@lenne.tech/cli 1.11.1 → 1.12.0

package/build/commands/claude/shortcuts.js

@@ -30,6 +30,11 @@ const CLAUDE_SHORTCUTS = [
         command: 'claude --dangerously-skip-permissions --resume',
         description: 'Select and resume previous session',
     },
+    {
+        alias: 'cf',
+        command: 'LT_PLUGIN_HOOKS_SKIP=1 claude --dangerously-skip-permissions',
+        description: 'Start Claude Code in fast mode (skip lenne.tech plugin detect hooks)',
+    },
 ];
 /**
  * Install Claude Code shell shortcuts

package/build/commands/fullstack/init.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const hoist_workspace_pnpm_config_1 = require("../../lib/hoist-workspace-pnpm-config");
 /**
  * Create a new fullstack workspace
  */
@@ -456,6 +457,14 @@ const NewCommand = {
             else {
                 serverSpinner.warn('Nest Server Starter not integrated');
             }
+            // Hoist workspace-scoped pnpm config out of sub-projects. pnpm only
+            // honors `pnpm.overrides`, `pnpm.onlyBuiltDependencies`, and
+            // `pnpm.ignoredOptionalDependencies` at the workspace root; leaving
+            // them in projects/api/package.json or projects/app/package.json
+            // causes `WARN The field … was found in … This will not take
+            // effect. You should configure … at the root of the workspace
+            // instead.` and silently disables CVE overrides.
+            (0, hoist_workspace_pnpm_config_1.hoistWorkspacePnpmConfig)({ filesystem, projectDir, subProjects: ['projects/api', 'projects/app'] });
             // Install all packages
             const installSpinner = spin('Install all packages');
             try {
@@ -467,6 +476,18 @@ const NewCommand = {
                 installSpinner.fail(`Failed to install packages: ${err.message}`);
                 return;
             }
+            // Post-install format pass. processApiMode (run earlier in
+            // setupServerForFullstack) and convertAppCloneToVendored rewrite
+            // source files, leaving whitespace artifacts that oxfmt flags in
+            // `pnpm run format:check` (multi-line arrays/imports after region
+            // stripping, import-path rewrites that now fit single-line). The
+            // formatter is only available after install, so we normalize here.
+            if (apiMode && filesystem.isDirectory(`${projectDir}/projects/api`)) {
+                yield toolbox.apiMode.formatProject(`${projectDir}/projects/api`);
+            }
+            if (isNuxt && filesystem.isDirectory(`${projectDir}/projects/app`)) {
+                yield toolbox.apiMode.formatProject(`${projectDir}/projects/app`);
+            }
             // Create initial commit after everything is set up
             try {
                 yield system.run(`cd ${projectDir} && git add . && git commit -m "Initial commit"`);

package/build/commands/fullstack/update.js

@@ -126,10 +126,7 @@ const NewCommand = {
         info(colors.dim('─'.repeat(60)));
         info('');
         // Detect frontend project
-        const appCandidates = [
-            (0, path_1.join)(cwd, 'projects', 'app'),
-            (0, path_1.join)(cwd, 'packages', 'app'),
-        ].filter((p) => Boolean(p));
+        const appCandidates = [(0, path_1.join)(cwd, 'projects', 'app'), (0, path_1.join)(cwd, 'packages', 'app')].filter((p) => Boolean(p));
         let appDir;
         for (const candidate of appCandidates) {
             if (filesystem.exists((0, path_1.join)(candidate, 'nuxt.config.ts')) || filesystem.exists((0, path_1.join)(candidate, 'package.json'))) {

package/build/commands/git/reset.js

@@ -45,8 +45,8 @@ const NewCommand = {
             error('No current branch!');
             return;
         }
-        // Check remote
-        const remoteBranch = yield system.run(`git ls-remote --heads origin ${branch}`);
+        // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
+        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;

package/build/commands/git/update.js

@@ -47,8 +47,8 @@ const NewCommand = {
             info('');
             info(`Current branch: ${branch}`);
             info('');
-            // Fetch to see incoming changes
-            yield run('git fetch');
+            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
+            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
             // Check for incoming commits
             const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
@@ -78,7 +78,7 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('git fetch && git pull --rebase');
+        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git pull --rebase');
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {

package/build/commands/server/add-property.js

@@ -434,9 +434,7 @@ const NewCommand = {
                 // path to src/core whose depth depends on the model file location.
                 // We search for BOTH forms so this works regardless of how the file
                 // was originally generated.
-                const vendoredSpec = (0, framework_detection_1.isVendoredProject)(path)
-                    ? (0, framework_detection_1.getFrameworkImportSpecifier)(path, modelPath)
-                    : null;
+                const vendoredSpec = (0, framework_detection_1.isVendoredProject)(path) ? (0, framework_detection_1.getFrameworkImportSpecifier)(path, modelPath) : null;
                 let existingImports = moduleFile.getImportDeclaration('@lenne.tech/nest-server');
                 if (!existingImports && vendoredSpec) {
                     existingImports = moduleFile.getImportDeclaration(vendoredSpec);

package/build/commands/server/module.js

@@ -410,7 +410,7 @@ const NewCommand = {
                     // plus the `from '@nestjs/common'` clause. The replacement wedges
                     // `, forwardRef` in between.
                     yield patching.patch(serverModule, {
-                        insert: "$1, forwardRef$2",
+                        insert: '$1, forwardRef$2',
                         replace: /(import\s*\{\s*[^}]*?)(\s*\}\s*from\s+['"]@nestjs\/common['"])/,
                     });
                 }

package/build/config/vendor-runtime-deps.json

@@ -1,9 +1,5 @@
 {
   "$schema": "./vendor-runtime-deps.schema.json",
   "description": "Upstream @lenne.tech/nest-server devDependencies that are actually needed at runtime in a consumer project. When vendoring, these entries are promoted from upstream devDependencies into the project's dependencies so production runtime has them available.",
-  "runtimeHelpers": [
-    "find-file-up"
-  ]
+  "runtimeHelpers": ["find-file-up"]
 }
-</content>
-</invoke>

package/build/extensions/api-mode.js

@@ -55,6 +55,50 @@ class ApiMode {
             this.filesystem.remove((0, path_1.join)(projectPath, 'scripts', 'strip-api-mode-markers.mjs'));
             // Remove strip-markers script from package.json
             this.removeScriptFromPackageJson(projectPath, 'strip-markers');
+            // NOTE: auto-format of the stripped files happens separately in
+            // `formatProject()`, which MUST be called by the caller AFTER
+            // `pnpm install`. At this point the project's formatter (oxfmt) is
+            // not yet on disk, so running it here would silently no-op.
+        });
+    }
+    /**
+     * Run the project's `format` (or `format:fix`) npm script, if it exists.
+     * Call this AFTER the project's dependencies have been installed —
+     * otherwise the formatter (e.g. oxfmt) isn't available yet and the
+     * pass silently no-ops.
+     *
+     * Used after region stripping to normalize whitespace artifacts the
+     * formatter would otherwise flag in `format:check` (e.g. collapsing
+     * `providers: [\n  X,\n]` to `providers: [X]` once graphql items were
+     * removed). Failures are non-fatal so a misbehaving formatter never
+     * blocks init.
+     */
+    formatProject(projectPath) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const pkgPath = (0, path_1.join)(projectPath, 'package.json');
+            const pkgRaw = this.filesystem.read(pkgPath);
+            if (!pkgRaw)
+                return;
+            let pkg;
+            try {
+                pkg = JSON.parse(pkgRaw);
+            }
+            catch (_d) {
+                return;
+            }
+            const scripts = (_a = pkg.scripts) !== null && _a !== void 0 ? _a : {};
+            const formatScript = scripts.format ? 'format' : scripts['format:fix'] ? 'format:fix' : null;
+            if (!formatScript)
+                return;
+            const { pm, system } = this.toolbox;
+            const runner = (_c = (_b = pm === null || pm === void 0 ? void 0 : pm.run) === null || _b === void 0 ? void 0 : _b.call(pm, formatScript, pm.detect(projectPath))) !== null && _c !== void 0 ? _c : `pnpm run ${formatScript}`;
+            try {
+                yield system.run(`cd "${projectPath}" && ${runner}`);
+            }
+            catch (_e) {
+                // Non-fatal: the user can run format manually if this misbehaves.
+            }
         });
     }
     /**
@@ -143,13 +187,77 @@ class ApiMode {
                 if (!content) {
                     continue;
                 }
-                const processed = this.processFileRegions(content, removeMarker, keepMarker);
+                // Special-case config.env.ts in REST mode: simply deleting the
+                // `graphQl: { … }` property is not enough — `CoreModule.forRoot`
+                // treats `graphQl === undefined` as enabled and tries to build
+                // the GraphQL schema anyway (which then fails on core models
+                // like CoreHealthCheckResult that reference the JSON scalar).
+                // Replace each stripped `// #region graphql … // #endregion
+                // graphql` block with an explicit `graphQl: false,` so GraphQL
+                // is cleanly disabled.
+                let processed;
+                if (removeMarker === 'graphql' && file.endsWith('/config.env.ts')) {
+                    processed = this.replaceGraphqlRegionsWithDisabled(content, keepMarker);
+                }
+                else {
+                    processed = this.processFileRegions(content, removeMarker, keepMarker);
+                }
                 if (processed !== content) {
                     this.filesystem.write(file, processed);
                 }
             }
         }
     }
+    /**
+     * Like `processFileRegions` with removeMarker='graphql', but a
+     * stripped region that contains a `graphQl:` property assignment is
+     * replaced with `graphQl: false,` (at the region's indent) instead of
+     * being deleted outright. Other graphql-regions (e.g. wrapping
+     * `execAfterInit: 'pnpm run docs:bootstrap'`) are deleted as usual.
+     *
+     * Rationale: `CoreModule.forRoot` treats `options.graphQl === undefined`
+     * as enabled, so dropping the property silently keeps GraphQL active
+     * and later crashes when the schema references scalars that were
+     * purged in REST mode.
+     *
+     * Preserves keepMarker behaviour (strip marker lines only, keep content).
+     */
+    replaceGraphqlRegionsWithDisabled(content, keepMarker) {
+        const lines = content.split('\n');
+        const result = [];
+        let inRegion = false;
+        let regionIndent = '';
+        let regionBuffer = [];
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (trimmed === '// #region graphql') {
+                inRegion = true;
+                regionIndent = line.slice(0, line.indexOf('//'));
+                regionBuffer = [];
+                continue;
+            }
+            if (trimmed === '// #endregion graphql') {
+                inRegion = false;
+                // Only emit a replacement if the stripped block actually
+                // contained a `graphQl:` assignment.
+                if (regionBuffer.some((l) => /\bgraphQl\s*:/.test(l))) {
+                    result.push(`${regionIndent}graphQl: false,`);
+                }
+                regionBuffer = [];
+                continue;
+            }
+            if (inRegion) {
+                regionBuffer.push(line);
+                continue;
+            }
+            // Keep-marker lines (e.g. `// #region rest`) are dropped; content between them stays.
+            if (trimmed === `// #region ${keepMarker}` || trimmed === `// #endregion ${keepMarker}`) {
+                continue;
+            }
+            result.push(line);
+        }
+        return result.join('\n');
+    }
     /**
      * Process region markers in file content
      */
@@ -261,8 +369,20 @@ class ApiMode {
             }
             catch (_b) {
                 // If ts-morph is not available or fails, fall back to regex
-                this.modifyConfigEnvForRestFallback(projectPath);
             }
+            // Safety net: always run the regex fallback too. ts-morph only
+            // traverses direct ObjectLiteralExpression properties, so configs
+            // that wrap env-blocks in helper functions (e.g. `local:
+            // localConfig(...)`) are skipped silently. The regex is idempotent
+            // — if ts-morph already replaced `graphQl: {...}` with
+            // `graphQl: false` it's a no-op, but if ts-morph missed a wrapped
+            // occurrence the regex catches it. Without this, REST-mode
+            // projects built from a starter that lacks explicit
+            // `// #region graphql` markers would end up with `graphQl:
+            // undefined`, which `CoreModule.forRoot` treats as ENABLED, and
+            // the GraphQL schema build crashes on core models that still
+            // reference the JSON scalar.
+            this.modifyConfigEnvForRestFallback(projectPath);
         });
     }
     /**
@@ -389,9 +509,7 @@ class ApiMode {
                 importLineSet.add(j);
             }
         }
-        const codeContent = lines
-            .map((line, idx) => (importLineSet.has(idx) ? '' : line))
-            .join('\n');
+        const codeContent = lines.map((line, idx) => (importLineSet.has(idx) ? '' : line)).join('\n');
         // Check each import
         const linesToRemove = new Set();
         for (const imp of importLines) {

package/build/extensions/frontend-helper.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
+const markdown_table_1 = require("../lib/markdown-table");
 /**
  * Frontend helper functions for project scaffolding
  * Provides reusable methods for setting up Nuxt and Angular frontends
@@ -273,9 +274,7 @@ class FrontendHelper {
                     const { print } = this.toolbox;
                     print.warning('');
                     print.warning('VENDOR.md documents local patches in app/core/ that will be LOST:');
-                    const rows = localChangesSection[0]
-                        .split('\n')
-                        .filter((l) => /^\|\s*\d{4}-/.test(l));
+                    const rows = localChangesSection[0].split('\n').filter((l) => /^\|\s*\d{4}-/.test(l));
                     for (const row of rows.slice(0, 5)) {
                         print.info(`  ${row.trim()}`);
                     }
@@ -307,8 +306,7 @@ class FrontendHelper {
                         // Unhook freshness from check/check:fix/check:naf
                         for (const scriptName of ['check', 'check:fix', 'check:naf']) {
                             if ((_a = scripts[scriptName]) === null || _a === void 0 ? void 0 : _a.includes('check:vendor-freshness')) {
-                                scripts[scriptName] = scripts[scriptName]
-                                    .replace(/pnpm run check:vendor-freshness && /g, '');
+                                scripts[scriptName] = scripts[scriptName].replace(/pnpm run check:vendor-freshness && /g, '');
                             }
                         }
                     }
@@ -354,7 +352,7 @@ class FrontendHelper {
      */
     convertAppCloneToVendored(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { dest, upstreamBranch, upstreamRepoUrl = 'https://github.com/lenneTech/nuxt-extensions.git', } = options;
+            const { dest, upstreamBranch, upstreamRepoUrl = 'https://github.com/lenneTech/nuxt-extensions.git' } = options;
             const path = require('node:path');
             const { filesystem, system } = this.toolbox;
             const coreDir = path.join(dest, 'app', 'core');
@@ -501,14 +499,14 @@ class FrontendHelper {
                             "var f=require('fs'),h=require('https');",
                             "try{var c=f.readFileSync('app/core/VENDOR.md','utf8')}catch(e){process.exit(0)}",
                             'var m=c.match(/Baseline-Version[^0-9]*(\\d+\\.\\d+\\.\\d+)/);',
-                            'if(!m){process.stderr.write(String.fromCharCode(9888)+\' vendor-freshness: no baseline\\n\');process.exit(0)}',
+                            "if(!m){process.stderr.write(String.fromCharCode(9888)+' vendor-freshness: no baseline\\n');process.exit(0)}",
                             'var v=m[1];',
                             "h.get('https://registry.npmjs.org/@lenne.tech/nuxt-extensions/latest',function(r){",
                             "var d='';r.on('data',function(c){d+=c});r.on('end',function(){",
-                            "try{var l=JSON.parse(d).version;",
+                            'try{var l=JSON.parse(d).version;',
                             "if(v===l)console.log('vendor core up-to-date (v'+v+')');",
                             "else process.stderr.write('vendor core v'+v+', latest v'+l+'\\n')",
-                            '}catch(e){}})}).on(\'error\',function(){});',
+                            "}catch(e){}})}).on('error',function(){});",
                             'setTimeout(function(){process.exit(0)},5000)',
                             '"',
                         ].join('');
@@ -525,7 +523,20 @@ class FrontendHelper {
                         hookFreshness('check:fix');
                         hookFreshness('check:naf');
                     }
-                    filesystem.write(pkgPath, pkg, { jsonIndent: 2 });
+                    // Sort dependency maps alphabetically so merged-in entries
+                    // (e.g. upstream `@nuxt/kit`) end up in the expected position
+                    // and the generated package.json passes oxfmt/format:check.
+                    const sortObjectKeys = (obj) => {
+                        if (!obj)
+                            return obj;
+                        return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
+                    };
+                    pkg.dependencies = sortObjectKeys(pkg.dependencies);
+                    pkg.devDependencies = sortObjectKeys(pkg.devDependencies);
+                    pkg.peerDependencies = sortObjectKeys(pkg.peerDependencies);
+                    // Ensure trailing newline — oxfmt with the starter's .editorconfig
+                    // `insert_final_newline = true` requires it.
+                    filesystem.write(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
                 }
             }
             // ── 6. CLAUDE.md: prepend vendor marker + merge upstream sections ────
@@ -544,8 +555,8 @@ class FrontendHelper {
                         'project code. There is **no** `@lenne.tech/nuxt-extensions` npm dependency.',
                         '',
                         '- **Read framework code from `app/core/**`** — not from `node_modules/`.',
-                        '- **nuxt.config.ts** references `\'./app/core/module\'` instead of',
-                        '  `\'@lenne.tech/nuxt-extensions\'`.',
+                        "- **nuxt.config.ts** references `'./app/core/module'` instead of",
+                        "  `'@lenne.tech/nuxt-extensions'`.",
                         '- **Baseline + patch log** live in `app/core/VENDOR.md`. Log any',
                         '  substantial local change there so the `nuxt-extensions-core-updater`',
                         '  agent can classify it at sync time.',
@@ -595,13 +606,41 @@ class FrontendHelper {
                     '# @lenne.tech/nuxt-extensions (vendored)',
                     '',
                     'This directory is a curated vendor copy of `@lenne.tech/nuxt-extensions`.',
-                    'It is first-class project code, not a node_modules shadow copy.',
-                    'Edit freely; log substantial changes in the "Local changes" table below',
-                    'so the `nuxt-extensions-core-updater` agent can classify them at sync time.',
+                    'It is first-class project code, not a node_modules shadow copy — but it',
+                    'is **not a fork**. The copy exists so Claude Code (and humans) can read',
+                    'framework internals directly. Log substantial local changes in the',
+                    '"Local changes" table below so the `nuxt-extensions-core-updater` agent',
+                    'can classify them at sync time.',
                     '',
                     'Unlike the backend (nest-server) vendoring, no flatten-fix is needed —',
                     'the nuxt-extensions source structure is already flat.',
                     '',
+                    '## Modification Policy',
+                    '',
+                    'Edit `app/core/` **only** when the change is generally useful to every',
+                    '@lenne.tech/nuxt-extensions consumer:',
+                    '',
+                    '- Bugfixes that apply to every consumer',
+                    '- Broad framework enhancements (new composables, better defaults, SSR fixes)',
+                    '- Security vulnerability fixes',
+                    '- Type/config compatibility fixes every consumer would hit',
+                    '',
+                    'Everything else stays **outside** `app/core/`. Project-specific business',
+                    'rules, customer branding, and proprietary integrations belong in project',
+                    'code (`app/composables/`, `app/components/`, `app/middleware/`, plugin',
+                    'overrides).',
+                    '',
+                    'Generally-useful changes **MUST** be submitted as an upstream PR to',
+                    'https://github.com/lenneTech/nuxt-extensions. Run',
+                    '`/lt-dev:frontend:contribute-nuxt-extensions-core` to prepare it — the',
+                    'agent filters cosmetic commits, categorizes local changes as',
+                    'upstream-candidate vs. project-specific, and writes PR drafts for human',
+                    "review. Letting useful fixes rot in one project's vendor tree is an",
+                    'anti-pattern: they belong upstream so every consumer benefits and the',
+                    'local patch disappears on the next sync.',
+                    '',
+                    'When in doubt, ask before editing `app/core/`.',
+                    '',
                     '## Baseline',
                     '',
                     '- **Upstream-Repo:** https://github.com/lenneTech/nuxt-extensions',
@@ -612,22 +651,15 @@ class FrontendHelper {
                     '',
                     '## Sync history',
                     '',
-                    '| Date | From | To | Notes |',
-                    '| ---- | ---- | -- | ----- |',
-                    `| ${today} | — | ${syncHistoryTo} | scaffolded by lt CLI |`,
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'From', 'To', 'Notes'], [[today, '—', syncHistoryTo, 'scaffolded by lt CLI']]),
                     '',
                     '## Local changes',
                     '',
-                    '| Date | Commit | Scope | Reason | Status |',
-                    '| ---- | ------ | ----- | ------ | ------ |',
-                    '| — | — | (none, pristine) | initial vendor | — |',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'Commit', 'Scope', 'Reason', 'Status'], [['—', '—', '(none, pristine)', 'initial vendor', '—']]),
                     '',
                     '## Upstream PRs',
                     '',
-                    '| PR | Title | Commits | Status |',
-                    '| -- | ----- | ------- | ------ |',
-                    '| — | (none yet) | — | — |',
-                    '',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['PR', 'Title', 'Commits', 'Status'], [['—', '(none yet)', '—', '—']]),
                 ].join('\n'));
             }
             // ── Post-conversion verification ─────────────────────────────────────
@@ -749,9 +781,7 @@ class FrontendHelper {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
             const content = filesystem.read(absFile) || '';
-            const matches = typeof needle === 'string'
-                ? content.includes(needle)
-                : needle.test(content);
+            const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
             if (matches) {
                 stale.push(absFile.replace(`${appDir}/`, ''));
             }
@@ -800,10 +830,7 @@ class FrontendHelper {
     walkConsumerFiles(appDir) {
         const fs = require('node:fs');
         const path = require('node:path');
-        const searchDirs = [
-            path.join(appDir, 'app'),
-            path.join(appDir, 'tests'),
-        ];
+        const searchDirs = [path.join(appDir, 'app'), path.join(appDir, 'tests')];
         const allFiles = [];
         const walk = (dir) => {
             try {

package/build/extensions/git.js

@@ -119,8 +119,8 @@ class Git {
             const result = [];
             // Toolbox features
             const { system } = this.toolbox;
-            // Get branches
-            const branches = yield system.run('git fetch && git show-branch --list');
+            // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
+            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null; git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -251,11 +251,10 @@ class Git {
             if (opts.spin) {
                 searchSpin = spin(opts.spinText);
             }
-            // Update infos
-            const fetch = yield system.run('git fetch');
+            // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
+            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
-                process.exit(1);
             }
             // Search branch
             if (opts.exact) {

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const markdown_table_1 = require("../lib/markdown-table");
 /**
  * Server helper functions
  */
@@ -749,6 +750,13 @@ class Server {
                 catch (err) {
                     return { method: result.method, path: dest, success: false };
                 }
+                // Post-install format pass. processApiMode may have left whitespace
+                // artifacts (multi-line arrays/imports) that the formatter flags in
+                // format:check; oxfmt is only available after install, so we run it
+                // here.
+                if (apiMode) {
+                    yield apiModeHelper.formatProject(dest);
+                }
             }
             return { method: result.method, path: dest, success: true };
         });
@@ -890,9 +898,11 @@ class Server {
      *
      * In vendor mode we additionally clone `@lenne.tech/nest-server` to
      * /tmp, copy its framework kernel (`src/core/`, `src/index.ts`,
-     * `src/core.module.ts`, `src/test/`, `src/templates/`, `src/types/`,
-     * `LICENSE`, `bin/migrate.js`) into the project at `src/core/`
-     * applying the flatten-fix, remove `@lenne.tech/nest-server` from the
+     * `src/core.module.ts`, `src/test/`, `src/types/`, `LICENSE`,
+     * `bin/migrate.js`) into the project at `src/core/` applying the
+     * flatten-fix, place upstream `src/templates/` at `<project>/src/templates/`
+     * (outside core/ so the runtime resolver finds it at the same relative
+     * path as in npm mode), remove `@lenne.tech/nest-server` from the
      * project's `package.json`, merge the framework's transitive deps into
      * the project's own deps, and run an AST-based codemod that rewrites
      * every `from '@lenne.tech/nest-server'` import in consumer code
@@ -994,7 +1004,10 @@ class Server {
                 //
                 // Upstream layout: src/core/ (framework sub-dir) + src/index.ts +
                 // src/core.module.ts + src/test/ + src/templates/ + src/types/.
-                // Target layout: everything flat under <project>/src/core/.
+                // Target layout: most things flat under <project>/src/core/, with
+                // one exception: src/templates/ stays at the same upstream location
+                // (<project>/src/templates/) because the runtime email-template
+                // resolver uses __dirname-relative lookup that must match npm mode.
                 //
                 // We WIPE the starter's (non-existent in npm mode) src/core/ first
                 // just to guarantee idempotency when users run this twice.
@@ -1006,7 +1019,15 @@ class Server {
                     [`${tmpClone}/src/index.ts`, `${coreDir}/index.ts`],
                     [`${tmpClone}/src/core.module.ts`, `${coreDir}/core.module.ts`],
                     [`${tmpClone}/src/test`, `${coreDir}/test`],
-                    [`${tmpClone}/src/templates`, `${coreDir}/templates`],
+                    // src/templates/ stays OUTSIDE src/core/ at its upstream location so
+                    // the runtime template resolver (which computes
+                    // `__dirname + '../../../templates'` from within
+                    // src/core/modules/better-auth/) finds E-Mail templates at the same
+                    // relative path as in npm mode (node_modules/@lenne.tech/nest-server/
+                    // src/templates/). Keeping templates as first-class project files
+                    // outside core/ also lets projects customize them without touching
+                    // the vendored framework tree.
+                    [`${tmpClone}/src/templates`, `${dest}/src/templates`],
                     [`${tmpClone}/src/types`, `${coreDir}/types`],
                     [`${tmpClone}/LICENSE`, `${coreDir}/LICENSE`],
                 ];
@@ -1395,14 +1416,14 @@ class Server {
                             "var f=require('fs'),h=require('https');",
                             "try{var c=f.readFileSync('src/core/VENDOR.md','utf8')}catch(e){process.exit(0)}",
                             'var m=c.match(/Baseline-Version[^0-9]*(\\d+\\.\\d+\\.\\d+)/);',
-                            'if(!m){process.stderr.write(String.fromCharCode(9888)+\' vendor-freshness: no baseline\\n\');process.exit(0)}',
+                            "if(!m){process.stderr.write(String.fromCharCode(9888)+' vendor-freshness: no baseline\\n');process.exit(0)}",
                             'var v=m[1];',
                             "h.get('https://registry.npmjs.org/@lenne.tech/nest-server/latest',function(r){",
                             "var d='';r.on('data',function(c){d+=c});r.on('end',function(){",
-                            "try{var l=JSON.parse(d).version;",
+                            'try{var l=JSON.parse(d).version;',
                             "if(v===l)console.log('vendor core up-to-date (v'+v+')');",
                             "else process.stderr.write('vendor core v'+v+', latest v'+l+'\\n')",
-                            '}catch(e){}})}).on(\'error\',function(){});',
+                            "}catch(e){}})}).on('error',function(){});",
                             'setTimeout(function(){process.exit(0)},5000)',
                             '"',
                         ].join('');
@@ -1417,7 +1438,8 @@ class Server {
                                 return;
                             const installPrefix = 'pnpm install && ';
                             if (existing.startsWith(installPrefix)) {
-                                scripts[scriptName] = `${installPrefix}pnpm run check:vendor-freshness && ${existing.slice(installPrefix.length)}`;
+                                scripts[scriptName] =
+                                    `${installPrefix}pnpm run check:vendor-freshness && ${existing.slice(installPrefix.length)}`;
                             }
                             else {
                                 scripts[scriptName] = `pnpm run check:vendor-freshness && ${existing}`;
@@ -1485,7 +1507,7 @@ class Server {
                     ' * Vendor-mode stub for extras/sync-packages.mjs.',
                     ' *',
                     ' * The original script is designed for npm-mode projects where',
-                    " * `@lenne.tech/nest-server` is an installed dependency and",
+                    ' * `@lenne.tech/nest-server` is an installed dependency and',
                     ' * `pnpm run update` pulls the latest upstream deps into the',
                     ' * project package.json.',
                     ' *',
@@ -1547,7 +1569,7 @@ class Server {
                         '',
                         '- **Read framework code from `src/core/**`** — not from `node_modules/`.',
                         '- **Generated imports use relative paths** to `src/core`, e.g.',
-                        '  `import { CrudService } from \'../../../core\';`',
+                        "  `import { CrudService } from '../../../core';`",
                         '  The exact depth depends on the file location. `lt server module`',
                         '  computes it automatically.',
                         '- **Baseline + patch log** live in `src/core/VENDOR.md`. Log any',
@@ -1615,17 +1637,48 @@ class Server {
                     '',
                     'This directory is a curated vendor copy of the `core/` tree from',
                     '@lenne.tech/nest-server. It is first-class project code, not a',
-                    'node_modules shadow copy. Edit freely; log substantial changes in',
-                    'the "Local changes" table below so the `nest-server-core-updater`',
-                    'agent can classify them at sync time.',
+                    'node_modules shadow copy — but it is **not a fork**. The copy',
+                    'exists so Claude Code (and humans) can read framework internals',
+                    'directly. Log substantial local changes in the "Local changes"',
+                    'table below so the `nest-server-core-updater` agent can classify',
+                    'them at sync time.',
                     '',
                     'The flatten-fix was applied during `lt fullstack init`: the',
                     'upstream `src/index.ts`, `src/core.module.ts`, `src/test/`,',
-                    '`src/templates/`, `src/types/`, and `LICENSE` were moved under',
-                    '`src/core/` and their relative `./core/…` specifiers were',
-                    'stripped. See the init code in',
+                    '`src/types/`, and `LICENSE` were moved under `src/core/` and',
+                    'their relative `./core/…` specifiers were stripped. The upstream',
+                    '`src/templates/` tree (E-Mail templates) was placed at the',
+                    'project root `src/templates/` (outside `src/core/`) so the',
+                    'runtime template resolver finds them at the same relative path',
+                    'as in npm mode. See the init code in',
                     '`lenneTech/cli/src/extensions/server.ts#convertCloneToVendored`.',
                     '',
+                    '## Modification Policy',
+                    '',
+                    'Edit `src/core/` **only** when the change is generally useful to every',
+                    '@lenne.tech/nest-server consumer:',
+                    '',
+                    '- Bugfixes that apply to every consumer',
+                    '- Broad framework enhancements',
+                    '- Security vulnerability fixes',
+                    '- Build/TypeScript compatibility fixes every consumer would hit',
+                    '',
+                    'Everything else stays **outside** `src/core/`. Project-specific',
+                    'business rules, customer enums, and proprietary integrations',
+                    'belong in project code via modification, inheritance, extension,',
+                    'or `ICoreModuleOverrides`.',
+                    '',
+                    'Generally-useful changes **MUST** be submitted as an upstream PR',
+                    'to https://github.com/lenneTech/nest-server. Run',
+                    '`/lt-dev:backend:contribute-nest-server-core` to prepare it — the',
+                    'agent filters cosmetic commits, categorizes local changes as',
+                    'upstream-candidate vs. project-specific, and writes PR drafts for',
+                    "human review. Letting useful fixes rot in one project's vendor",
+                    'tree is an anti-pattern: they belong upstream so every consumer',
+                    'benefits and the local patch disappears on the next sync.',
+                    '',
+                    'When in doubt, ask before editing `src/core/`.',
+                    '',
                     '## Baseline',
                     '',
                     '- **Upstream-Repo:** https://github.com/lenneTech/nest-server',
@@ -1636,22 +1689,15 @@ class Server {
                     '',
                     '## Sync history',
                     '',
-                    '| Date | From | To | Notes |',
-                    '| ---- | ---- | -- | ----- |',
-                    `| ${today} | — | ${syncHistoryTo} | scaffolded by lt CLI |`,
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'From', 'To', 'Notes'], [[today, '—', syncHistoryTo, 'scaffolded by lt CLI']]),
                     '',
                     '## Local changes',
                     '',
-                    '| Date | Commit | Scope | Reason | Status |',
-                    '| ---- | ------ | ----- | ------ | ------ |',
-                    '| — | — | (none, pristine) | initial vendor | — |',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['Date', 'Commit', 'Scope', 'Reason', 'Status'], [['—', '—', '(none, pristine)', 'initial vendor', '—']]),
                     '',
                     '## Upstream PRs',
                     '',
-                    '| PR | Title | Commits | Status |',
-                    '| -- | ----- | ------- | ------ |',
-                    '| — | (none yet) | — | — |',
-                    '',
+                    ...(0, markdown_table_1.formatMarkdownTable)(['PR', 'Title', 'Commits', 'Status'], [['—', '(none yet)', '—', '—']]),
                 ].join('\n'));
             }
             // ── Post-conversion verification ──────────────────────────────────────
@@ -1842,10 +1888,7 @@ class Server {
         if (!this.filesystem.exists(tsconfigPath)) {
             return;
         }
-        const EXCLUDE_ENTRIES = [
-            'src/core/modules/migrate/templates/**/*.template.ts',
-            'src/core/test/**/*.ts',
-        ];
+        const EXCLUDE_ENTRIES = ['src/core/modules/migrate/templates/**/*.template.ts', 'src/core/test/**/*.ts'];
         try {
             // The upstream tsconfig files may contain comments — standard JSON parse
             // breaks on them. Use a regex-based patch as a fallback.
@@ -2080,9 +2123,7 @@ class Server {
                     print.warning('');
                     print.warning('⚠  VENDOR.md documents local patches in src/core/ that will be LOST:');
                     // Extract non-header table rows
-                    const rows = localChangesSection[0]
-                        .split('\n')
-                        .filter((l) => /^\|\s*\d{4}-/.test(l));
+                    const rows = localChangesSection[0].split('\n').filter((l) => /^\|\s*\d{4}-/.test(l));
                     for (const row of rows.slice(0, 5)) {
                         print.info(`  ${row.trim()}`);
                     }
@@ -2112,10 +2153,7 @@ class Server {
             for (const sourceFile of project.getSourceFiles()) {
                 let modified = false;
                 // Static imports + re-exports
-                for (const decl of [
-                    ...sourceFile.getImportDeclarations(),
-                    ...sourceFile.getExportDeclarations(),
-                ]) {
+                for (const decl of [...sourceFile.getImportDeclarations(), ...sourceFile.getExportDeclarations()]) {
                     const spec = decl.getModuleSpecifierValue();
                     if (!spec)
                         continue;
@@ -2182,7 +2220,8 @@ class Server {
                 const migrateCompiler = 'ts:./node_modules/@lenne.tech/nest-server/dist/core/modules/migrate/helpers/ts-compiler.js';
                 const migrateStore = '--store ./migrations-utils/migrate.js --migrations-dir ./migrations';
                 const migrateTemplate = './node_modules/@lenne.tech/nest-server/dist/core/modules/migrate/templates/migration-project.template.ts';
-                scripts['migrate:create'] = `f() { migrate create "$1" --template-file ${migrateTemplate} --migrations-dir ./migrations --compiler ${migrateCompiler}; }; f`;
+                scripts['migrate:create'] =
+                    `f() { migrate create "$1" --template-file ${migrateTemplate} --migrations-dir ./migrations --compiler ${migrateCompiler}; }; f`;
                 scripts['migrate:up'] = `migrate up ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:down'] = `migrate down ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:list'] = `migrate list ${migrateStore} --compiler ${migrateCompiler}`;
@@ -2262,8 +2301,7 @@ class Server {
                 let content = filesystem.read(gitignorePath) || '';
                 content = content
                     .split('\n')
-                    .filter((line) => !line.includes('scripts/vendor/sync-results') &&
-                    !line.includes('scripts/vendor/upstream-candidates'))
+                    .filter((line) => !line.includes('scripts/vendor/sync-results') && !line.includes('scripts/vendor/upstream-candidates'))
                     .join('\n');
                 filesystem.write(gitignorePath, content);
             }
@@ -2279,7 +2317,7 @@ class Server {
                 for (const f of staleRelativeImports.slice(0, 10)) {
                     print.info(`  ${f}`);
                 }
-                print.info('These imports must be manually rewritten to \'@lenne.tech/nest-server\'.');
+                print.info("These imports must be manually rewritten to '@lenne.tech/nest-server'.");
             }
         });
     }

package/build/lib/frontend-framework-detection.js

@@ -81,8 +81,7 @@ function findAppDir(startDir) {
     let current = path.resolve(startDir);
     const root = path.parse(current).root;
     while (current !== root) {
-        if ((0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.ts')) ||
-            (0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.js'))) {
+        if ((0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.ts')) || (0, node_fs_1.existsSync)(path.join(current, 'nuxt.config.js'))) {
             return current;
         }
         current = path.dirname(current);

package/build/lib/hoist-workspace-pnpm-config.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+/**
+ * pnpm workspace-scoped fields that must live at the workspace root.
+ * When present in sub-project package.json files, pnpm emits:
+ *
+ *   WARN  The field "<field>" was found in <path>. This will not take
+ *   effect. You should configure "<field>" at the root of the workspace
+ *   instead.
+ *
+ * Crucially, the WARN also means the values are silently ignored — CVE
+ * overrides defined only in projects/api/package.json never reach the
+ * install resolver. Hoisting them to the root fixes both the warning
+ * and the actual dependency-resolution behavior.
+ */
+const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ignoredOptionalDependencies'];
+/**
+ * Hoist workspace-scoped pnpm config from sub-projects into the root
+ * package.json. After this runs, sub-project package.json files no
+ * longer have `overrides`, `onlyBuiltDependencies`, or
+ * `ignoredOptionalDependencies`, and the root package.json contains
+ * the merged union.
+ *
+ * Idempotent: running twice has the same effect as running once.
+ *
+ * @param options.filesystem  Gluegun filesystem tool
+ * @param options.projectDir  Workspace root (contains pnpm-workspace.yaml)
+ * @param options.subProjects Sub-project dirs relative to projectDir
+ */
+function hoistWorkspacePnpmConfig(options) {
+    var _a;
+    const { filesystem, projectDir, subProjects } = options;
+    const rootPkgPath = `${projectDir}/package.json`;
+    if (!filesystem.exists(rootPkgPath))
+        return;
+    const rootPkg = filesystem.read(rootPkgPath, 'json');
+    if (!rootPkg)
+        return;
+    (_a = rootPkg.pnpm) !== null && _a !== void 0 ? _a : (rootPkg.pnpm = {});
+    let rootChanged = false;
+    for (const subDir of subProjects) {
+        const subPkgPath = `${projectDir}/${subDir}/package.json`;
+        if (!filesystem.exists(subPkgPath))
+            continue;
+        const subPkg = filesystem.read(subPkgPath, 'json');
+        if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+            continue;
+        let subChanged = false;
+        for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
+            const subValue = subPkg.pnpm[field];
+            if (subValue === undefined)
+                continue;
+            rootPkg.pnpm[field] = mergePnpmFieldValue(field, rootPkg.pnpm[field], subValue);
+            rootChanged = true;
+            delete subPkg.pnpm[field];
+            subChanged = true;
+        }
+        if (subChanged) {
+            // If the sub-project's pnpm section is now empty, drop it entirely.
+            if (subPkg.pnpm && Object.keys(subPkg.pnpm).length === 0) {
+                delete subPkg.pnpm;
+            }
+            filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+        }
+    }
+    if (rootChanged) {
+        filesystem.write(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
+    }
+}
+/**
+ * Merge two values for a pnpm workspace-scoped field.
+ *
+ * pnpm expects:
+ * - `overrides` → object ({pkg: version})
+ * - `onlyBuiltDependencies` → array of strings
+ * - `ignoredOptionalDependencies` → array of strings
+ *
+ * Arrays: deduplicated, alphabetically sorted union.
+ * Objects: sub-project values take precedence over root (sub-projects
+ * like nest-server-starter own the authoritative CVE override list for
+ * their transitive deps; the root usually only seeds cross-cutting
+ * handlebars/minimatch patches).
+ */
+function mergePnpmFieldValue(field, rootValue, subValue) {
+    if (field === 'onlyBuiltDependencies' || field === 'ignoredOptionalDependencies') {
+        const rootArr = Array.isArray(rootValue) ? rootValue : [];
+        const subArr = Array.isArray(subValue) ? subValue : [];
+        return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
+    }
+    const rootObj = rootValue && typeof rootValue === 'object' && !Array.isArray(rootValue)
+        ? rootValue
+        : {};
+    const subObj = subValue && typeof subValue === 'object' && !Array.isArray(subValue) ? subValue : {};
+    const merged = Object.assign(Object.assign({}, rootObj), subObj);
+    return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+}

package/build/lib/markdown-table.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatMarkdownTable = formatMarkdownTable;
+/**
+ * Build an oxfmt-compatible Markdown table with padded columns so that the
+ * generated file passes `oxfmt --check` without a reformat pass.
+ *
+ * Column width = max(header length, longest cell length, 3). Cells are
+ * padded with trailing spaces; the separator row uses `-` characters of
+ * the same width.
+ *
+ * Character width note: uses JavaScript `.length` (UTF-16 code units),
+ * which matches oxfmt's own accounting for typical BMP characters used
+ * in VENDOR.md generation (em-dash `—`, backticks, version strings).
+ *
+ * @param headers Column headers (top row)
+ * @param rows    Data rows; each row must have `headers.length` cells
+ * @returns       Lines ready to concatenate with `\n`
+ */
+function formatMarkdownTable(headers, rows) {
+    const columnCount = headers.length;
+    const widths = headers.map((h, i) => {
+        const cellMax = rows.reduce((max, row) => { var _a; return Math.max(max, ((_a = row[i]) !== null && _a !== void 0 ? _a : '').length); }, 0);
+        return Math.max(h.length, cellMax, 3);
+    });
+    const formatRow = (cells) => `| ${cells.map((cell, i) => cell.padEnd(widths[i])).join(' | ')} |`;
+    const lines = [formatRow(headers), `| ${widths.map((w) => '-'.repeat(w)).join(' | ')} |`];
+    for (const row of rows) {
+        const padded = Array.from({ length: columnCount }, (_, i) => { var _a; return (_a = row[i]) !== null && _a !== void 0 ? _a : ''; });
+        lines.push(formatRow(padded));
+    }
+    return lines;
+}

package/docs/VENDOR-MODE-WORKFLOW.md

@@ -11,6 +11,7 @@ Practical guide for converting a lenne.tech fullstack project from **npm mode**
 ## Table of Contents
 
 - [Prerequisites](#prerequisites)
+- [Vendor Modification Policy](#vendor-modification-policy)
 - [Part 1: Convert npm → vendor](#part-1-convert-npm--vendor)
 - [Part 2: Update in vendor mode](#part-2-update-in-vendor-mode)
 - [Part 3: Roll back vendor → npm](#part-3-roll-back-vendor--npm)
@@ -32,6 +33,78 @@ Before you start, make sure:
 
 ---
 
+## Vendor Modification Policy
+
+**Read this before you convert.** It shapes how you work in vendor mode.
+
+Vendoring copies the framework source into your project tree:
+
+- Backend: `projects/api/src/core/` (from `@lenne.tech/nest-server`)
+- Frontend: `projects/app/app/core/` (from `@lenne.tech/nuxt-extensions`)
+
+**This is a comprehension aid, not a fork.** The copy exists so Claude
+Code (and humans) can read framework internals directly — it is **not**
+an invitation to embed project-specific behavior in the framework tree.
+
+### When may I edit `core/`?
+
+Only when the change is **generally useful to every consumer** of the
+framework:
+
+| ✅ Valid reason to edit `core/` | ❌ Belongs in project code instead |
+|--------------------------------|------------------------------------|
+| Bugfix that every consumer hits | Customer-specific business rules |
+| Broad framework enhancement | Project tenant IDs, enums, branding |
+| Security vulnerability fix | Proprietary integration adapters |
+| TypeScript / build compatibility | Project-specific authorization logic |
+
+**Project-specific behavior belongs outside `core/`:**
+
+- Backend: extend/inherit from core classes, use `ICoreModuleOverrides`
+  on `CoreModule.forRoot()`
+- Frontend: use `app/composables/`, `app/components/`,
+  `app/middleware/`, or plugin overrides
+
+### Every generic change MUST flow back upstream
+
+If you fixed or improved something in `core/` that every consumer could
+benefit from, you MUST submit it as a pull request to the corresponding
+upstream repository:
+
+| Layer | Command | Upstream |
+|-------|---------|----------|
+| Backend | `/lt-dev:backend:contribute-nest-server-core` | https://github.com/lenneTech/nest-server |
+| Frontend | `/lt-dev:frontend:contribute-nuxt-extensions-core` | https://github.com/lenneTech/nuxt-extensions |
+
+The contributor command analyzes your local changes, filters cosmetic
+noise, categorizes commits as upstream-candidate vs. project-specific,
+cherry-picks candidates onto a branch in a fresh upstream clone, and
+drafts a PR body for your review. It **never auto-pushes** — you
+explicitly open the PR via normal GitHub flow.
+
+**Why this matters:** Without upstream flow-back, useful fixes rot in
+one project's vendor tree and conflict on every sync. Once merged
+upstream, the next `/lt-dev:*:update-*-core` sync picks the change up
+as upstream-delivered and the local patch disappears — clean state for
+everyone.
+
+### Where the policy is documented
+
+The same policy is enforced / surfaced in multiple places so you
+encounter it at every relevant touchpoint:
+
+- `projects/api/src/core/VENDOR.md` and `projects/app/app/core/VENDOR.md`
+  (inside every vendor project, auto-generated by the lt CLI)
+- Skills `nest-server-core-vendoring` and `nuxt-extensions-core-vendoring`
+  (lt-dev plugin)
+- Reviewer agents `backend-reviewer` and `frontend-reviewer`
+  (flag non-compliant changes in code reviews)
+- The contributor commands themselves
+
+When in doubt, **ask before editing `core/`**.
+
+---
+
 ## Part 1: Convert npm → vendor
 
 ### Step 1: Check status

package/docs/commands.md

@@ -230,7 +230,7 @@ lt server convert-mode --to <vendor|npm> [options]
 
 - **npm → vendor:**
   - Clones `@lenne.tech/nest-server` from GitHub at the specified tag (default: currently installed version)
-  - Copies `src/core/`, `src/index.ts`, `src/core.module.ts`, `src/test/`, `src/templates/`, `src/types/`, and `LICENSE` to `<api-root>/src/core/`
+  - Copies `src/core/`, `src/index.ts`, `src/core.module.ts`, `src/test/`, `src/types/`, and `LICENSE` to `<api-root>/src/core/`; places upstream `src/templates/` at `<api-root>/src/templates/` (outside `core/` so the runtime E-Mail template resolver works)
   - Applies flatten-fix on `index.ts`, `core.module.ts`, `test.helper.ts`, `core-persistence-model.interface.ts`
   - Rewrites all consumer imports from `'@lenne.tech/nest-server'` to relative paths
   - Merges upstream dependencies dynamically into `package.json`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -18,7 +18,11 @@
     "lt": "bin/lt"
   },
   "scripts": {
-    "check": "npm install && npm run format && npm run build && npm run start",
+    "c": "npm run check",
+    "cf": "npm run check:fix",
+    "check": "npm install && npm run format && npm run build && npm run check:start",
+    "check:fix": "npm install && npm audit fix && npm run format && npm run lint:fix && npm run build && npm run check:start",
+    "check:start": "bash scripts/check-cli-start.sh",
     "postinstall": "node bin/postinstall.js 2>/dev/null || true",
     "build": "npm run lint && npm run test && npm run clean-build && npm run compile && npm run copy-templates",
     "clean-build": "npx rimraf ./build",
@@ -53,20 +57,19 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1029.0",
+    "@aws-sdk/client-s3": "3.1032.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
     "axios": "1.15.0",
     "bcrypt": "6.0.0",
-    "ejs": "5.0.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "0.11.1",
     "js-yaml": "4.1.1",
     "lodash": "4.18.1",
     "open": "11.0.0",
-    "ts-morph": "27.0.2",
+    "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
-    "typescript": "6.0.2"
+    "typescript": "6.0.3"
   },
   "devDependencies": {
     "@lenne.tech/eslint-config-ts": "2.1.4",
@@ -76,23 +79,28 @@
     "@types/js-yaml": "4.0.9",
     "@types/lodash": "4.17.24",
     "@types/node": "25.6.0",
-    "@typescript-eslint/eslint-plugin": "8.58.1",
-    "@typescript-eslint/parser": "8.58.1",
+    "@typescript-eslint/eslint-plugin": "8.58.2",
+    "@typescript-eslint/parser": "8.58.2",
+    "ejs": "5.0.2",
     "eslint": "9.39.4",
     "eslint-config-prettier": "10.1.8",
     "husky": "9.1.7",
     "jest": "30.3.0",
-    "prettier": "3.8.2",
+    "prettier": "3.8.3",
     "rimraf": "6.1.3",
     "standard-version": "9.5.0",
     "ts-jest": "29.4.9"
   },
+  "//overrides": {
+    "semver@*": "Force latest semver across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
+  },
   "overrides": {
     "semver@*": "7.7.4"
   },
   "jest": {
     "testEnvironment": "node",
     "rootDir": "__tests__",
+    "testTimeout": 60000,
     "transform": {
       "^.+\\.tsx?$": [
         "ts-jest",