filesystem, projectDir, subProjects });
+    const { conflicts } = (0, hoist_workspace_pnpm_config_1.hoistWorkspacePnpmConfig)({ filesystem, projectDir, subProjects });
     (0, hoist_workspace_pnpm_config_1.hoistPackageManager)({ filesystem, projectDir, subProjects });
     (0, remove_nested_lockfiles_1.removeNestedLockfiles)({ filesystem, projectDir, subProjects });
     (0, ensure_root_dockerignore_1.ensureRootDockerignore)({ filesystem, projectDir });
+    return { conflicts };
 }
 /**
  * Walk up from `startDir` until a workspace marker is found or the
@@ -264,6 +280,25 @@ function reconfigureUpstreamForDownstream(options) {
     filesystem.write(upstreamPath, next, { jsonIndent: 2 });
     return { updated: true };
 }
+/**
+ * Surface what `finalizeWorkspaceRoot` could not decide.
+ *
+ * Shared by all three fullstack scaffolders so the wording — and the fact that
+ * it is printed at all — cannot drift between them. Called TWICE per command:
+ * once where the conflict arises, and once in the closing block, because the
+ * first call lands immediately before `pnpm install` and several hundred lines
+ * of install output bury it. Nothing here changes the exit code: the workspace
+ * is still assembled, and the disagreement needs a human decision in two
+ * repositories rather than a failed scaffold.
+ *
+ * A no-op for the overwhelmingly common empty case, so callers can call it
+ * unconditionally.
+ */
+function reportWorkspaceConflicts(conflicts, warn) {
+    for (const conflict of conflicts) {
+        warn(`[workspace] ${conflict}`);
+    }
+}
 /**
  * Run the experimental `bun run rename <projectDir>` step. Only relevant
  * for the `--next` nest-base template (it ships hard-coded `nest-base`

package/docs/commands.md

@@ -451,9 +451,24 @@ lt dev up
 | `NUXT_PUBLIC_SITE_URL` | Nuxt `useRuntimeConfig().public.siteUrl` + Playwright | `https://crm.localhost` |
 | `NUXT_PUBLIC_STORAGE_PREFIX` | namespaces sessionStorage/localStorage | `crm` |
 | `NUXT_PUBLIC_API_PROXY` | always `false` — Caddy + cookie-domain make it obsolete | `false` |
+| `NUXT_SESSION_PASSWORD` | Nuxt/h3 `useSession` — only projects that added h3 sessions or `nuxt-auth-utils` read it; the Better-Auth default stack ignores it | `a1b2…` (32 hex chars) |
 | `NSC__MONGOOSE__URI` | nest-server Mongoose URI | `mongodb://127.0.0.1/crm-local` |
 | `DATABASE_URL` | Postgres convenience URL (for nest-base-style projects) | `postgresql://crm-local:crm-local@localhost:5432/crm-local` |
 
+`NUXT_SESSION_PASSWORD` exists because `lt dev test` serves the **built** Nitro server, which
+reads no `.env` — so a project that keeps its password there watched every login answer 500
+(`H3Error: Empty password`). Resolution order: a value exported in the shell, then the app's own
+`.env`, then a fallback derived as `HMAC-SHA256(machine salt, 'lt-dev:session:<slug>')` truncated
+to 32 hex chars. `lt dev` only fills the gap — it never replaces a value the project chose.
+
+The salt lives at `~/.lenneTech/dev-session-salt` (created once, mode 0600; override the path with
+`LT_DEV_SESSION_SALT_PATH`). It is what makes the value unguessable: the slug itself is public —
+the app ships it to every browser as `NUXT_PUBLIC_STORAGE_PREFIX`, and `lt dev tunnel` can put
+that app on a public URL — so an unsalted derivation would hand any visitor the key that seals
+the stack's session cookies. Keying on the slug also means the dev stack, the `lt dev test` stack
+and each `--shard` stack get **different** passwords, so one stack's cookies never validate
+against another's.
+
 **Override the binary** for both spawns via `LT_PNPM_BIN` (e.g. `LT_PNPM_BIN=/usr/local/bin/pnpm lt dev up`).
 
 **Pre-flight guards (exit code 1 each):**
@@ -685,10 +700,16 @@ lt dev test -- --ui spec.ts      # everything after `--` is forwarded to playwri
 | `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL` | Same URLs for Nuxt |
 | `NUXT_PUBLIC_STORAGE_PREFIX` | Project slug |
 | `NUXT_PUBLIC_API_PROXY` | Always `false` under `lt dev` |
+| `NUXT_SESSION_PASSWORD` | The app process's h3 session password — lets a suite tell a stack that can log in from one that 500s on every login, and seal its own cookie to skip the login form |
 | `NSC__MONGOOSE__URI`, `DATABASE_URL` | Project-namespaced DB URI (when `dbName` known) |
 | `LT_DEV_ACTIVE`, `LT_DEV_DB_NAME` | Marker keys for consumers |
 | `NODE_EXTRA_CA_CERTS` | Path to Caddy's root CA cert (auto-detected) |
 
+Because `NUXT_SESSION_PASSWORD` is a session-sealing key, the bridge file is written with mode
+`0600` (and chmod'ed on every rewrite, since a file created by an older `lt` would otherwise keep
+its `0644`). It is gitignored via `.lt-dev/`. Treat it as credential-bearing when deciding what
+else may be written there.
+
 Additionally, `lt dev test` exports two build-directory keys into the app process it
 spawns. They are **not** written to the bridge file — they scope one run, not the
 project:
@@ -1167,7 +1188,7 @@ lt fullstack add-api [options]
 - `projects/api/` already exists → suggests `lt fullstack init` in a fresh directory
 - no workspace detected at the target path → asks the user to run `lt fullstack init` first
 
-**Side effects:** writes `projects/api/lt.config.json` with the resolved `apiMode` + `frameworkMode`, hoists workspace-scoped `pnpm.overrides` from sub-projects to the root, runs `pnpm install` + `oxfmt` on the new sub-project (unless `--skip-install` is set).
+**Side effects:** writes `projects/api/lt.config.json` with the resolved `apiMode` + `frameworkMode`, hoists workspace-scoped `pnpm.overrides` from sub-projects to the root, runs `pnpm install` + `oxfmt` on the new sub-project (unless `--skip-install` is set). It warns (`[workspace] …`) when two sources set the same pnpm key to different values, when hoisting widens the audit suppressions workspace-wide, or when it overwrites a value an earlier run hoisted from the other sub-project; the warnings do not change the exit code and are repeated at the end of the run.
 
 **Configuration:** Reads `commands.fullstack.*` (same keys as `lt fullstack init`).
 
@@ -1200,7 +1221,7 @@ lt fullstack add-app [options]
 - `projects/app/` already exists → suggests `lt fullstack init` in a fresh directory
 - no workspace detected at the target path → asks the user to run `lt fullstack init` first
 
-**Side effects:** patches `projects/app/.env` with a project-specific `NUXT_PUBLIC_STORAGE_PREFIX`, optionally vendorizes `nuxt-extensions` into `app/core/`, hoists workspace-scoped `pnpm.overrides`, runs `pnpm install` + `oxfmt` on the new sub-project (unless `--skip-install` is set).
+**Side effects:** patches `projects/app/.env` with a project-specific `NUXT_PUBLIC_STORAGE_PREFIX`, optionally vendorizes `nuxt-extensions` into `app/core/`, hoists workspace-scoped `pnpm.overrides`, runs `pnpm install` + `oxfmt` on the new sub-project (unless `--skip-install` is set). It warns (`[workspace] …`) when two sources set the same pnpm key to different values, when hoisting widens the audit suppressions workspace-wide, or when it overwrites a value an earlier run hoisted from the other sub-project; the warnings do not change the exit code and are repeated at the end of the run.
 
 **Configuration:** Reads `commands.fullstack.*` (same keys as `lt fullstack init`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.44.0",
+  "version": "1.46.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -77,7 +77,13 @@
     "turndown-plugin-gfm": "1.0.2",
     "typescript": "6.0.3"
   },
+  "//devDependencies": {
+    "@emnapi/core": "Not imported by this CLI. @napi-rs/wasm-runtime 1.x moved @emnapi/core and @emnapi/runtime from dependencies to peerDependencies (napi-rs#3174), and the only path to them here is dev-only AND optional: eslint-plugin-import-x / jest-resolve > unrs-resolver > @unrs/resolver-binding-wasm32-wasi (cpu: wasm32) > @napi-rs/wasm-runtime. npm >= 11.5.0 (arborist 9.1.3) prunes nodes that are both peer and optional from the ideal tree, so it never writes them to the lockfile — while npm <= 11.4 still demands them and fails npm ci with \"Missing: @emnapi/core@1.11.3 from lock file\". Declaring them here is the remedy arborist's own source comment names: an optional peer stops being optional once a root dependency requires it, so both npm generations then agree. Verified: npm ci passes on npm 10 and 11.6, and npm install no longer strips the entries. Remove once @napi-rs/wasm-runtime declares them in peerDependenciesMeta as optional, or once npm >= 11.5 is the floor everywhere (GitHub Actions still runs Node 20 = npm 10).",
+    "@emnapi/runtime": "Same as @emnapi/core."
+  },
   "devDependencies": {
+    "@emnapi/core": "^1.11.3",
+    "@emnapi/runtime": "^1.11.3",
     "@lenne.tech/eslint-config-ts": "2.3.0",
     "@lenne.tech/npm-package-helper": "0.0.12",
     "@types/ejs": "3.1.5",