@lenne.tech/cli 1.50.4 → 1.50.6

package/build/commands/dev/doctor.js

@@ -179,52 +179,58 @@ const DoctorCommand = {
             //     "matches the canonical CLI version" for a project whose `check` was
             //     completely broken — and doctor is the tool people reach for exactly
             //     then.
-            try {
-                const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
-                const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
-                const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
-                const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
-                if (filesystem.exists(bundledCheck)) {
-                    const missing = [];
-                    const drifted = [];
-                    for (const { rel, source } of resolveCopySet(bundledCheck)) {
-                        const target = j(layout.root, rel);
-                        if (!filesystem.exists(target)) {
-                            missing.push(rel);
+            //
+            //     Workspace roots only: a standalone starter project carries its own
+            //     `scripts/check.mjs`, which is not a drifted copy of the root wrapper,
+            //     and `lt fullstack update` deliberately leaves it alone.
+            if (layout.workspace) {
+                try {
+                    const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
+                    const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
+                    const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
+                    const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
+                    if (filesystem.exists(bundledCheck)) {
+                        const missing = [];
+                        const drifted = [];
+                        for (const { rel, source } of resolveCopySet(bundledCheck)) {
+                            const target = j(layout.root, rel);
+                            if (!filesystem.exists(target)) {
+                                missing.push(rel);
+                            }
+                            else if (read(target, 'utf8') !== read(source, 'utf8')) {
+                                drifted.push(rel);
+                            }
                         }
-                        else if (read(target, 'utf8') !== read(source, 'utf8')) {
-                            drifted.push(rel);
+                        // A missing module only breaks `check` when the project's wrapper is the
+                        // canonical one that imports it (or the wrapper itself is missing). An
+                        // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
+                        // still runs — calling that "cannot start" would be a false alarm.
+                        const wrapperDrifted = drifted.includes('scripts/check.mjs');
+                        // A project wrapper that heal refuses to replace (newer release, or the same
+                        // release with other content) is not drift to fix: pointing at
+                        // `lt fullstack update` there would recommend a no-op or a downgrade.
+                        const kept = keptWrapperReason(layout.root, bundledCheck);
+                        if (kept) {
+                            line('INFO', colors.cyan, `check wrapper: ${kept}`);
+                        }
+                        else if (missing.length > 0 && !wrapperDrifted) {
+                            line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
+                            line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
+                        }
+                        else if (drifted.length > 0) {
+                            const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
+                            const verb = outdated.length === 1 ? 'differs' : 'differ';
+                            line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
+                            line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
+                        }
+                        else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
+                            line('OK', colors.green, 'check wrapper matches the canonical CLI version');
                         }
-                    }
-                    // A missing module only breaks `check` when the project's wrapper is the
-                    // canonical one that imports it (or the wrapper itself is missing). An
-                    // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
-                    // still runs — calling that "cannot start" would be a false alarm.
-                    const wrapperDrifted = drifted.includes('scripts/check.mjs');
-                    // A project wrapper that heal refuses to replace (newer release, or the same
-                    // release with other content) is not drift to fix: pointing at
-                    // `lt fullstack update` there would recommend a no-op or a downgrade.
-                    const kept = keptWrapperReason(layout.root, bundledCheck);
-                    if (kept) {
-                        line('INFO', colors.cyan, `check wrapper: ${kept}`);
-                    }
-                    else if (missing.length > 0 && !wrapperDrifted) {
-                        line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
-                        line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
-                    }
-                    else if (drifted.length > 0) {
-                        const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
-                        const verb = outdated.length === 1 ? 'differs' : 'differ';
-                        line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
-                        line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
-                    }
-                    else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
-                        line('OK', colors.green, 'check wrapper matches the canonical CLI version');
                     }
                 }
-            }
-            catch (_a) {
-                /* best-effort diagnostics */
+                catch (_a) {
+                    /* best-effort diagnostics */
+                }
             }
             // 7.6 oxlint config filename: oxlint only auto-discovers `.oxlintrc.json`.
             //     Apps from the template before the rename carry `oxlint.json`, whose

package/build/commands/dev/prune.js

@@ -62,7 +62,7 @@ const PruneCommand = {
         // driver; the api dir merely improves the driver fallback when present.
         const observed = (0, dev_ticket_1.listDatabaseNames)(undefined, [mainLayout.apiDir, mainRepoRoot].filter(Boolean));
         if (observed === null) {
-            warning('Could not list databases (mongosh missing or MongoDB unreachable) — only the registry is pruned.');
+            warning('Could not list databases (mongosh missing, MongoDB unreachable, or mongosh slower than 10 s) — only the registry is pruned. Re-run to sweep the databases.');
         }
         const plan = (0, dev_prune_1.collectDevPrunePlan)({
             loadRegistry: dev_state_1.loadRegistry,

package/build/commands/fullstack/update.js

@@ -195,8 +195,13 @@ const NewCommand = {
         // pre-existing projects predate it. This idempotently installs the bundled
         // wrapper (and rewrites the root `check`/`check:raw`) so a migrated project
         // gets the quiet, report-driven check too. No-op once already wired.
+        //
+        // Only at a workspace root: the bundled file is lt-monorepo's ROOT wrapper.
+        // `projects/api` and standalone starter projects ship their own, unmarked
+        // `scripts/check.mjs`, which heal reads as legacy — run from there, this
+        // replaced the API's check and the starter's tests failed on its content.
         const checkAsset = (0, path_1.join)(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
-        const changedCheck = (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset);
+        const changedCheck = isWorkspace ? (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset) : [];
         if (changedCheck.length > 0) {
             info('');
             // A skip entry is NOT a success — it means the wrapper stayed on its old

package/build/extensions/api-mode.js

@@ -649,8 +649,12 @@ class ApiMode {
      * For non-aliased imports, returns the identifier as-is.
      */
     resolveImportAlias(identifier) {
-        const asMatch = identifier.match(/^\S+\s+as\s+(\S+)$/);
-        return asMatch ? asMatch[1] : identifier;
+        // An inline `type` modifier is not part of the name: searching the code for the
+        // literal "type LookupAddress" found nothing, so a used specifier got pruned
+        // (nest-server's outbound-url.helper.ts → TS2304 in every vendor-mode project).
+        const name = identifier.replace(/^type\s+/, '');
+        const asMatch = name.match(/^\S+\s+as\s+(\S+)$/);
+        return asMatch ? asMatch[1] : name;
     }
     /**
      * Collapse multiple consecutive blank lines into at most one

package/build/extensions/server.js

@@ -50,6 +50,7 @@ const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const cross_env_1 = require("../lib/cross-env");
+const express_type_imports_1 = require("../lib/express-type-imports");
 const markdown_table_1 = require("../lib/markdown-table");
 const migrate_scripts_1 = require("../lib/migrate-scripts");
 const module_specifiers_1 = require("../lib/module-specifiers");
@@ -1229,12 +1230,10 @@ class Server {
             // and type imports were erased before runtime. In vendor-mode, vitest/vite
             // evaluates the TypeScript source directly and chokes with:
             //   "The requested module 'express' does not provide an export named 'Response'"
-            // Fix: convert `import { Request, Response } from 'express'` (and variants
-            // with NextFunction etc.) to type-only imports wherever they appear in the
-            // vendored core. This is safe because the core code uses Request/Response
-            // only as type annotations — any runtime `new Request(...)` calls refer
-            // to the global Fetch API Request, not the express one.
-            const expressImportRegex = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"]\s*;?\s*$/gm;
+            // Fix: mark the type names in every `import { … } from 'express'` of the
+            // vendored core as type-only. Runtime exports (`json`, `urlencoded`, `Router`
+            // …) stay value imports — see src/lib/express-type-imports.ts for why a
+            // blanket `import type` broke the build (nest-server 11.42.4+).
             // `glob`, not `filesystem.find`: jetpack builds its matcher by concatenating the
             // RESOLVED base path in front of the pattern, and minimatch reads a backslash
             // inside a PATTERN as an escape. On Windows `C:\…\core` + `**/*.ts` therefore
@@ -1249,16 +1248,7 @@ class Server {
                 const content = filesystem.read(absPath) || '';
                 if (!content.includes("from 'express'") && !content.includes('from "express"'))
                     continue;
-                const patched = content.replace(expressImportRegex, (_match, names) => {
-                    const cleanNames = names
-                        .split(',')
-                        .map((n) => n.trim())
-                        .filter((n) => n.length > 0 && n !== 'type')
-                        // Strip any pre-existing 'type ' prefix on individual names
-                        .map((n) => n.replace(/^type\s+/, ''))
-                        .join(', ');
-                    return `import type { ${cleanNames} } from 'express';`;
-                });
+                const patched = (0, express_type_imports_1.rewriteExpressImportsToTypeOnly)(content);
                 if (patched !== content) {
                     filesystem.write(absPath, patched);
                 }

package/build/lib/caddy.js

@@ -42,6 +42,8 @@ const path_1 = require("path");
 const dev_process_1 = require("./dev-process");
 const platform_1 = require("./platform");
 const CADDYFILE_PATH = process.env.LT_DEV_CADDYFILE || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech', 'Caddyfile');
+/** Upstream connection cap per route — well below the 128 of macOS `somaxconn` (see `renderProjectBlock`). */
+const UPSTREAM_MAX_CONNS = 32;
 const HEADER = '# Managed by `lt dev`. Per-project blocks are bounded by `# >>> lt-dev:<slug> >>>` markers.';
 /** Detect whether `caddy` is on PATH. */
 function caddyAvailable() {
@@ -115,12 +117,27 @@ function removeProjectBlock(slug) {
  *   - `localhost` as Caddy upstream resolves to `::1` first on macOS,
  *     so it would still pick the IPv6 family and miss the IPv4 bind.
  *     Pinning to `127.0.0.1` removes that ambiguity entirely.
+ *
+ * Every upstream is capped at `UPSTREAM_MAX_CONNS` connections. The browser
+ * talks HTTP/2 to Caddy and multiplexes a cold `nuxt dev`'s first page load —
+ * around 800 raw modules — over one connection; Caddy used to fan that out
+ * into one upstream dial per request. The dev server's accept queue
+ * (`somaxconn`, 128 on macOS) overflowed, the excess dials got `connect:
+ * connection reset by peer`, Caddy answered 502, and a page missing a module
+ * never hydrated: the form looked fine and submitted natively. With the cap,
+ * Caddy queues the burst instead (Go's `MaxConnsPerHost` blocks the dial).
+ * `~/.lenneTech/caddy.err.log` held about 51 000 such resets across projects
+ * when this was found (lt-crm DEV-2899).
  */
 function renderProjectBlock(slug, routes) {
     const lines = [`# >>> lt-dev:${slug} >>>`];
     for (const route of routes) {
         lines.push(`${route.hostname} {`);
-        lines.push(`  reverse_proxy 127.0.0.1:${route.upstreamPort}`);
+        lines.push(`  reverse_proxy 127.0.0.1:${route.upstreamPort} {`);
+        lines.push('    transport http {');
+        lines.push(`      max_conns_per_host ${UPSTREAM_MAX_CONNS}`);
+        lines.push('    }');
+        lines.push('  }');
         lines.push('}');
     }
     lines.push(`# <<< lt-dev:${slug} <<<`);

package/build/lib/dev-ticket.js

@@ -260,7 +260,14 @@ function gitFetch(repoDir, remote = 'origin') {
 function gitMainRepoRoot(cwd) {
     // `--git-common-dir` is the SHARED `.git` (same for every worktree); its
     // parent is the main repo root.
-    const commonDir = git(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+    // stderr is captured, not inherited: every caller catches the throw for a
+    // non-git directory (a normal case for `lt dev up` / `lt dev prune`), so git's
+    // "fatal: not a git repository" belongs in the error, not on the terminal.
+    const commonDir = (0, child_process_1.execFileSync)('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
+        cwd,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
     return (0, path_1.dirname)(commonDir);
 }
 /** True if `ref` resolves to a commit in the repo (any ref kind: local, remote, tag, sha). */

package/build/lib/express-type-imports.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Marks the TYPE names in a vendored file's `express` imports as type-only.
+ *
+ * Why it exists: express exports `Request`, `Response`, `NextFunction` & co. as types
+ * only. The npm-mode framework shipped compiled, so those imports were erased before
+ * runtime; vendor mode runs the TypeScript source through vitest/vite, which keeps a
+ * plain `import { Request } from 'express'` and fails with
+ * "The requested module 'express' does not provide an export named 'Request'".
+ *
+ * Why it does not simply rewrite the whole import to `import type`: express also has
+ * runtime exports, and the vendored core imports some of them as values —
+ * `core-body-parser.initializer.ts` (nest-server 11.42.4+) calls `json()` and
+ * `urlencoded()`. A blanket `import type { json, urlencoded }` broke the build of every
+ * generated vendor-mode project with TS1361. So only names that are NOT runtime exports
+ * become type-only; a mixed import keeps its values and gets inline `type` modifiers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteExpressImportsToTypeOnly = rewriteExpressImportsToTypeOnly;
+/**
+ * The runtime (value) exports of express — `lib/express.js`, v4 and v5. Everything
+ * else a TypeScript file can import from 'express' only exists in its type declarations.
+ */
+const EXPRESS_VALUE_EXPORTS = new Set([
+    'application',
+    'json',
+    'query',
+    'raw',
+    'request',
+    'response',
+    'Route',
+    'Router',
+    'static',
+    'text',
+    'urlencoded',
+]);
+// `[ \t]*`, not `\s*`, after the module name: `\s*$` under the `m` flag also swallowed
+// the line break, and with it the blank line that usually follows the imports.
+const EXPRESS_NAMED_IMPORT = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"][ \t]*;?[ \t]*$/gm;
+/** Rewrites every `import { … } from 'express'` in `content`; returns it unchanged when nothing applies. */
+function rewriteExpressImportsToTypeOnly(content) {
+    return content.replace(EXPRESS_NAMED_IMPORT, (_match, names) => {
+        const specifiers = names
+            .split(',')
+            .map((n) => n.trim().replace(/^type\s+/, ''))
+            .filter((n) => n.length > 0);
+        const isValue = (specifier) => EXPRESS_VALUE_EXPORTS.has(specifier.split(/\s+as\s+/)[0].trim());
+        if (!specifiers.some(isValue)) {
+            return `import type { ${specifiers.join(', ')} } from 'express';`;
+        }
+        const marked = specifiers.map((s) => (isValue(s) ? s : `type ${s}`));
+        return `import { ${marked.join(', ')} } from 'express';`;
+    });
+}

package/build/templates/check/check.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @lt-check-wrapper 3.14.1
+// @lt-check-wrapper 3.15.2
 /**
  * Quiet, report-driven wrapper around the project `check` pipeline.
  *

package/build/templates/check/lib/audit-report.mjs

@@ -133,17 +133,20 @@ export function advisoryBulkUrl(registry) {
  * and the default is what pnpm itself would use.
  */
 export function configuredRegistry(env = process.env) {
-  // Environment FIRST, and this order is not cosmetic. pnpm honours `npm_config_registry` for the
-  // audit itself, but `pnpm config get registry` does NOT report it — measured 2026-09-04:
+  // The probe must ask the registry the AUDIT used, so it reads the variable the audit reads.
+  // Under pnpm 11 that is `pnpm_config_registry`; `npm_config_registry` is IGNORED by both
+  // `pnpm audit` and `pnpm config get registry` — measured 2026-10-06 with pnpm 11.14.0,
+  // re-measured 2026-10-09 with 11.28.5:
   //
-  //   npm_config_registry=http://127.0.0.1:9/ pnpm audit               uses 127.0.0.1:9, fails
-  //   npm_config_registry=http://127.0.0.1:9/ pnpm config get registry https://registry.npmjs.org/
+  //   pnpm_config_registry=http://127.0.0.1:9/ pnpm audit --json   {"error": … "fetch failed"}
+  //   npm_config_registry=http://127.0.0.1:9/  pnpm audit --json   a normal report from npmjs.org
   //
-  // Asking pnpm alone therefore points the probe at npmjs.org while the audit talked to somewhere
-  // else. npmjs.org answers, the run concludes "no outage", and the green tick is back — the same
-  // false all-clear as a hardcoded URL, one layer further in. Found by nuxt-extensions-f7, whose
-  // end-to-end test was green and should not have been.
-  const fromEnv = env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY;
+  // The version before read `npm_config_registry`, from a measurement on 2026-09-04 with an older
+  // pnpm. Under pnpm 11 that sent the probe to a registry the audit never talked to: a stub there
+  // answered, the run concluded "no outage", and an unreachable audit registry read as clean.
+  // `pnpm config get registry` below would report `pnpm_config_registry` too; reading it here saves
+  // the spawn and keeps the answer independent of how a pnpm shim forwards the environment.
+  const fromEnv = env.pnpm_config_registry ?? env.PNPM_CONFIG_REGISTRY;
   if (typeof fromEnv === 'string' && fromEnv.trim()) return fromEnv.trim();
 
   try {

package/build/templates/check/lt-monorepo-pin.json

@@ -1,13 +1,13 @@
 {
-  "commit": "26365f7c8acaa98bc48f360886055d0fe45c593d",
+  "commit": "a49b79d7a9be72b480ec658de48e909b76c9a45e",
   "files": {
     "build-test-gate.mjs": "865bf1b9dd28151f53b9f2dfe4c3c46d29b9303fb1c2f497ce0e3136bcd37d71",
-    "check.mjs": "6be5506f5fb63f53c65ea438c67d810de1afe1f3299828ef4531c37cc2457d4b",
+    "check.mjs": "0a0377f79d7131c2ddc3705f59804461c12d08a928b35b945e996c31e29b4012",
     "lib/ansi.mjs": "f997ee6e9bf1c7ee54ab612d4040fcc778064ec160eae19bf5c3960a75a6e2ff",
-    "lib/audit-report.mjs": "503825c3342dec1ee5d8d70e5af21b73e798faee320426b2492190cde0801df2",
+    "lib/audit-report.mjs": "d8c6fef1bf06d37f5737aaffa1eeb287ec03af608588ce845ba90f16cafac0b9",
     "lib/workspace-packages.mjs": "ccdd133622a88186c924bc8271d35cf1f8357dc26d4a607998ca5e91fce5bf88"
   },
-  "ref": "v3.14.1",
+  "ref": "v3.15.2",
   "repository": "lenneTech/lt-monorepo",
-  "version": "3.14.1"
+  "version": "3.15.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.50.4",
+  "version": "1.50.6",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -58,13 +58,13 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1146.0",
+    "@aws-sdk/client-s3": "3.1149.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
     "axios": "1.20.0",
     "bcrypt": "6.0.0",
     "cross-spawn": "7.0.6",
-    "defuddle": "0.19.4",
-    "ejs": "6.0.1",
+    "defuddle": "0.19.5",
+    "ejs": "7.0.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "1.0.0",
@@ -73,7 +73,7 @@
     "jsonc-parser": "3.3.1",
     "lodash": "4.18.1",
     "open": "11.0.4",
-    "playwright-core": "1.63.0",
+    "playwright-core": "1.64.0",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -94,14 +94,14 @@
     "@types/jest": "30.0.0",
     "@types/js-yaml": "4.0.9",
     "@types/jsdom": "28.0.1",
-    "@types/lodash": "4.17.25",
-    "@types/node": "26.6.4",
+    "@types/lodash": "4.17.26",
+    "@types/node": "26.6.5",
     "@types/turndown": "5.0.6",
     "eslint": "10.12.0",
     "husky": "9.1.7",
     "jest": "30.5.2",
     "minimatch": "10.2.6",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "rimraf": "6.1.3",
     "ts-jest": "29.4.14"
   },