@lenne.tech/cli 1.48.0 → 1.50.0

package/build/lib/dev-prune.js

@@ -43,6 +43,7 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const dev_project_1 = require("./dev-project");
+const dev_state_1 = require("./dev-state");
 const dev_ticket_1 = require("./dev-ticket");
 /** Branch prefix `lt ticket start` creates worktrees on. */
 const TICKET_BRANCH_PREFIX = 'feat/';
@@ -188,9 +189,15 @@ function planOrphanTicketDbSweep(args) {
  * never auto-dropped).
  */
 function planRegistryPrune(registry) {
-    return Object.entries(registry.projects)
-        .filter(([, entry]) => entry.path && !(0, fs_1.existsSync)(entry.path))
-        .map(([key]) => key);
+    return (Object.entries(registry.projects)
+        // A relative stored path is not evidence of anything: `existsSync` resolves
+        // it against the current process's cwd, so a perfectly live project reads as
+        // gone from any other directory — and pruning it reclaims its slug and its
+        // reserved internal ports for the next project that asks. "Cannot verify" is
+        // not "absent"; these are left alone until a registry write from inside the
+        // project replaces the path with an absolute one.
+        .filter(([, entry]) => (0, dev_state_1.isVerifiablePath)(entry.path) && !(0, fs_1.existsSync)(entry.path))
+        .map(([key]) => key));
 }
 /**
  * Orphaned smoke-test databases. The `/lt-dev:fullstack:smoke-test` command
@@ -218,12 +225,15 @@ function planSmokeTestDbSweep(args) {
     const entries = Object.entries(registry.projects);
     const smokeRunLive = entries.some(([key, entry]) => (key === exports.SMOKE_TEST_DB_PREFIX || key.startsWith(`${exports.SMOKE_TEST_DB_PREFIX}-`)) &&
         entry.path &&
-        (0, fs_1.existsSync)(entry.path));
+        (!(0, dev_state_1.isVerifiablePath)(entry.path) || (0, fs_1.existsSync)(entry.path)));
     if (smokeRunLive)
         return [];
     const protectedNames = new Set();
     for (const [, entry] of entries) {
-        if (entry.dbName && entry.path && (0, fs_1.existsSync)(entry.path)) {
+        // `!isVerifiablePath` → we cannot prove the checkout is gone, so the database
+        // keeps its protection. Erring the other way would expose a live project's DB
+        // to the orphan sweep on the strength of a path we know we cannot read.
+        if (entry.dbName && entry.path && (!(0, dev_state_1.isVerifiablePath)(entry.path) || (0, fs_1.existsSync)(entry.path))) {
             protectedNames.add(entry.dbName);
             protectedNames.add((0, dev_project_1.deriveTestDbName)(entry.dbName));
         }

package/build/lib/dev-service.js

@@ -51,6 +51,8 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const caddy_1 = require("./caddy");
+const dev_process_1 = require("./dev-process");
+const platform_1 = require("./platform");
 /**
  * Resolve the user's home directory in a test-overridable way.
  *
@@ -139,12 +141,12 @@ function installService() {
                 ok: false,
             };
         }
-        const caddyBin = opts.caddyBin || (yield resolveCaddyBin());
+        const caddyBin = opts.caddyBin || (yield resolveCaddyBin(opts.lookup));
         if (!caddyBin) {
             return {
                 bootstrapped: false,
                 created: false,
-                message: 'caddy not found on PATH. Install with `brew install caddy` (macOS) or your package manager (Linux).',
+                message: caddyMissingMessage(),
                 ok: false,
             };
         }
@@ -249,14 +251,19 @@ StandardError=append:${cfg.errFile}
 WantedBy=default.target
 `;
 }
-/** Resolve the absolute path of `caddy` via `which` so launchd has a guaranteed path. */
+/**
+ * Absolute path of `caddy`, so launchd/systemd get a guaranteed path rather than
+ * a PATH lookup in an environment they do not share with the user's shell.
+ *
+ * Resolved in-process instead of by spawning `which`: there is no `which` on
+ * Windows, and `where.exe` prints every match rather than the first. The async
+ * signature is kept because callers await it and a future platform may need to
+ * ask something that does spawn.
+ */
 function resolveCaddyBin() {
-    return __awaiter(this, void 0, void 0, function* () {
-        const r = yield activeRunner('which', ['caddy']);
-        if (!r.ok)
-            return undefined;
-        const line = r.stdout.split('\n').find((s) => s.trim().length > 0);
-        return line ? line.trim() : undefined;
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a;
+        return (_a = (0, platform_1.findExecutable)('caddy', options)) !== null && _a !== void 0 ? _a : undefined;
     });
 }
 /** Inject a custom runner (tests). Pass `null` to reset to the real spawner. */
@@ -315,6 +322,16 @@ function waitForServiceReady() {
         return false;
     });
 }
+/** Install hint for the current platform — `brew` is not advice on Linux or Windows. */
+function caddyMissingMessage() {
+    if (process.platform === 'darwin') {
+        return 'caddy not found on PATH. Install with `brew install caddy`.';
+    }
+    if (process.platform === 'win32') {
+        return 'caddy not found on PATH. Install with `winget install CaddyServer.Caddy` or `scoop install caddy`.';
+    }
+    return 'caddy not found on PATH. Install it with your package manager.';
+}
 function defaultShellRunner(cmd, args) {
     return new Promise((resolve) => {
         var _a, _b;
@@ -396,13 +413,10 @@ function installLinux(paths, changed, existed) {
         };
     });
 }
+/** See `caddy.ts#caddyDaemonRunning` for why this is not a `curl` any more. */
 function pingCaddyAdmin() {
-    return new Promise((resolve) => {
-        const child = (0, child_process_1.spawn)('curl', ['-fsS', '-o', '/dev/null', '--max-time', '1', 'http://127.0.0.1:2019/config/'], {
-            stdio: ['ignore', 'ignore', 'ignore'],
-        });
-        child.on('error', () => resolve(false));
-        child.on('close', (code) => resolve(code === 0));
+    return __awaiter(this, void 0, void 0, function* () {
+        return (yield (0, dev_process_1.httpStatus)('http://127.0.0.1:2019/config/', 1000)) !== null;
     });
 }
 function sleep(ms) {

package/build/lib/dev-state.js

@@ -18,6 +18,7 @@ exports.clearSession = clearSession;
 exports.detectSlugConflict = detectSlugConflict;
 exports.isPidAlive = isPidAlive;
 exports.isValidPid = isValidPid;
+exports.isVerifiablePath = isVerifiablePath;
 exports.loadRegistry = loadRegistry;
 exports.loadSession = loadSession;
 exports.sameRealPath = sameRealPath;
@@ -142,13 +143,33 @@ function clearSession(root, sessionFile = SESSION_FILE) {
  */
 function detectSlugConflict(slug, root) {
     const entry = loadRegistry().projects[slug];
-    if (!(entry === null || entry === void 0 ? void 0 : entry.path) || sameRealPath(entry.path, root))
+    // A relative stored path cannot be compared to anything: its base is lost, so
+    // it names a different directory from every cwd. Entries like that were written
+    // by `lt fullstack init` before the path was absolutised, and comparing one
+    // produced "slug 't-5' is also registered to another checkout: t-5". Claiming a
+    // conflict we cannot establish is worse than staying quiet — the next registry
+    // write from inside the project repairs the entry anyway.
+    if (!(entry === null || entry === void 0 ? void 0 : entry.path) || !isVerifiablePath(entry.path) || sameRealPath(entry.path, root))
         return null;
     const session = loadSession(entry.path);
     const otherSessionAlive = !!session && [session.pids.api, session.pids.app].some((p) => typeof p === 'number' && isPidAlive(p));
     return { otherPath: entry.path, otherSessionAlive };
 }
-/** Check whether a process with the given PID is currently alive. */
+/**
+ * Check whether a process with the given PID is currently alive.
+ *
+ * Signal 0 delivers nothing; it only asks the kernel whether the target exists
+ * and may be signalled. The two failures mean opposite things, and collapsing
+ * them was a bug:
+ *
+ * - `ESRCH` — no such process. Dead.
+ * - `EPERM` — **the process EXISTS**, this user may not signal it.
+ *
+ * Reading `EPERM` as dead made `classifyComponentHealth` report a running
+ * component as `dead`, so `lt dev up` killed and restarted a healthy stack.
+ * Reproducible on any POSIX machine: `process.kill(1, 0)` throws `EPERM`.
+ * More likely on Windows, where an elevated shell is ordinary.
+ */
 function isPidAlive(pid) {
     if (!isValidPid(pid))
         return false;
@@ -156,14 +177,29 @@ function isPidAlive(pid) {
         process.kill(pid, 0);
         return true;
     }
-    catch (_a) {
-        return false;
+    catch (err) {
+        return (err === null || err === void 0 ? void 0 : err.code) === 'EPERM';
     }
 }
 /** Validate a PID — positive integer, within plausible range. */
 function isValidPid(pid) {
     return typeof pid === 'number' && Number.isInteger(pid) && pid > 0 && pid < 4194304;
 }
+/**
+ * True when a stored registry path can be checked against the file system.
+ *
+ * A relative path in the registry has lost the directory it was relative TO, so
+ * `existsSync` / `realpathSync` answer about whatever directory the current
+ * process started in. Every such answer is meaningless, and two of them were
+ * actively harmful: `planRegistryPrune` reclaimed a live project's slug and
+ * reserved ports, and `detectSlugConflict` reported a project as colliding with
+ * itself. Legacy entries are therefore treated as "cannot determine" rather than
+ * as "gone"; running any `lt dev` command inside the project rewrites the entry
+ * with an absolute path and clears the condition.
+ */
+function isVerifiablePath(storedPath) {
+    return !!storedPath && (0, path_1.isAbsolute)(storedPath);
+}
 /** Load the central registry; returns an empty one if missing or unreadable. */
 function loadRegistry() {
     if (!(0, fs_1.existsSync)(REGISTRY_PATH))

package/build/lib/dev-test-session.js

@@ -1,37 +1,14 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
-exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
-exports.autoShardCount = autoShardCount;
-exports.bringUpTestSession = bringUpTestSession;
-exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
-exports.buildTestAppEnv = buildTestAppEnv;
-exports.hasTestSession = hasTestSession;
-exports.isStackServing = isStackServing;
-exports.resolveTestSession = resolveTestSession;
-exports.runShardedTestSession = runShardedTestSession;
-exports.shardReportDir = shardReportDir;
-exports.tearDownAllTestSessions = tearDownAllTestSessions;
-exports.tearDownTestSession = tearDownTestSession;
-exports.testAppEntryCandidates = testAppEntryCandidates;
-exports.unreachableStackError = unreachableStackError;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
  * Brings up a SECOND, fully separate stack (own URLs, own internal ports,
  * own Caddy block, own database) that runs PARALLEL to — and never touches —
  * the developer's `lt dev up` session. Used to run the Playwright E2E suite
- * against a clean, dedicated database so a developer can keep working in their
- * own environment while tests run, and so a test run never pollutes dev data.
+ * against a dedicated database so a developer can keep working in their own
+ * environment while tests run, and so a test run never pollutes dev data. That
+ * database outlives the run — the CLI never drops it — so the API is migrated
+ * before it starts, like every other environment (DEV-3289).
  *
  * Topology (for slug `svl`):
  *   - dev session  : svl.localhost / api.svl.localhost   → db `<…>-local`
@@ -52,7 +29,33 @@ exports.unreachableStackError = unreachableStackError;
  * Teardown is idempotent and residue-free (processes, Caddy block, env bridge,
  * session file, registry entry), so a stale session is always safely reclaimed.
  */
-const child_process_1 = require("child_process");
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
+exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
+exports.autoShardCount = autoShardCount;
+exports.bringUpTestSession = bringUpTestSession;
+exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
+exports.buildTestAppEnv = buildTestAppEnv;
+exports.hasTestSession = hasTestSession;
+exports.isStackServing = isStackServing;
+exports.migrationFailedError = migrationFailedError;
+exports.resolveTestSession = resolveTestSession;
+exports.runShardedTestSession = runShardedTestSession;
+exports.shardReportDir = shardReportDir;
+exports.startTestApi = startTestApi;
+exports.tearDownAllTestSessions = tearDownAllTestSessions;
+exports.tearDownTestSession = tearDownTestSession;
+exports.testAppEntryCandidates = testAppEntryCandidates;
+exports.unreachableStackError = unreachableStackError;
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -65,6 +68,7 @@ const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_process_1 = require("./dev-process");
 const dev_project_1 = require("./dev-project");
+const platform_1 = require("./platform");
 const dev_state_1 = require("./dev-state");
 /**
  * Make sure the Playwright browser build the app's OWN playwright version needs
@@ -79,12 +83,22 @@ const dev_state_1 = require("./dev-state");
  * fails (offline), the suite still runs and Playwright's own error explains it.
  */
 function ensurePlaywrightBrowsers(appDir, pm, logInfo) {
+    const note = () => {
+        logInfo === null || logInfo === void 0 ? void 0 : logInfo('playwright install chromium failed — continuing (the suite reports missing browsers itself).');
+    };
     try {
         const args = pm.exec('playwright', ['install', 'chromium']);
-        (0, child_process_1.execFileSync)(pm.bin, args, { cwd: appDir, stdio: 'ignore', timeout: 300000 });
+        // `spawnCmdSync` (spawnSync) does NOT throw on a non-zero exit, unlike the
+        // `execFileSync` this replaced — so the status is checked explicitly.
+        // Without it the failure would be silent and the suite would die later on a
+        // missing browser, which reads as a broken spec rather than a missing install.
+        const result = (0, platform_1.spawnCmdSync)(pm.bin, args, { cwd: appDir, stdio: 'ignore', timeout: 300000 });
+        if (result.error || result.status !== 0) {
+            note();
+        }
     }
     catch (_a) {
-        logInfo === null || logInfo === void 0 ? void 0 : logInfo('playwright install chromium failed — continuing (the suite reports missing browsers itself).');
+        note();
     }
 }
 const TEST_API_LOG = 'api.test.log';
@@ -99,12 +113,13 @@ const TEST_PORT_BASE = 4500;
  * `systemSetup.initialAdmin.*` and seeds the admin ONCE on an empty DB (it never
  * overwrites an existing admin), so a set-up system exists before the suite runs.
  * A fresh template project's standard auth E2E specs assume such a system — they
- * do no self-setup — so without this they fail LOCALLY on the empty per-run DB.
+ * do no self-setup — so without this they fail LOCALLY on a test DB that has no
+ * users yet (its first run, or after a global-setup reset it).
  * These are the exact values the lt-monorepo template CI uses
  * (`.gitlab-ci.yml` / `.github/workflows/test.yml`), keeping CI ↔ local parity.
  *
- * Injected ONLY into the `lt dev test` API process (its DB is fresh + discarded
- * per run), NEVER into `lt dev up` — no surprise admin in the persistent dev DB.
+ * Injected ONLY into the `lt dev test` API process (its DB is the dedicated
+ * `<…>-test` one), NEVER into `lt dev up` — no surprise admin in the dev DB.
  */
 exports.TEST_INITIAL_ADMIN_ENV = {
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL: 'ci-admin@test.com',
@@ -235,11 +250,14 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 taken.add(apiPort);
             appPort = layout.appDir ? (0, dev_state_1.allocateInternalPort)(TEST_PORT_BASE, taken) : undefined;
             const portsToCheck = [apiPort, appPort].filter((p) => typeof p === 'number');
-            const snap = yield (0, dev_process_1.listenSnapshot)(portsToCheck);
+            const probe = yield (0, dev_process_1.probePorts)(portsToCheck);
             for (const p of portsToCheck) {
-                const r = snap.get(p);
-                if (r)
-                    throw new Error(`test internal port ${p} already in use by ${r.command} (pid ${r.pid}).`);
+                if (!probe.bound.has(p))
+                    continue;
+                const owner = probe.owners.get(p);
+                throw new Error(owner
+                    ? `test internal port ${p} already in use by ${owner.command} (pid ${owner.pid}).`
+                    : `test internal port ${p} already in use by an unidentified process.`);
             }
             // Reserve immediately (still under the lock) so a concurrent run sees these
             // ports as taken. PIDs are written to the session file after spawn, below.
@@ -276,7 +294,11 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             log.info(`  app: ${appUrl}  →  127.0.0.1:${appPort}`);
         if (apiUrl)
             log.info(`  api: ${apiUrl}  →  127.0.0.1:${apiPort}`);
-        log.info(`  db:  mongodb://127.0.0.1/${dbName}  (reset before the suite by Playwright global-setup)`);
+        // No claim about resetting here: the CLI never drops this DB, and whether a
+        // project's global-setup does is the project's business. The claim used to be
+        // printed unconditionally and sent a diagnosis looking for a reset that never
+        // happened instead of at the un-migrated DB (DEV-3289).
+        log.info(`  db:  mongodb://127.0.0.1/${dbName}`);
         log.info('');
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
@@ -294,43 +316,23 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // hands it to the Playwright child as well.
         const appEnv = buildTestAppEnv(devEnv.app.env);
         const pids = {};
-        // --- API: compiled (`node dist`) for stability; fall back to the project's
-        // own dev start script. `skipBuild` (sibling shards) reuses the dist the
-        // first shard produced. Per-component PM detection mirrors `lt dev up`:
-        // a monorepo with an npm api and a pnpm app must drive each correctly. ---
+        // --- API: compiled (`node dist`) for stability, migrated first; falls back to
+        // the project's own start script (see `startTestApi`). ---
         if (layout.apiDir && apiPort) {
-            const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
-            let build = 0;
-            if (!skipBuild) {
-                log.info(log.dim('Building API (compiled, for stable long runs) …'));
-                build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: layout.apiDir, env: process.env });
-            }
-            const entry = (0, dev_api_launch_1.findCompiledEntry)(layout.apiDir);
-            // Seed a throwaway initial admin into the fresh, isolated test DB so the
-            // standard auth E2E specs run against a set-up system — locally exactly like
-            // the lt-monorepo template CI. Defaults first so an explicitly inherited
+            // Seed a throwaway initial admin into the isolated test DB so the standard
+            // auth E2E specs run against a set-up system — locally exactly like the
+            // lt-monorepo template CI. Defaults first so an explicitly inherited
             // `NSC__…INITIAL_ADMIN__…` still wins (deliberate override respected). Only
             // reached from `lt dev test` — `lt dev up` never calls bringUpTestSession.
             const apiEnv = Object.assign(Object.assign(Object.assign({}, exports.TEST_INITIAL_ADMIN_ENV), devEnv.api.env), { NODE_ENV: 'local' });
-            let apiSpawn;
-            if (build === 0 && entry) {
-                // Runtime follows the PROJECT, never a hardcoded default: a `nest-base` API
-                // bundles with `Bun.build({ target: 'bun' })` and dies under node with
-                // "__require is not a function" (DEV-3208).
-                apiSpawn = (0, dev_process_1.spawnDetached)((0, dev_api_launch_1.resolveApiRuntime)(layout.apiDir), [entry], {
-                    cwd: layout.apiDir,
-                    env: apiEnv,
-                    logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
-                });
-            }
-            else {
-                log.warn(`compiled API not available — falling back to \`${apiPm.bin} start\` (ts-node).`);
-                apiSpawn = (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
-                    cwd: layout.apiDir,
-                    env: apiEnv,
-                    logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
-                });
-            }
+            const apiSpawn = yield startTestApi({
+                apiDir: layout.apiDir,
+                apiEnv,
+                dbName,
+                log,
+                logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
+                skipBuild,
+            });
             if (apiSpawn)
                 pids.api = apiSpawn.pid;
         }
@@ -416,10 +418,19 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // left to wait for. Being wrong here costs nothing — the timeout still bounds
         // the wait, so this only ever makes the abort arrive sooner.
         const gone = (pid) => pid === undefined || !(0, dev_state_1.isPidAlive)(pid);
+        // The probes go to the LOOPBACK address, not the public name: this is Node
+        // asking, and on Windows `*.localhost` does not resolve for Node at all — the
+        // waits would time out against a stack that is up, and `bringUpTestSession`
+        // aborts before Playwright ever starts. Probing the port directly also measures
+        // the component rather than the proxy, which is the better question here.
+        // The public name stays in the MESSAGES, because that is what the developer
+        // opens; the loopback pair is printed next to it above.
+        const appProbeUrl = (0, dev_env_1.internalUrl)(appPort) || appUrl;
+        const apiProbeUrl = (0, dev_env_1.internalUrl)(apiPort) || apiUrl;
         // Wait for the test App to answer.
         if (appUrl) {
             log.info(log.dim(`Waiting for ${appUrl} …`));
-            const appReady = yield (0, dev_process_1.waitForHttp)(appUrl, 90000, isStackServing, () => gone(pids.app));
+            const appReady = yield (0, dev_process_1.waitForHttp)(appProbeUrl, 90000, isStackServing, () => gone(pids.app));
             if (!appReady)
                 throw unreachableStackError('App', appUrl, appLogPath);
         }
@@ -429,7 +440,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // `ensureApiReachableOrSkip` guard (the API-readiness race).
         if (apiUrl) {
             log.info(log.dim(`Waiting for ${apiUrl}/meta …`));
-            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
+            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiProbeUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
             if (!apiReady)
                 throw unreachableStackError('API', `${apiUrl}/meta`, apiLogPath);
         }
@@ -515,6 +526,19 @@ function hasTestSession(root) {
 function isStackServing(status) {
     return status > 0 && ![502, 503, 504].includes(status);
 }
+/**
+ * The abort thrown when the test DB cannot be migrated.
+ *
+ * An abort rather than a warning for the same reason as `unreachableStackError`:
+ * a suite run on an un-migrated DB tests a data state no environment has, and
+ * whatever it reports is about the test setup, not about the feature. Unlike the
+ * API's boot, `migrate:up` runs in the foreground, so its output is already on
+ * screen right above this message.
+ */
+function migrationFailedError(dbName, exitCode) {
+    return new Error(`migrate:up failed (exit ${String(exitCode)}) against the test DB "${dbName}" — test API not started, ` +
+        'because a suite on an un-migrated DB tests a state no environment has. The migration output is above.');
+}
 /** Build the dedicated test identity + test DB name for a project. */
 function resolveTestSession(layout, baseIdentity, shardIndex, devDbName) {
     const names = testStackNames(shardIndex);
@@ -599,6 +623,50 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
 function shardReportDir(root, shardIndex) {
     return (0, path_1.join)(root, '.lt-dev', `shard.${shardIndex}.playwright-report`);
 }
+/**
+ * Start the test stack's API: build → apply pending migrations → start the
+ * compiled bundle, or fall back to the project's own `start` script when no
+ * bundle is available.
+ *
+ * The compiled start bypasses that `start` script and therefore the
+ * `migrate:up` it chains in front of the server. The test DB outlives every
+ * run — the CLI never drops it — so without the explicit step here it drifted
+ * behind every environment that does migrate (DEV-3289). The migration runs
+ * with `apiEnv`, the API's own env, so both resolve the same database, and
+ * before the spawn, because the API syncs its indexes against whatever it finds
+ * on boot. A failed migration throws `migrationFailedError`.
+ *
+ * `skipBuild` (sibling shards) reuses the dist the first shard produced but
+ * still migrates: every shard has a database of its own. The fallback does not
+ * migrate itself — the `start` script it runs owns that, exactly as under
+ * `lt dev up`. Per-directory package manager, like `lt dev up`: a monorepo with
+ * an npm API and a pnpm App must drive each with its own.
+ */
+function startTestApi(opts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { apiDir, apiEnv, dbName, log, logFile, skipBuild } = opts;
+        const apiPm = (0, dev_package_manager_1.pickPackageManager)(apiDir);
+        let build = 0;
+        if (!skipBuild) {
+            log.info(log.dim('Building API (compiled, for stable long runs) …'));
+            build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: apiDir, env: process.env });
+        }
+        const entry = (0, dev_api_launch_1.findCompiledEntry)(apiDir);
+        if (build === 0 && entry) {
+            const migration = yield (0, dev_api_launch_1.applyPendingMigrations)({ apiDir, env: apiEnv, pm: apiPm });
+            if (migration.status === 'failed')
+                throw migrationFailedError(dbName, migration.exitCode);
+            if (migration.status === 'skipped')
+                log.info(log.dim(`no migrate:up script — ${dbName} is not migrated`));
+            // Runtime follows the PROJECT, never a hardcoded default: a `nest-base` API
+            // bundles with `Bun.build({ target: 'bun' })` and dies under node with
+            // "__require is not a function" (DEV-3208).
+            return (0, dev_process_1.spawnDetached)((0, dev_api_launch_1.resolveApiRuntime)(apiDir), [entry], { cwd: apiDir, env: apiEnv, logFile });
+        }
+        log.warn(`compiled API not available — falling back to \`${apiPm.bin} start\` (ts-node).`);
+        return (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), { cwd: apiDir, env: apiEnv, logFile });
+    });
+}
 /**
  * Tear down the unsharded test stack AND every sharded stack discovered on disk
  * (`state.test.<i>.json` in `.lt-dev/`). Used by `lt dev test down` so a

package/build/lib/dev-ticket.js

@@ -57,6 +57,7 @@ const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_project_1 = require("./dev-project");
 const dev_state_1 = require("./dev-state");
+const platform_1 = require("./platform");
 /** Marker file (under `.lt-dev/`) that tags a worktree with its ticket id. */
 const TICKET_MARKER = 'ticket';
 /** Where ticket databases live. Deliberately loopback-only — never a remote/prod host. */
@@ -281,8 +282,19 @@ function gitRefExists(repoDir, ref) {
  * for fresh scaffolds without a lockfile yet.
  */
 function installWorktreeDeps(dir) {
+    var _a;
     const pm = (0, dev_package_manager_1.pickPackageManager)(dir);
-    (0, child_process_1.execFileSync)(pm.bin, pm.installArgs, { cwd: dir, stdio: 'inherit' });
+    // `spawnCmdSync` (spawnSync) does NOT throw on a non-zero exit, unlike the
+    // `execFileSync` this replaced. The contract here is to throw: the only caller
+    // (`lt ticket start`) catches and warns, and swallowing the failure would hand
+    // the developer a half-installed worktree with no hint that anything went wrong.
+    const result = (0, platform_1.spawnCmdSync)(pm.bin, pm.installArgs, { cwd: dir, stdio: 'inherit' });
+    if (result.error) {
+        throw result.error;
+    }
+    if (result.status !== 0) {
+        throw new Error(`${pm.bin} ${pm.installArgs.join(' ')} exited with ${(_a = result.status) !== null && _a !== void 0 ? _a : 'a signal'}`);
+    }
 }
 /**
  * True for ticket ids whose derived database would collide with a project-level

package/build/lib/fail-run.js

@@ -20,6 +20,17 @@ exports.failRun = failRun;
  * buffered output, including the spinner's own failure message, which is the one
  * line the operator actually needs.
  *
+ * That choice carries a precondition worth stating, because it was violated:
+ * setting `process.exitCode` only ends the process once **the event loop drains**,
+ * and `bin/lt` has no terminal `process.exit()` after `run()`. A running ora
+ * spinner holds the loop open on two counts — its `setInterval` for the animation
+ * and the `stdin.resume()` its stdin discarder performs. So a command that called
+ * `failRun` and returned while a spinner was still spinning did not exit at all:
+ * no message, no prompt back, and the terminal left in raw mode. The remedy is to
+ * stop the spinner, NOT to switch this helper to `process.exit()` — that would
+ * trade a hang for the truncated-output bug this helper exists to avoid.
+ * `__tests__/spinner-lifetime.test.ts` enforces the spinner half.
+ *
  * **Guarded by `fromGluegunMenu`**, like the CLI's other exit-code call sites
  * (`dev test`, `dev tunnel`, `tools ocr`, `workspace-integration`): inside the
  * interactive `lt` menu a command is one step of a longer session, and failing

package/build/lib/heal-vendor-migrate-store.js

@@ -90,9 +90,10 @@ const ts = __importStar(require("typescript"));
  * Detection runs on the TypeScript AST, not on regex-stripped text. A regex
  * "lexer" has no string/template/regex-literal state, so a `/*` or `//` inside a
  * literal earlier in the file silently erased the guard and triggered the very
- * overwrite this function must avoid. `lib/strip-comments.ts` solves the comment
- * half properly (TS scanner) and would have been the right reuse; the AST solves
- * comments AND nesting in one step, and recognises a backtick require for free.
+ * overwrite this function must avoid. Scanning is not enough either: a standalone
+ * `ts.createScanner` loop desynchronises on the first interpolating template
+ * literal (that is what retired `lib/strip-comments.ts`). The AST solves comments
+ * AND nesting in one step, and recognises a backtick require for free.
  *
  * ## Recoverability
  *

package/build/lib/hoist-workspace-pnpm-config.js

@@ -32,11 +32,16 @@ const fs_utils_1 = require("./fs-utils");
  * starter's assessed-advisory allowlist is destroyed rather than merely ignored,
  * and the generated project's very first pipeline goes red on an advisory that
  * was already justified upstream.
+ *
+ * `peerDependencyRules` (`{ allowedVersions: {...}, ignoreMissing: [...] }`) is
+ * the same trap one step later: the starter scope-allows known-stale peer ranges
+ * there, and without the hoist the root `check:peers` step fails the first
+ * `pnpm run check` of every generated project.
  */
 const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
-/** Objects whose values are arrays to be unioned, not replaced. */
-const NESTED_ARRAY_FIELDS = ['auditConfig'];
+/** Objects whose inner arrays are unioned and inner maps merged, not replaced. */
+const NESTED_ARRAY_FIELDS = ['auditConfig', 'peerDependencyRules'];
 /** The union of all three, in declaration order. Declared here, with its inputs,
  * because the comment-carrying helpers below default their `fields` parameter to it. */
 const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
@@ -611,11 +616,13 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
         const subArr = Array.isArray(subValue) ? subValue : [];
         return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
     }
-    // Nested (`auditConfig.ignoreGhsas` / `.ignoreCves`): union each inner array
-    // instead of letting the sub-project's object replace the root's. A plain
-    // key-by-key merge would drop every advisory the root had already justified.
+    // Nested (`auditConfig.ignoreGhsas`, `peerDependencyRules.allowedVersions`, …):
+    // union each inner array and merge each inner map instead of letting the
+    // sub-project's object replace the root's. A plain key-by-key merge would drop
+    // every advisory or peer rule the root had already justified.
     if (isNestedArrayField(field)) {
-        const asObj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+        const isMap = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+        const asObj = (v) => (isMap(v) ? v : {});
         const rootObj = asObj(rootValue);
         const subObj = asObj(subValue);
         const merged = Object.assign({}, rootObj);
@@ -625,6 +632,10 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
                 const b = Array.isArray(value) ? value : [];
                 merged[key] = Array.from(new Set([...a, ...b])).sort((x, y) => x.localeCompare(y));
             }
+            else if (isMap(value) && isMap(merged[key])) {
+                const inner = Object.assign(Object.assign({}, merged[key]), value);
+                merged[key] = Object.fromEntries(Object.entries(inner).sort(([x], [y]) => x.localeCompare(y)));
+            }
             else {
                 merged[key] = value;
             }