@lenne.tech/cli 1.42.0 → 1.43.0

package/build/commands/fullstack/add-api.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add an API (`projects/api/`) to a fullstack workspace that currently
@@ -68,6 +69,7 @@ const NewCommand = {
         info('Add API to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-api --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--api-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -126,10 +128,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApi) {
             error(`An API already exists at "${workspaceDir}/projects/api". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve api mode (CLI > experimental override > config > global > interactive/default).
@@ -177,6 +181,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -282,6 +287,7 @@ const NewCommand = {
         });
         if (!apiResult.success) {
             apiSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         apiSpinner.succeed(`API integrated (${apiResult.method})`);

package/build/commands/fullstack/add-app.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add a frontend app (`projects/app/`) to a fullstack workspace that
@@ -57,6 +58,7 @@ const NewCommand = {
         info('Add app to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-app --frontend <nuxt|angular> [--frontend-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -110,10 +112,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApp) {
             error(`An app already exists at "${workspaceDir}/projects/app". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve frontend.
@@ -123,6 +127,7 @@ const NewCommand = {
         }
         else if (cliFrontend) {
             error('Invalid --frontend option. Use "angular" or "nuxt".');
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontend === 'angular' || configFrontend === 'nuxt') {
@@ -150,6 +155,7 @@ const NewCommand = {
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
@@ -225,6 +231,7 @@ const NewCommand = {
             });
         if (!result.success) {
             appSpinner.fail(`Failed to set up ${frontend} frontend: ${result.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         appSpinner.succeed(`${frontend} integrated (${result.method})`);

package/build/commands/fullstack/init.js

@@ -16,6 +16,7 @@ const gluegun_1 = require("gluegun");
 const caddy_1 = require("../../lib/caddy");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
+const fail_run_1 = require("../../lib/fail-run");
 const package_name_1 = require("../../lib/package-name");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 const workspace_integration_1 = require("../../lib/workspace-integration");
@@ -38,9 +39,10 @@ const NewCommand = {
         // Info
         info('Create a new fullstack workspace');
         // Hint for non-interactive callers (e.g. Claude Code)
-        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
+        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor: workspace-wide, applies to API and frontend> [--frontend-framework-mode <npm|vendor>: overrides --framework-mode for the frontend only] [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
         // Check git
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Load configuration
@@ -92,6 +94,7 @@ const NewCommand = {
                 if (cwdLayout.hasApi && cwdLayout.hasApp) {
                     error('Workspace already has both projects/api and projects/app — nothing to add.');
                     info('Use `lt fullstack add-api --help-json` or `lt fullstack add-app --help-json` to inspect options.');
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
                 if (cwdLayout.hasApp && !cwdLayout.hasApi) {
@@ -124,6 +127,7 @@ const NewCommand = {
         if (filesystem.exists(projectDir)) {
             info('');
             error(`There's already a folder named "${projectDir}" here.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Determine frontend with priority: CLI > config > interactive
@@ -132,6 +136,7 @@ const NewCommand = {
             frontend = cliFrontend === 'angular' ? 'angular' : cliFrontend === 'nuxt' ? 'nuxt' : null;
             if (!frontend) {
                 error('Invalid frontend option. Use "angular" or "nuxt".');
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -220,6 +225,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -245,20 +251,34 @@ const NewCommand = {
         }
         // ── Frontend framework mode ─────────────────────────────────────────
         const configFrontendFrameworkMode = (_0 = (_z = ltConfig === null || ltConfig === void 0 ? void 0 : ltConfig.commands) === null || _z === void 0 ? void 0 : _z.fullstack) === null || _0 === void 0 ? void 0 : _0.frontendFrameworkMode;
+        // Precedence: frontend-specific CLI flag > workspace-wide CLI flag >
+        // frontend-specific config > workspace-wide config > vendor default.
+        //
+        // `--framework-mode` is the workspace-wide default and MUST propagate here.
+        // Without that inheritance, `--framework-mode npm` silently produced an
+        // npm API next to a vendored frontend — visible only as the M1..M3 steps in
+        // a `--dry-run` plan, or afterwards as an unexpected `app/core/` tree.
+        // Consumers who genuinely want mixed modes pass `--frontend-framework-mode`.
         let frontendFrameworkMode;
         if (cliFrontendFrameworkMode === 'npm' || cliFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = cliFrontendFrameworkMode;
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
+        else if (cliFrameworkMode === 'npm' || cliFrameworkMode === 'vendor') {
+            frontendFrameworkMode = cliFrameworkMode;
+            info(`Using frontend framework mode from --framework-mode: ${frontendFrameworkMode}`);
+        }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = configFrontendFrameworkMode;
             info(`Using frontend framework mode from lt.config: ${frontendFrameworkMode}`);
         }
-        else if (noConfirm) {
-            frontendFrameworkMode = 'vendor';
+        else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
+            frontendFrameworkMode = configFrameworkMode;
+            info(`Using frontend framework mode from lt.config frameworkMode: ${frontendFrameworkMode}`);
         }
         else {
             // Default to vendor without asking (unless user sets it explicitly)
@@ -403,11 +423,13 @@ const NewCommand = {
         }
         catch (err) {
             workspaceSpinner.fail(`Failed to clone monorepo: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Check for directory
         if (!filesystem.isDirectory(`./${projectDir}`)) {
             workspaceSpinner.fail(`The directory "${projectDir}" could not be created.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         workspaceSpinner.succeed(`Create fullstack workspace with ${frontend} in ${projectDir} for ${name} created`);
@@ -467,6 +489,7 @@ const NewCommand = {
         }
         catch (err) {
             error(`Failed to initialize git: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Add remote if push is configured
@@ -476,6 +499,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to add remote: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -503,6 +527,7 @@ const NewCommand = {
         }
         if (!frontendResult.success) {
             error(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Patch frontend .env with project-specific values (skip for linked templates)
@@ -546,6 +571,7 @@ const NewCommand = {
             });
             if (!apiResult.success) {
                 serverSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Auto-run `bun run rename <projectDir>` for the experimental nest-base
@@ -638,6 +664,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     installSpinner.fail(`Failed to install packages: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }
@@ -673,6 +700,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to create initial commit: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Push to remote if configured
@@ -682,6 +710,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     error(`Failed to push to remote: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }

package/build/commands/git/reset.js

@@ -46,7 +46,7 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;

package/build/commands/git/update.js

@@ -48,7 +48,7 @@ const NewCommand = {
             info(`Current branch: ${branch}`);
             info('');
             // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             // Check for incoming commits
             const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
@@ -78,7 +78,7 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git pull --rebase');
+        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {

package/build/extensions/frontend-helper.js

@@ -13,6 +13,7 @@ exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
+const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -520,6 +521,24 @@ class FrontendHelper {
             this.rewriteConsumerImportsToVendor(dest);
             // ── 4. Rewrite nuxt.config.ts module entry ──────────────────────────
             this.rewriteNuxtConfig(dest, 'vendor');
+            // ── 4b. Drop the core's `nuxt/schema` runtime-config augmentation ────
+            //
+            // Harmless inside node_modules, poisonous as project source: it augments the
+            // same interface under both `nuxt/schema` and `@nuxt/schema` (the former
+            // re-exports the latter) and closes a cycle with Nuxt's generated
+            // runtime-config types. TS2310 — suppressed by `skipLibCheck`, so all a
+            // developer sees is every `config.public.*` typed `unknown`. See the lib for
+            // the measurement.
+            const strippedAugmentation = (0, strip_vendor_schema_augmentation_1.stripVendorSchemaAugmentation)({ coreDir, filesystem });
+            if (strippedAugmentation.touched.length > 0) {
+                this.toolbox.print.info(`  vendored core: removed the nuxt/schema runtime-config augmentation from ${strippedAugmentation.touched.length} file(s) — keeps config.public.* typed`);
+            }
+            // A block the transform could not process is left in place, which means the
+            // TS2310 bug ships with the project. Silence there would be the worst of both
+            // worlds: the conversion reports success and the typing is broken anyway.
+            for (const warning of strippedAugmentation.warnings) {
+                this.toolbox.print.warning(`  ⚠ vendored core: ${warning}`);
+            }
             // ── 5. package.json: remove @lenne.tech/nuxt-extensions, merge deps ─
             const pkgPath = path.join(dest, 'package.json');
             if (filesystem.exists(pkgPath)) {

package/build/extensions/git.js

@@ -120,7 +120,7 @@ class Git {
             // Toolbox features
             const { system } = this.toolbox;
             // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null; git show-branch --list');
+            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,6 +197,27 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
+    /**
+     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
+     * rather than assigning it outright.
+     *
+     * These commands do a best-effort `git fetch` to see whether the branch is
+     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
+     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
+     * reachable and every signature needs an interactive approval; unattended it
+     * waits and then reports `communication with agent failed`. Measured: **61 s per
+     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
+     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
+     * connect, not the agent.
+     *
+     * Waiting for a human to approve a key is legitimate for an interactive command,
+     * so the default is unchanged. What was wrong is that the assignment was
+     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
+     * including a test harness trying to make the behaviour deterministic. The
+     * `:-` default respects an existing value and keeps the old behaviour when there
+     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
+     * ~1 s with a clean `Permission denied (publickey)`.
+     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -252,7 +273,7 @@ class Git {
                 searchSpin = spin(opts.spinText);
             }
             // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
@@ -1021,6 +1022,22 @@ class Server {
                 // Best-effort — without the lockfile, the closure step falls back to
                 // the upstream package.json ranges (still better than nothing).
             }
+            // Snapshot the upstream pnpm-workspace.yaml. It carries `allowBuilds`, the map
+            // that decides which packages may run install scripts — and vendoring is what
+            // makes the framework's entries the PROJECT's problem: step 5b turns the core's
+            // import closure into direct dependencies, so packages nest-server knew about
+            // (bullmq → msgpackr → msgpackr-extract) become the project's own. pnpm 11 aborts
+            // the install outright on an unlisted one, so a missing entry is an unusable
+            // project rather than a warning. This file is NOT in nest-server's npm tarball,
+            // so the clone is the only moment it can be read at all.
+            let upstreamWorkspaceYaml = '';
+            try {
+                upstreamWorkspaceYaml = filesystem.read(`${tmpClone}/pnpm-workspace.yaml`) || '';
+            }
+            catch (_c) {
+                // Best-effort: an older framework revision may predate the file. The project
+                // then keeps exactly the allowlist its own template shipped.
+            }
             // Snapshot the upstream CLAUDE.md for section-merge into projects/api/CLAUDE.md.
             // The nest-server CLAUDE.md contains framework-specific instructions that
             // Claude Code needs to work correctly with the vendored source (API conventions,
@@ -1033,7 +1050,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_c) {
+            catch (_d) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1042,7 +1059,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_d) {
+            catch (_e) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1325,7 +1342,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_e) {
+                    catch (_f) {
                         // skip unreadable file
                     }
                 }
@@ -1503,6 +1520,14 @@ class Server {
                         upstreamDeps,
                         upstreamDevDeps,
                     });
+                    // The closure above just made framework-only packages direct dependencies of
+                    // this project. Their build-script decisions have to come along, or the first
+                    // `pnpm install` stops on ERR_PNPM_IGNORED_BUILDS. Additive only — a decision
+                    // the project already made is never overwritten.
+                    const adoptedBuilds = (0, adopt_upstream_build_allowlist_1.adoptUpstreamBuildAllowlist)({ dest, filesystem, upstreamWorkspaceYaml });
+                    if (adoptedBuilds.length > 0) {
+                        this.toolbox.print.info(`  vendored core allowlist: adopted ${adoptedBuilds.length} build decision(s) from nest-server → ${adoptedBuilds.join(', ')}`);
+                    }
                     // Add a script to run the local bin/migrate.js. The starter's
                     // existing migrate:* scripts are already correct for npm mode; we
                     // need them pointing at the local bin + local ts-compiler.

package/build/lib/adopt-upstream-build-allowlist.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adoptUpstreamBuildAllowlist = adoptUpstreamBuildAllowlist;
+const js_yaml_1 = require("js-yaml");
+const fs_utils_1 = require("./fs-utils");
+const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
+/**
+ * Carry the framework's build-script allowlist into a project that has just
+ * vendored it.
+ *
+ * `allowBuilds` decides which packages may run install scripts. pnpm 11 does not
+ * treat an unlisted one as "deny" — it ABORTS the install with
+ * `ERR_PNPM_IGNORED_BUILDS` and writes a `set this to true or false` placeholder
+ * into the workspace file. So a single missing entry is not a hardening gap; it
+ * is a project that cannot be installed at all, on the very first
+ * `lt fullstack init`, before anyone has written a line of code.
+ *
+ * Vendoring is exactly where that gap opens. The conversion resolves the core's
+ * import closure into DIRECT dependencies — `import('bullmq')` in
+ * core-cron-jobs.service.ts becomes a real `bullmq` dep, which pulls
+ * `msgpackr` → `msgpackr-extract`, a package with an install script. nest-server
+ * knows about it and lists it. The project does not, and cannot: nest-server's
+ * `pnpm-workspace.yaml` is not part of its npm tarball — `files` ships `dist`,
+ * `src`, `bin` and the docs, never a repo-root config file — so nothing
+ * downstream can read it. Until now the only bridge was a
+ * human copying entries into nest-server-starter by hand — and that bridge has
+ * already been observed to rot: `@scarf/scarf` sat at `true` in the starter while
+ * the framework denied it, for long enough that the drift shipped.
+ *
+ * Deliberately additive. A key the project has already decided is left exactly as
+ * it is, including an explicit `false`: the project is the more specific context,
+ * and silently flipping its decision to match the framework would be a worse bug
+ * than the one this fixes. Only genuinely absent keys are taken over — together
+ * with the comment that explains them, because an entry like
+ * `'msgpackr-extract': false` reads as dead weight without it and gets deleted by
+ * the next person who runs `pnpm why`.
+ *
+ * @returns the keys actually adopted, for the caller to report.
+ */
+function adoptUpstreamBuildAllowlist(options) {
+    var _a;
+    const { dest, filesystem, upstreamWorkspaceYaml } = options;
+    if (!upstreamWorkspaceYaml)
+        return [];
+    const upstream = parseYamlObject(upstreamWorkspaceYaml);
+    const upstreamAllow = asStringBoolMap(upstream === null || upstream === void 0 ? void 0 : upstream.allowBuilds);
+    if (Object.keys(upstreamAllow).length === 0)
+        return [];
+    // Never write through a symlinked project: with `--api-link` it points at the
+    // user's own nest-server-starter checkout, and this would edit their repo. The
+    // same guard already protects `hoistWorkspacePnpmConfig` and
+    // `removeNestedLockfiles`; these two libs were the odd ones out.
+    if ((0, fs_utils_1.isSymlink)(dest))
+        return [];
+    const destPath = `${dest}/pnpm-workspace.yaml`;
+    // No file to extend means no pnpm settings of the project's own. Writing one
+    // here would invent a workspace root the scaffolding did not ask for, so the
+    // absence is respected rather than filled in.
+    if (!filesystem.exists(destPath))
+        return [];
+    const destRaw = (_a = filesystem.read(destPath)) !== null && _a !== void 0 ? _a : '';
+    const destWs = parseYamlObject(destRaw);
+    if (!destWs)
+        return [];
+    // The project's map is read RAW, not through `asStringBoolMap`. Narrowing it to
+    // booleans first was a live deny-bypass with no attacker involved: js-yaml 4
+    // uses the YAML 1.2 core schema, so `esbuild: no` and `esbuild: off` parse as
+    // STRINGS. A maintainer writing `no` to mean "deny" was read as "no opinion",
+    // upstream's `true` was adopted, and the original entry was dropped from the
+    // rewritten map as well. Same for `'false'`, for an empty value (null), and for
+    // pnpm's own `set this to true or false` placeholder — all five verified.
+    //
+    // `Object.create(null)` and `hasOwnProperty.call`: with a plain object,
+    // `'constructor' in map` is true via the prototype, so eight real package names
+    // ('constructor', 'toString', 'valueOf', …) would be treated as already decided
+    // and silently never adopted — the ERR_PNPM_IGNORED_BUILDS abort this whole
+    // function exists to prevent.
+    const merged = Object.assign(Object.create(null), asRawMap(destWs.allowBuilds));
+    const adopted = [];
+    for (const [pkg, value] of Object.entries(upstreamAllow)) {
+        // ANY existing key is a decision, whatever shape YAML gave it.
+        if (Object.prototype.hasOwnProperty.call(merged, pkg))
+            continue;
+        merged[pkg] = value;
+        adopted.push(pkg);
+    }
+    if (adopted.length === 0)
+        return [];
+    destWs.allowBuilds = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+    // The project's own annotations win where both files comment the same key; the
+    // upstream ones fill in only for the keys just adopted, which by definition the
+    // project had nothing to say about.
+    const comments = (0, hoist_workspace_pnpm_config_1.extractKeyComments)(destRaw);
+    for (const [key, block] of (0, hoist_workspace_pnpm_config_1.extractKeyComments)(upstreamWorkspaceYaml)) {
+        if (!comments.has(key))
+            comments.set(key, block);
+    }
+    filesystem.write(destPath, (0, hoist_workspace_pnpm_config_1.reattachKeyComments)((0, js_yaml_1.dump)(destWs, { lineWidth: -1, sortKeys: false }), comments));
+    return adopted;
+}
+/** The value as a plain key/value map, or an empty one — no narrowing of values. */
+function asRawMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    return value;
+}
+/**
+ * Narrow an unknown value to a `{ pkg: boolean }` map, dropping other shapes.
+ *
+ * Used for the UPSTREAM side only. There, dropping a non-boolean is right — we
+ * adopt only decisions we understand. On the DEST side it is the opposite: see
+ * the comment at the merge above.
+ */
+function asStringBoolMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+        if (typeof v === 'boolean')
+            out[key] = v;
+    }
+    return out;
+}
+/** Parse YAML into a plain object, or null on empty/malformed/non-object input. */
+function parseYamlObject(raw) {
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(raw);
+    }
+    catch (_a) {
+        // Malformed upstream YAML must not take the conversion down with it — the
+        // vendored project is still usable, it just does not inherit the allowlist.
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    return parsed;
+}

package/build/lib/fail-run.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.failRun = failRun;
+/**
+ * Mark the current command run as failed.
+ *
+ * A gluegun command signals failure by printing and returning, and a bare
+ * `return` leaves the process at exit code 0. So a scaffold that died halfway
+ * reported SUCCESS to every caller that checks `$?` — a CI job, a wrapper
+ * script, an agent. That is not theoretical: a `lt fullstack init` whose
+ * `pnpm install` aborted on a native build script printed a red spinner and
+ * still exited 0, and the half-built workspace was only noticed later, by hand.
+ *
+ * Call it immediately before every `return` on an error path:
+ *
+ *     failRun(toolbox);
+ *     return;
+ *
+ * **`process.exitCode`, not `process.exit()`** — the latter can truncate
+ * buffered output, including the spinner's own failure message, which is the one
+ * line the operator actually needs.
+ *
+ * **Guarded by `fromGluegunMenu`**, like the CLI's other exit-code call sites
+ * (`dev test`, `dev tunnel`, `tools ocr`, `workspace-integration`): inside the
+ * interactive `lt` menu a command is one step of a longer session, and failing
+ * the whole session because one step errored is the same over-reach in reverse.
+ *
+ * Shared rather than redeclared per command: `fullstack init` delegates to
+ * `add-api` / `add-app` inside an existing workspace, so all three have to agree
+ * on the contract or the exit code depends on which directory the user happened
+ * to be standing in — which was exactly the state before this helper existed.
+ */
+function failRun(toolbox) {
+    var _a, _b;
+    if (!((_b = (_a = toolbox.parameters) === null || _a === void 0 ? void 0 : _a.options) === null || _b === void 0 ? void 0 : _b.fromGluegunMenu)) {
+        process.exitCode = 1;
+    }
+}

package/build/lib/hoist-workspace-pnpm-config.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractKeyComments = extractKeyComments;
+exports.reattachKeyComments = reattachKeyComments;
 exports.hoistPackageManager = hoistPackageManager;
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
 const js_yaml_1 = require("js-yaml");
@@ -35,11 +37,162 @@ const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
 /** Objects whose values are arrays to be unioned, not replaced. */
 const NESTED_ARRAY_FIELDS = ['auditConfig'];
+/** The union of all three, in declaration order. Declared here, with its inputs,
+ * because the comment-carrying helpers below default their `fields` parameter to it. */
+const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
+/**
+ * Separator for the composite map key.
+ *
+ * `\0` rather than a space, because a YAML mapping key may legally contain
+ * spaces — `overrides` selectors like `minimatch@>=5.0.0 <10.2.6` do — and a
+ * space would let two different (field, key) pairs collide on one entry,
+ * silently attaching one entry's reasoning to another's. Written as an escape
+ * rather than a literal control character: a raw NUL in the source makes git
+ * treat this file as binary, which costs every future reviewer the diff.
+ */
+const KEY_SEPARATOR = '\0';
+/**
+ * Control characters that must never survive into an emitted YAML comment.
+ *
+ * Everything below U+0020 except TAB (U+0009) and LF (U+000A) — CR included,
+ * deliberately: it is the one that reads as whitespace and parses as a line
+ * break. LF cannot appear here (the harvest splits on it) and TAB is harmless.
+ */
+const CONTROL_CHARS = /[\u0000-\u0008\u000B-\u001F\u007F]/;
+const commentKey = (field, key) => `${field}${KEY_SEPARATOR}${key}`;
+/**
+ * Comment blocks attached to the entries of each top-level mapping in `raw`.
+ *
+ * Only contiguous `#` lines DIRECTLY above an entry are taken, and a blank line
+ * ends the block — a comment separated from a key by an empty line belongs to the
+ * section, not to that key, and re-attaching it would silently move a section
+ * header onto whichever entry happened to come first.
+ */
+function extractKeyComments(raw, fields = WORKSPACE_SCOPED_PNPM_FIELDS) {
+    const out = new Map();
+    if (!raw)
+        return out;
+    const lines = raw.split('\n');
+    let field = null;
+    let fieldIndent = 0;
+    let pending = [];
+    for (const line of lines) {
+        const topLevel = /^([A-Za-z_][\w-]*):\s*$/.exec(line);
+        if (topLevel) {
+            field = fields.includes(topLevel[1]) ? topLevel[1] : null;
+            fieldIndent = 0;
+            pending = [];
+            continue;
+        }
+        if (field === null)
+            continue;
+        if (/^\s*$/.test(line)) {
+            pending = [];
+            continue;
+        }
+        const indent = line.search(/\S/);
+        // Back at column 0 → the mapping is over (a new top-level key or a list item).
+        if (indent === 0) {
+            field = null;
+            pending = [];
+            continue;
+        }
+        if (/^\s*#/.test(line)) {
+            // A bare CR is NOT a line break to `String.split('\n')` but IS one to every
+            // YAML parser. So a comment containing one is re-emitted verbatim, and
+            // everything after the CR becomes real YAML at a column of its author's
+            // choosing. Verified against pnpm 11: a comment carrying
+            // `\r  left-pad: 9.9.9` installs as a workspace-wide `overrides` entry —
+            // an arbitrary version force in every generated project — while the line
+            // still renders as an ordinary comment in editors and diffs.
+            //
+            // Dropping the whole block is the right response rather than sanitising it:
+            // a rationale nobody can read is worth less than the risk of guessing what
+            // the author meant.
+            if (CONTROL_CHARS.test(line)) {
+                pending = [];
+                continue;
+            }
+            pending.push(line.trimStart());
+            continue;
+        }
+        const entry = /^\s*((?:'[^']*')|(?:"[^"]*")|(?:[^\s:#][^:]*?))\s*:/.exec(line);
+        if (!entry) {
+            pending = [];
+            continue;
+        }
+        // Nested deeper than the first entry level (e.g. `auditConfig.ignoreGhsas`
+        // items) — the block belongs to the inner key, which this pass does not carry.
+        if (fieldIndent === 0)
+            fieldIndent = indent;
+        if (indent === fieldIndent && pending.length) {
+            out.set(commentKey(field, unquoteYamlKey(entry[1])), pending.join('\n'));
+        }
+        pending = [];
+    }
+    return out;
+}
+/**
+ * Put the harvested comment blocks back above their keys in dumped YAML.
+ *
+ * A key whose comment is already present is left alone, so re-running the hoist
+ * over an already-annotated file is idempotent rather than stuttering.
+ */
+function reattachKeyComments(yaml, comments, fields = WORKSPACE_SCOPED_PNPM_FIELDS) {
+    var _a;
+    if (comments.size === 0)
+        return yaml;
+    const lines = yaml.split('\n');
+    const out = [];
+    let field = null;
+    let fieldIndent = 0;
+    for (const line of lines) {
+        const topLevel = /^([A-Za-z_][\w-]*):\s*$/.exec(line);
+        if (topLevel) {
+            field = fields.includes(topLevel[1]) ? topLevel[1] : null;
+            fieldIndent = 0;
+            out.push(line);
+            continue;
+        }
+        if (field !== null && !/^\s*$/.test(line)) {
+            const indent = line.search(/\S/);
+            if (indent === 0) {
+                field = null;
+            }
+            else {
+                const entry = /^\s*((?:'[^']*')|(?:"[^"]*")|(?:[^\s:#][^:]*?))\s*:/.exec(line);
+                if (entry) {
+                    if (fieldIndent === 0)
+                        fieldIndent = indent;
+                    if (indent === fieldIndent) {
+                        const block = comments.get(commentKey(field, unquoteYamlKey(entry[1])));
+                        // `out[out.length - 1]`, not `.at(-1)`: this project's tsconfig lib
+                        // predates ES2022.
+                        const already = ((_a = out[out.length - 1]) !== null && _a !== void 0 ? _a : '').trim().startsWith('#');
+                        // Second gate on purpose: harvest is one source of blocks today, and a
+                        // control character reaching the emitted file is the whole exploit.
+                        if (block && !already && !CONTROL_CHARS.test(block)) {
+                            const pad = ' '.repeat(indent);
+                            out.push(...block.split('\n').map((l) => `${pad}${l}`));
+                        }
+                    }
+                }
+            }
+        }
+        out.push(line);
+    }
+    return out.join('\n');
+}
+/** `'msgpackr-extract'` / `"foo"` / `foo` all denote the same mapping key. */
+function unquoteYamlKey(raw) {
+    const trimmed = raw.trim();
+    const quoted = /^(['"])([\s\S]*)\1$/.exec(trimmed);
+    return quoted ? quoted[2] : trimmed;
+}
 /** Provenance note written above a hoisted `auditConfig` — see `annotateAuditConfig`. */
 const AUDIT_CONFIG_NOTE = '# Hoisted from the sub-projects by the lt CLI. These advisory suppressions now\n' +
     '# apply to EVERY package in this workspace, not just the one that justified\n' +
     '# them — review before adding, and drop entries once the advisory is fixed.';
-const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
 const isArrayField = (field) => ARRAY_FIELDS.includes(field);
 const isNestedArrayField = (field) => NESTED_ARRAY_FIELDS.includes(field);
 /**
@@ -157,13 +310,18 @@ function hoistPackageManager(options) {
  * @param options.subProjects Sub-project dirs relative to projectDir
  */
 function hoistWorkspacePnpmConfig(options) {
-    var _a;
+    var _a, _b;
     const { filesystem, projectDir, subProjects } = options;
     const rootWsPath = `${projectDir}/pnpm-workspace.yaml`;
     // The root pnpm-workspace.yaml is the destination. It normally exists (the
     // lt-monorepo clone ships one declaring `packages:`); start from it so
     // `packages:` and any root-owned settings are preserved.
     const rootWs = (_a = readYaml(filesystem, rootWsPath)) !== null && _a !== void 0 ? _a : {};
+    // Why the reasons are harvested rather than regenerated: they are prose written
+    // by whoever added the entry, and no rule can reconstruct them. The root's own
+    // comments are collected FIRST so that where two sources annotate the same key,
+    // the root's wording wins — it is the file a maintainer of THIS workspace edits.
+    const comments = extractKeyComments((_b = filesystem.read(rootWsPath)) !== null && _b !== void 0 ? _b : '');
     let rootChanged = false;
     for (const subDir of subProjects) {
         const subPath = `${projectDir}/${subDir}`;
@@ -176,7 +334,7 @@ function hoistWorkspacePnpmConfig(options) {
         if (hoistFromSubPackageJson({ filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
-        if (hoistFromSubWorkspaceYaml({ filesystem, rootWs, subPath })) {
+        if (hoistFromSubWorkspaceYaml({ comments, filesystem, rootWs, subPath })) {
             rootChanged = true;
         }
     }
@@ -184,7 +342,8 @@ function hoistWorkspacePnpmConfig(options) {
         // Keep allowBuilds (pnpm 11) and onlyBuiltDependencies (pnpm 10) in sync so
         // the build-script allowlist survives regardless of which key pnpm reads.
         syncBuildAllowlists(rootWs);
-        filesystem.write(rootWsPath, annotateAuditConfig((0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false })));
+        const dumped = (0, js_yaml_1.dump)(rootWs, { lineWidth: -1, sortKeys: false });
+        filesystem.write(rootWsPath, annotateAuditConfig(reattachKeyComments(dumped, comments)));
     }
 }
 /**
@@ -264,13 +423,22 @@ function hoistFromSubPackageJson(options) {
 }
 /** Source 2: the sub-project's pnpm-workspace.yaml. */
 function hoistFromSubWorkspaceYaml(options) {
-    const { filesystem, rootWs, subPath } = options;
+    var _a;
+    const { comments, filesystem, rootWs, subPath } = options;
     const subWsPath = `${subPath}/pnpm-workspace.yaml`;
     if (!filesystem.exists(subWsPath))
         return false;
+    const raw = (_a = filesystem.read(subWsPath)) !== null && _a !== void 0 ? _a : '';
     const ws = readYaml(filesystem, subWsPath);
     if (!ws)
         return false;
+    // Harvest BEFORE hoisting: this file is about to be deleted (or stripped of
+    // exactly these keys), and with it the only copy of the reasoning. An entry
+    // already annotated by the root keeps the root's wording.
+    for (const [key, block] of extractKeyComments(raw)) {
+        if (!comments.has(key))
+            comments.set(key, block);
+    }
     if (!hoistFields(rootWs, ws))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these

package/build/lib/strip-vendor-schema-augmentation.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripAugmentationBlocks = stripAugmentationBlocks;
+exports.stripVendorSchemaAugmentation = stripVendorSchemaAugmentation;
+const fs_utils_1 = require("./fs-utils");
+/**
+ * Drop `declare module '<nuxt|@nuxt>/schema' { … }` blocks that only augment
+ * `PublicRuntimeConfig`, leaving a note in their place.
+ *
+ * Brace-counted rather than regex-matched to the closing brace: a block may grow
+ * more members, and a pattern pinned to today's exact two lines would silently
+ * stop matching the moment it does — reintroducing the bug with no test failing,
+ * because the symptom only appears in a generated project.
+ *
+ * A block that augments anything OTHER than `PublicRuntimeConfig` is left alone.
+ * Those carry real declarations (module options, hooks) with no cycle, and
+ * deleting them would trade a typing bug for a worse one.
+ */
+function stripAugmentationBlocks(source, onSkip) {
+    const OPEN = /declare module ['"](?:@nuxt|nuxt)\/schema['"]\s*\{/g;
+    let out = source;
+    // A forward cursor rather than restarting `exec` from 0 after every rewrite.
+    // The restart made the matching branch O(k²) in the block count — measured
+    // 40 ms at 400 blocks, 558 ms at 1600. Real input is k=2, so this is shape
+    // rather than cost; the cursor is simply the honest way to write it, and it
+    // removes the recursion the non-matching branch needed.
+    let searchFrom = 0;
+    for (;;) {
+        OPEN.lastIndex = searchFrom;
+        const match = OPEN.exec(out);
+        if (!match)
+            break;
+        const bodyStart = match.index + match[0].length;
+        const end = matchingBrace(out, bodyStart);
+        if (end === -1) {
+            // Unbalanced (or a brace the scanner could not follow). Leaving it is the
+            // safe direction — truncating would break the file — but it must NOT be
+            // silent: the augmentation stays, so `config.public.*` is `unknown` in the
+            // generated project and nothing said so. Report and stop.
+            onSkip === null || onSkip === void 0 ? void 0 : onSkip("could not find the end of a `declare module '…/schema'` block; the augmentation was left in place. " +
+                'Remove it by hand, or `config.public.*` will type as `unknown` in this project.');
+            break;
+        }
+        const body = out.slice(bodyStart, end);
+        if (!/\bPublicRuntimeConfig\b/.test(body) || /\binterface\s+(?!PublicRuntimeConfig\b)/.test(body)) {
+            // Not ours, or carries other declarations too — keep it and move past it.
+            searchFrom = end + 1;
+            continue;
+        }
+        const note = '// The `nuxt/schema` PublicRuntimeConfig augmentation was removed by `lt` when this\n' +
+            '// core was vendored. In node_modules it is harmless; as project source it augments\n' +
+            '// the same interface twice (`nuxt/schema` re-exports `@nuxt/schema`) and closes a\n' +
+            "// cycle with Nuxt's generated runtime-config types — TS2310, hidden by skipLibCheck,\n" +
+            '// which makes every `config.public.*` read `unknown`. The keys are unaffected: Nuxt\n' +
+            "// writes them into the generated types from the module's runtime-config defaults.\n" +
+            '// Do not restore it here; fix it upstream in @lenne.tech/nuxt-extensions.';
+        out = `${out.slice(0, match.index)}${note}${out.slice(end + 1)}`;
+        searchFrom = match.index + note.length;
+    }
+    return out;
+}
+/**
+ * Remove the `nuxt/schema` runtime-config augmentations from a vendored
+ * nuxt-extensions core.
+ *
+ * ## What breaks without this
+ *
+ * `runtime/types/module.ts` in nuxt-extensions ends with:
+ *
+ *     declare module 'nuxt/schema'  { interface PublicRuntimeConfig extends LtExtensionsPublicRuntimeConfig {} }
+ *     declare module '@nuxt/schema' { interface PublicRuntimeConfig extends LtExtensionsPublicRuntimeConfig {} }
+ *
+ * In npm mode that file ships as a `.d.ts` inside `node_modules` and never
+ * enters the consumer's TypeScript program. Vendoring copies it to
+ * `app/core/runtime/types/module.ts`, which the project's own `include` picks up
+ * unconditionally — and `nuxt/schema` re-exports `@nuxt/schema`, so augmenting
+ * both names decorates ONE interface twice. Nuxt's generated
+ * `.nuxt/types/runtime-config.d.ts` then closes the loop with its own
+ * `interface PublicRuntimeConfig extends UserPublicRuntimeConfig` (imported from
+ * `nuxt/schema`), and TypeScript reports:
+ *
+ *     .nuxt/types/runtime-config.d.ts: error TS2310:
+ *       Type 'PublicRuntimeConfig' recursively references itself as a base type.
+ *
+ * An interface in that state resolves every member to `unknown`. So in every
+ * vendor-mode project — the DEFAULT for `lt fullstack init` — `config.public.x`
+ * is `unknown` rather than its declared type, and `nuxt typecheck` fails on
+ * ordinary, correct code.
+ *
+ * ## Why it took so long to find
+ *
+ * Nuxt sets `skipLibCheck: true`, which suppresses TS2310 because it is reported
+ * in a `.d.ts`. The cause is therefore invisible and only the consequence shows:
+ * a plain `Argument of type 'unknown' is not assignable to parameter of type
+ * 'string'` at a call site that is not wrong. That is why the trap was previously
+ * written up as "vendor mode does not emit the schema block" — in
+ * `nuxt-base-starter/nuxt-base-template/CLAUDE.md` and in the JSDoc of that
+ * template's `app/utils/app-origin.ts`, both since corrected. The block IS
+ * emitted, and is byte-identical between the two modes (`diff` of the two
+ * generated `.nuxt/types/runtime-config.d.ts` is empty). Measured 2026-08-22 by
+ * converting the template and re-running the type gate with
+ * `--skipLibCheck false`.
+ *
+ * ## Why removing it costs nothing
+ *
+ * `ltExtensions` does not reach the consumer through this augmentation. The
+ * module sets its runtime-config defaults at build time, so Nuxt writes the whole
+ * shape into `SharedPublicRuntimeConfig` in the generated file. Verified after
+ * stripping: `config.public.ltExtensions.auth.enabled` is `boolean`,
+ * `.basePath` is `string`, `config.public.siteUrl` is `string`, and the type gate
+ * is clean.
+ *
+ * The conversion is the right owner: it is the step that turns package typings
+ * into project source, so it owns what that change of status implies.
+ *
+ * @returns the files that were modified, plus any block it could not process —
+ *          which the caller MUST surface, because a skipped block means the bug
+ *          is still there and only the transform knows it.
+ */
+function stripVendorSchemaAugmentation(options) {
+    var _a;
+    const { coreDir, filesystem } = options;
+    if (!filesystem.isDirectory(coreDir))
+        return { touched: [], warnings: [] };
+    // A linked sub-project points at the user's own checkout; rewriting files there
+    // would edit their repository. Same guard the workspace helpers already apply.
+    if ((0, fs_utils_1.isSymlink)(coreDir))
+        return { touched: [], warnings: [] };
+    const touched = [];
+    const warnings = [];
+    for (const file of (_a = filesystem.find(coreDir, { matching: '**/*.ts' })) !== null && _a !== void 0 ? _a : []) {
+        const content = filesystem.read(file);
+        if (!content || !content.includes('PublicRuntimeConfig'))
+            continue;
+        const patched = stripAugmentationBlocks(content, (reason) => {
+            warnings.push(`${file}: ${reason}`);
+        });
+        if (patched === content)
+            continue;
+        filesystem.write(file, patched);
+        touched.push(file);
+    }
+    return { touched, warnings };
+}
+/**
+ * Index of the `}` closing the block whose body starts at `from`, or -1.
+ *
+ * Skips over string literals, template literals and comments. Counting raw
+ * braces looked adequate — the augmentation bodies are two plain
+ * `interface … extends … {}` lines — but a fuzz pass found both failure modes,
+ * and both are silent:
+ *
+ * - a `}` inside a string (`{ open: '}' }`) drops depth to 0 early, so the strip
+ *   cuts mid-block and leaves a stray `}` behind. The vendored file then does not
+ *   compile, in a project the developer just generated.
+ * - a `{` inside a string (`type X = '{'`) never balances, this returns -1, the
+ *   caller stops, and the augmentation is silently RETAINED — the exact TS2310
+ *   bug the whole transform exists to remove, with nothing printed.
+ *
+ * Neither triggers on today's nuxt-extensions. But this file's own contract is
+ * that the block may grow members (that is why it counts braces instead of
+ * matching a fixed pattern), and the day a member carries a brace in a string is
+ * the day it misfires.
+ */
+function matchingBrace(text, from) {
+    let depth = 1;
+    for (let i = from; i < text.length; i++) {
+        const ch = text[i];
+        // Line comment — nothing structural until the newline.
+        if (ch === '/' && text[i + 1] === '/') {
+            const nl = text.indexOf('\n', i);
+            if (nl === -1)
+                return -1;
+            i = nl;
+            continue;
+        }
+        // Block comment.
+        if (ch === '/' && text[i + 1] === '*') {
+            const close = text.indexOf('*/', i + 2);
+            if (close === -1)
+                return -1;
+            i = close + 1;
+            continue;
+        }
+        // String or template literal. Templates may nest `${…}`, which would need a
+        // full parser to follow — so a template is treated as opaque, which is the
+        // safe direction: at worst a brace inside `${}` is ignored and the caller
+        // gets -1 and warns, rather than cutting the file in the wrong place.
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const quote = ch;
+            i++;
+            while (i < text.length && text[i] !== quote) {
+                if (text[i] === '\\')
+                    i++;
+                // An unterminated single/double-quoted string cannot span a newline.
+                else if (text[i] === '\n' && quote !== '`')
+                    return -1;
+                i++;
+            }
+            if (i >= text.length)
+                return -1;
+            continue;
+        }
+        if (ch === '{')
+            depth++;
+        else if (ch === '}') {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}

package/build/lib/vendor-claude-md.js

@@ -92,6 +92,21 @@ function buildFrontendVendorBlock() {
         '- **Contribute back:** run `/lt-dev:frontend:contribute-nuxt-extensions-core`.',
         '- **Freshness check:** `pnpm run check:vendor-freshness` warns when',
         '  upstream has a newer release than the baseline.',
+        '',
+        '**If `config.public.*` types as `unknown`** (projects vendored before lt CLI',
+        '1.43.0), check with:',
+        '',
+        '    grep -rn "declare module \'@nuxt/schema\'" app/core/',
+        '',
+        'A match means the vendored core still augments `PublicRuntimeConfig` under both',
+        '`nuxt/schema` and `@nuxt/schema`. Those are one interface (the former re-exports',
+        "the latter), and as project source they close a cycle with Nuxt's generated",
+        'runtime-config types — TS2310, which `skipLibCheck` hides, so every',
+        '`config.public.*` read silently becomes `unknown`. Delete both blocks from',
+        '`app/core/runtime/types/module.ts`; nothing is lost, because `ltExtensions`',
+        "reaches the app through the module's runtime-config defaults either way.",
+        'New conversions strip them automatically — but a core update copies upstream',
+        'verbatim, so re-run the grep after every sync.',
     ]);
 }
 /**

package/docs/VENDOR-MODE-WORKFLOW.md

@@ -443,6 +443,41 @@ git commit -m "chore: revert fullstack to npm mode
 
 ## Troubleshooting
 
+### Problem: `config.public.*` is `unknown` in a project vendored before 1.43.0
+
+**Symptom.** `nuxt typecheck` fails with `Argument of type 'unknown' is not
+assignable to parameter of type 'string'` on code that is correct, at any
+`useRuntimeConfig().public.x` read.
+
+**Check whether you are affected** — version-independent:
+
+```bash
+grep -rn "declare module '@nuxt/schema'" projects/app/app/core/
+```
+
+**Cause.** The vendored nuxt-extensions core augments `PublicRuntimeConfig` under
+both `nuxt/schema` and `@nuxt/schema`. The former re-exports the latter, so that
+is one interface decorated twice; as project source it closes a cycle with Nuxt's
+generated runtime-config types. TypeScript reports
+`TS2310: Type 'PublicRuntimeConfig' recursively references itself as a base type`,
+which Nuxt's `skipLibCheck: true` suppresses — so only the confusing symptom is
+visible. See it with:
+
+```bash
+cd projects/app && npx vue-tsc --noEmit -p .nuxt-check/tsconfig.json --skipLibCheck false | grep TS2310
+```
+
+**Repair.** Delete the two `declare module '…/schema'` blocks from
+`projects/app/app/core/runtime/types/module.ts`. Nothing is lost — `ltExtensions`
+reaches the consumer through the module's runtime-config defaults, which Nuxt
+writes into the generated types either way.
+
+New conversions strip the blocks automatically (`stripVendorSchemaAugmentation`).
+**Re-check after every core update:** the updater copies upstream files verbatim
+and would bring them back. The template's own `CLAUDE.md` carries the same repair
+note for the project side.
+
+
 ### Problem: `tsc` fails with `new Error('msg', { cause })` error
 
 **Cause:** TypeScript target is too old (ES2020 or lower).

package/docs/commands.md

@@ -1075,6 +1075,15 @@ Installs helper scripts:
 
 ### `lt fullstack init`
 
+**Exit codes.** `0` on success, `1` on any failure — a failed clone, an aborted
+`pnpm install`, an invalid flag value, an existing target directory. Until 1.43.0
+every one of those exited `0`, so `lt fullstack init … && echo ok` printed `ok`
+after a broken scaffold; scripts and CI jobs that check `$?` need no workaround
+any more. The same contract holds for `lt fullstack add-api` / `add-app`, which
+`init` delegates to inside an existing workspace. A cancelled interactive prompt
+is not a failure and still exits `0`.
+
+
 Creates a new fullstack workspace with API and frontend.
 
 **Usage:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.42.0",
+  "version": "1.43.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -65,7 +65,7 @@
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "1.0.0",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "jsdom": "29.1.1",
     "jsonc-parser": "3.3.1",
     "lodash": "4.18.1",
@@ -104,7 +104,8 @@
     "//minimatch-note": "brace-expansion 1.x and 2.x are END OF LINE for GHSA-mh99-v99m-4gvg: the advisory range is <=5.0.7 across ALL majors and upstream patched ONLY 5.0.8+. 1.1.18 and 2.1.4 are the newest releases of their majors and remain vulnerable. Forcing brace-expansion 5.x globally is NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. The only real fix is to raise each CONSUMER off minimatch 3.x/5.x, which is what the scoped entries below do. Each was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
     "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. Covers filelist (gluegun > ejs > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1), @typescript-eslint/typescript-estree (^9.0.4) and jest-config/jest-runtime/@jest/reporters (^9). Verified safe per consumer: filelist calls only the static helper `minimatch.match(files, pat, opts)`; typescript-estree calls the named `minimatch(filePath, pattern, { dot: true })`; the three jest packages declare minimatch but never require it. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Drop once these consumers request minimatch >=10 themselves.",
     "babel-plugin-istanbul > test-exclude@<8": "test-exclude 6.0.0 pins minimatch ^3.0.4 and glob ^7. test-exclude 8.0.0 uses minimatch ^10.2.2 + glob ^13 (the glob major this project already ships) and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul's _interopRequireDefault + `new TestExclude(opts)` keeps working. Drop once babel-plugin-istanbul widens its ^6.0.0 range.",
-    "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
+    "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched).",
+    "@istanbuljs/load-nyc-config": "GHSA-5p4m-2wfm-xmqj (high): quadratic CPU consumption resolving !!omap. Patched only in 4.3.1 - the advisory states the fix was NOT backported to 3.x, so 3.15.0 is the end of its line and there is nothing to raise it to within the major. The one 3.x path is dev-only: ts-jest > @jest/transform > babel-plugin-istanbul > @istanbuljs/load-nyc-config > js-yaml@3.15.0. Cross-major export shape verified before adding (repo policy): load-nyc-config calls `require('js-yaml').load(...)` at index.js:80, and 4.x exports `load` - so the raise is API-compatible. It is also strictly SAFER: 4.x `load` behaves like 3.x `safeLoad`, refusing arbitrary type construction, and the input here is a repo-local .nycrc.yml. Scoped to this ONE consumer rather than raised globally: that is the call site whose shape was verified, and a global raise would silently apply to consumers nobody checked. A top-level `js-yaml@<4.3.1` selector was tried first and npm did not apply it to this nested path at all - the scoped form is what actually resolves. Remove once ts-jest's istanbul chain requests a patched js-yaml itself."
   },
   "overrides": {
     "semver@*": "7.8.5",
@@ -117,7 +118,10 @@
     "babel-plugin-istanbul": {
       "test-exclude@<8": "8.0.0"
     },
-    "minimatch@>=4 <10": "10.2.6"
+    "minimatch@>=4 <10": "10.2.6",
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "4.3.1"
+    }
   },
   "//jest.workerIdleMemoryLimit": "Recycle a ts-jest worker once its heap passes this. Guards against an intermittent `A jest worker process was terminated by another process: signal=SIGSEGV` that kills ONE suite while every other test passes (seen twice in marketplace*, both under `npm run check`, never reproducible on demand - 0 in 9 targeted runs incl. --maxWorkers=16). It is a worker crash, NOT an assertion failure: the signature is `Test suite failed to run` with the remaining count still green. All versions are current and in-range (node 24 / jest 30 / ts-jest 29 / ts 6), so this is a resilience measure against unbounded worker heap growth, not a proven root-cause fix - if it recurs, capture the suite name and re-open.",
   "jest": {