@lenne.tech/cli 1.33.0 → 1.35.0

package/build/extensions/server.js

@@ -1006,6 +1006,20 @@ class Server {
                 // Best-effort — if we can't read upstream pkg, the starter's own
                 // deps should still cover most of the framework's needs.
             }
+            // Snapshot the upstream lockfile too. The shallow clone ships
+            // pnpm-lock.yaml, which pins EXACT versions for every transitive
+            // dependency the vendored core imports directly (cron, jose,
+            // fs-capacitor, graphql-ws, ws, …) but that nest-server never declares
+            // as a direct dep. Step 5b below resolves the core's import closure
+            // against this so those packages become direct project deps.
+            let upstreamLockRaw = '';
+            try {
+                upstreamLockRaw = filesystem.read(`${tmpClone}/pnpm-lock.yaml`) || '';
+            }
+            catch (_b) {
+                // Best-effort — without the lockfile, the closure step falls back to
+                // the upstream package.json ranges (still better than nothing).
+            }
             // Snapshot the upstream CLAUDE.md for section-merge into projects/api/CLAUDE.md.
             // The nest-server CLAUDE.md contains framework-specific instructions that
             // Claude Code needs to work correctly with the vendored source (API conventions,
@@ -1018,7 +1032,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_b) {
+            catch (_c) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1027,7 +1041,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_c) {
+            catch (_d) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1310,7 +1324,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_d) {
+                    catch (_e) {
                         // skip unreadable file
                     }
                 }
@@ -1319,25 +1333,74 @@ class Server {
             // above works indirectly (via `bin/migrate.js` loading ts-node first),
             // but it's fragile: if somebody invokes migrate.js standalone, `require
             // ('../src/core')` would crash because Node cannot load TypeScript.
-            // Replace the file with the explicit, imo-pilot-proven variant that
-            // registers ts-node itself BEFORE requiring the vendored core and
-            // points at the specific migration.helper path (not the index hub).
+            //
+            // Two things this file must get right, both learned the hard way:
+            //   1. ts-node is registered ONLY when the core next to it is still
+            //      TypeScript. In the production image everything is compiled and
+            //      ts-node is pruned, so an unconditional `require('./ts-compiler')`
+            //      would throw MODULE_NOT_FOUND and — under `set -e` in the
+            //      entrypoint — take the whole container down before the server starts.
+            //   2. The Mongo URI comes from resolveMongoUri(), which falls back to
+            //      NSC__MONGOOSE__URI when config.env.ts is not loadable (Docker).
+            //      Reading `config.default.mongoose.uri` directly crashes there.
             const migrateJsPath = `${dest}/migrations-utils/migrate.js`;
-            filesystem.write(migrateJsPath, [
-                '// The vendored core is TypeScript-only (no prebuilt dist/). Register ts-node (via our',
-                '// custom bootstrap) before requiring any vendor module, so that .ts source files are',
-                '// transparently compiled on demand. Uses the same compiler config as the migrate CLI.',
-                "require('./ts-compiler');",
-                '',
-                "const { createMigrationStore } = require('../src/core/modules/migrate/helpers/migration.helper');",
-                "const config = require('../src/config.env');",
-                '',
-                'module.exports = createMigrationStore(',
-                '  config.default.mongoose.uri,',
-                "  'migrations' // optional, default is 'migrations'",
-                ');',
-                '',
-            ].join('\n'));
+            const migrateStoreTemplate = filesystem.read(path.join(__dirname, '..', 'templates', 'vendor-scripts', 'migrate-store.js'));
+            if (!migrateStoreTemplate) {
+                throw new Error('CLI build is missing templates/vendor-scripts/migrate-store.js — cannot generate migrations-utils/migrate.js.');
+            }
+            filesystem.write(migrateJsPath, migrateStoreTemplate);
+            // The generated migrate.js does `require('./mongo-uri')` (resolveMongoUri).
+            // Unlike ts-compiler.js (written below), that file is NOT generated here — it
+            // ships with nest-server-starter (the vendor clone base) and is copied into
+            // dist/ by `copy:migrations`. Assert it so a non-standard/older starter that
+            // lacks it fails loudly HERE instead of silently skipping every migration at
+            // container start (the entrypoint's `migrate up` is best-effort under `set -e`).
+            if (!filesystem.exists(`${dest}/migrations-utils/mongo-uri.js`)) {
+                this.toolbox.print.warning('  ⚠ migrations-utils/mongo-uri.js is missing — the generated migrate.js requires it ' +
+                    '(resolveMongoUri). Migrations will not run. It normally ships with nest-server-starter; ' +
+                    'add it (must export resolveMongoUri) so `migrate up` can resolve the Mongo URI.');
+            }
+            // Compile migrations to JavaScript. The production image prunes ts-node, so
+            // `migrate up` can only load plain .js migrations there. Without this the
+            // entrypoint's migration step never applies anything.
+            const tsconfigBuildPath = `${dest}/tsconfig.build.json`;
+            if (filesystem.exists(tsconfigBuildPath)) {
+                const tsconfigBuildRaw = filesystem.read(tsconfigBuildPath) || '';
+                if (!tsconfigBuildRaw.includes('migrations/**/*.ts')) {
+                    // 1. Extend `include` so tsc also emits the .ts migrations + helpers.
+                    const includePatched = tsconfigBuildRaw.replace(/"include":\s*\[\s*"src\/\*\*\/\*"\s*\]/, '"include": ["src/**/*", "migrations/**/*.ts", "migrations-utils/**/*.ts"]');
+                    if (includePatched === tsconfigBuildRaw) {
+                        this.toolbox.print.warning('  ⚠ tsconfig.build.json: could not extend "include" automatically — ' +
+                            'add "migrations/**/*.ts" and "migrations-utils/**/*.ts" manually, ' +
+                            'otherwise migrations are never compiled and the container skips them.');
+                    }
+                    else {
+                        // 2. Pin rootDir. Once `include` reaches beyond src/, tsc re-infers the
+                        //    rootDir from the common parent of ALL included files, which can
+                        //    shift the emit layout and relocate the entry point. An explicit
+                        //    "rootDir": "./" keeps the output mirroring the project tree:
+                        //    `dist/src/main.js` — which is exactly what the Docker entrypoint
+                        //    runs (see nest-server-starter/docker-entrypoint.sh) — plus
+                        //    `dist/migrations/` and `dist/migrations-utils/`. Without the pin the
+                        //    entry can move and the container's `node dist/src/main.js` dies with
+                        //    MODULE_NOT_FOUND. Newer starters ship the pin; older ones (pre-9.0) do not.
+                        let patched = includePatched;
+                        let rootDirPinned = /"rootDir"\s*:/.test(patched);
+                        if (!rootDirPinned) {
+                            const withRootDir = patched.replace(/("compilerOptions"\s*:\s*\{)/, '$1\n    "rootDir": "./",');
+                            if (withRootDir !== patched) {
+                                patched = withRootDir;
+                                rootDirPinned = true;
+                            }
+                        }
+                        filesystem.write(tsconfigBuildPath, patched);
+                        if (!rootDirPinned) {
+                            this.toolbox.print.warning('  ⚠ tsconfig.build.json: extended "include" but could not confirm "rootDir": "./" — ' +
+                                'add it manually, otherwise tsc may relocate the emit and `node dist/src/main.js` fails.');
+                        }
+                    }
+                }
+            }
             // ── 4b. (removed) ─────────────────────────────────────────────────────
             //
             // Previous versions copied three maintenance scripts into
@@ -1420,6 +1483,25 @@ class Server {
                             }
                         }
                     }
+                    // ── 5b. Backfill the vendored core's transitive import closure ──
+                    //
+                    // The merge above only covers nest-server's *declared* dependencies.
+                    // The vendored core ALSO imports packages that used to arrive
+                    // transitively through the @lenne.tech/nest-server npm dep
+                    // (cron←@nestjs/schedule, jose←better-auth, fs-capacitor←graphql-upload,
+                    // graphql-ws / ws). Once vendored, those imports are direct, so under
+                    // pnpm's isolated node_modules they are unresolvable unless declared
+                    // as direct deps → TS2307 at build time. Scan the core's bare imports
+                    // and add any missing package (+ matching @types) at the EXACT version
+                    // pinned by the upstream lockfile.
+                    this.gatherVendorCoreImportClosure({
+                        coreDir,
+                        deps,
+                        devDeps,
+                        lockRaw: upstreamLockRaw,
+                        upstreamDeps,
+                        upstreamDevDeps,
+                    });
                     // Add a script to run the local bin/migrate.js. The starter's
                     // existing migrate:* scripts are already correct for npm mode; we
                     // need them pointing at the local bin + local ts-compiler.
@@ -1438,6 +1520,79 @@ class Server {
                         scripts['migrate:test:up'] = `NODE_ENV=test node ./bin/migrate.js up ${migrateArgs}`;
                         scripts['migrate:preview:up'] = `NODE_ENV=preview node ./bin/migrate.js up ${migrateArgs}`;
                         scripts['migrate:prod:up'] = `NODE_ENV=production node ./bin/migrate.js up ${migrateArgs}`;
+                        // Make the production build carry a runnable migration setup.
+                        //
+                        // The image has no ts-node, and the docker entrypoint looks for
+                        // `dist/bin/migrate.js`. Without these three scripts the entrypoint
+                        // silently skips migrations forever — the failure mode is invisible
+                        // until the first real data migration quietly does not run.
+                        //
+                        //   copy:bin          ships bin/migrate.js into dist/
+                        //   copy:migrations   ships only the .js helpers (the .ts migrations
+                        //                     are compiled by tsc, see tsconfig.build.json)
+                        //   prune:migrations  drops the *.d.ts / *.js.map that tsc emits next
+                        //                     to each compiled migration — the runner would
+                        //                     otherwise pick the declaration file up as a
+                        //                     second migration and throw on `export declare`
+                        //
+                        // Define each only if the project doesn't already have it, so a
+                        // deliberate customization survives a re-run (older starters simply
+                        // lack them → still repaired).
+                        if (typeof scripts['copy:bin'] !== 'string') {
+                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || true';
+                        }
+                        if (typeof scripts['copy:migrations'] !== 'string') {
+                            scripts['copy:migrations'] =
+                                'cpy "./migrations-utils/*.js" ./dist/migrations-utils/ && cpy ./tsconfig.json ./dist/';
+                        }
+                        if (typeof scripts['prune:migrations'] !== 'string') {
+                            scripts['prune:migrations'] = 'rimraf --glob "./dist/migrations/*.d.ts" "./dist/migrations/*.js.map"';
+                        }
+                        // Wire the three steps into the build. Order among them is irrelevant:
+                        // all three only need to run AFTER tsc, which `build` does first
+                        // (copy:bin/copy:migrations copy source files; prune only cleans
+                        // tsc's dist/migrations output). A step is already covered when it is
+                        // named directly in `build` or reachable through a `copy` aggregator
+                        // that `build` runs (newer starters). Older starters have no such
+                        // aggregator, so append to `build` — the one script guaranteed to
+                        // exist and to run tsc first; without this the sub-scripts are defined
+                        // but never invoked and the image ships without dist/bin/migrate.js.
+                        //
+                        // Use the package-manager `run` the project's own scripts already use
+                        // (older starters: npm, newer: pnpm); a hard-coded `pnpm run` would
+                        // make `build` die with "pnpm: command not found" in an npm project.
+                        const scriptText = Object.values(scripts)
+                            .filter((v) => typeof v === 'string')
+                            .join('\n');
+                        const pmRun = /\bpnpm\s+run\b/.test(scriptText)
+                            ? 'pnpm run'
+                            : /\byarn\s+run\b/.test(scriptText)
+                                ? 'yarn run'
+                                : /\bnpm\s+run\b/.test(scriptText)
+                                    ? 'npm run'
+                                    : 'pnpm run';
+                        if (typeof scripts.build === 'string') {
+                            const copyAggregator = typeof scripts.copy === 'string' ? scripts.copy : '';
+                            const covered = (step) => scripts.build.includes(step) || copyAggregator.includes(step);
+                            const missingSteps = ['copy:bin', 'copy:migrations', 'prune:migrations'].filter((s) => !covered(s));
+                            if (missingSteps.length > 0) {
+                                scripts.build = `${scripts.build}${missingSteps.map((s) => ` && ${pmRun} ${s}`).join('')}`;
+                            }
+                        }
+                        else {
+                            this.toolbox.print.warning('  ⚠ package.json has no "build" script — copy:bin/copy:migrations/prune:migrations were defined but ' +
+                                'not wired in; the production image may ship without dist/bin/migrate.js and skip migrations.');
+                        }
+                        // prune:migrations needs `rimraf`, copy:* need `cpy` (cpy-cli). Older
+                        // starters ship cpy-cli but not rimraf — add whatever is missing so
+                        // `build` doesn't die on an absent binary.
+                        const devDependencies = (pkg.devDependencies && typeof pkg.devDependencies === 'object'
+                            ? pkg.devDependencies
+                            : (pkg.devDependencies = {}));
+                        if (typeof devDependencies.rimraf !== 'string')
+                            devDependencies.rimraf = '^6.0.1';
+                        if (typeof devDependencies['cpy-cli'] !== 'string')
+                            devDependencies['cpy-cli'] = '^6.0.0';
                         // Vendor freshness check: reads VENDOR.md baseline version and
                         // compares against npm registry. Non-blocking (always exits 0).
                         // Uses a short inline script — no external file needed.
@@ -1692,7 +1847,13 @@ class Server {
             // Scan all consumer files for stale bare-specifier imports that the
             // codemod should have rewritten. A single miss causes a compile error,
             // so catching it here with a clear message saves the user debugging time.
-            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server');
+            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server', 
+            // Match only real import/export/require specifiers in single/double
+            // quotes — NOT comment references like
+            // `node_modules/@lenne.tech/nest-server/...` (backticks, no keyword),
+            // which the codemod legitimately leaves untouched. A naive substring
+            // match flagged config.env.ts's JSDoc path as a false positive.
+            /(?:from|import|export|require)\s*\(?\s*['"]@lenne\.tech\/nest-server(?:\/[^'"]*)?['"]/);
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleImports.length} file(s) still contain '@lenne.tech/nest-server' imports after vendor conversion:`);
@@ -2341,6 +2502,177 @@ class Server {
         }
         return stale;
     }
+    /**
+     * Backfills the vendored core's transitive import closure into the
+     * project's dependencies. After vendoring, `src/core/**` imports packages
+     * that previously arrived transitively via the `@lenne.tech/nest-server`
+     * npm dependency (e.g. `cron`, `jose`, `fs-capacitor`, `graphql-ws`,
+     * `ws`). nest-server never declares these as direct deps, so the
+     * upstream-deps merge misses them — yet the vendored code imports them
+     * directly, which pnpm's isolated node_modules cannot resolve → TS2307 at
+     * build time.
+     *
+     * Scans every `.ts` file under the vendored core for bare import
+     * specifiers, drops Node builtins and already-declared packages, and adds
+     * the remainder (plus any matching `@types/*`) using EXACT versions read
+     * from the upstream `pnpm-lock.yaml`. Mutates `deps`/`devDeps` in place.
+     */
+    gatherVendorCoreImportClosure(options) {
+        const { coreDir, deps, devDeps, lockRaw, upstreamDeps, upstreamDevDeps } = options;
+        const { print } = this.toolbox;
+        const builtins = new Set(require('module').builtinModules);
+        // Compare two dotted versions numerically (major.minor.patch) — used to
+        // pick the highest when the lockfile pins multiple copies (e.g. ws 7/8).
+        const compareVersions = (a, b) => {
+            const pa = a.split('.').map((n) => parseInt(n, 10) || 0);
+            const pb = b.split('.').map((n) => parseInt(n, 10) || 0);
+            for (let i = 0; i < 3; i++) {
+                if ((pa[i] || 0) !== (pb[i] || 0)) {
+                    return (pa[i] || 0) - (pb[i] || 0);
+                }
+            }
+            return 0;
+        };
+        // Parse `<name>@<version>` keys from the lockfile's `packages:` section
+        // into a name→version map (highest version wins). pnpm-lock v9 lists
+        // every package (direct + transitive) there with a clean 2-space indent.
+        const parseLockVersions = (raw) => {
+            const map = {};
+            let inPackages = false;
+            for (const line of raw.split('\n')) {
+                if (/^packages:\s*$/.test(line)) {
+                    inPackages = true;
+                    continue;
+                }
+                if (inPackages && /^\S/.test(line)) {
+                    break; // reached the next top-level section
+                }
+                if (!inPackages) {
+                    continue;
+                }
+                const matched = line.match(/^ {2}(['"]?)(.+?)\1:\s*$/);
+                if (!matched) {
+                    continue;
+                }
+                let key = matched[2] || '';
+                const paren = key.indexOf('('); // strip pnpm peer suffix
+                if (paren >= 0) {
+                    key = key.slice(0, paren);
+                }
+                const at = key.lastIndexOf('@');
+                if (at <= 0) {
+                    continue;
+                }
+                const name = key.slice(0, at);
+                const version = key.slice(at + 1);
+                if (!/^\d/.test(version)) {
+                    continue; // ranges / non-versions
+                }
+                const current = map[name];
+                if (!current || compareVersions(version, current) > 0) {
+                    map[name] = version;
+                }
+            }
+            return map;
+        };
+        // Reduce an import specifier to its package name (or null for relative
+        // paths and Node builtins, which need no dependency entry).
+        const packageNameOf = (spec) => {
+            if (!spec || spec.startsWith('.') || spec.startsWith('/')) {
+                return null;
+            }
+            const bare = spec.startsWith('node:') ? spec.slice('node:'.length) : spec;
+            const parts = bare.split('/');
+            const name = bare.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0] || '';
+            // Drop Node builtins, the framework package itself (never a dependency
+            // of its own vendored code), and anything that is not a syntactically
+            // valid npm package name (defensive guard).
+            if (!name || builtins.has(name) || name === '@lenne.tech/nest-server') {
+                return null;
+            }
+            return /^(?:@[\w.~-]+\/)?[\w.~-]+$/.test(name) ? name : null;
+        };
+        // Collect every bare specifier imported by the vendored core. Parse the
+        // TypeScript AST (ts-morph) rather than scanning text, so that prose in
+        // comments/strings — a JSDoc `import … from '@lenne.tech/nest-server'`
+        // example, or an English `… distinguishable from "never set"` — is never
+        // mistaken for a real import (which a naive regex did).
+        const imported = new Set();
+        const { Project, SyntaxKind } = require('ts-morph');
+        const scanProject = new Project({
+            skipAddingFilesFromTsConfig: true,
+            skipFileDependencyResolution: true,
+        });
+        const sourceFiles = scanProject.addSourceFilesAtPaths(`${coreDir}/**/*.ts`);
+        for (const sourceFile of sourceFiles) {
+            // `import … from 'x'` and `export … from 'x'`
+            for (const decl of [...sourceFile.getImportDeclarations(), ...sourceFile.getExportDeclarations()]) {
+                const spec = decl.getModuleSpecifierValue();
+                const name = spec ? packageNameOf(spec) : null;
+                if (name) {
+                    imported.add(name);
+                }
+            }
+            // `import x = require('x')`
+            for (const decl of sourceFile.getDescendantsOfKind(SyntaxKind.ImportEqualsDeclaration)) {
+                const ref = decl
+                    .getModuleReference()
+                    .getText()
+                    .match(/^require\(\s*['"]([^'"]+)['"]\s*\)$/);
+                const name = ref ? packageNameOf(ref[1] || '') : null;
+                if (name) {
+                    imported.add(name);
+                }
+            }
+            // Dynamic `import('x')` / `require('x')` calls
+            for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+                const callee = call.getExpression().getText();
+                if (callee !== 'import' && callee !== 'require') {
+                    continue;
+                }
+                const arg = call.getArguments()[0];
+                if (arg && arg.getKind() === SyntaxKind.StringLiteral) {
+                    const name = packageNameOf(arg.getLiteralText());
+                    if (name) {
+                        imported.add(name);
+                    }
+                }
+            }
+        }
+        const lockVersions = parseLockVersions(lockRaw);
+        const added = [];
+        const unresolved = [];
+        for (const name of [...imported].sort()) {
+            if (name in deps || name in devDeps) {
+                continue; // already declared by the starter or the upstream merge
+            }
+            const version = lockVersions[name] || upstreamDeps[name] || upstreamDevDeps[name];
+            if (!version) {
+                unresolved.push(name);
+                continue;
+            }
+            deps[name] = version;
+            added.push(`${name}@${version}`);
+            // Add a matching @types/* (for packages that ship no own types) so the
+            // vendored core type-checks. Handles scoped names
+            // (@scope/x → @types/scope__x) too.
+            const typesName = name.startsWith('@') ? `@types/${name.slice(1).replace('/', '__')}` : `@types/${name}`;
+            if (!(typesName in deps) && !(typesName in devDeps)) {
+                const typesVersion = lockVersions[typesName] || upstreamDevDeps[typesName];
+                if (typesVersion) {
+                    devDeps[typesName] = typesVersion;
+                }
+            }
+        }
+        if (added.length > 0) {
+            print.info(`  vendored core closure: added ${added.length} transitive dep(s) → ${added.join(', ')}`);
+        }
+        if (unresolved.length > 0) {
+            print.warning(`⚠ ${unresolved.length} vendored-core import(s) could not be resolved to a version ` +
+                `(absent from the upstream lock and package.json): ${unresolved.join(', ')}. ` +
+                'Add them to projects/api/package.json manually if the build fails.');
+        }
+    }
     /**
      * Checks whether an import specifier resolves to the vendored core directory.
      * Used during vendor→npm import rewriting.

package/build/lib/angular-environments.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAngularEnvironmentsDir = findAngularEnvironmentsDir;
+exports.patchAngularEnvironments = patchAngularEnvironments;
+exports.stageHosts = stageHosts;
+/**
+ * Rewrite the hardcoded localhost URLs in an Angular app's environment files
+ * to the deployed TurboOps stage URLs.
+ *
+ * WHY: a Nuxt app reads its API URL from the stage env at runtime
+ * (`NUXT_PUBLIC_API_URL`, injected by TurboOps). Angular has no such runtime
+ * config — `ng build --configuration production` BAKES `environment.prod.ts`
+ * into the bundle. Without this patch a deployed Angular app ships
+ * `apiUrl: 'http://127.0.0.1:3000/graphql'` and calls the end user's own
+ * machine.
+ *
+ * Stage mapping (TurboOps knows exactly two stages, `dev` and `production`):
+ *
+ *   environment.prod.ts     → production → <domain>     + api.<domain>
+ *   environment.develop.ts  → dev        → dev.<domain> + api.dev.<domain>
+ *   environment.test.ts     → dev        → dev.<domain> + api.dev.<domain>
+ *
+ * `environment.ts` is the local-dev config and is deliberately left alone.
+ * `environment.test.ts` and `environment.develop.ts` are identical in
+ * ng-base-starter (both `prefix: 'app-test'`); with no TurboOps "test" stage,
+ * the non-production stage is `dev` for both.
+ *
+ * Only the URL ORIGIN (scheme + host + optional port) is replaced — the path
+ * (`/graphql`, `/api`) is preserved, so a project that customised it keeps its
+ * routes. That also makes the patch idempotent AND re-runnable with a new
+ * domain: an already-deployed URL is rewritten to the new one instead of being
+ * skipped (the old `http://127.0.0.1:3000`-only replace silently did nothing
+ * on the second run).
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** Which environment file belongs to which TurboOps stage. */
+const ENVIRONMENT_STAGES = {
+    'environment.develop.ts': 'dev',
+    'environment.prod.ts': 'production',
+    'environment.test.ts': 'dev',
+};
+/**
+ * Locate the Angular `environments/` directory for a project root.
+ * Returns null for non-Angular apps (e.g. Nuxt), which makes the whole
+ * patch a no-op there.
+ */
+function findAngularEnvironmentsDir(projectRoot) {
+    const candidates = [(0, path_1.join)('projects', 'app', 'src', 'environments'), (0, path_1.join)('src', 'environments')];
+    for (const rel of candidates) {
+        const dir = (0, path_1.join)(projectRoot, rel);
+        if ((0, fs_1.existsSync)(dir))
+            return dir;
+    }
+    return null;
+}
+/**
+ * Point every stage-specific Angular environment file at the deployed URLs.
+ * Returns one {@link PatchResult} per file that exists (empty array when the
+ * project is not an Angular app).
+ */
+function patchAngularEnvironments(options) {
+    const dir = findAngularEnvironmentsDir(options.projectRoot);
+    if (!dir)
+        return [];
+    const results = [];
+    for (const [fileName, stage] of Object.entries(ENVIRONMENT_STAGES)) {
+        const file = (0, path_1.join)(dir, fileName);
+        if (!(0, fs_1.existsSync)(file))
+            continue;
+        results.push(patchEnvironmentFile(file, options.domain, stage));
+    }
+    return results;
+}
+/**
+ * Public hostnames of a stage. The API always lives one label in front of the
+ * app host, so `dev` nests as `api.dev.<domain>`.
+ */
+function stageHosts(domain, stage) {
+    const app = stage === 'production' ? domain : `dev.${domain}`;
+    return { api: `api.${app}`, app };
+}
+/** Rewrite the four URL properties of a single environment file. */
+function patchEnvironmentFile(file, domain, stage) {
+    const hosts = stageHosts(domain, stage);
+    const original = (0, fs_1.readFileSync)(file, 'utf8');
+    let content = original;
+    let replacements = 0;
+    let recognized = 0;
+    const rewriteOrigin = (property, origin) => {
+        // (property: )(quote)scheme://host[:port](path)(same quote)
+        const pattern = new RegExp(`(${property}:\\s*)(['"])[a-z]+://[^'"/]+([^'"]*)\\2`, 'g');
+        content = content.replace(pattern, (match, prefix, quote, path) => {
+            recognized++;
+            const next = `${prefix}${quote}${origin}${path}${quote}`;
+            if (next !== match)
+                replacements++;
+            return next;
+        });
+    };
+    rewriteOrigin('apiUrl', `https://${hosts.api}`);
+    rewriteOrigin('restUrl', `https://${hosts.api}`);
+    rewriteOrigin('wsUrl', `wss://${hosts.api}`);
+    rewriteOrigin('appUrl', `https://${hosts.app}`);
+    if (replacements > 0)
+        (0, fs_1.writeFileSync)(file, content, 'utf8');
+    return { file, patched: replacements > 0, recognized: recognized > 0, replacements };
+}

package/build/lib/codex-cli.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = void 0;
+exports.findCodexCli = findCodexCli;
+exports.runCodexCommand = runCodexCommand;
+/**
+ * Codex CLI utilities.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || '/Users/kaihaase/code/lenneTech/codex';
+function findCodexCli() {
+    const possiblePaths = [
+        (0, path_1.join)((0, os_1.homedir)(), '.local', 'bin', 'codex'),
+        (0, path_1.join)((0, os_1.homedir)(), '.codex', 'bin', 'codex'),
+        '/usr/local/bin/codex',
+        '/opt/homebrew/bin/codex',
+        '/usr/bin/codex',
+    ];
+    for (const path of possiblePaths) {
+        if ((0, fs_1.existsSync)(path)) {
+            return path;
+        }
+    }
+    try {
+        const result = (0, child_process_1.spawnSync)('which', ['codex'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        const path = (result.stdout || '').trim();
+        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
+            return path;
+        }
+    }
+    catch (_a) {
+        // Codex CLI not found in PATH.
+    }
+    return null;
+}
+function runCodexCommand(cli, args) {
+    try {
+        const result = (0, child_process_1.spawnSync)(cli, args, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return {
+            output: result.stdout + result.stderr,
+            success: result.status === 0,
+        };
+    }
+    catch (err) {
+        return {
+            output: err.message,
+            success: false,
+        };
+    }
+}