@lenne.tech/cli 1.48.0 → 1.49.0

package/build/commands/dev/test.js

@@ -23,8 +23,10 @@ const dev_ticket_1 = require("../../lib/dev-ticket");
  * App mode (default) runs the Playwright suite against a fully ISOLATED test
  * stack (own URLs / ports / Caddy block / dedicated `<…>-test` database) that
  * runs parallel to — and never touches — the developer's `lt dev up` session.
- * Playwright's global-setup resets that dedicated DB once before the first test.
- * The stack is torn down automatically when the run finishes (residue-free).
+ * That DB outlives the run, so pending migrations are applied to it before the
+ * API starts; a project's Playwright global-setup may reset it on top (the CLI
+ * does not). The stack is torn down automatically when the run finishes
+ * (residue-free).
  *
  * API mode (`--api`) runs the standalone API test suite (`pnpm test:e2e` in the
  * API), which already isolates itself on its own DB — no stack is brought up.
@@ -225,7 +227,7 @@ const TestCommand = {
         try {
             const ctx = yield (0, dev_test_session_1.bringUpTestSession)(layout, identity, log, { devDbName });
             const env = Object.assign(Object.assign(Object.assign(Object.assign({}, process.env), readBridgeEnv(layout.root)), { 
-                // Playwright global-setup resets THIS db (allow-listed) before the suite.
+                // THIS db, for a project whose global-setup resets or cleans it (allow-listed).
                 MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` }), (ctx.apiLogPath ? { NEST_SERVER_LOG: ctx.apiLogPath } : {}));
             if (debug) {
                 env.PWDEBUG = '1';

package/build/commands/fullstack/init.js

@@ -488,7 +488,7 @@ const NewCommand = {
             yield system.run(`cd ${projectDir} && git init --initial-branch=dev`);
         }
         catch (err) {
-            error(`Failed to initialize git: ${err.message}`);
+            ngBaseSpinner.fail(`Failed to initialize git: ${err.message}`);
             (0, fail_run_1.failRun)(toolbox);
             return;
         }
@@ -498,7 +498,7 @@ const NewCommand = {
                 yield system.run(`cd ${projectDir} && git remote add origin ${gitLink}`);
             }
             catch (err) {
-                error(`Failed to add remote: ${err.message}`);
+                ngBaseSpinner.fail(`Failed to add remote: ${err.message}`);
                 (0, fail_run_1.failRun)(toolbox);
                 return;
             }
@@ -526,7 +526,7 @@ const NewCommand = {
             });
         }
         if (!frontendResult.success) {
-            error(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
+            ngBaseSpinner.fail(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
             (0, fail_run_1.failRun)(toolbox);
             return;
         }
@@ -774,6 +774,15 @@ const NewCommand = {
             // For tests
             return `new workspace ${projectDir} with ${name}`;
         }
+        else {
+            // The frontend setup reported success but left no `projects/app`. Without this
+            // branch the command fell off the end here: no message, no failing exit code,
+            // and `ngBaseSpinner` still spinning — which keeps the event loop alive (see
+            // the spinner note in CLAUDE.md), so the process never returned at all.
+            ngBaseSpinner.fail(`${frontend} was set up but "${projectDir}/projects/app" does not exist — cannot continue`);
+            (0, fail_run_1.failRun)(toolbox);
+            return;
+        }
     }),
 };
 exports.default = NewCommand;

package/build/commands/git/squash.js

@@ -129,7 +129,10 @@ const NewCommand = {
         const mergeBaseSpin = spin(`Get merge ${base}`);
         const mergeBase = yield git.getMergeBase(base);
         if (!mergeBase) {
-            error('No merge base found!');
+            // `fail` rather than `error` + `return`: a running spinner holds the event
+            // loop open (ora resumes stdin and keeps a render interval), so the old
+            // shape did not just print and leave — the command never exited at all.
+            mergeBaseSpin.fail(`No merge base found with ${base}!`);
             return;
         }
         mergeBaseSpin.succeed();

package/build/extensions/api-mode.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiMode = void 0;
 const glob_1 = require("glob");
 const path_1 = require("path");
+const config_env_graphql_1 = require("../lib/config-env-graphql");
 /**
  * API Mode processing for nest-server-starter template
  *
@@ -46,11 +47,18 @@ class ApiMode {
                 // REST mode: remove graphql regions, keep rest regions
                 yield this.removeMode(projectPath, manifest, 'graphql', 'rest');
                 yield this.modifyConfigEnvForRest(projectPath);
+                this.assertGraphQlDisabled(projectPath);
             }
             else if (mode === 'GraphQL') {
                 // GraphQL mode: remove rest regions, keep graphql regions
                 yield this.removeMode(projectPath, manifest, 'rest', 'graphql');
             }
+            // Both conversions above must leave no marker behind. Verified rather than
+            // assumed: a strip that quietly does nothing reports success just as loudly as
+            // one that worked (see assertNoMarkersRemain).
+            if (mode !== 'Both') {
+                this.assertNoMarkersRemain(projectPath, mode === 'Rest' ? 'graphql' : 'rest');
+            }
             // Remove manifest and strip-markers script
             this.filesystem.remove(manifestPath);
             this.filesystem.remove((0, path_1.join)(projectPath, 'scripts', 'strip-api-mode-markers.mjs'));
@@ -167,6 +175,67 @@ class ApiMode {
             this.cleanOrphanImports(projectPath);
         });
     }
+    /**
+     * Final check of the REST conversion: every environment block in `config.env.ts`
+     * must disable GraphQL.
+     *
+     * `CoreModule.forRoot` reads a missing `graphQl` as ENABLED, so a block without it
+     * yields a project that fails at START time with `Cannot determine a GraphQL output
+     * type for the "arguments"` — long after the generator reported success. Every step
+     * before this one REPLACES an existing property; none of them adds a missing one, so
+     * nothing guaranteed the outcome.
+     *
+     * Repairs what it can (insert the switch) and throws when a block still lacks it,
+     * rather than handing over a project that cannot boot.
+     */
+    assertGraphQlDisabled(projectPath) {
+        const configPath = (0, path_1.join)(projectPath, 'src', 'config.env.ts');
+        const content = this.filesystem.read(configPath);
+        if (!content) {
+            return;
+        }
+        const { added, content: repaired } = (0, config_env_graphql_1.disableGraphQlInEveryEnvBlock)(content);
+        if (added.length > 0) {
+            this.filesystem.write(configPath, repaired);
+        }
+        const offenders = (0, config_env_graphql_1.envBlocksWithoutGraphQlDisabled)(repaired);
+        if (offenders.length > 0) {
+            throw new Error(`REST conversion incomplete: src/config.env.ts has no \`graphQl: false\` in ${offenders.join(', ')}. ` +
+                'The framework treats a missing switch as GraphQL ENABLED, and the server would fail to start. ' +
+                'Add it to those environment blocks and re-run.');
+        }
+    }
+    /**
+     * Refuse to hand over a project that still carries markers of the removed mode.
+     *
+     * A leftover `// #region graphql` announces a mode the project does not have — and,
+     * worse, means the region CONTENT is still there: resolvers, graphql-only wiring,
+     * e2e specs. That is what a silent no-op looks like from the outside, and the strip
+     * used to be exactly that on Windows (fixed in the glob helper above): it reported
+     * success while touching nothing.
+     *
+     * Cheap, and it fails at generation time instead of in the user's editor.
+     */
+    assertNoMarkersRemain(projectPath, removedMarker) {
+        const marked = [];
+        for (const dir of ['src', 'tests']) {
+            const base = (0, path_1.join)(projectPath, dir);
+            if (!this.filesystem.exists(base)) {
+                continue;
+            }
+            for (const file of this.globFiles(base, '**/*.ts')) {
+                const content = this.filesystem.read(file);
+                if ((content === null || content === void 0 ? void 0 : content.includes(`// #region ${removedMarker}`)) || (content === null || content === void 0 ? void 0 : content.includes(`// #endregion ${removedMarker}`))) {
+                    marked.push(`${dir}/${(0, path_1.basename)(file)}`);
+                }
+            }
+        }
+        if (marked.length > 0) {
+            throw new Error(`API-mode conversion incomplete: ${marked.length} file(s) still carry \`// #region ${removedMarker}\` ` +
+                `markers (${marked.slice(0, 5).join(', ')}${marked.length > 5 ? ', …' : ''}). ` +
+                'The region content was not removed, so this project still contains code of a mode it does not have.');
+        }
+    }
     /**
      * Resolve a POSIX-style glob pattern against `baseDir` and return the
      * matching files as absolute, OS-native paths.

package/build/extensions/frontend-helper.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
-const strip_comments_1 = require("../lib/strip-comments");
+const module_specifiers_1 = require("../lib/module-specifiers");
 const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
@@ -399,7 +399,7 @@ class FrontendHelper {
                 }
             }
             // ── Post-conversion verification ─────────────────────────────────────
-            const stale = this.findStaleFrontendImports(dest, /from\s+['"]\..*\/core['"]/);
+            const stale = this.findStaleFrontendImports(dest, module_specifiers_1.isRelativeCoreImport);
             if (stale.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`${stale.length} file(s) still contain relative core imports after npm conversion:`);
@@ -716,8 +716,7 @@ class FrontendHelper {
                 ].join('\n'));
             }
             // ── Post-conversion verification ─────────────────────────────────────
-            // Only match actual import/from statements, not comments or strings
-            const staleImports = this.findStaleFrontendImports(dest, /(?:^|\s)(?:import|from)\s+['"][^'"]*@lenne\.tech\/nuxt-extensions/m, 'app/core/');
+            const staleImports = this.findStaleFrontendImports(dest, (specifier) => (0, module_specifiers_1.isPackageImport)(specifier, '@lenne.tech/nuxt-extensions'), 'app/core/');
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`${staleImports.length} file(s) still contain '@lenne.tech/nuxt-extensions' imports after vendor conversion:`);
@@ -826,20 +825,20 @@ class FrontendHelper {
     /**
      * Scan consumer files for stale imports matching a pattern.
      */
-    findStaleFrontendImports(appDir, needle, skipPathContaining) {
+    findStaleFrontendImports(appDir, matches, skipPathContaining) {
         const { filesystem } = this.toolbox;
         const allFiles = this.walkConsumerFiles(appDir);
         const stale = [];
         for (const absFile of allFiles) {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
-            // Strip comments first — a docblock that DOCUMENTS the conversion legitimately quotes the
-            // very import syntax this looks for, and would otherwise be reported as a file the user has
-            // to fix by hand. Same false-positive class that hit the backend detector on
-            // nest-server-starter's bootstrap-diagnostics.spec.ts.
-            const content = (0, strip_comments_1.stripComments)(filesystem.read(absFile) || '');
-            const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
-            if (matches) {
+            // Ask the parser for the file's module specifiers instead of searching its text.
+            // A docblock that DOCUMENTS the conversion quotes the very import syntax a text
+            // search looks for, and blanking comments first does not hold either — see
+            // src/lib/module-specifiers.ts. A comment is not part of the AST, so the whole
+            // false-positive class is gone rather than worked around.
+            const specifiers = (0, module_specifiers_1.fileImportedSpecifiers)(absFile, (path) => filesystem.read(path) || undefined);
+            if (specifiers.some(matches)) {
                 stale.push(absFile.replace(`${appDir}/`, ''));
             }
         }

package/build/extensions/server.js

@@ -49,8 +49,10 @@ const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
+const cross_env_1 = require("../lib/cross-env");
 const markdown_table_1 = require("../lib/markdown-table");
-const strip_comments_1 = require("../lib/strip-comments");
+const migrate_scripts_1 = require("../lib/migrate-scripts");
+const module_specifiers_1 = require("../lib/module-specifiers");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -1556,10 +1558,16 @@ class Server {
                         scripts['migrate:up'] = `node ./bin/migrate.js up ${migrateArgs}`;
                         scripts['migrate:down'] = `node ./bin/migrate.js down ${migrateArgs}`;
                         scripts['migrate:list'] = `node ./bin/migrate.js list ${migrateArgs}`;
-                        scripts['migrate:develop:up'] = `NODE_ENV=develop node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:test:up'] = `NODE_ENV=test node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:preview:up'] = `NODE_ENV=preview node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:prod:up'] = `NODE_ENV=production node ./bin/migrate.js up ${migrateArgs}`;
+                        // The deployed scripts run the COMPILED migrations under dist/, not the
+                        // sources: a production tree has no ts-node (devDependency), so the
+                        // `--compiler ts:…` form dies there. `copy:bin` ships the shim into
+                        // dist/bin. See src/lib/migrate-scripts.ts.
+                        Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('node ./dist/bin/migrate.js'));
+                        const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                        if (guardWarning) {
+                            this.toolbox.print.warning(guardWarning);
+                        }
+                        (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                         // Make the production build carry a runnable migration setup.
                         //
                         // The image has no ts-node, and the docker entrypoint looks for
@@ -1579,7 +1587,8 @@ class Server {
                         // deliberate customization survives a re-run (older starters simply
                         // lack them → still repaired).
                         if (typeof scripts['copy:bin'] !== 'string') {
-                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || true';
+                            // `|| exit 0`, not `|| true`: cmd.exe has no `true` command.
+                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || exit 0';
                         }
                         if (typeof scripts['copy:migrations'] !== 'string') {
                             scripts['copy:migrations'] =
@@ -1887,13 +1896,10 @@ class Server {
             // Scan all consumer files for stale bare-specifier imports that the
             // codemod should have rewritten. A single miss causes a compile error,
             // so catching it here with a clear message saves the user debugging time.
-            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server', 
-            // Match only real import/export/require specifiers in single/double
-            // quotes — NOT comment references like
-            // `node_modules/@lenne.tech/nest-server/...` (backticks, no keyword),
-            // which the codemod legitimately leaves untouched. A naive substring
-            // match flagged config.env.ts's JSDoc path as a false positive.
-            /(?:from|import|export|require)\s*\(?\s*['"]@lenne\.tech\/nest-server(?:\/[^'"]*)?['"]/);
+            // A specifier, not a text match: a JSDoc path like
+            // `node_modules/@lenne.tech/nest-server/...` is prose and never reaches the AST,
+            // which is what used to make config.env.ts a false positive.
+            const staleImports = this.findStaleImports(dest, (specifier) => (0, module_specifiers_1.isPackageImport)(specifier, '@lenne.tech/nest-server'));
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleImports.length} file(s) still contain '@lenne.tech/nest-server' imports after vendor conversion:`);
@@ -2417,11 +2423,16 @@ class Server {
                 scripts['migrate:up'] = `migrate up ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:down'] = `migrate down ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:list'] = `migrate list ${migrateStore} --compiler ${migrateCompiler}`;
-                // Env-prefixed migrate scripts
-                for (const env of ['develop', 'test', 'preview', 'prod']) {
-                    const nodeEnv = env === 'prod' ? 'production' : env;
-                    scripts[`migrate:${env}:up`] = `NODE_ENV=${nodeEnv} migrate up ${migrateStore} --compiler ${migrateCompiler}`;
-                }
+                // Deployed scripts: compiled migrations under dist/, no --compiler (no ts-node
+                // in a production tree), via cross-env for cmd.exe. `migrate` is the binary of
+                // @lenne.tech/nest-server, a production dependency in npm mode — the same path
+                // docker-entrypoint.sh uses for this mode.
+                Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('migrate'));
+                const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                if (guardWarning) {
+                    this.toolbox.print.warning(guardWarning);
+                }
+                (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                 filesystem.write(`${dest}/package.json`, pkg);
             }
             // ── 5. Remove vendor artifacts ──────────────────────────────────────
@@ -2498,7 +2509,7 @@ class Server {
             // Scan all consumer files for stale relative imports that still resolve
             // to the (now deleted) src/core/ directory. These would be silent
             // compile errors.
-            const staleRelativeImports = this.findStaleImports(dest, '../core', /['"]\.\.?\/[^'"]*core['"]|from\s+['"]\.\.?\/[^'"]*core['"]/);
+            const staleRelativeImports = this.findStaleImports(dest, module_specifiers_1.isRelativeCoreImport);
             if (staleRelativeImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleRelativeImports.length} file(s) still contain relative core imports after npm conversion:`);
@@ -2514,11 +2525,10 @@ class Server {
      * rewritten by a mode conversion. Returns a list of file paths that still
      * contain matches.
      *
-     * @param dest      Project root directory
-     * @param needle    Literal string to search for (used when no regex provided)
-     * @param pattern   Optional regex for more flexible matching
+     * @param dest    Project root directory
+     * @param matches Predicate on a module SPECIFIER, e.g. `(s) => isPackageImport(s, 'pkg')`
      */
-    findStaleImports(dest, needle, pattern) {
+    findStaleImports(dest, matches) {
         // Patterns are relative to `dest` and passed to `glob` rather than
         // `filesystem.find`: jetpack concatenates the resolved base path in front of
         // the pattern, and minimatch treats a backslash inside a PATTERN as an escape,
@@ -2538,15 +2548,15 @@ class Server {
         for (const glob of globs) {
             const files = (0, glob_1.globSync)(glob, { absolute: true, cwd: dest, dot: true, nodir: true });
             for (const file of files) {
-                const raw = this.filesystem.read(file) || '';
-                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
-                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
-                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
-                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
-                // and told the user to rewrite imports that file does not have. A detector that reads
-                // comments as code produces false alarms on exactly the files that explain it best.
-                const content = (0, strip_comments_1.stripComments)(raw);
-                if (pattern ? pattern.test(content) : content.includes(needle)) {
+                // Ask the parser for the file's module specifiers rather than searching its
+                // text. A docblock that DOCUMENTS the conversion quotes the very syntax a text
+                // search looks for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts`
+                // names `from '@lenne.tech/nest-server'` in prose, and the detector told the user
+                // to rewrite imports that file does not have. Blanking comments first was the old
+                // answer and does not hold (see src/lib/module-specifiers.ts); a comment is not
+                // part of the AST at all.
+                const specifiers = (0, module_specifiers_1.fileImportedSpecifiers)(file, (path) => this.filesystem.read(path) || undefined);
+                if (specifiers.some(matches)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }
             }

package/build/lib/check-template-sync.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHECK_TEMPLATE_PIN_FILE = exports.CHECK_TEMPLATE_REPOSITORY = void 0;
 exports.readCheckTemplatePin = readCheckTemplatePin;
 exports.syncCheckTemplate = syncCheckTemplate;
+exports.spawnedSiblings = spawnedSiblings;
 exports.verifyCheckTemplate = verifyCheckTemplate;
 /**
  * Keep `src/templates/check/` a verbatim copy of a PINNED lt-monorepo state.
@@ -77,6 +78,14 @@ function syncCheckTemplate(options) {
                 (0, fs_1.rmSync)((0, path_1.join)(templateDir, stale), { force: true });
             }
         }
+        // Refuse rather than ship silently: whether a spawned sibling belongs in the
+        // template or whether lt-monorepo should drop the call is a human decision.
+        const spawned = spawnedSiblings(templateDir, Object.keys(files)).filter((name) => !(name in files));
+        if (spawned.length > 0) {
+            throw new Error(`${ref}: the template starts sibling script(s) it does not ship: ${spawned.join(', ')}. ` +
+                'resolveCopySet only follows imports, so these would be missing in every generated project. ' +
+                'Add them to the wrapper\'s import closure, ship them deliberately, or remove the call upstream.');
+        }
         const pin = {
             commit,
             files: sortKeys(files),
@@ -91,10 +100,54 @@ function syncCheckTemplate(options) {
         (0, fs_1.rmSync)(checkout, { force: true, recursive: true });
     }
 }
+/**
+ * A sibling script the wrapper SPAWNS rather than imports.
+ *
+ * `resolveCopySet` follows imports, so a `node scripts/x.mjs` — or a spawn/execFile
+ * with such a path — is invisible to it: the file is never shipped, the pin test stays
+ * green, and only the generated project breaks. Matched on the path inside a STRING
+ * rather than on the call shape, so `spawn('node', ['scripts/x.mjs'])`,
+ * `execSync('bash scripts/x.sh')` and a bare `'scripts/x.mjs'` are all covered.
+ *
+ * Comment LINES are skipped before matching. These files document their own behaviour
+ * in backtick-quoted prose, and a backtick is a string delimiter to a regex: the first
+ * draft reported `bash scripts/audit.sh` out of a comment on `check.mjs:103` and would
+ * have refused every sync from then on. `stripComments` is deliberately NOT used —
+ * measured on this very file, it stops blanking at offset 3329, where a regex literal
+ * (`/^projects\//`) is followed by a division (`ms / 1000`) and the standalone
+ * TypeScript scanner, having no parser context, can no longer tell the two apart.
+ */
+const SPAWNED_SIBLING = /['"`](?:[\w./-]+\s+)*(?:\.\/)?scripts\/([\w.-]+\.(?:mjs|cjs|js|sh))/g;
+/**
+ * Sibling scripts the template STARTS instead of importing, as `scripts/<name>`.
+ * Deduplicated, and the wrapper's own name is never reported.
+ */
+function spawnedSiblings(templateDir, files) {
+    const found = new Set();
+    for (const name of files) {
+        const file = (0, path_1.join)(templateDir, name);
+        if (!(0, fs_1.existsSync)(file)) {
+            continue;
+        }
+        for (const line of (0, fs_1.readFileSync)(file, 'utf8').split('\n')) {
+            const code = line.trimStart();
+            if (code.startsWith('//') || code.startsWith('*') || code.startsWith('/*')) {
+                continue;
+            }
+            for (const [, sibling] of code.matchAll(SPAWNED_SIBLING)) {
+                if (sibling !== 'check.mjs' && sibling !== name) {
+                    found.add(sibling);
+                }
+            }
+        }
+    }
+    return [...found].sort();
+}
 /**
  * Differences between the template dir and its pin; empty when they match.
- * Checks both directions: every pinned file with its hash, and every file the
- * wrapper actually imports is pinned (a hand-added import would otherwise slip by).
+ * Checks three directions: every pinned file with its hash, every file the wrapper
+ * imports is pinned (a hand-added import would otherwise slip by), and no file is
+ * SPAWNED that nothing ships.
  */
 function verifyCheckTemplate(templateDir, pin) {
     const problems = [];
@@ -113,6 +166,13 @@ function verifyCheckTemplate(templateDir, pin) {
             problems.push(`${name}: imported by the wrapper but not pinned`);
         }
     }
+    for (const sibling of spawnedSiblings(templateDir, [...Object.keys(pin.files), ...actual])) {
+        if (!(sibling in pin.files)) {
+            problems.push(`${sibling}: STARTED by the template (\`node scripts/${sibling}\`) but not shipped — ` +
+                'a generated project would call a file it does not have. Decide deliberately: add it to the ' +
+                'template, or have lt-monorepo drop the call.');
+        }
+    }
     const version = (0, heal_check_wrapper_1.readWrapperVersion)((0, path_1.join)(templateDir, 'check.mjs'));
     if (version !== pin.version) {
         problems.push(`check.mjs: marker ${version !== null && version !== void 0 ? version : '(none)'} does not match pinned version ${pin.version}`);

package/build/lib/config-env-graphql.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.disableGraphQlInEveryEnvBlock = disableGraphQlInEveryEnvBlock;
+exports.envBlocksWithoutGraphQlDisabled = envBlocksWithoutGraphQlDisabled;
+/**
+ * Add `graphQl: false` to every environment block that has no `graphQl` property, and
+ * replace a `graphQl: { … }` that survived with `false`.
+ *
+ * Line endings are preserved: a CRLF file stays CRLF.
+ */
+function disableGraphQlInEveryEnvBlock(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const added = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        if (!property) {
+            block.insertPropertyAssignment(0, { initializer: 'false', name: 'graphQl' });
+            added.push(name);
+            continue;
+        }
+        const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (initializer && initializer.getText() !== 'false') {
+            property.setInitializer('false');
+            added.push(name);
+        }
+    }
+    const written = added.length > 0 ? sourceFile.getFullText() : content;
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return { added, content: restoreLineEndings(content, written) };
+}
+/**
+ * Environment blocks that do NOT disable GraphQL — empty when the file is fine.
+ * Used as the conversion's final check.
+ */
+function envBlocksWithoutGraphQlDisabled(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const offenders = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        const initializer = property && ((_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a));
+        if (!initializer || initializer.getText() !== 'false') {
+            offenders.push(name);
+        }
+    }
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return offenders;
+}
+/**
+ * The environment blocks of a `config.env.ts`: the object-literal properties of the
+ * exported `config` object, including the ones passed to a `merge(…)` call (the shape
+ * the starter uses). Only direct children count — a nested `mongoose: { … }` is not an
+ * environment.
+ */
+function envBlocks(sourceFile) {
+    var _a, _b;
+    const { SyntaxKind } = require('ts-morph');
+    const roots = [];
+    for (const statement of sourceFile.getVariableStatements()) {
+        for (const declaration of statement.getDeclarations()) {
+            if (declaration.getName() !== 'config') {
+                continue;
+            }
+            const initializer = declaration.getInitializer();
+            if (!initializer) {
+                continue;
+            }
+            if (initializer.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                roots.push(initializer);
+            }
+            if (initializer.getKind() === SyntaxKind.CallExpression) {
+                for (const argument of initializer.getArguments()) {
+                    if (argument.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                        roots.push(argument);
+                    }
+                }
+            }
+        }
+    }
+    const blocks = [];
+    for (const root of roots) {
+        for (const property of root.getProperties()) {
+            if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+                continue;
+            }
+            const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+            if ((initializer === null || initializer === void 0 ? void 0 : initializer.getKind()) === SyntaxKind.ObjectLiteralExpression) {
+                blocks.push([property.getName(), initializer]);
+            }
+        }
+    }
+    return blocks;
+}
+function parse(content) {
+    const { Project } = require('ts-morph');
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: true });
+    return { project, sourceFile: project.createSourceFile('config.env.ts', content, { overwrite: true }) };
+}
+/** ts-morph writes LF; a file that came in as CRLF goes back out as CRLF. */
+function restoreLineEndings(original, written) {
+    if (!original.includes('\r\n')) {
+        return written;
+    }
+    return written.replace(/\r?\n/g, '\r\n');
+}