@lenne.tech/cli 1.50.3 → 1.50.5

package/build/commands/dev/doctor.js

@@ -179,52 +179,58 @@ const DoctorCommand = {
             //     "matches the canonical CLI version" for a project whose `check` was
             //     completely broken — and doctor is the tool people reach for exactly
             //     then.
-            try {
-                const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
-                const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
-                const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
-                const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
-                if (filesystem.exists(bundledCheck)) {
-                    const missing = [];
-                    const drifted = [];
-                    for (const { rel, source } of resolveCopySet(bundledCheck)) {
-                        const target = j(layout.root, rel);
-                        if (!filesystem.exists(target)) {
-                            missing.push(rel);
+            //
+            //     Workspace roots only: a standalone starter project carries its own
+            //     `scripts/check.mjs`, which is not a drifted copy of the root wrapper,
+            //     and `lt fullstack update` deliberately leaves it alone.
+            if (layout.workspace) {
+                try {
+                    const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
+                    const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
+                    const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
+                    const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
+                    if (filesystem.exists(bundledCheck)) {
+                        const missing = [];
+                        const drifted = [];
+                        for (const { rel, source } of resolveCopySet(bundledCheck)) {
+                            const target = j(layout.root, rel);
+                            if (!filesystem.exists(target)) {
+                                missing.push(rel);
+                            }
+                            else if (read(target, 'utf8') !== read(source, 'utf8')) {
+                                drifted.push(rel);
+                            }
                         }
-                        else if (read(target, 'utf8') !== read(source, 'utf8')) {
-                            drifted.push(rel);
+                        // A missing module only breaks `check` when the project's wrapper is the
+                        // canonical one that imports it (or the wrapper itself is missing). An
+                        // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
+                        // still runs — calling that "cannot start" would be a false alarm.
+                        const wrapperDrifted = drifted.includes('scripts/check.mjs');
+                        // A project wrapper that heal refuses to replace (newer release, or the same
+                        // release with other content) is not drift to fix: pointing at
+                        // `lt fullstack update` there would recommend a no-op or a downgrade.
+                        const kept = keptWrapperReason(layout.root, bundledCheck);
+                        if (kept) {
+                            line('INFO', colors.cyan, `check wrapper: ${kept}`);
+                        }
+                        else if (missing.length > 0 && !wrapperDrifted) {
+                            line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
+                            line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
+                        }
+                        else if (drifted.length > 0) {
+                            const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
+                            const verb = outdated.length === 1 ? 'differs' : 'differ';
+                            line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
+                            line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
+                        }
+                        else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
+                            line('OK', colors.green, 'check wrapper matches the canonical CLI version');
                         }
-                    }
-                    // A missing module only breaks `check` when the project's wrapper is the
-                    // canonical one that imports it (or the wrapper itself is missing). An
-                    // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
-                    // still runs — calling that "cannot start" would be a false alarm.
-                    const wrapperDrifted = drifted.includes('scripts/check.mjs');
-                    // A project wrapper that heal refuses to replace (newer release, or the same
-                    // release with other content) is not drift to fix: pointing at
-                    // `lt fullstack update` there would recommend a no-op or a downgrade.
-                    const kept = keptWrapperReason(layout.root, bundledCheck);
-                    if (kept) {
-                        line('INFO', colors.cyan, `check wrapper: ${kept}`);
-                    }
-                    else if (missing.length > 0 && !wrapperDrifted) {
-                        line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
-                        line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
-                    }
-                    else if (drifted.length > 0) {
-                        const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
-                        const verb = outdated.length === 1 ? 'differs' : 'differ';
-                        line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
-                        line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
-                    }
-                    else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
-                        line('OK', colors.green, 'check wrapper matches the canonical CLI version');
                     }
                 }
-            }
-            catch (_a) {
-                /* best-effort diagnostics */
+                catch (_a) {
+                    /* best-effort diagnostics */
+                }
             }
             // 7.6 oxlint config filename: oxlint only auto-discovers `.oxlintrc.json`.
             //     Apps from the template before the rename carry `oxlint.json`, whose

package/build/commands/fullstack/update.js

@@ -195,8 +195,13 @@ const NewCommand = {
         // pre-existing projects predate it. This idempotently installs the bundled
         // wrapper (and rewrites the root `check`/`check:raw`) so a migrated project
         // gets the quiet, report-driven check too. No-op once already wired.
+        //
+        // Only at a workspace root: the bundled file is lt-monorepo's ROOT wrapper.
+        // `projects/api` and standalone starter projects ship their own, unmarked
+        // `scripts/check.mjs`, which heal reads as legacy — run from there, this
+        // replaced the API's check and the starter's tests failed on its content.
         const checkAsset = (0, path_1.join)(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
-        const changedCheck = (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset);
+        const changedCheck = isWorkspace ? (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset) : [];
         if (changedCheck.length > 0) {
             info('');
             // A skip entry is NOT a success — it means the wrapper stayed on its old

package/build/extensions/api-mode.js

@@ -649,8 +649,12 @@ class ApiMode {
      * For non-aliased imports, returns the identifier as-is.
      */
     resolveImportAlias(identifier) {
-        const asMatch = identifier.match(/^\S+\s+as\s+(\S+)$/);
-        return asMatch ? asMatch[1] : identifier;
+        // An inline `type` modifier is not part of the name: searching the code for the
+        // literal "type LookupAddress" found nothing, so a used specifier got pruned
+        // (nest-server's outbound-url.helper.ts → TS2304 in every vendor-mode project).
+        const name = identifier.replace(/^type\s+/, '');
+        const asMatch = name.match(/^\S+\s+as\s+(\S+)$/);
+        return asMatch ? asMatch[1] : name;
     }
     /**
      * Collapse multiple consecutive blank lines into at most one

package/build/extensions/server.js

@@ -50,6 +50,7 @@ const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const cross_env_1 = require("../lib/cross-env");
+const express_type_imports_1 = require("../lib/express-type-imports");
 const markdown_table_1 = require("../lib/markdown-table");
 const migrate_scripts_1 = require("../lib/migrate-scripts");
 const module_specifiers_1 = require("../lib/module-specifiers");
@@ -1229,12 +1230,10 @@ class Server {
             // and type imports were erased before runtime. In vendor-mode, vitest/vite
             // evaluates the TypeScript source directly and chokes with:
             //   "The requested module 'express' does not provide an export named 'Response'"
-            // Fix: convert `import { Request, Response } from 'express'` (and variants
-            // with NextFunction etc.) to type-only imports wherever they appear in the
-            // vendored core. This is safe because the core code uses Request/Response
-            // only as type annotations — any runtime `new Request(...)` calls refer
-            // to the global Fetch API Request, not the express one.
-            const expressImportRegex = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"]\s*;?\s*$/gm;
+            // Fix: mark the type names in every `import { … } from 'express'` of the
+            // vendored core as type-only. Runtime exports (`json`, `urlencoded`, `Router`
+            // …) stay value imports — see src/lib/express-type-imports.ts for why a
+            // blanket `import type` broke the build (nest-server 11.42.4+).
             // `glob`, not `filesystem.find`: jetpack builds its matcher by concatenating the
             // RESOLVED base path in front of the pattern, and minimatch reads a backslash
             // inside a PATTERN as an escape. On Windows `C:\…\core` + `**/*.ts` therefore
@@ -1249,16 +1248,7 @@ class Server {
                 const content = filesystem.read(absPath) || '';
                 if (!content.includes("from 'express'") && !content.includes('from "express"'))
                     continue;
-                const patched = content.replace(expressImportRegex, (_match, names) => {
-                    const cleanNames = names
-                        .split(',')
-                        .map((n) => n.trim())
-                        .filter((n) => n.length > 0 && n !== 'type')
-                        // Strip any pre-existing 'type ' prefix on individual names
-                        .map((n) => n.replace(/^type\s+/, ''))
-                        .join(', ');
-                    return `import type { ${cleanNames} } from 'express';`;
-                });
+                const patched = (0, express_type_imports_1.rewriteExpressImportsToTypeOnly)(content);
                 if (patched !== content) {
                     filesystem.write(absPath, patched);
                 }

package/build/lib/caddy.js

@@ -42,6 +42,8 @@ const path_1 = require("path");
 const dev_process_1 = require("./dev-process");
 const platform_1 = require("./platform");
 const CADDYFILE_PATH = process.env.LT_DEV_CADDYFILE || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech', 'Caddyfile');
+/** Upstream connection cap per route — well below the 128 of macOS `somaxconn` (see `renderProjectBlock`). */
+const UPSTREAM_MAX_CONNS = 32;
 const HEADER = '# Managed by `lt dev`. Per-project blocks are bounded by `# >>> lt-dev:<slug> >>>` markers.';
 /** Detect whether `caddy` is on PATH. */
 function caddyAvailable() {
@@ -115,12 +117,27 @@ function removeProjectBlock(slug) {
  *   - `localhost` as Caddy upstream resolves to `::1` first on macOS,
  *     so it would still pick the IPv6 family and miss the IPv4 bind.
  *     Pinning to `127.0.0.1` removes that ambiguity entirely.
+ *
+ * Every upstream is capped at `UPSTREAM_MAX_CONNS` connections. The browser
+ * talks HTTP/2 to Caddy and multiplexes a cold `nuxt dev`'s first page load —
+ * around 800 raw modules — over one connection; Caddy used to fan that out
+ * into one upstream dial per request. The dev server's accept queue
+ * (`somaxconn`, 128 on macOS) overflowed, the excess dials got `connect:
+ * connection reset by peer`, Caddy answered 502, and a page missing a module
+ * never hydrated: the form looked fine and submitted natively. With the cap,
+ * Caddy queues the burst instead (Go's `MaxConnsPerHost` blocks the dial).
+ * `~/.lenneTech/caddy.err.log` held about 51 000 such resets across projects
+ * when this was found (lt-crm DEV-2899).
  */
 function renderProjectBlock(slug, routes) {
     const lines = [`# >>> lt-dev:${slug} >>>`];
     for (const route of routes) {
         lines.push(`${route.hostname} {`);
-        lines.push(`  reverse_proxy 127.0.0.1:${route.upstreamPort}`);
+        lines.push(`  reverse_proxy 127.0.0.1:${route.upstreamPort} {`);
+        lines.push('    transport http {');
+        lines.push(`      max_conns_per_host ${UPSTREAM_MAX_CONNS}`);
+        lines.push('    }');
+        lines.push('  }');
         lines.push('}');
     }
     lines.push(`# <<< lt-dev:${slug} <<<`);

package/build/lib/dev-patches.js

@@ -430,11 +430,14 @@ function patchPlaywrightConfig(file) {
  * identically to a live one: the block would silently never load
  * `.lt-dev/.env` again and Playwright would fall back to `localhost:3001`.
  *
- * Quote style and intra-line whitespace are normalised away because the
- * consumer's formatter owns this file (which direction it flips is
- * project-specific — do not assume). Blind spot to keep in mind: a change
- * that differs ONLY in quotes or whitespace is invisible here, which is
- * what `BRIDGE_VERSION` is for.
+ * Quote style, intra-line whitespace, the padding inside brackets and
+ * trailing commas are normalised away because the consumer's formatter owns
+ * this file (which direction it flips is project-specific — do not assume).
+ * oxfmt at printWidth 80 wraps the bridge imports and adds a trailing comma;
+ * read as a code change, that rewrote playwright.config.ts on every run.
+ * Blind spot to keep in mind: a change that differs ONLY in quotes,
+ * whitespace or trailing commas is invisible here, which is what
+ * `BRIDGE_VERSION` is for.
  */
 function normaliseBridgeBlock(s) {
     return s
@@ -443,6 +446,9 @@ function normaliseBridgeBlock(s) {
         .filter((l) => l !== '' && !l.startsWith('//'))
         .join(' ')
         .replace(/['"]/g, '"')
+        .replace(/,\s*([)\]}])/g, '$1')
+        .replace(/([([{])\s+/g, '$1')
+        .replace(/\s+([)\]}])/g, '$1')
         .replace(/\s+/g, ' ')
         .trim();
 }

package/build/lib/express-type-imports.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Marks the TYPE names in a vendored file's `express` imports as type-only.
+ *
+ * Why it exists: express exports `Request`, `Response`, `NextFunction` & co. as types
+ * only. The npm-mode framework shipped compiled, so those imports were erased before
+ * runtime; vendor mode runs the TypeScript source through vitest/vite, which keeps a
+ * plain `import { Request } from 'express'` and fails with
+ * "The requested module 'express' does not provide an export named 'Request'".
+ *
+ * Why it does not simply rewrite the whole import to `import type`: express also has
+ * runtime exports, and the vendored core imports some of them as values —
+ * `core-body-parser.initializer.ts` (nest-server 11.42.4+) calls `json()` and
+ * `urlencoded()`. A blanket `import type { json, urlencoded }` broke the build of every
+ * generated vendor-mode project with TS1361. So only names that are NOT runtime exports
+ * become type-only; a mixed import keeps its values and gets inline `type` modifiers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteExpressImportsToTypeOnly = rewriteExpressImportsToTypeOnly;
+/**
+ * The runtime (value) exports of express — `lib/express.js`, v4 and v5. Everything
+ * else a TypeScript file can import from 'express' only exists in its type declarations.
+ */
+const EXPRESS_VALUE_EXPORTS = new Set([
+    'application',
+    'json',
+    'query',
+    'raw',
+    'request',
+    'response',
+    'Route',
+    'Router',
+    'static',
+    'text',
+    'urlencoded',
+]);
+// `[ \t]*`, not `\s*`, after the module name: `\s*$` under the `m` flag also swallowed
+// the line break, and with it the blank line that usually follows the imports.
+const EXPRESS_NAMED_IMPORT = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"][ \t]*;?[ \t]*$/gm;
+/** Rewrites every `import { … } from 'express'` in `content`; returns it unchanged when nothing applies. */
+function rewriteExpressImportsToTypeOnly(content) {
+    return content.replace(EXPRESS_NAMED_IMPORT, (_match, names) => {
+        const specifiers = names
+            .split(',')
+            .map((n) => n.trim().replace(/^type\s+/, ''))
+            .filter((n) => n.length > 0);
+        const isValue = (specifier) => EXPRESS_VALUE_EXPORTS.has(specifier.split(/\s+as\s+/)[0].trim());
+        if (!specifiers.some(isValue)) {
+            return `import type { ${specifiers.join(', ')} } from 'express';`;
+        }
+        const marked = specifiers.map((s) => (isValue(s) ? s : `type ${s}`));
+        return `import { ${marked.join(', ')} } from 'express';`;
+    });
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -4,7 +4,9 @@ exports.extractKeyComments = extractKeyComments;
 exports.reattachKeyComments = reattachKeyComments;
 exports.hoistPackageManager = hoistPackageManager;
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+const fs_1 = require("fs");
 const js_yaml_1 = require("js-yaml");
+const path_1 = require("path");
 const fs_utils_1 = require("./fs-utils");
 /**
  * pnpm workspace-scoped fields that must live at the workspace root.
@@ -37,8 +39,16 @@ const fs_utils_1 = require("./fs-utils");
  * the same trap one step later: the starter scope-allows known-stale peer ranges
  * there, and without the hoist the root `check:peers` step fails the first
  * `pnpm run check` of every generated project.
+ *
+ * `patchedDependencies` (`{ "pkg@version": "patches/pkg@version.patch" }`) is the
+ * same trap once more, with a file attached. nuxt-base-starter pairs an override
+ * (`simple-git: 4.0.2`) with a patch that restores the default export its consumer
+ * imports. Hoisting the override without the patch installs the package unpatched,
+ * and `nuxt prepare` aborts the first `pnpm install` of every generated project.
+ * The value is a path relative to the workspace root, so the file moves with it —
+ * see `relocatePatches`.
  */
-const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
+const OBJECT_FIELDS = ['overrides', 'allowBuilds', 'patchedDependencies'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
 /** Objects whose inner arrays are unioned and inner maps merged, not replaced. */
 const NESTED_ARRAY_FIELDS = ['auditConfig', 'peerDependencyRules'];
@@ -333,6 +343,7 @@ function hoistWorkspacePnpmConfig(options) {
     const conflicts = [];
     const rootOverrides = [];
     const auditWidenedBy = new Set();
+    const relocatedPatches = new Map();
     // Sub-projects that are present and eligible but hand over nothing, because an
     // earlier run already hoisted their settings and deleted the source. They are
     // what turns a root-vs-sub override into a sub-vs-sub disagreement.
@@ -349,15 +360,31 @@ function hoistWorkspacePnpmConfig(options) {
         // across its own two config sources is the same silent-winner bug one scope
         // down, and a shared label hides it.
         const fromPkg = hoistFromSubPackageJson({
-            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/package.json#pnpm` },
+            context: {
+                auditWidenedBy,
+                conflicts,
+                provenance,
+                relocatedPatches,
+                rootOverrides,
+                sourceLabel: `${subDir}/package.json#pnpm`,
+            },
             filesystem,
+            projectDir,
             rootWs,
             subPath,
         });
         const fromYaml = hoistFromSubWorkspaceYaml({
             comments,
-            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/pnpm-workspace.yaml` },
+            context: {
+                auditWidenedBy,
+                conflicts,
+                provenance,
+                relocatedPatches,
+                rootOverrides,
+                sourceLabel: `${subDir}/pnpm-workspace.yaml`,
+            },
             filesystem,
+            projectDir,
             rootWs,
             subPath,
         });
@@ -547,13 +574,14 @@ function hoistFields(rootWs, source, context) {
 }
 /** Source 1: the sub-project's package.json `pnpm` block. */
 function hoistFromSubPackageJson(options) {
-    const { filesystem, rootWs, subPath } = options;
+    const { filesystem, projectDir, rootWs, subPath } = options;
     const subPkgPath = `${subPath}/package.json`;
     if (!filesystem.exists(subPkgPath))
         return false;
     const subPkg = filesystem.read(subPkgPath, 'json');
     if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
         return false;
+    relocatePatches({ context: options.context, filesystem, projectDir, source: subPkg.pnpm, subPath });
     if (!hoistFields(rootWs, subPkg.pnpm, options.context))
         return false;
     // If the sub-project's pnpm section is now empty, drop it entirely.
@@ -566,7 +594,7 @@ function hoistFromSubPackageJson(options) {
 /** Source 2: the sub-project's pnpm-workspace.yaml. */
 function hoistFromSubWorkspaceYaml(options) {
     var _a;
-    const { comments, filesystem, rootWs, subPath } = options;
+    const { comments, filesystem, projectDir, rootWs, subPath } = options;
     const subWsPath = `${subPath}/pnpm-workspace.yaml`;
     if (!filesystem.exists(subWsPath))
         return false;
@@ -581,6 +609,7 @@ function hoistFromSubWorkspaceYaml(options) {
         if (!comments.has(key))
             comments.set(key, block);
     }
+    relocatePatches({ context: options.context, filesystem, projectDir, source: ws, subPath });
     if (!hoistFields(rootWs, ws, options.context))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these
@@ -658,6 +687,21 @@ function pmVersion(pin) {
     const afterAt = pin.slice(pin.lastIndexOf('@') + 1);
     return afterAt.split('+')[0];
 }
+/** Remove `dir` and every parent it empties, stopping below `stopAt`, which is never removed. */
+function pruneEmptyDirs(filesystem, dir, stopAt) {
+    var _a;
+    const stop = (0, path_1.resolve)(stopAt);
+    let current = (0, path_1.resolve)(dir);
+    for (;;) {
+        const rel = (0, path_1.relative)(stop, current);
+        if (!rel || rel.startsWith('..') || (0, path_1.isAbsolute)(rel))
+            return;
+        if (((_a = filesystem.list(current)) !== null && _a !== void 0 ? _a : ['?']).length > 0)
+            return;
+        filesystem.remove(current);
+        current = (0, path_1.dirname)(current);
+    }
+}
 /** Parse a YAML file into a plain object, or null on missing/malformed/non-object. */
 function readYaml(filesystem, path) {
     if (!filesystem.exists(path))
@@ -746,6 +790,90 @@ function recordRootOverrides(field, rootValue, subValue, context) {
         });
     }
 }
+/**
+ * Make every `patchedDependencies` path in a sub-project's pnpm config valid at the
+ * workspace root, by moving the patch file to `<root>/patches/`.
+ *
+ * Why the file moves instead of the path just being rewritten to
+ * `projects/app/patches/…`: pnpm would find either, but the Dockerfiles copy only the
+ * build-context-root `patches/` into their deps stage, and in a monorepo the context IS
+ * the root. A path into `projects/app/` installs locally and breaks the image build.
+ *
+ * Never overwrites, never writes through a symlink, never deletes a patch it could not
+ * place. Where the move is impossible the entry points at the file where it is (a local
+ * install keeps working) and the reason is reported. A clash with ANOTHER sub-project's
+ * entry for the same key is left to `recordObjectFieldProvenance`, which names both
+ * sources; reporting it here as well would say the same thing twice.
+ */
+function relocatePatches(options) {
+    var _a, _b;
+    const { context, filesystem, projectDir, source, subPath } = options;
+    const entries = source.patchedDependencies;
+    if (!entries || typeof entries !== 'object' || Array.isArray(entries))
+        return;
+    const rootPatchesDir = (0, path_1.resolve)(projectDir, 'patches');
+    const toRootPath = (abs) => (0, path_1.relative)((0, path_1.resolve)(projectDir), abs).split(path_1.sep).join('/');
+    const isInside = (dir, path) => {
+        const rel = (0, path_1.relative)(dir, path);
+        return !!rel && !rel.startsWith('..') && !(0, path_1.isAbsolute)(rel);
+    };
+    const relocated = {};
+    const moved = (_a = context === null || context === void 0 ? void 0 : context.relocatedPatches) !== null && _a !== void 0 ? _a : new Map();
+    for (const [key, value] of Object.entries(entries)) {
+        relocated[key] = value;
+        if (typeof value !== 'string')
+            continue;
+        const from = (0, path_1.resolve)(subPath, value);
+        const fromPath = toRootPath(from);
+        relocated[key] = (_b = moved.get(from)) !== null && _b !== void 0 ? _b : fromPath;
+        if (moved.has(from))
+            continue;
+        const leftInPlace = (reason) => {
+            context === null || context === void 0 ? void 0 : context.conflicts.push(`patchedDependencies: ${JSON.stringify(key)} — ${reason}, so ${fromPath} was left in place. ` +
+                `A local install still finds it, but the Dockerfiles copy only the root patches/ and the image build will not.`);
+        };
+        if (isInside(rootPatchesDir, from))
+            continue;
+        if (filesystem.exists(from) !== 'file') {
+            context === null || context === void 0 ? void 0 : context.conflicts.push(`patchedDependencies: ${JSON.stringify(key)} points at ${fromPath}, which does not exist. ` +
+                `pnpm install fails until the patch file is there.`);
+            continue;
+        }
+        if (!isInside((0, path_1.resolve)(subPath), from)) {
+            leftInPlace('the patch lives outside its sub-project');
+            continue;
+        }
+        if ((0, fs_utils_1.isSymlink)(from)) {
+            leftInPlace('the patch file is a symlink');
+            continue;
+        }
+        const dirState = filesystem.exists(rootPatchesDir);
+        if ((0, fs_utils_1.isSymlink)(rootPatchesDir) || (dirState && dirState !== 'dir')) {
+            leftInPlace('patches/ at the workspace root is a symlink or not a directory');
+            continue;
+        }
+        const to = (0, path_1.join)(rootPatchesDir, (0, path_1.basename)(from));
+        if (filesystem.exists(to)) {
+            const identical = filesystem.exists(to) === 'file' && !(0, fs_utils_1.isSymlink)(to) && (0, fs_1.readFileSync)(to).equals((0, fs_1.readFileSync)(from));
+            if (identical) {
+                filesystem.remove(from);
+                pruneEmptyDirs(filesystem, (0, path_1.dirname)(from), subPath);
+                relocated[key] = toRootPath(to);
+                moved.set(from, toRootPath(to));
+            }
+            else if (!(context === null || context === void 0 ? void 0 : context.provenance.has(`patchedDependencies.${key}`))) {
+                leftInPlace(`${toRootPath(to)} already exists with different content`);
+            }
+            continue;
+        }
+        filesystem.dir(rootPatchesDir);
+        filesystem.move(from, to);
+        pruneEmptyDirs(filesystem, (0, path_1.dirname)(from), subPath);
+        relocated[key] = toRootPath(to);
+        moved.set(from, toRootPath(to));
+    }
+    source.patchedDependencies = relocated;
+}
 /**
  * One line, not one per advisory: say that hoisting widened the audit
  * suppressions to the whole workspace, and name who brought them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.50.3",
+  "version": "1.50.5",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -58,13 +58,13 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1146.0",
+    "@aws-sdk/client-s3": "3.1148.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
     "axios": "1.20.0",
     "bcrypt": "6.0.0",
     "cross-spawn": "7.0.6",
     "defuddle": "0.19.4",
-    "ejs": "6.0.1",
+    "ejs": "7.0.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "1.0.0",
@@ -73,7 +73,7 @@
     "jsonc-parser": "3.3.1",
     "lodash": "4.18.1",
     "open": "11.0.4",
-    "playwright-core": "1.63.0",
+    "playwright-core": "1.64.0",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -113,6 +113,7 @@
     "//minimatch-note": "Why the minimatch raises exist: when they were added, brace-expansion 1.x and 2.x were END OF LINE for GHSA-mh99-v99m-4gvg (advisory range <=5.0.7 across ALL majors, patched only 5.0.8+), so the only fix was to raise each CONSUMER off minimatch 3.x/5.x/9.x. That premise no longer holds: upstream has since backported every fix (GHSA-mh99 now reads <1.1.17 / >=2.0.0 <2.1.3, and 1.1.21 / 2.1.7 patch all five current advisories). Verified 2026-10-03 with fresh lockfile resolves: without `minimatch@>=4 <10` and `fs-jetpack > minimatch@<10` npm audit is still clean, the tree only gains minimatch 3.1.5 + 5.1.9 and brace-expansion 1.1.21 + 2.1.7 (7 packages). So both are now a DEDUPE measure (one minimatch 10.2.6, one brace-expansion 5.0.12), not a security fix - dropping them is a judgment call, it reopens no advisory. Forcing brace-expansion 5.x globally is still NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. Each scoped entry was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
     "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. As of 2026-10-03 the only consumer it still raises is filelist (gluegun > ejs 3.1.10 > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1): @typescript-eslint/typescript-estree 8.65 requests ^10.2.2 itself and the jest 30.5 packages no longer depend on minimatch. Verified safe: filelist calls only the static helper `minimatch.match(files, pat, opts)`. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Dedupe, not security (see //minimatch-note). Drop once filelist requests minimatch >=10.",
     "babel-plugin-istanbul > test-exclude@<8": "Dedupe override, no longer a security fix. Added when babel-plugin-istanbul requested test-exclude ^6.0.0, whose 6.0.0 pins minimatch ^3.0.4 and glob ^7. Since jest 30.5 (babel-plugin-istanbul 8.0.0) the request is ^7.0.1, and test-exclude 7.0.2 already uses minimatch ^10.2.2: a fresh resolve without this entry audits clean (2026-10-03) but adds 23 packages (glob 10.5.0 and its subtree). 8.0.0 uses glob ^13, the major this project already ships, and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul 8's _interopRequireDefault + `new _testExclude.default(opts)` keeps working. Drop once babel-plugin-istanbul requests test-exclude ^8.",
+    "@istanbuljs/load-nyc-config > js-yaml": "Security fix for GHSA-hp3w-g68c-fv3c (sprintf-js, DoS via unbounded precision specifiers, moderate). Advisory range is ALL versions, so there is no patched sprintf-js to raise to. Dev-only path: ts-jest > @jest/transform > babel-plugin-istanbul 8.0.0 > @istanbuljs/load-nyc-config 1.1.0 (js-yaml ^3.13.1) > js-yaml 3.15.2 > argparse 1.0.10 > sprintf-js. Every link is already at its latest release (2026-10-06), and only js-yaml 4.x leaves the chain: it depends on argparse ^2, which has no sprintf-js. `$js-yaml` pins it to this project's own direct js-yaml, so the two never drift. Verified safe: load-nyc-config only calls `require('js-yaml').load(...)` (index.js:80), which 4.x has; 4.x `load` behaves like 3.x `safeLoad`. Drop once load-nyc-config requests js-yaml >=4 or argparse 1.x drops sprintf-js.",
     "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
   },
   "overrides": {
@@ -126,6 +127,9 @@
     "babel-plugin-istanbul": {
       "test-exclude@<8": "8.0.0"
     },
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "$js-yaml"
+    },
     "minimatch@>=4 <10": "10.2.6"
   },
   "//jest.workerIdleMemoryLimit": "Recycle a ts-jest worker once its heap passes this. Guards against an intermittent `A jest worker process was terminated by another process: signal=SIGSEGV` that kills ONE suite while every other test passes (seen twice in marketplace*, both under `npm run check`, never reproducible on demand - 0 in 9 targeted runs incl. --maxWorkers=16). It is a worker crash, NOT an assertion failure: the signature is `Test suite failed to run` with the remaining count still green. All versions are current and in-range (node 24 / jest 30 / ts-jest 29 / ts 6), so this is a resilience measure against unbounded worker heap growth, not a proven root-cause fix - if it recurs, capture the suite name and re-open.",