@lenne.tech/cli 1.32.0 → 1.33.0

package/build/commands/fullstack/update.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
+const heal_check_wrapper_1 = require("../../lib/heal-check-wrapper");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 /**
  * Update a fullstack workspace — mode-aware.
@@ -185,6 +186,18 @@ const NewCommand = {
                 info(`    ${changedPath}`);
             }
         }
+        // ── Self-heal: install/refresh the report-driven `check` wrapper ──────
+        //
+        // `lt fullstack init` ships `scripts/check.mjs` via the template clone, but
+        // pre-existing projects predate it. This idempotently installs the bundled
+        // wrapper (and rewrites the root `check`/`check:raw`) so a migrated project
+        // gets the quiet, report-driven check too. No-op once already wired.
+        const checkAsset = (0, path_1.join)(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
+        const changedCheck = (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset);
+        if (changedCheck.length > 0) {
+            info('');
+            success(`  Installed/updated the check wrapper: ${changedCheck.join(', ')}`);
+        }
         info('');
         info(colors.bold('For a comprehensive update of everything, use:'));
         info('');

package/build/extensions/frontend-helper.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
+const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
@@ -316,7 +317,6 @@ class FrontendHelper {
      */
     convertAppToNpmMode(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
             const { dest, targetVersion } = options;
             const { filesystem } = this.toolbox;
             const path = require('node:path');
@@ -375,13 +375,7 @@ class FrontendHelper {
                     // Remove vendor-specific scripts
                     if (pkg.scripts && typeof pkg.scripts === 'object') {
                         const scripts = pkg.scripts;
-                        delete scripts['check:vendor-freshness'];
-                        // Unhook freshness from check/check:fix/check:naf
-                        for (const scriptName of ['check', 'check:fix', 'check:naf']) {
-                            if ((_a = scripts[scriptName]) === null || _a === void 0 ? void 0 : _a.includes('check:vendor-freshness')) {
-                                scripts[scriptName] = scripts[scriptName].replace(/pnpm run check:vendor-freshness && /g, '');
-                            }
-                        }
+                        (0, check_freshness_hooks_1.unhookCheckFreshness)(scripts);
                     }
                     filesystem.write(pkgPath, pkg, { jsonIndent: 2 });
                 }
@@ -576,18 +570,9 @@ class FrontendHelper {
                             'setTimeout(function(){process.exit(0)},5000)',
                             '"',
                         ].join('');
-                        // Hook freshness into check scripts
-                        const hookFreshness = (scriptName) => {
-                            const existing = scripts[scriptName];
-                            if (!existing)
-                                return;
-                            if (existing.includes('check:vendor-freshness'))
-                                return;
-                            scripts[scriptName] = `pnpm run check:vendor-freshness && ${existing}`;
-                        };
-                        hookFreshness('check');
-                        hookFreshness('check:fix');
-                        hookFreshness('check:naf');
+                        // Hook freshness into the check scripts (targets check:raw, never the
+                        // check.mjs wrapper). See the shared lib helper.
+                        (0, check_freshness_hooks_1.hookCheckFreshness)(scripts);
                     }
                     // Sort dependency maps alphabetically so merged-in entries
                     // (e.g. upstream `@nuxt/kit`) end up in the expected position

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
@@ -1458,26 +1459,9 @@ class Server {
                             '"',
                         ].join('');
                         // Hook vendor-freshness as the first step of check / check:fix /
-                        // check:naf. Non-blocking (exit 0 even on mismatch), so it just
-                        // surfaces the warning at the top of the log.
-                        const hookFreshness = (scriptName) => {
-                            const existing = scripts[scriptName];
-                            if (!existing)
-                                return;
-                            if (existing.includes('check:vendor-freshness'))
-                                return;
-                            const installPrefix = 'pnpm install && ';
-                            if (existing.startsWith(installPrefix)) {
-                                scripts[scriptName] =
-                                    `${installPrefix}pnpm run check:vendor-freshness && ${existing.slice(installPrefix.length)}`;
-                            }
-                            else {
-                                scripts[scriptName] = `pnpm run check:vendor-freshness && ${existing}`;
-                            }
-                        };
-                        hookFreshness('check');
-                        hookFreshness('check:fix');
-                        hookFreshness('check:naf');
+                        // check:naf (non-blocking; surfaces a warning at the top of the log).
+                        // Targets check:raw — never the check.mjs wrapper. See lib helper.
+                        (0, check_freshness_hooks_1.hookCheckFreshness)(scripts);
                     }
                     filesystem.write(pkgPath, pkg, { jsonIndent: 2 });
                 }
@@ -2218,17 +2202,11 @@ class Server {
                 // (they'll come back via node_modules when nest-server is installed)
                 // We only remove deps that are ALSO in nest-server's package.json.
                 // For safety, we don't remove any dep the consumer might use directly.
-                // Remove vendor-specific scripts
+                // Remove vendor-specific scripts + unhook vendor-freshness (see lib helper).
                 const scripts = pkg.scripts || {};
-                delete scripts['check:vendor-freshness'];
                 delete scripts['vendor:sync'];
                 delete scripts['vendor:propose-upstream'];
-                // Unhook vendor-freshness from check / check:fix / check:naf
-                for (const key of ['check', 'check:fix', 'check:naf']) {
-                    if (scripts[key] && typeof scripts[key] === 'string') {
-                        scripts[key] = scripts[key].replace(/pnpm run check:vendor-freshness && /g, '');
-                    }
-                }
+                (0, check_freshness_hooks_1.unhookCheckFreshness)(scripts);
                 // Restore migrate scripts to npm-mode paths
                 const migrateCompiler = 'ts:./node_modules/@lenne.tech/nest-server/dist/core/modules/migrate/helpers/ts-compiler.js';
                 const migrateStore = '--store ./migrations-utils/migrate.js --migrations-dir ./migrations';

package/build/lib/check-freshness-hooks.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Helpers for (un)hooking the vendor-freshness step in a project's `check`
+ * scripts during vendor-mode conversion. Extracted so the logic is unit-tested
+ * (server.ts + frontend-helper.ts call these instead of inline closures).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hookCheckFreshness = hookCheckFreshness;
+exports.unhookCheckFreshness = unhookCheckFreshness;
+const WRAPPER_HINT = 'check.mjs';
+const FRESHNESS_STEP = 'pnpm run check:vendor-freshness';
+const INSTALL_PREFIX = 'pnpm install && ';
+/**
+ * Prepend the `check:vendor-freshness` step to the relevant check scripts.
+ *
+ * - Skips a script that already includes the step (idempotent) or that IS the
+ *   `node scripts/check.mjs` wrapper (the wrapper only orchestrates the real
+ *   chain — vendor-freshness belongs in that chain).
+ * - Targets `check:raw` instead of `check` when the project runs the wrapper,
+ *   so freshness becomes a step the wrapper executes.
+ * - Preserves a leading `pnpm install && ` so install stays first.
+ *
+ * Assumes the caller has already defined `scripts['check:vendor-freshness']`.
+ * Mutates `scripts` in place.
+ */
+function hookCheckFreshness(scripts) {
+    const hook = (name) => {
+        const existing = scripts[name];
+        if (!existing || existing.includes('check:vendor-freshness') || existing.includes(WRAPPER_HINT)) {
+            return;
+        }
+        scripts[name] = existing.startsWith(INSTALL_PREFIX)
+            ? `${INSTALL_PREFIX}${FRESHNESS_STEP} && ${existing.slice(INSTALL_PREFIX.length)}`
+            : `${FRESHNESS_STEP} && ${existing}`;
+    };
+    // Prefer the raw chain when the project runs the check.mjs wrapper.
+    hook(scripts['check:raw'] ? 'check:raw' : 'check');
+    hook('check:fix');
+    hook('check:naf');
+}
+/**
+ * Remove the vendor-freshness step (and its script) from a project's check
+ * scripts — the inverse of {@link hookCheckFreshness}, used when converting a
+ * project back to npm mode. Mutates `scripts` in place.
+ */
+function unhookCheckFreshness(scripts) {
+    delete scripts['check:vendor-freshness'];
+    for (const name of ['check', 'check:raw', 'check:fix', 'check:naf']) {
+        if (typeof scripts[name] === 'string') {
+            scripts[name] = scripts[name].replace(/pnpm run check:vendor-freshness && /g, '');
+        }
+    }
+}

package/build/lib/dev-patches.js

@@ -209,13 +209,16 @@ function patchPlaywrightConfig(file) {
         "let __ltDevEnvFile = '';",
         'for (let __ltDevDir = process.cwd(), __i = 0; __i < 6; __i++) {',
         "  const __candidate = __ltDevResolve(__ltDevDir, '.lt-dev/.env');",
-        '  if (__ltDevExists(__candidate)) { __ltDevEnvFile = __candidate; break; }',
+        '  if (__ltDevExists(__candidate)) {',
+        '    __ltDevEnvFile = __candidate;',
+        '    break;',
+        '  }',
         '  const __parent = __ltDevDirname(__ltDevDir);',
         '  if (__parent === __ltDevDir) break;',
         '  __ltDevDir = __parent;',
         '}',
         'if (__ltDevEnvFile) {',
-        '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
+        "  for (const __ln of __ltDevRead(__ltDevEnvFile, 'utf8').split(/\\r?\\n/)) {",
         '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
         '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
         '  }',

package/build/lib/heal-check-wrapper.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.healCheckWrapper = healCheckWrapper;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** Marker value for the report-driven check wrapper. */
+const WRAPPER = 'node scripts/check.mjs';
+/**
+ * Idempotently install the report-driven `check.mjs` wrapper into a project.
+ *
+ * Copies the bundled canonical wrapper to `<root>/scripts/check.mjs` and rewrites
+ * the root `package.json` so that `check` runs the wrapper while the original
+ * chain is preserved as `check:raw`. A no-op once already wired (so it is safe to
+ * run on every `lt fullstack update`).
+ *
+ * `lt fullstack init` already ships the wrapper via the template clone; this is
+ * the MIGRATION path that brings it into pre-existing projects.
+ *
+ * @param projectRoot Absolute path to the (workspace) project root.
+ * @param assetPath   Absolute path to the bundled canonical `check.mjs`.
+ * @returns The list of changed file paths (relative to `projectRoot`); empty when nothing changed.
+ */
+function healCheckWrapper(projectRoot, assetPath) {
+    const changed = [];
+    const pkgPath = (0, path_1.join)(projectRoot, 'package.json');
+    if (!(0, fs_1.existsSync)(pkgPath) || !(0, fs_1.existsSync)(assetPath)) {
+        return changed;
+    }
+    let pkg;
+    try {
+        pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf8'));
+    }
+    catch (_a) {
+        return changed;
+    }
+    const scripts = pkg.scripts;
+    // Only touch projects that actually define a `check` script.
+    if (!scripts || typeof scripts.check !== 'string') {
+        return changed;
+    }
+    // 1. Ensure scripts/check.mjs exists and matches the bundled canonical version.
+    const targetScript = (0, path_1.join)(projectRoot, 'scripts', 'check.mjs');
+    const bundled = (0, fs_1.readFileSync)(assetPath, 'utf8');
+    if (!(0, fs_1.existsSync)(targetScript) || (0, fs_1.readFileSync)(targetScript, 'utf8') !== bundled) {
+        (0, fs_1.mkdirSync)((0, path_1.dirname)(targetScript), { recursive: true });
+        (0, fs_1.copyFileSync)(assetPath, targetScript);
+        changed.push('scripts/check.mjs');
+    }
+    // 2. Wire package.json: `check` runs the wrapper; the original chain becomes `check:raw`.
+    if (scripts.check !== WRAPPER) {
+        if (!scripts['check:raw']) {
+            scripts['check:raw'] = scripts.check;
+        }
+        scripts.check = WRAPPER;
+        (0, fs_1.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+        changed.push('package.json');
+    }
+    return changed;
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -15,40 +15,41 @@ const js_yaml_1 = require("js-yaml");
  * overrides defined only in projects/api/package.json never reach the
  * install resolver. Hoisting them to the root fixes both the warning
  * and the actual dependency-resolution behavior.
+ *
+ * Object-valued fields (`overrides`, `allowBuilds`) merge key-by-key;
+ * array-valued fields union + dedupe + sort. `minimumReleaseAgeExclude`
+ * is hoisted too so a sub-project's first-party exemption (e.g.
+ * `@lenne.tech/*`) keeps working in the monorepo — otherwise the
+ * minimum-release-age gate would block freshly published own packages.
  */
-const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ignoredOptionalDependencies'];
-/**
- * pnpm 11 renamed `onlyBuiltDependencies` (string array) to `allowBuilds`
- * (a `{ pkg: boolean }` map). A migrated sub-project pnpm-workspace.yaml
- * usually carries BOTH for cross-version compatibility, but we must not
- * rely on the array twin always being present: we normalise `allowBuilds`
- * back into `onlyBuiltDependencies` before hoisting (see
- * `normalizeAllowBuilds`) so the build-allowlist survives into the pnpm-10
- * monorepo root even when the file only carries the pnpm-11 object form.
- */
-const PNPM11_BUILD_KEY = 'allowBuilds';
+const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
+const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
+const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS];
+const isArrayField = (field) => ARRAY_FIELDS.includes(field);
 /**
- * Hoist workspace-scoped pnpm config from sub-projects into the root
- * package.json. After this runs, sub-project package.json files no
- * longer have `overrides`, `onlyBuiltDependencies`, or
- * `ignoredOptionalDependencies`, and the root package.json contains
- * the merged union.
+ * Hoist workspace-scoped pnpm config from sub-projects into the monorepo
+ * root `pnpm-workspace.yaml`. After this runs, sub-project pnpm config
+ * (package.json#pnpm or a settings-only pnpm-workspace.yaml) is gone, and
+ * the root pnpm-workspace.yaml carries the merged union next to `packages:`.
+ *
+ * Why pnpm-workspace.yaml and not package.json#pnpm: the monorepo root
+ * pins pnpm 11 (via `packageManager`), and pnpm 11 SILENTLY IGNORES the
+ * `pnpm` block in package.json — overrides/build-allowlists/etc. declared
+ * there never take effect, regressing `pnpm audit` and the minimum-release
+ * -age exemptions. pnpm-workspace.yaml is the pnpm-recommended home and is
+ * read by both pnpm 10 and 11.
  *
  * Two sources are read per sub-project, because the two starters store
  * their pnpm config differently:
  *
- *   1. `<sub>/package.json` `pnpm` block — nest-server-starter, and
- *      nuxt-base-template before its pnpm-11 migration.
- *   2. `<sub>/pnpm-workspace.yaml` — nuxt-base-template after the
- *      migration. pnpm 11 silently ignores the `pnpm` block in
- *      package.json, so the template moved overrides into
- *      pnpm-workspace.yaml. Inside a monorepo that nested file would
- *      (a) not be hoisted by the old package.json-only logic, regressing
- *      the CVE overrides, and (b) declare a nested workspace root that
- *      conflicts with the monorepo's own pnpm-workspace.yaml. We hoist
- *      its fields into the root package.json (the lt-monorepo root pins
- *      pnpm@10 via `packageManager`, where package.json#pnpm IS honored)
- *      and remove the now-redundant nested file.
+ *   1. `<sub>/package.json` `pnpm` block — nest-server-starter, and any
+ *      template that has not migrated to the pnpm-11 layout yet.
+ *   2. `<sub>/pnpm-workspace.yaml` — nuxt-base-template (pnpm-11 layout).
+ *      Inside a monorepo that nested file would (a) not be hoisted if we
+ *      only read package.json, regressing the CVE overrides, and (b)
+ *      declare a nested workspace root that conflicts with the monorepo's
+ *      own pnpm-workspace.yaml. We hoist its fields into the root and
+ *      remove the now-redundant nested file.
  *
  * Symlinked sub-projects are skipped entirely: in `--frontend-link` /
  * `--api-link` mode `projects/app` (or `projects/api`) points at the
@@ -64,14 +65,11 @@ const PNPM11_BUILD_KEY = 'allowBuilds';
 function hoistWorkspacePnpmConfig(options) {
     var _a;
     const { filesystem, projectDir, subProjects } = options;
-    const rootPkgPath = `${projectDir}/package.json`;
-    if (!filesystem.exists(rootPkgPath))
-        return;
-    const rootPkg = filesystem.read(rootPkgPath, 'json');
-    if (!rootPkg)
-        return;
-    (_a = rootPkg.pnpm) !== null && _a !== void 0 ? _a : (rootPkg.pnpm = {});
-    const rootPnpm = rootPkg.pnpm;
+    const rootWsPath = `${projectDir}/pnpm-workspace.yaml`;
+    // The root pnpm-workspace.yaml is the destination. It normally exists (the
+    // lt-monorepo clone ships one declaring `packages:`); start from it so
+    // `packages:` and any root-owned settings are preserved.
+    const rootWs = (_a = readYaml(filesystem, rootWsPath)) !== null && _a !== void 0 ? _a : {};
     let rootChanged = false;
     for (const subDir of subProjects) {
         const subPath = `${projectDir}/${subDir}`;
@@ -81,27 +79,30 @@ function hoistWorkspacePnpmConfig(options) {
         // checkout in link mode.
         if (isSymlink(subPath))
             continue;
-        if (hoistFromSubPackageJson({ filesystem, rootPnpm, subPath })) {
+        if (hoistFromSubPackageJson({ filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
-        if (hoistFromSubWorkspaceYaml({ filesystem, rootPnpm, subPath })) {
+        if (hoistFromSubWorkspaceYaml({ filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
     }
     if (rootChanged) {
-        filesystem.write(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
+        // Keep allowBuilds (pnpm 11) and onlyBuiltDependencies (pnpm 10) in sync so
+        // the build-script allowlist survives regardless of which key pnpm reads.
+        syncBuildAllowlists(rootWs);
+        filesystem.write(rootWsPath, (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false }));
     }
 }
 /**
- * Move the workspace-scoped pnpm fields from `source` into `rootPnpm`,
+ * Move the workspace-scoped pnpm fields from `source` into `rootWs`,
  * deleting each moved field from `source`. Returns true if anything moved.
  */
-function hoistFields(rootPnpm, source) {
+function hoistFields(rootWs, source) {
     let changed = false;
     for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
         if (source[field] === undefined)
             continue;
-        rootPnpm[field] = mergePnpmFieldValue(field, rootPnpm[field], source[field]);
+        rootWs[field] = mergePnpmFieldValue(field, rootWs[field], source[field]);
         delete source[field];
         changed = true;
     }
@@ -109,14 +110,14 @@ function hoistFields(rootPnpm, source) {
 }
 /** Source 1: the sub-project's package.json `pnpm` block. */
 function hoistFromSubPackageJson(options) {
-    const { filesystem, rootPnpm, subPath } = options;
+    const { filesystem, rootWs, subPath } = options;
     const subPkgPath = `${subPath}/package.json`;
     if (!filesystem.exists(subPkgPath))
         return false;
     const subPkg = filesystem.read(subPkgPath, 'json');
     if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
         return false;
-    if (!hoistFields(rootPnpm, subPkg.pnpm))
+    if (!hoistFields(rootWs, subPkg.pnpm))
         return false;
     // If the sub-project's pnpm section is now empty, drop it entirely.
     if (Object.keys(subPkg.pnpm).length === 0) {
@@ -125,37 +126,23 @@ function hoistFromSubPackageJson(options) {
     filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
     return true;
 }
-/** Source 2: the sub-project's pnpm-workspace.yaml (pnpm-11 layout). */
+/** Source 2: the sub-project's pnpm-workspace.yaml. */
 function hoistFromSubWorkspaceYaml(options) {
-    const { filesystem, rootPnpm, subPath } = options;
+    const { filesystem, rootWs, subPath } = options;
     const subWsPath = `${subPath}/pnpm-workspace.yaml`;
     if (!filesystem.exists(subWsPath))
         return false;
-    const raw = filesystem.read(subWsPath);
-    if (!raw)
+    const ws = readYaml(filesystem, subWsPath);
+    if (!ws)
         return false;
-    let parsed;
-    try {
-        parsed = (0, js_yaml_1.load)(raw);
-    }
-    catch (_a) {
-        // Malformed YAML — leave it untouched rather than risk data loss.
-        return false;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-        return false;
-    const ws = parsed;
-    // Fold the pnpm-11 `allowBuilds` map into `onlyBuiltDependencies` so it is
-    // hoisted rather than discarded — even when the array twin is absent.
-    normalizeAllowBuilds(ws);
-    if (!hoistFields(rootPnpm, ws))
+    if (!hoistFields(rootWs, ws))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these
     // hoisted keys — once emptied it would only declare a nested workspace
     // root, so remove it. A file that declares `packages:` is a real (rare)
     // nested workspace; keep it minus the hoisted keys.
     if (Array.isArray(ws.packages) && ws.packages.length > 0) {
-        filesystem.write(subWsPath, (0, js_yaml_1.dump)(ws));
+        filesystem.write(subWsPath, (0, js_yaml_1.dump)(ws, { lineWidth: -1, sortKeys: false }));
     }
     else {
         filesystem.remove(subWsPath);
@@ -174,19 +161,16 @@ function isSymlink(path) {
 /**
  * Merge two values for a pnpm workspace-scoped field.
  *
- * pnpm expects:
- * - `overrides` → object ({pkg: version})
- * - `onlyBuiltDependencies` → array of strings
- * - `ignoredOptionalDependencies` → array of strings
+ * Arrays (`onlyBuiltDependencies`, `ignoredOptionalDependencies`,
+ * `minimumReleaseAgeExclude`): deduplicated, alphabetically sorted union.
  *
- * Arrays: deduplicated, alphabetically sorted union.
- * Objects: sub-project values take precedence over root (sub-projects
- * like nest-server-starter own the authoritative CVE override list for
- * their transitive deps; the root usually only seeds cross-cutting
- * handlebars/minimatch patches).
+ * Objects (`overrides`, `allowBuilds`): key-by-key merge where sub-project
+ * values take precedence over root (sub-projects like nest-server-starter
+ * own the authoritative CVE override list for their transitive deps; the
+ * root usually only seeds cross-cutting patches).
  */
 function mergePnpmFieldValue(field, rootValue, subValue) {
-    if (field === 'onlyBuiltDependencies' || field === 'ignoredOptionalDependencies') {
+    if (isArrayField(field)) {
         const rootArr = Array.isArray(rootValue) ? rootValue : [];
         const subArr = Array.isArray(subValue) ? subValue : [];
         return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
@@ -198,26 +182,55 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
     const merged = Object.assign(Object.assign({}, rootObj), subObj);
     return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
 }
+/** Parse a YAML file into a plain object, or null on missing/malformed/non-object. */
+function readYaml(filesystem, path) {
+    if (!filesystem.exists(path))
+        return null;
+    const raw = filesystem.read(path);
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(raw);
+    }
+    catch (_a) {
+        // Malformed YAML — leave it untouched rather than risk data loss.
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    return parsed;
+}
 /**
- * Fold a pnpm-11 `allowBuilds: { pkg: boolean }` map into the pnpm-10
- * `onlyBuiltDependencies: string[]` form (packages whose value is `true`),
- * unioned with any existing array, then remove the `allowBuilds` key so the
- * redundant object form does not linger. Mutates `ws` in place.
+ * Keep the two build-allowlist forms consistent and complete after hoisting:
+ * - `allowBuilds` (pnpm 11) is a `{ pkg: boolean }` map.
+ * - `onlyBuiltDependencies` (pnpm 10) is a `string[]` of allowed packages.
  *
- * No-op when `allowBuilds` is absent or not an object map — an unexpected
- * shape is left untouched rather than risk silent data loss.
+ * Sub-templates carry one or both (nest-server-starter only `allowBuilds`,
+ * nuxt-base-template both). After merging we derive the full set of allowed
+ * packages from BOTH forms and write back canonical, sorted twins so the
+ * allowlist survives whichever key the active pnpm version reads. Explicit
+ * `false` entries in `allowBuilds` are preserved (and excluded from the
+ * array). No-op when neither key is present. Mutates `ws` in place.
  */
-function normalizeAllowBuilds(ws) {
-    const raw = ws[PNPM11_BUILD_KEY];
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+function syncBuildAllowlists(ws) {
+    const arr = Array.isArray(ws.onlyBuiltDependencies) ? ws.onlyBuiltDependencies : [];
+    const obj = ws.allowBuilds && typeof ws.allowBuilds === 'object' && !Array.isArray(ws.allowBuilds)
+        ? ws.allowBuilds
+        : {};
+    if (arr.length === 0 && Object.keys(obj).length === 0)
         return;
-    const allowed = Object.entries(raw)
-        .filter(([, enabled]) => enabled === true)
-        .map(([pkg]) => pkg);
-    if (allowed.length > 0) {
-        const existing = Array.isArray(ws.onlyBuiltDependencies) ? ws.onlyBuiltDependencies : [];
-        // Order here is irrelevant — mergePnpmFieldValue sorts the union on hoist.
-        ws.onlyBuiltDependencies = Array.from(new Set([...allowed, ...existing]));
-    }
-    delete ws[PNPM11_BUILD_KEY];
+    // Every array entry implies allowBuilds[entry] = true unless already set.
+    const map = {};
+    for (const [pkg, enabled] of Object.entries(obj))
+        map[pkg] = enabled === true;
+    for (const pkg of arr)
+        if (map[pkg] === undefined)
+            map[pkg] = true;
+    const allowed = Object.entries(map)
+        .filter(([, enabled]) => enabled)
+        .map(([pkg]) => pkg)
+        .sort((a, b) => a.localeCompare(b));
+    ws.allowBuilds = Object.fromEntries(Object.entries(map).sort(([a], [b]) => a.localeCompare(b)));
+    ws.onlyBuiltDependencies = allowed;
 }

package/build/templates/check/check.mjs

@@ -0,0 +1,512 @@
+#!/usr/bin/env node
+/**
+ * Quiet, report-driven wrapper around the project `check` pipeline.
+ *
+ * Replaces the noisy `pnpm audit && pnpm -r --parallel run check` with:
+ *   - a minimal live view — one status line per running project (spinner +
+ *     current step), so you always see where the run is;
+ *   - abort on the first failing step, printing the captured reason;
+ *   - on success a report: the executed steps + their key metrics
+ *     (vulnerabilities per level, test counts per area Unit/API/Playwright, …);
+ *   - format + lint auto-fix every fixable finding (oxfmt writes, oxlint --fix);
+ *     only non-fixable lint errors then remain and fail the run.
+ *
+ * Flags:
+ *   --verbose / -v      stream the full tool output live (deep debugging)
+ *   --sequential/--seq  run projects one after another (default: parallel)
+ *   --no-fix            read-only gate — do not auto-fix format/lint
+ *   --project=<substr>  restrict to matching workspace projects (repeatable)
+ *
+ * Design: the per-project `check` scripts stay the single source of truth for
+ * WHAT runs. This wrapper discovers each workspace project's `check` chain,
+ * splits it on `&&`, and runs the steps with status + metrics — so adding or
+ * removing a step in a project's `check` needs no change here.
+ *
+ * Exit code: 0 when every step passed, 1 otherwise (preserves the contract the
+ * lt-dev `running-check-script` skill relies on: non-zero === failed).
+ */
+import { spawn } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const VERBOSE = process.argv.includes("--verbose") || process.argv.includes("-v");
+const SEQUENTIAL = process.argv.includes("--sequential") || process.argv.includes("--seq");
+const NO_FIX = process.argv.includes("--no-fix");
+const PROJECT_FILTERS = process.argv
+  .filter((a) => a.startsWith("--project="))
+  .map((a) => a.slice("--project=".length));
+// Verbose streams raw output, so the in-place live view is disabled there.
+const TTY = Boolean(process.stdout.isTTY) && !VERBOSE;
+
+// ── tiny ANSI helpers ──────────────────────────────────────────────────────
+const C = {
+  bold: (s) => `\x1b[1m${s}\x1b[0m`,
+  cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+  dim: (s) => `\x1b[2m${s}\x1b[0m`,
+  green: (s) => `\x1b[32m${s}\x1b[0m`,
+  red: (s) => `\x1b[31m${s}\x1b[0m`,
+  yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+};
+const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
+const shortRel = (rel) => rel.replace(/^projects\//, "");
+
+function fmtDuration(ms) {
+  const s = ms / 1000;
+  if (s < 60) return `${s.toFixed(1)}s`;
+  const m = Math.floor(s / 60);
+  return `${m}m ${Math.round(s - m * 60)}s`;
+}
+
+// ── step classification ────────────────────────────────────────────────────
+// Map a raw command from a `check` chain onto a stable kind + label so the
+// report stays readable regardless of the underlying tool (oxfmt/oxlint/tsc/…).
+function classify(cmd) {
+  const c = cmd.toLowerCase();
+  if (c.includes("vendor-freshness"))
+    return { fatal: false, kind: "vendor", label: "vendor-freshness" };
+  if (c.includes("audit")) return { fatal: true, kind: "audit", label: "audit" };
+  if (c.includes("format:check") || c.includes("oxfmt") || c.includes("prettier"))
+    return { fatal: true, kind: "format", label: "format" };
+  if (c.includes("lint")) return { fatal: true, kind: "lint", label: "lint" };
+  if (/(^|&|\s)(pnpm\s+)?test(:|\s|$)|vitest|jest|test:unit|test:ci/.test(c))
+    return { fatal: true, kind: "test", label: "test" };
+  if (c.includes("build") || c.includes("nuxt build") || c.includes("tsc"))
+    return { fatal: true, kind: "build", label: "build" };
+  if (c.includes("check-server-start") || c.includes("server-start"))
+    return { fatal: true, kind: "server", label: "server-start" };
+  return { fatal: true, kind: "other", label: cmd.length > 32 ? `${cmd.slice(0, 29)}…` : cmd };
+}
+
+// Rewrite a check-only format/lint command into its auto-fixing variant, so a
+// `check` run repairs every fixable finding instead of only reporting it.
+function toFixCommand(kind, cmd) {
+  if (NO_FIX) return cmd;
+  if (kind === "format") {
+    if (/\bformat:check\b/.test(cmd)) return cmd.replace(/\bformat:check\b/, "format");
+    if (/\boxfmt\b/.test(cmd)) return cmd.replace(/\s--check\b/, "");
+    if (/\bprettier\b/.test(cmd)) return cmd.replace(/\s--check\b/, " --write");
+    return cmd;
+  }
+  if (kind === "lint") {
+    if (/\blint:fix\b/.test(cmd) || /--fix\b/.test(cmd)) return cmd;
+    if (/\brun\s+lint\b/.test(cmd)) return cmd.replace(/\brun\s+lint\b/, "run lint:fix");
+    if (/\boxlint\b/.test(cmd)) return cmd.replace(/\boxlint\b/, "oxlint --fix --fix-suggestions");
+    return cmd;
+  }
+  return cmd;
+}
+
+// ── metric parsers ─────────────────────────────────────────────────────────
+function parseVitest(out) {
+  const clean = stripAnsi(out);
+  const tests = clean.match(/Tests\s+(?:(\d+)\s+failed[^\n]*?)?(\d+)\s+passed/i);
+  const files = clean.match(/Test Files\s+(?:(\d+)\s+failed[^\n]*?)?(\d+)\s+passed/i);
+  const failed = clean.match(/Tests\s+(\d+)\s+failed/i);
+  if (!tests && !files) return null;
+  return {
+    failed: failed ? Number(failed[1]) : 0,
+    files: files ? Number(files[2]) : null,
+    passed: tests ? Number(tests[2]) : null,
+  };
+}
+function parseLint(out) {
+  const clean = stripAnsi(out);
+  const summary = clean.match(/Found\s+(\d+)\s+warnings?(?:\s+and\s+(\d+)\s+errors?)?/i);
+  if (summary) return { errors: summary[2] ? Number(summary[2]) : 0, warnings: Number(summary[1]) };
+  return {
+    errors: (clean.match(/\berror\b/gi) || []).length,
+    warnings: (clean.match(/\bwarning\b/g) || []).length,
+  };
+}
+
+// ── audit (faithful: runs the project's OWN audit command) ──────────────────
+const SEVERITIES = ["critical", "high", "moderate", "low", "info"];
+
+// Run the audit command exactly as the check chain defines it (same scope /
+// --prod / --audit-level), only appending --json for the counts. The gate is
+// the command's own exit code, so `check` blocks precisely when a bare
+// `<auditCmd>` would — never with a narrower scope than the chain. (The old
+// hardcoded `--prod` hid devDependency vulns for library packages.)
+async function runAudit(auditCmd) {
+  const cmd = /(^|\s)--json(\s|$)/.test(auditCmd) ? auditCmd : `${auditCmd} --json`;
+  const { code, out } = await capture(cmd, ROOT);
+  let counts = null;
+  try {
+    counts = JSON.parse(out.slice(out.indexOf("{")))?.metadata?.vulnerabilities ?? null;
+  } catch {
+    /* fall through to raw reason */
+  }
+  const total = counts ? SEVERITIES.reduce((n, s) => n + (counts[s] || 0), 0) : 0;
+  return { auditCmd, blocking: code !== 0, counts, reason: counts ? null : out, total };
+}
+
+// ── command runner ─────────────────────────────────────────────────────────
+const RUNNING = new Set();
+function capture(cmd, cwd) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, { cwd, shell: true });
+    RUNNING.add(child);
+    let out = "";
+    const onData = (d) => {
+      out += d;
+      if (VERBOSE) process.stdout.write(d);
+    };
+    child.stdout.on("data", onData);
+    child.stderr.on("data", onData);
+    const done = (code, extra) => {
+      RUNNING.delete(child);
+      resolve({ code, out: extra ? `${out}\n${extra}` : out });
+    };
+    child.on("close", (code) => done(code ?? 1));
+    child.on("error", (err) => done(1, err.message));
+  });
+}
+function killAll() {
+  for (const child of RUNNING) {
+    try {
+      child.kill("SIGTERM");
+    } catch {
+      /* already gone */
+    }
+  }
+}
+
+// ── live multi-line status (one line per running project) ────────────────────
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+let liveCount = 0;
+let frame = 0;
+function drawLive(lines) {
+  if (!TTY) return;
+  if (liveCount > 0) process.stdout.write(`\x1b[${liveCount}A`);
+  for (const l of lines) process.stdout.write(`\r\x1b[K${l}\n`);
+  liveCount = lines.length;
+}
+function statusLines(order, states) {
+  frame += 1;
+  return order.map((rel) => {
+    const s = states.get(rel);
+    if (s.failed) return `${C.red("✗")} ${shortRel(rel).padEnd(5)} ${C.red(`${s.failed} FAILED`)}`;
+    if (s.done)
+      return `${C.green("✓")} ${shortRel(rel).padEnd(5)} ${C.dim(`done (${fmtDuration(s.total)})`)}`;
+    const spin = C.cyan(FRAMES[frame % FRAMES.length]);
+    const el = s.stepStart ? C.dim(` (${fmtDuration(Date.now() - s.stepStart)})`) : "";
+    return `${spin} ${shortRel(rel).padEnd(5)} ${s.current || "queued"}${el}`;
+  });
+}
+
+// ── project discovery + step grouping ────────────────────────────────────────
+const IS_ORCHESTRATOR = (script) => !script || script.includes("check.mjs");
+
+// Read the `packages:` globs from pnpm-workspace.yaml (monorepos). A simple
+// value-list parse — enough for the globs lt projects use (e.g. `projects/*`).
+function workspaceGlobs() {
+  let text;
+  try {
+    text = readFileSync(join(ROOT, "pnpm-workspace.yaml"), "utf8");
+  } catch {
+    return [];
+  }
+  const globs = [];
+  let inPackages = false;
+  for (const raw of text.split("\n")) {
+    const line = raw.replace(/#.*$/, "");
+    if (/^packages:\s*$/.test(line)) {
+      inPackages = true;
+      continue;
+    }
+    if (inPackages) {
+      const m = line.match(/^\s*-\s*['"]?([^'"]+?)['"]?\s*$/);
+      if (m) globs.push(m[1]);
+      else if (line.trim() && !/^\s/.test(line)) break; // next top-level key
+    }
+  }
+  return globs;
+}
+
+// Expand a workspace glob to concrete directories (handles `dir/*` and literals).
+function expandGlob(glob) {
+  if (glob.endsWith("/*")) {
+    const base = glob.slice(0, -2);
+    try {
+      return readdirSync(join(ROOT, base), { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => join(base, d.name));
+    } catch {
+      return [];
+    }
+  }
+  return [glob];
+}
+
+function asProject(rel, check) {
+  let pkg = {};
+  try {
+    pkg = JSON.parse(
+      readFileSync(
+        rel === "." ? join(ROOT, "package.json") : join(ROOT, rel, "package.json"),
+        "utf8",
+      ),
+    );
+  } catch {
+    /* keep defaults */
+  }
+  return { check, dir: rel === "." ? ROOT : join(ROOT, rel), name: pkg.name || rel, rel };
+}
+
+// Workspace sub-projects whose `check` is a real chain; if there are none (a
+// single-package repo), fall back to the root project — whose real chain lives
+// in `check:raw`, because the root `check` is THIS wrapper.
+function discoverProjects() {
+  const projects = [];
+  for (const glob of workspaceGlobs()) {
+    for (const rel of expandGlob(glob)) {
+      let pkg;
+      try {
+        pkg = JSON.parse(readFileSync(join(ROOT, rel, "package.json"), "utf8"));
+      } catch {
+        continue;
+      }
+      if (!IS_ORCHESTRATOR(pkg.scripts?.check)) projects.push(asProject(rel, pkg.scripts.check));
+    }
+  }
+  if (projects.length === 0) {
+    const root = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+    const chain =
+      root.scripts?.["check:raw"] ??
+      (IS_ORCHESTRATOR(root.scripts?.check) ? null : root.scripts?.check);
+    if (chain) projects.push(asProject(".", chain));
+  }
+  if (PROJECT_FILTERS.length)
+    return projects.filter((p) =>
+      PROJECT_FILTERS.some((f) => p.rel.includes(f) || p.name.includes(f)),
+    );
+  return projects;
+}
+
+// One group per project: its ordered, fix-mapped steps. The audit step is
+// hoisted to a single workspace-level run; its EXACT command (scope + level +
+// package manager) is captured so the run mirrors the chain's own audit.
+function buildGroups(projects) {
+  let auditCmd = null;
+  const groups = projects.map((project) => {
+    const steps = [];
+    for (const raw of project.check
+      .split("&&")
+      .map((s) => s.trim())
+      .filter(Boolean)) {
+      const meta = classify(raw);
+      if (meta.kind === "audit") {
+        if (!auditCmd) auditCmd = raw;
+        continue;
+      }
+      steps.push({ ...meta, cmd: toFixCommand(meta.kind, raw), cwd: project.dir });
+    }
+    return { project, steps };
+  });
+  return { auditCmd, groups };
+}
+
+// ── per-project runner ───────────────────────────────────────────────────────
+// Runs a group's steps in order, recording results + live state. Stops early
+// when another project already failed (abort.hit).
+async function runGroup(group, states, results, abort) {
+  const rel = group.project.rel;
+  const st = states.get(rel);
+  const startedAt = Date.now();
+  for (const step of group.steps) {
+    if (abort.hit) return;
+    st.current = step.label;
+    st.stepStart = Date.now();
+    if (!TTY) process.stdout.write(`  ${C.dim("→")} ${shortRel(rel)} · ${step.label}\n`);
+    const { code, out } = await capture(step.cmd, step.cwd);
+    const dur = Date.now() - st.stepStart;
+    const r = { dur, kind: step.kind, label: step.label, project: rel };
+    if (step.kind === "test") r.tests = parseVitest(out);
+    if (step.kind === "lint") r.lint = parseLint(out);
+    results.push(r);
+    if (code !== 0 && step.fatal) {
+      st.failed = step.label;
+      if (!abort.hit) {
+        abort.hit = true;
+        abort.failure = { out, project: rel, step: `${shortRel(rel)} · ${step.label}` };
+        killAll();
+      }
+      return;
+    }
+    if (!TTY)
+      process.stdout.write(
+        `  ${C.green("✓")} ${shortRel(rel)} · ${step.label}${metricSuffix(r)} ${C.dim(`(${fmtDuration(dur)})`)}\n`,
+      );
+  }
+  st.done = true;
+  st.total = Date.now() - startedAt;
+}
+
+// ── main ─────────────────────────────────────────────────────────────────────
+async function main() {
+  const started = Date.now();
+  const projects = discoverProjects();
+  if (projects.length === 0) {
+    console.error(C.red("No workspace projects with a `check` script found."));
+    process.exit(1);
+  }
+  const { auditCmd, groups } = buildGroups(projects);
+  const stepCount = groups.reduce((n, g) => n + g.steps.length, 0) + (auditCmd ? 1 : 0);
+  const mode = SEQUENTIAL ? "sequential" : "parallel";
+  const pkgName = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).name;
+
+  console.log(C.bold(`\nRunning checks for ${C.cyan(pkgName)}`));
+  console.log(
+    C.dim(
+      `${projects.length} project(s) · ${stepCount} steps · ${mode} · audit: ${auditCmd ?? "none"}` +
+        `${NO_FIX ? "" : " · auto-fix format+lint"}${VERBOSE ? " · verbose" : ""}\n`,
+    ),
+  );
+
+  const results = [];
+
+  // Step 0 — single workspace audit (blocking gate, runs before the fan-out).
+  // Mirrors the chain's own audit command (scope/level/PM); skipped only when
+  // the chain has no audit step.
+  if (auditCmd) {
+    const t = Date.now();
+    if (!TTY) process.stdout.write(`  ${C.dim("→")} audit\n`);
+    else drawLive([`${C.cyan(FRAMES[0])} audit`]);
+    const audit = await runAudit(auditCmd);
+    liveCount = 0;
+    const dur = Date.now() - t;
+    if (audit.blocking) {
+      const summary = audit.counts
+        ? `${audit.total} vuln (${renderVulnLine(audit.counts)})`
+        : "failed";
+      console.log(`${C.red("✗")} audit  ${C.red(summary)} ${C.dim(`(${fmtDuration(dur)})`)}`);
+      return fail(
+        `audit (${auditCmd})`,
+        audit.counts ? renderVulnLine(audit.counts) : audit.reason,
+        started,
+      );
+    }
+    console.log(
+      `${C.green("✓")} audit  ${audit.counts ? renderVulnLine(audit.counts) : C.dim("0")} ${C.dim(`(${fmtDuration(dur)})`)}`,
+    );
+    results.push({ audit, kind: "audit" });
+  }
+
+  // Per-project steps — parallel by default, serial with --sequential.
+  const order = groups.map((g) => g.project.rel);
+  const states = new Map(order.map((rel) => [rel, { current: "queued" }]));
+  const abort = { failure: null, hit: false };
+  const ticker = TTY ? setInterval(() => drawLive(statusLines(order, states)), 80) : null;
+  if (TTY) drawLive(statusLines(order, states));
+
+  if (SEQUENTIAL) {
+    for (const g of groups) {
+      await runGroup(g, states, results, abort);
+      if (abort.hit) break;
+    }
+  } else {
+    await Promise.all(groups.map((g) => runGroup(g, states, results, abort)));
+  }
+
+  if (ticker) clearInterval(ticker);
+  if (TTY) drawLive(statusLines(order, states)); // final frame
+
+  if (abort.hit) return fail(abort.failure.step, abort.failure.out, started);
+
+  report(started, results);
+  process.exit(0);
+}
+
+// ── rendering helpers ─────────────────────────────────────────────────────────
+function renderVulnLine(counts) {
+  return SEVERITIES.map((s) => {
+    const n = counts[s] || 0;
+    const txt = `${s} ${n}`;
+    if (n > 0 && (s === "critical" || s === "high")) return C.red(txt);
+    return n > 0 ? C.yellow(txt) : C.dim(txt);
+  }).join(C.dim(" · "));
+}
+
+function metricSuffix(r) {
+  if (r.kind === "test" && r.tests?.passed != null) {
+    const failed = r.tests.failed ? C.red(` / ${r.tests.failed} failed`) : "";
+    return `  ${C.dim(`${r.tests.passed} passed${r.tests.files != null ? ` / ${r.tests.files} files` : ""}`)}${failed}`;
+  }
+  if (r.kind === "lint" && r.lint) {
+    return r.lint.warnings > 0
+      ? `  ${C.yellow(`${r.lint.warnings} warning${r.lint.warnings === 1 ? "" : "s"}`)}`
+      : `  ${C.dim("clean")}`;
+  }
+  return "";
+}
+
+function fail(stepLabel, reason, started) {
+  console.log(`\n${C.red(`──── reason · ${stepLabel} ────`)}`);
+  console.log(stripAnsi(String(reason)).trimEnd().split("\n").slice(-40).join("\n"));
+  console.log(C.red("────────────────────────────────────────\n"));
+  console.log(
+    C.bold(
+      C.red(`✗ Check FAILED at step "${stepLabel}" after ${fmtDuration(Date.now() - started)}.`),
+    ),
+  );
+  console.log(C.dim("Re-run with --verbose for the full output of every step."));
+  process.exit(1);
+}
+
+function report(started, results) {
+  const audit = results.find((r) => r.kind === "audit")?.audit;
+  const tests = results.filter((r) => r.kind === "test");
+  const unit = tests.find((r) => r.project?.includes("app"))?.tests;
+  const api = tests.find((r) => r.project?.includes("api"))?.tests;
+  const totalPassed = tests.reduce((n, r) => n + (r.tests?.passed || 0), 0);
+
+  const bar = "═".repeat(52);
+  console.log(`\n${C.green(bar)}`);
+  console.log(
+    C.bold(`  ${C.green("✓ Check PASSED")}  ${C.dim(`(${fmtDuration(Date.now() - started)})`)}`),
+  );
+  console.log(C.green(bar));
+
+  console.log(`\n${C.bold("Steps")}`);
+  for (const r of results.filter((x) => x.kind !== "audit")) {
+    console.log(
+      `  ${C.green("✓")} ${`${shortRel(r.project)} · ${r.label}`.padEnd(26)}${metricSuffix(r) || "  "} ${C.dim(`(${fmtDuration(r.dur)})`)}`,
+    );
+  }
+
+  console.log(
+    `\n${C.bold("Vulnerabilities")} ${C.dim(audit ? `(${audit.auditCmd})` : "(no audit step)")}`,
+  );
+  console.log(
+    `  ${audit?.counts ? renderVulnLine(audit.counts) : C.dim(audit ? "counts unavailable" : "—")}`,
+  );
+
+  console.log(`\n${C.bold("Tests")}`);
+  if (unit || api) {
+    // Monorepo with app and/or api projects → the canonical area breakdown.
+    console.log(
+      `  ${"Unit (app)".padEnd(18)}${unit?.passed != null ? `${unit.passed} passed` : C.dim("—")}`,
+    );
+    console.log(
+      `  ${"API (api)".padEnd(18)}${api?.passed != null ? `${api.passed} passed` : C.dim("—")}`,
+    );
+    console.log(`  ${"Playwright".padEnd(18)}${C.dim("— (run via `lt dev test` / CI)")}`);
+  } else {
+    // Single-package repo → one line per test-bearing project.
+    for (const r of tests)
+      console.log(
+        `  ${shortRel(r.project).padEnd(18)}${r.tests?.passed != null ? `${r.tests.passed} passed` : C.dim("—")}`,
+      );
+    if (tests.length === 0) console.log(`  ${C.dim("no test step")}`);
+  }
+  console.log(`  ${C.bold("Total".padEnd(18))}${C.bold(`${totalPassed} passed`)}`);
+
+  console.log(`\n${C.green("All checks passed.")}\n`);
+}
+
+main().catch((err) => {
+  console.error(C.red(`\ncheck.mjs crashed: ${err?.stack || err}`));
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -104,14 +104,16 @@
     "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
     "js-yaml": "Security fix: GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling) in js-yaml <=4.1.1. Forces 4.2.0 everywhere, incl. the 3.14.2 pulled transitively by @istanbuljs/load-nyc-config under babel-plugin-istanbul (jest coverage); that loader only runs js-yaml when reading a YAML nyc config, which this project does not use. Remove once the jest toolchain resolves js-yaml >=4.2.0 itself.",
     "form-data": "Security fix: GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped multipart field names) in form-data 4.0.0-4.0.5 - transitive via axios. Remove once axios pins form-data >=4.0.6.",
-    "@babel/core": "Security fix: GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL) in @babel/core <=7.29.0 - transitive via the jest toolchain. Remove once jest resolves @babel/core >=7.29.6."
+    "@babel/core": "Security fix: GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL) in @babel/core <=7.29.0 - transitive via the jest toolchain. Remove once jest resolves @babel/core >=7.29.6.",
+    "undici": "Security fix: GHSA-vmh5-mc38-953g (TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent) and GHSA-pr7r-676h-xcf6 (cross-user info disclosure via shared cache whitespace bypass) in undici 7.0.0-7.27.2 - transitive via jsdom (jest test environment). Forces 7.28.0, which satisfies jsdom's ^7.25.0 range. Remove once jsdom resolves undici >=7.28.0."
   },
   "overrides": {
     "@babel/core": "7.29.7",
     "brace-expansion@5.0.2 - 5.0.5": "5.0.6",
     "form-data": "4.0.6",
     "js-yaml": "4.2.0",
-    "semver@*": "7.8.1"
+    "semver@*": "7.8.1",
+    "undici": "7.28.0"
   },
   "jest": {
     "testEnvironment": "node",