@lenne.tech/cli 1.47.0 → 1.49.0

package/build/extensions/server.js

@@ -44,12 +44,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
+const glob_1 = require("glob");
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
+const cross_env_1 = require("../lib/cross-env");
 const markdown_table_1 = require("../lib/markdown-table");
-const strip_comments_1 = require("../lib/strip-comments");
+const migrate_scripts_1 = require("../lib/migrate-scripts");
+const module_specifiers_1 = require("../lib/module-specifiers");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -1232,13 +1235,15 @@ class Server {
             // only as type annotations — any runtime `new Request(...)` calls refer
             // to the global Fetch API Request, not the express one.
             const expressImportRegex = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"]\s*;?\s*$/gm;
-            const vendoredTsFiles = filesystem.find(coreDir, {
-                matching: '**/*.ts',
-                recursive: true,
-            }) || [];
-            for (const filePath of vendoredTsFiles) {
-                // filesystem.find returns paths relative to jetpack cwd — use absolute resolution
-                const absPath = filePath.startsWith('/') ? filePath : require('node:path').resolve(filePath);
+            // `glob`, not `filesystem.find`: jetpack builds its matcher by concatenating the
+            // RESOLVED base path in front of the pattern, and minimatch reads a backslash
+            // inside a PATTERN as an escape. On Windows `C:\…\core` + `**/*.ts` therefore
+            // collapses to a literal that matches nothing, so this loop silently patched
+            // no files at all. (minimatch 3 normalised the pattern's separators; the repo
+            // now resolves the hoisted minimatch 10, which does not — see package.json.)
+            // `glob` keeps base and pattern apart and returns absolute OS-native paths.
+            const vendoredTsFiles = (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true });
+            for (const absPath of vendoredTsFiles) {
                 if (!filesystem.exists(absPath))
                     continue;
                 const content = filesystem.read(absPath) || '';
@@ -1553,10 +1558,16 @@ class Server {
                         scripts['migrate:up'] = `node ./bin/migrate.js up ${migrateArgs}`;
                         scripts['migrate:down'] = `node ./bin/migrate.js down ${migrateArgs}`;
                         scripts['migrate:list'] = `node ./bin/migrate.js list ${migrateArgs}`;
-                        scripts['migrate:develop:up'] = `NODE_ENV=develop node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:test:up'] = `NODE_ENV=test node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:preview:up'] = `NODE_ENV=preview node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:prod:up'] = `NODE_ENV=production node ./bin/migrate.js up ${migrateArgs}`;
+                        // The deployed scripts run the COMPILED migrations under dist/, not the
+                        // sources: a production tree has no ts-node (devDependency), so the
+                        // `--compiler ts:…` form dies there. `copy:bin` ships the shim into
+                        // dist/bin. See src/lib/migrate-scripts.ts.
+                        Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('node ./dist/bin/migrate.js'));
+                        const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                        if (guardWarning) {
+                            this.toolbox.print.warning(guardWarning);
+                        }
+                        (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                         // Make the production build carry a runnable migration setup.
                         //
                         // The image has no ts-node, and the docker entrypoint looks for
@@ -1576,7 +1587,8 @@ class Server {
                         // deliberate customization survives a re-run (older starters simply
                         // lack them → still repaired).
                         if (typeof scripts['copy:bin'] !== 'string') {
-                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || true';
+                            // `|| exit 0`, not `|| true`: cmd.exe has no `true` command.
+                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || exit 0';
                         }
                         if (typeof scripts['copy:migrations'] !== 'string') {
                             scripts['copy:migrations'] =
@@ -1884,13 +1896,10 @@ class Server {
             // Scan all consumer files for stale bare-specifier imports that the
             // codemod should have rewritten. A single miss causes a compile error,
             // so catching it here with a clear message saves the user debugging time.
-            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server', 
-            // Match only real import/export/require specifiers in single/double
-            // quotes — NOT comment references like
-            // `node_modules/@lenne.tech/nest-server/...` (backticks, no keyword),
-            // which the codemod legitimately leaves untouched. A naive substring
-            // match flagged config.env.ts's JSDoc path as a false positive.
-            /(?:from|import|export|require)\s*\(?\s*['"]@lenne\.tech\/nest-server(?:\/[^'"]*)?['"]/);
+            // A specifier, not a text match: a JSDoc path like
+            // `node_modules/@lenne.tech/nest-server/...` is prose and never reaches the AST,
+            // which is what used to make config.env.ts a false positive.
+            const staleImports = this.findStaleImports(dest, (specifier) => (0, module_specifiers_1.isPackageImport)(specifier, '@lenne.tech/nest-server'));
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleImports.length} file(s) still contain '@lenne.tech/nest-server' imports after vendor conversion:`);
@@ -2414,11 +2423,16 @@ class Server {
                 scripts['migrate:up'] = `migrate up ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:down'] = `migrate down ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:list'] = `migrate list ${migrateStore} --compiler ${migrateCompiler}`;
-                // Env-prefixed migrate scripts
-                for (const env of ['develop', 'test', 'preview', 'prod']) {
-                    const nodeEnv = env === 'prod' ? 'production' : env;
-                    scripts[`migrate:${env}:up`] = `NODE_ENV=${nodeEnv} migrate up ${migrateStore} --compiler ${migrateCompiler}`;
-                }
+                // Deployed scripts: compiled migrations under dist/, no --compiler (no ts-node
+                // in a production tree), via cross-env for cmd.exe. `migrate` is the binary of
+                // @lenne.tech/nest-server, a production dependency in npm mode — the same path
+                // docker-entrypoint.sh uses for this mode.
+                Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('migrate'));
+                const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                if (guardWarning) {
+                    this.toolbox.print.warning(guardWarning);
+                }
+                (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                 filesystem.write(`${dest}/package.json`, pkg);
             }
             // ── 5. Remove vendor artifacts ──────────────────────────────────────
@@ -2495,7 +2509,7 @@ class Server {
             // Scan all consumer files for stale relative imports that still resolve
             // to the (now deleted) src/core/ directory. These would be silent
             // compile errors.
-            const staleRelativeImports = this.findStaleImports(dest, '../core', /['"]\.\.?\/[^'"]*core['"]|from\s+['"]\.\.?\/[^'"]*core['"]/);
+            const staleRelativeImports = this.findStaleImports(dest, module_specifiers_1.isRelativeCoreImport);
             if (staleRelativeImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleRelativeImports.length} file(s) still contain relative core imports after npm conversion:`);
@@ -2511,35 +2525,38 @@ class Server {
      * rewritten by a mode conversion. Returns a list of file paths that still
      * contain matches.
      *
-     * @param dest      Project root directory
-     * @param needle    Literal string to search for (used when no regex provided)
-     * @param pattern   Optional regex for more flexible matching
+     * @param dest    Project root directory
+     * @param matches Predicate on a module SPECIFIER, e.g. `(s) => isPackageImport(s, 'pkg')`
      */
-    findStaleImports(dest, needle, pattern) {
+    findStaleImports(dest, matches) {
+        // Patterns are relative to `dest` and passed to `glob` rather than
+        // `filesystem.find`: jetpack concatenates the resolved base path in front of
+        // the pattern, and minimatch treats a backslash inside a PATTERN as an escape,
+        // so on Windows every slash-bearing pattern below matched nothing. This
+        // function would then report "no stale imports" for a project that has them —
+        // a false clean bill of health on the one check meant to catch a broken
+        // conversion. See the same fix at the vendored-express patch above.
         const globs = [
-            `${dest}/src/server/**/*.ts`,
-            `${dest}/src/main.ts`,
-            `${dest}/src/config.env.ts`,
-            `${dest}/tests/**/*.ts`,
-            `${dest}/migrations/**/*.ts`,
-            `${dest}/scripts/**/*.ts`,
+            'src/server/**/*.ts',
+            'src/main.ts',
+            'src/config.env.ts',
+            'tests/**/*.ts',
+            'migrations/**/*.ts',
+            'scripts/**/*.ts',
         ];
         const stale = [];
         for (const glob of globs) {
-            const files = this.filesystem.find(dest, {
-                matching: glob.replace(`${dest}/`, ''),
-                recursive: true,
-            }) || [];
+            const files = (0, glob_1.globSync)(glob, { absolute: true, cwd: dest, dot: true, nodir: true });
             for (const file of files) {
-                const raw = this.filesystem.read(file) || '';
-                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
-                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
-                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
-                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
-                // and told the user to rewrite imports that file does not have. A detector that reads
-                // comments as code produces false alarms on exactly the files that explain it best.
-                const content = (0, strip_comments_1.stripComments)(raw);
-                if (pattern ? pattern.test(content) : content.includes(needle)) {
+                // Ask the parser for the file's module specifiers rather than searching its
+                // text. A docblock that DOCUMENTS the conversion quotes the very syntax a text
+                // search looks for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts`
+                // names `from '@lenne.tech/nest-server'` in prose, and the detector told the user
+                // to rewrite imports that file does not have. Blanking comments first was the old
+                // answer and does not hold (see src/lib/module-specifiers.ts); a comment is not
+                // part of the AST at all.
+                const specifiers = (0, module_specifiers_1.fileImportedSpecifiers)(file, (path) => this.filesystem.read(path) || undefined);
+                if (specifiers.some(matches)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }
             }

package/build/lib/check-template-sync.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHECK_TEMPLATE_PIN_FILE = exports.CHECK_TEMPLATE_REPOSITORY = void 0;
 exports.readCheckTemplatePin = readCheckTemplatePin;
 exports.syncCheckTemplate = syncCheckTemplate;
+exports.spawnedSiblings = spawnedSiblings;
 exports.verifyCheckTemplate = verifyCheckTemplate;
 /**
  * Keep `src/templates/check/` a verbatim copy of a PINNED lt-monorepo state.
@@ -77,6 +78,14 @@ function syncCheckTemplate(options) {
                 (0, fs_1.rmSync)((0, path_1.join)(templateDir, stale), { force: true });
             }
         }
+        // Refuse rather than ship silently: whether a spawned sibling belongs in the
+        // template or whether lt-monorepo should drop the call is a human decision.
+        const spawned = spawnedSiblings(templateDir, Object.keys(files)).filter((name) => !(name in files));
+        if (spawned.length > 0) {
+            throw new Error(`${ref}: the template starts sibling script(s) it does not ship: ${spawned.join(', ')}. ` +
+                'resolveCopySet only follows imports, so these would be missing in every generated project. ' +
+                'Add them to the wrapper\'s import closure, ship them deliberately, or remove the call upstream.');
+        }
         const pin = {
             commit,
             files: sortKeys(files),
@@ -91,10 +100,54 @@ function syncCheckTemplate(options) {
         (0, fs_1.rmSync)(checkout, { force: true, recursive: true });
     }
 }
+/**
+ * A sibling script the wrapper SPAWNS rather than imports.
+ *
+ * `resolveCopySet` follows imports, so a `node scripts/x.mjs` — or a spawn/execFile
+ * with such a path — is invisible to it: the file is never shipped, the pin test stays
+ * green, and only the generated project breaks. Matched on the path inside a STRING
+ * rather than on the call shape, so `spawn('node', ['scripts/x.mjs'])`,
+ * `execSync('bash scripts/x.sh')` and a bare `'scripts/x.mjs'` are all covered.
+ *
+ * Comment LINES are skipped before matching. These files document their own behaviour
+ * in backtick-quoted prose, and a backtick is a string delimiter to a regex: the first
+ * draft reported `bash scripts/audit.sh` out of a comment on `check.mjs:103` and would
+ * have refused every sync from then on. `stripComments` is deliberately NOT used —
+ * measured on this very file, it stops blanking at offset 3329, where a regex literal
+ * (`/^projects\//`) is followed by a division (`ms / 1000`) and the standalone
+ * TypeScript scanner, having no parser context, can no longer tell the two apart.
+ */
+const SPAWNED_SIBLING = /['"`](?:[\w./-]+\s+)*(?:\.\/)?scripts\/([\w.-]+\.(?:mjs|cjs|js|sh))/g;
+/**
+ * Sibling scripts the template STARTS instead of importing, as `scripts/<name>`.
+ * Deduplicated, and the wrapper's own name is never reported.
+ */
+function spawnedSiblings(templateDir, files) {
+    const found = new Set();
+    for (const name of files) {
+        const file = (0, path_1.join)(templateDir, name);
+        if (!(0, fs_1.existsSync)(file)) {
+            continue;
+        }
+        for (const line of (0, fs_1.readFileSync)(file, 'utf8').split('\n')) {
+            const code = line.trimStart();
+            if (code.startsWith('//') || code.startsWith('*') || code.startsWith('/*')) {
+                continue;
+            }
+            for (const [, sibling] of code.matchAll(SPAWNED_SIBLING)) {
+                if (sibling !== 'check.mjs' && sibling !== name) {
+                    found.add(sibling);
+                }
+            }
+        }
+    }
+    return [...found].sort();
+}
 /**
  * Differences between the template dir and its pin; empty when they match.
- * Checks both directions: every pinned file with its hash, and every file the
- * wrapper actually imports is pinned (a hand-added import would otherwise slip by).
+ * Checks three directions: every pinned file with its hash, every file the wrapper
+ * imports is pinned (a hand-added import would otherwise slip by), and no file is
+ * SPAWNED that nothing ships.
  */
 function verifyCheckTemplate(templateDir, pin) {
     const problems = [];
@@ -113,6 +166,13 @@ function verifyCheckTemplate(templateDir, pin) {
             problems.push(`${name}: imported by the wrapper but not pinned`);
         }
     }
+    for (const sibling of spawnedSiblings(templateDir, [...Object.keys(pin.files), ...actual])) {
+        if (!(sibling in pin.files)) {
+            problems.push(`${sibling}: STARTED by the template (\`node scripts/${sibling}\`) but not shipped — ` +
+                'a generated project would call a file it does not have. Decide deliberately: add it to the ' +
+                'template, or have lt-monorepo drop the call.');
+        }
+    }
     const version = (0, heal_check_wrapper_1.readWrapperVersion)((0, path_1.join)(templateDir, 'check.mjs'));
     if (version !== pin.version) {
         problems.push(`check.mjs: marker ${version !== null && version !== void 0 ? version : '(none)'} does not match pinned version ${pin.version}`);

package/build/lib/config-env-graphql.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.disableGraphQlInEveryEnvBlock = disableGraphQlInEveryEnvBlock;
+exports.envBlocksWithoutGraphQlDisabled = envBlocksWithoutGraphQlDisabled;
+/**
+ * Add `graphQl: false` to every environment block that has no `graphQl` property, and
+ * replace a `graphQl: { … }` that survived with `false`.
+ *
+ * Line endings are preserved: a CRLF file stays CRLF.
+ */
+function disableGraphQlInEveryEnvBlock(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const added = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        if (!property) {
+            block.insertPropertyAssignment(0, { initializer: 'false', name: 'graphQl' });
+            added.push(name);
+            continue;
+        }
+        const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (initializer && initializer.getText() !== 'false') {
+            property.setInitializer('false');
+            added.push(name);
+        }
+    }
+    const written = added.length > 0 ? sourceFile.getFullText() : content;
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return { added, content: restoreLineEndings(content, written) };
+}
+/**
+ * Environment blocks that do NOT disable GraphQL — empty when the file is fine.
+ * Used as the conversion's final check.
+ */
+function envBlocksWithoutGraphQlDisabled(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const offenders = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        const initializer = property && ((_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a));
+        if (!initializer || initializer.getText() !== 'false') {
+            offenders.push(name);
+        }
+    }
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return offenders;
+}
+/**
+ * The environment blocks of a `config.env.ts`: the object-literal properties of the
+ * exported `config` object, including the ones passed to a `merge(…)` call (the shape
+ * the starter uses). Only direct children count — a nested `mongoose: { … }` is not an
+ * environment.
+ */
+function envBlocks(sourceFile) {
+    var _a, _b;
+    const { SyntaxKind } = require('ts-morph');
+    const roots = [];
+    for (const statement of sourceFile.getVariableStatements()) {
+        for (const declaration of statement.getDeclarations()) {
+            if (declaration.getName() !== 'config') {
+                continue;
+            }
+            const initializer = declaration.getInitializer();
+            if (!initializer) {
+                continue;
+            }
+            if (initializer.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                roots.push(initializer);
+            }
+            if (initializer.getKind() === SyntaxKind.CallExpression) {
+                for (const argument of initializer.getArguments()) {
+                    if (argument.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                        roots.push(argument);
+                    }
+                }
+            }
+        }
+    }
+    const blocks = [];
+    for (const root of roots) {
+        for (const property of root.getProperties()) {
+            if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+                continue;
+            }
+            const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+            if ((initializer === null || initializer === void 0 ? void 0 : initializer.getKind()) === SyntaxKind.ObjectLiteralExpression) {
+                blocks.push([property.getName(), initializer]);
+            }
+        }
+    }
+    return blocks;
+}
+function parse(content) {
+    const { Project } = require('ts-morph');
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: true });
+    return { project, sourceFile: project.createSourceFile('config.env.ts', content, { overwrite: true }) };
+}
+/** ts-morph writes LF; a file that came in as CRLF goes back out as CRLF. */
+function restoreLineEndings(original, written) {
+    if (!original.includes('\r\n')) {
+        return written;
+    }
+    return written.replace(/\r?\n/g, '\r\n');
+}

package/build/lib/cross-env.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_PREFIX = exports.CROSS_ENV_PACKAGE = exports.CROSS_ENV_VERSION = void 0;
+exports.bareEnvPrefixes = bareEnvPrefixes;
+exports.ensureCrossEnvDependency = ensureCrossEnvDependency;
+exports.usesPosixEnvPrefix = usesPosixEnvPrefix;
+exports.withCrossEnv = withCrossEnv;
+/**
+ * Environment prefixes in GENERATED package.json scripts.
+ *
+ * npm and pnpm run scripts through cmd.exe on Windows, which knows no
+ * `VAR=value command` form: it reads `NODE_ENV` as the program name and aborts
+ * with "'NODE_ENV' is not recognized as an internal or external command"
+ * (reported from a Windows laptop, 2026-09-16, on a project generated by lt
+ * 1.47.0: `pnpm run start:local` died there).
+ *
+ * `cross-env` sets the variable in the child process instead, so the same script
+ * works in bash, zsh, PowerShell and cmd.exe.
+ */
+/** Pinned exactly: an override target or dependency of ours is never a range (repo rule). */
+exports.CROSS_ENV_VERSION = '10.1.0';
+exports.CROSS_ENV_PACKAGE = 'cross-env';
+/**
+ * A POSIX env assignment in front of a command — the form cmd.exe cannot run.
+ *
+ * Deliberately NOT anchored to the start of the script: the mistake that actually
+ * happens when converting is an `&&` chain in which only the first link was
+ * wrapped (`cross-env NODE_ENV=x a && NODE_ENV=x b`), and an anchored expression
+ * reports that as clean.
+ */
+exports.ENV_PREFIX = /(^|[\s;&|(])[A-Z_][A-Z0-9_]*=\S/;
+/** `cross-env` plus the assignments it carries — those are the covered ones. */
+const CROSS_ENV_ASSIGNMENTS = /cross-env\s+(?:[A-Z_][A-Z0-9_]*=\S+\s+)+/g;
+/**
+ * Bare `VAR=value` prefixes in `script`, i.e. the ones cmd.exe would choke on.
+ * Assignments that `cross-env` carries are removed first, so a correctly
+ * converted script — including `cross-env A=1 B=2 cmd` — reports nothing.
+ */
+function bareEnvPrefixes(script) {
+    const rest = script.replace(CROSS_ENV_ASSIGNMENTS, '');
+    const found = [];
+    for (const match of rest.matchAll(/(?:^|[\s;&|(])([A-Z_][A-Z0-9_]*=\S+)/g)) {
+        found.push(match[1]);
+    }
+    return found;
+}
+/**
+ * Make sure a generated project can run the scripts we just wrote.
+ *
+ * Lands in `dependencies`, NOT `devDependencies`: production trees are installed
+ * without dev packages — the starter's Dockerfile uses
+ * `pnpm install --frozen-lockfile --prod` and `pnpm deploy --prod` — and the scripts
+ * run there (`start:prod`, `dp:prod` → `migrate:prod:up`) are exactly the env-carrying
+ * ones. Measured by the starter session on two real `--prod` installs from one
+ * lockfile: as a devDependency `node_modules/.bin/cross-env` is missing, as a
+ * dependency it is there. (The framework repos keep it in devDependencies: their
+ * scripts never reach a customer image, and nest-server is published to npm, where a
+ * production dependency would be forced on every consumer.)
+ *
+ * Only added when the project does not declare it anywhere already — the starters ship
+ * it themselves, and a second entry would fight theirs on every update. An existing
+ * entry keeps its group and version, devDependencies included.
+ *
+ * @param pkg Parsed package.json of the generated project; mutated in place.
+ * @returns true when the dependency was added.
+ */
+function ensureCrossEnvDependency(pkg) {
+    const declared = [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies, pkg.optionalDependencies].some((group) => group && typeof group === 'object' && exports.CROSS_ENV_PACKAGE in group);
+    if (declared) {
+        return false;
+    }
+    if (!pkg.dependencies || typeof pkg.dependencies !== 'object') {
+        pkg.dependencies = {};
+    }
+    pkg.dependencies[exports.CROSS_ENV_PACKAGE] = exports.CROSS_ENV_VERSION;
+    pkg.dependencies = Object.fromEntries(Object.entries(pkg.dependencies).sort(([a], [b]) => a.localeCompare(b)));
+    return true;
+}
+/** True when `script` still carries a bare `VAR=value` prefix. */
+function usesPosixEnvPrefix(script) {
+    return bareEnvPrefixes(script).length > 0;
+}
+/**
+ * Prefix a command with `cross-env VAR=value …`.
+ *
+ * @param env     Variables to set, e.g. `{ NODE_ENV: 'production' }`.
+ * @param command The command to run.
+ */
+function withCrossEnv(env, command) {
+    const assignments = Object.entries(env)
+        .map(([name, value]) => `${name}=${value}`)
+        .join(' ');
+    return `cross-env ${assignments} ${command}`;
+}

package/build/lib/dev-api-launch.js

@@ -9,8 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPendingMigrations = applyPendingMigrations;
 exports.findCompiledEntry = findCompiledEntry;
 exports.isApiCompiledRequested = isApiCompiledRequested;
+exports.resolveApiRuntime = resolveApiRuntime;
 exports.startCompiledApi = startCompiledApi;
 /**
  * Launch strategy for the API process under `lt dev up`.
@@ -28,6 +30,33 @@ const node_path_1 = require("node:path");
 const dev_process_1 = require("./dev-process");
 /** Candidate compiled entry points, in preference order. Single-sourced so `lt dev test` agrees. */
 const COMPILED_ENTRIES = ['dist/src/main.js', 'dist/main.js'];
+/**
+ * Apply the project's pending migrations (`<pm> run migrate:up`) ahead of an API
+ * that is started WITHOUT its own `start` script.
+ *
+ * lt projects chain the migration into that script (`migrate:up && start:local`),
+ * so every path that starts the compiled bundle directly — `lt dev up
+ * --api-compiled` and `lt dev test` — drops the migration along with it. On a
+ * database that outlives the run, that leaves the API on a state no deployed
+ * environment has: a changed unique index never reached the `lt dev test` DB, and
+ * the suite failed with a 409 that looked like a bug in the feature (DEV-3289).
+ *
+ * `env` must be the environment the API itself gets. The migration store resolves
+ * its database from the same `config.env.ts` + `NSC__MONGOOSE__URI` merge, so
+ * sharing the env is what makes both reach the same database.
+ *
+ * A project without a `migrate:up` script is `skipped`, never an error — nest-base
+ * (Prisma) projects have none. A migration killed by a signal (`null`) is `failed`.
+ */
+function applyPendingMigrations(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { apiDir, env, pm } = options;
+        if (!hasScript(apiDir, 'migrate:up'))
+            return { status: 'skipped' };
+        const exitCode = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('migrate:up'), { cwd: apiDir, env });
+        return exitCode === 0 ? { status: 'applied' } : { exitCode, status: 'failed' };
+    });
+}
 /** Resolve the compiled API entry point in `apiDir`, or `undefined` if none was built. */
 function findCompiledEntry(apiDir) {
     return COMPILED_ENTRIES.map((rel) => (0, node_path_1.join)(apiDir, rel)).find((candidate) => (0, node_fs_1.existsSync)(candidate));
@@ -47,6 +76,50 @@ function isApiCompiledRequested(options = {}) {
     const affirmative = (value) => value === true || ['1', 'true', 'yes'].includes(String(value).toLowerCase());
     return affirmative(options.apiCompiled) || affirmative(options['api-compiled']);
 }
+/**
+ * Which runtime to start the API's COMPILED bundle with.
+ *
+ * A bundle is only portable across runtimes by accident. `nest-base` builds with
+ * `Bun.build({ target: 'bun' })`, whose output calls `__require` — a Bun-only
+ * shim. Started under node it dies in milliseconds with "__require is not a
+ * function" (DEV-3208), and because the caller used to only WARN when the API
+ * never answered, the whole Playwright suite then ran against a dead API: every
+ * data-dependent spec passed trivially or skipped, so a run that checked nothing
+ * looked exactly like one that checked everything.
+ *
+ * Detected from the project rather than configured, because the project already
+ * states it three times over. Any one signal is enough:
+ *   - a `bun.lock` / `bun.lockb` IN THIS DIRECTORY (not a nested package's),
+ *   - `engines.bun` in its package.json,
+ *   - a `build` / `start` script that invokes `bun` as the COMMAND.
+ *
+ * The script check matches `bun` as a whole word at a command position, never as
+ * a substring: `rollup --bundle` and `node -r bunyan …` are Node projects, and a
+ * loose `includes('bun')` would switch them to a runtime they never installed.
+ *
+ * Defaults to `node` whenever nothing says otherwise, including an unreadable or
+ * missing package.json — the historical behaviour, and the safe one: guessing
+ * `bun` for a project that does not have it installed turns a working start into
+ * an exit-127.
+ *
+ * This deliberately does NOT live in `dev-package-manager`: that module resolves
+ * which PACKAGE MANAGER drives a directory (`pnpm run build`), a separate axis
+ * from which runtime executes an already-built bundle. A Bun project whose
+ * scripts pnpm happens to run still needs `bun dist/main.js`.
+ */
+function resolveApiRuntime(apiDir) {
+    var _a, _b, _c;
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lock')) || (0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lockb')))
+        return 'bun';
+    const pkg = readPackageJson(apiDir);
+    if (!pkg)
+        return 'node';
+    if ((_a = pkg.engines) === null || _a === void 0 ? void 0 : _a.bun)
+        return 'bun';
+    // `bun` as the command itself, or after a shell separator (`&&`, `;`, `|`).
+    const invokesBun = /(?:^|[&|;]\s*)bun\b/;
+    return [(_b = pkg.scripts) === null || _b === void 0 ? void 0 : _b.build, (_c = pkg.scripts) === null || _c === void 0 ? void 0 : _c.start].some((script) => script && invokesBun.test(script)) ? 'bun' : 'node';
+}
 /**
  * Build the API and start it compiled (`node dist/src/main.js`). Applies pending
  * migrations first for parity with the ts-node path it replaces (`<pm> run start`
@@ -61,16 +134,18 @@ function startCompiledApi(options) {
         const build = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('build'), { cwd: apiDir, env });
         const entry = findCompiledEntry(apiDir);
         if (build === 0 && entry) {
-            if (hasScript(apiDir, 'migrate:up')) {
-                const migrate = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('migrate:up'), { cwd: apiDir, env });
-                if (migrate !== 0) {
-                    // Parity with `migrate:up && start:local`: a failed migration must PREVENT the server
-                    // from starting rather than boot it against a half-migrated DB behind a "Started" banner.
-                    log.warn(`migrate:up failed (exit ${String(migrate)}) — API NOT started (would run on an un-migrated DB).`);
-                    return undefined;
-                }
+            const migration = yield applyPendingMigrations({ apiDir, env, pm });
+            if (migration.status === 'failed') {
+                // Parity with `migrate:up && start:local`: a failed migration must PREVENT the server
+                // from starting rather than boot it against a half-migrated DB behind a "Started" banner.
+                log.warn(`migrate:up failed (exit ${String(migration.exitCode)}) — API NOT started (would run on an un-migrated DB).`);
+                return undefined;
             }
-            return (0, dev_process_1.spawnDetached)('node', [entry], { cwd: apiDir, env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }), logFile });
+            return (0, dev_process_1.spawnDetached)(resolveApiRuntime(apiDir), [entry], {
+                cwd: apiDir,
+                env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }),
+                logFile,
+            });
         }
         log.warn(`compiled API unavailable (build exit ${String(build)}) — falling back to \`${pm.bin} start\` (ts-node).`);
         return (0, dev_process_1.spawnDetached)(pm.bin, pm.runScript('start'), { cwd: apiDir, env, logFile });
@@ -78,12 +153,15 @@ function startCompiledApi(options) {
 }
 /** True when `package.json` in `apiDir` defines a script named `name`. */
 function hasScript(apiDir, name) {
-    var _a;
+    var _a, _b;
+    return typeof ((_b = (_a = readPackageJson(apiDir)) === null || _a === void 0 ? void 0 : _a.scripts) === null || _b === void 0 ? void 0 : _b[name]) === 'string';
+}
+/** The parsed `package.json` in `apiDir`, or `undefined` when it is missing or unparsable. */
+function readPackageJson(apiDir) {
     try {
-        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
-        return typeof ((_a = pkg.scripts) === null || _a === void 0 ? void 0 : _a[name]) === 'string';
+        return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
     }
-    catch (_b) {
-        return false;
+    catch (_a) {
+        return undefined;
     }
 }