@lenne.tech/cli 1.48.0 → 1.50.0

package/build/extensions/server.js

@@ -49,8 +49,10 @@ const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
+const cross_env_1 = require("../lib/cross-env");
 const markdown_table_1 = require("../lib/markdown-table");
-const strip_comments_1 = require("../lib/strip-comments");
+const migrate_scripts_1 = require("../lib/migrate-scripts");
+const module_specifiers_1 = require("../lib/module-specifiers");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -662,7 +664,7 @@ class Server {
                     if (!experimental) {
                         // Generate README
                         yield template.generate({
-                            props: { description, name },
+                            props: { description, name, vendor: frameworkMode === 'vendor' },
                             target: `${dest}/README.md`,
                             template: 'nest-server-starter/README.md.ejs',
                         });
@@ -1556,10 +1558,16 @@ class Server {
                         scripts['migrate:up'] = `node ./bin/migrate.js up ${migrateArgs}`;
                         scripts['migrate:down'] = `node ./bin/migrate.js down ${migrateArgs}`;
                         scripts['migrate:list'] = `node ./bin/migrate.js list ${migrateArgs}`;
-                        scripts['migrate:develop:up'] = `NODE_ENV=develop node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:test:up'] = `NODE_ENV=test node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:preview:up'] = `NODE_ENV=preview node ./bin/migrate.js up ${migrateArgs}`;
-                        scripts['migrate:prod:up'] = `NODE_ENV=production node ./bin/migrate.js up ${migrateArgs}`;
+                        // The deployed scripts run the COMPILED migrations under dist/, not the
+                        // sources: a production tree has no ts-node (devDependency), so the
+                        // `--compiler ts:…` form dies there. `copy:bin` ships the shim into
+                        // dist/bin. See src/lib/migrate-scripts.ts.
+                        Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('node ./dist/bin/migrate.js'));
+                        const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                        if (guardWarning) {
+                            this.toolbox.print.warning(guardWarning);
+                        }
+                        (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                         // Make the production build carry a runnable migration setup.
                         //
                         // The image has no ts-node, and the docker entrypoint looks for
@@ -1579,7 +1587,8 @@ class Server {
                         // deliberate customization survives a re-run (older starters simply
                         // lack them → still repaired).
                         if (typeof scripts['copy:bin'] !== 'string') {
-                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || true';
+                            // `|| exit 0`, not `|| true`: cmd.exe has no `true` command.
+                            scripts['copy:bin'] = 'cpy ./bin ./dist/ || exit 0';
                         }
                         if (typeof scripts['copy:migrations'] !== 'string') {
                             scripts['copy:migrations'] =
@@ -1887,13 +1896,10 @@ class Server {
             // Scan all consumer files for stale bare-specifier imports that the
             // codemod should have rewritten. A single miss causes a compile error,
             // so catching it here with a clear message saves the user debugging time.
-            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server', 
-            // Match only real import/export/require specifiers in single/double
-            // quotes — NOT comment references like
-            // `node_modules/@lenne.tech/nest-server/...` (backticks, no keyword),
-            // which the codemod legitimately leaves untouched. A naive substring
-            // match flagged config.env.ts's JSDoc path as a false positive.
-            /(?:from|import|export|require)\s*\(?\s*['"]@lenne\.tech\/nest-server(?:\/[^'"]*)?['"]/);
+            // A specifier, not a text match: a JSDoc path like
+            // `node_modules/@lenne.tech/nest-server/...` is prose and never reaches the AST,
+            // which is what used to make config.env.ts a false positive.
+            const staleImports = this.findStaleImports(dest, (specifier) => (0, module_specifiers_1.isPackageImport)(specifier, '@lenne.tech/nest-server'));
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleImports.length} file(s) still contain '@lenne.tech/nest-server' imports after vendor conversion:`);
@@ -2417,11 +2423,16 @@ class Server {
                 scripts['migrate:up'] = `migrate up ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:down'] = `migrate down ${migrateStore} --compiler ${migrateCompiler}`;
                 scripts['migrate:list'] = `migrate list ${migrateStore} --compiler ${migrateCompiler}`;
-                // Env-prefixed migrate scripts
-                for (const env of ['develop', 'test', 'preview', 'prod']) {
-                    const nodeEnv = env === 'prod' ? 'production' : env;
-                    scripts[`migrate:${env}:up`] = `NODE_ENV=${nodeEnv} migrate up ${migrateStore} --compiler ${migrateCompiler}`;
-                }
+                // Deployed scripts: compiled migrations under dist/, no --compiler (no ts-node
+                // in a production tree), via cross-env for cmd.exe. `migrate` is the binary of
+                // @lenne.tech/nest-server, a production dependency in npm mode — the same path
+                // docker-entrypoint.sh uses for this mode.
+                Object.assign(scripts, (0, migrate_scripts_1.deployedMigrateScripts)('migrate'));
+                const guardWarning = (0, migrate_scripts_1.missingBuildGuardWarning)(filesystem, dest);
+                if (guardWarning) {
+                    this.toolbox.print.warning(guardWarning);
+                }
+                (0, cross_env_1.ensureCrossEnvDependency)(pkg);
                 filesystem.write(`${dest}/package.json`, pkg);
             }
             // ── 5. Remove vendor artifacts ──────────────────────────────────────
@@ -2498,7 +2509,7 @@ class Server {
             // Scan all consumer files for stale relative imports that still resolve
             // to the (now deleted) src/core/ directory. These would be silent
             // compile errors.
-            const staleRelativeImports = this.findStaleImports(dest, '../core', /['"]\.\.?\/[^'"]*core['"]|from\s+['"]\.\.?\/[^'"]*core['"]/);
+            const staleRelativeImports = this.findStaleImports(dest, module_specifiers_1.isRelativeCoreImport);
             if (staleRelativeImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleRelativeImports.length} file(s) still contain relative core imports after npm conversion:`);
@@ -2514,11 +2525,10 @@ class Server {
      * rewritten by a mode conversion. Returns a list of file paths that still
      * contain matches.
      *
-     * @param dest      Project root directory
-     * @param needle    Literal string to search for (used when no regex provided)
-     * @param pattern   Optional regex for more flexible matching
+     * @param dest    Project root directory
+     * @param matches Predicate on a module SPECIFIER, e.g. `(s) => isPackageImport(s, 'pkg')`
      */
-    findStaleImports(dest, needle, pattern) {
+    findStaleImports(dest, matches) {
         // Patterns are relative to `dest` and passed to `glob` rather than
         // `filesystem.find`: jetpack concatenates the resolved base path in front of
         // the pattern, and minimatch treats a backslash inside a PATTERN as an escape,
@@ -2538,15 +2548,15 @@ class Server {
         for (const glob of globs) {
             const files = (0, glob_1.globSync)(glob, { absolute: true, cwd: dest, dot: true, nodir: true });
             for (const file of files) {
-                const raw = this.filesystem.read(file) || '';
-                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
-                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
-                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
-                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
-                // and told the user to rewrite imports that file does not have. A detector that reads
-                // comments as code produces false alarms on exactly the files that explain it best.
-                const content = (0, strip_comments_1.stripComments)(raw);
-                if (pattern ? pattern.test(content) : content.includes(needle)) {
+                // Ask the parser for the file's module specifiers rather than searching its
+                // text. A docblock that DOCUMENTS the conversion quotes the very syntax a text
+                // search looks for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts`
+                // names `from '@lenne.tech/nest-server'` in prose, and the detector told the user
+                // to rewrite imports that file does not have. Blanking comments first was the old
+                // answer and does not hold (see src/lib/module-specifiers.ts); a comment is not
+                // part of the AST at all.
+                const specifiers = (0, module_specifiers_1.fileImportedSpecifiers)(file, (path) => this.filesystem.read(path) || undefined);
+                if (specifiers.some(matches)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }
             }

package/build/lib/caddy.js

@@ -36,10 +36,11 @@ exports.writeCaddyfile = writeCaddyfile;
  * Lifecycle is owned by `lt dev install` (one-time setup) and
  * `lt dev up`/`lt dev down` (per-project block management).
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+const dev_process_1 = require("./dev-process");
+const platform_1 = require("./platform");
 const CADDYFILE_PATH = process.env.LT_DEV_CADDYFILE || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech', 'Caddyfile');
 const HEADER = '# Managed by `lt dev`. Per-project blocks are bounded by `# >>> lt-dev:<slug> >>>` markers.';
 /** Detect whether `caddy` is on PATH. */
@@ -49,16 +50,22 @@ function caddyAvailable() {
         return result.ok;
     });
 }
-/** Detect whether the Caddy admin endpoint is reachable (i.e. a daemon is running). */
+/**
+ * Detect whether the Caddy admin endpoint is reachable (i.e. a daemon is running).
+ *
+ * This asked `curl -fsS -o /dev/null`, and on Windows that reported a running
+ * Caddy as down: `/dev/null` is an ordinary file path there, so curl completed
+ * the request, received the 226-byte answer, failed to WRITE it, and exited 23.
+ * The exit code was all this function looked at. Measured on the laptop against a
+ * Caddy that was listening on :2019 and answering 200.
+ *
+ * `127.0.0.1` rather than `localhost` for consistency with the reverse-proxy
+ * upstreams (see the note above `renderProjectBlock`) — not because `localhost`
+ * was the fault here; it was measured to resolve correctly on that machine.
+ */
 function caddyDaemonRunning() {
     return __awaiter(this, void 0, void 0, function* () {
-        return new Promise((resolve) => {
-            const child = (0, child_process_1.spawn)('curl', ['-fsS', '-o', '/dev/null', 'http://localhost:2019/config/'], {
-                stdio: ['ignore', 'ignore', 'ignore'],
-            });
-            child.on('error', () => resolve(false));
-            child.on('close', (code) => resolve(code === 0));
-        });
+        return (yield (0, dev_process_1.httpStatus)('http://127.0.0.1:2019/config/', 2000)) !== null;
     });
 }
 /** Read the current Caddyfile (or empty string). */
@@ -162,7 +169,7 @@ function writeCaddyfile(content) {
 function runCaddy(args) {
     return new Promise((resolve) => {
         var _a, _b;
-        const child = (0, child_process_1.spawn)('caddy', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = (0, platform_1.spawnCmd)('caddy', args, { stdio: ['ignore', 'pipe', 'pipe'] });
         let stdout = '';
         let stderr = '';
         let errored = false;

package/build/lib/check-template-sync.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHECK_TEMPLATE_PIN_FILE = exports.CHECK_TEMPLATE_REPOSITORY = void 0;
 exports.readCheckTemplatePin = readCheckTemplatePin;
 exports.syncCheckTemplate = syncCheckTemplate;
+exports.spawnedSiblings = spawnedSiblings;
 exports.verifyCheckTemplate = verifyCheckTemplate;
 /**
  * Keep `src/templates/check/` a verbatim copy of a PINNED lt-monorepo state.
@@ -77,6 +78,14 @@ function syncCheckTemplate(options) {
                 (0, fs_1.rmSync)((0, path_1.join)(templateDir, stale), { force: true });
             }
         }
+        // Refuse rather than ship silently: whether a spawned sibling belongs in the
+        // template or whether lt-monorepo should drop the call is a human decision.
+        const spawned = spawnedSiblings(templateDir, Object.keys(files)).filter((name) => !(name in files));
+        if (spawned.length > 0) {
+            throw new Error(`${ref}: the template starts sibling script(s) it does not ship: ${spawned.join(', ')}. ` +
+                'resolveCopySet only follows imports, so these would be missing in every generated project. ' +
+                "Add them to the wrapper's import closure, ship them deliberately, or remove the call upstream.");
+        }
         const pin = {
             commit,
             files: sortKeys(files),
@@ -91,10 +100,54 @@ function syncCheckTemplate(options) {
         (0, fs_1.rmSync)(checkout, { force: true, recursive: true });
     }
 }
+/**
+ * A sibling script the wrapper SPAWNS rather than imports.
+ *
+ * `resolveCopySet` follows imports, so a `node scripts/x.mjs` — or a spawn/execFile
+ * with such a path — is invisible to it: the file is never shipped, the pin test stays
+ * green, and only the generated project breaks. Matched on the path inside a STRING
+ * rather than on the call shape, so `spawn('node', ['scripts/x.mjs'])`,
+ * `execSync('bash scripts/x.sh')` and a bare `'scripts/x.mjs'` are all covered.
+ *
+ * Comment LINES are skipped before matching. These files document their own behaviour
+ * in backtick-quoted prose, and a backtick is a string delimiter to a regex: the first
+ * draft reported `bash scripts/audit.sh` out of a comment on `check.mjs:103` and would
+ * have refused every sync from then on. `stripComments` is deliberately NOT used —
+ * measured on this very file, it stops blanking at offset 3329, where a regex literal
+ * (`/^projects\//`) is followed by a division (`ms / 1000`) and the standalone
+ * TypeScript scanner, having no parser context, can no longer tell the two apart.
+ */
+const SPAWNED_SIBLING = /['"`](?:[\w./-]+\s+)*(?:\.\/)?scripts\/([\w.-]+\.(?:mjs|cjs|js|sh))/g;
+/**
+ * Sibling scripts the template STARTS instead of importing, as `scripts/<name>`.
+ * Deduplicated, and the wrapper's own name is never reported.
+ */
+function spawnedSiblings(templateDir, files) {
+    const found = new Set();
+    for (const name of files) {
+        const file = (0, path_1.join)(templateDir, name);
+        if (!(0, fs_1.existsSync)(file)) {
+            continue;
+        }
+        for (const line of (0, fs_1.readFileSync)(file, 'utf8').split('\n')) {
+            const code = line.trimStart();
+            if (code.startsWith('//') || code.startsWith('*') || code.startsWith('/*')) {
+                continue;
+            }
+            for (const [, sibling] of code.matchAll(SPAWNED_SIBLING)) {
+                if (sibling !== 'check.mjs' && sibling !== name) {
+                    found.add(sibling);
+                }
+            }
+        }
+    }
+    return [...found].sort();
+}
 /**
  * Differences between the template dir and its pin; empty when they match.
- * Checks both directions: every pinned file with its hash, and every file the
- * wrapper actually imports is pinned (a hand-added import would otherwise slip by).
+ * Checks three directions: every pinned file with its hash, every file the wrapper
+ * imports is pinned (a hand-added import would otherwise slip by), and no file is
+ * SPAWNED that nothing ships.
  */
 function verifyCheckTemplate(templateDir, pin) {
     const problems = [];
@@ -113,6 +166,13 @@ function verifyCheckTemplate(templateDir, pin) {
             problems.push(`${name}: imported by the wrapper but not pinned`);
         }
     }
+    for (const sibling of spawnedSiblings(templateDir, [...Object.keys(pin.files), ...actual])) {
+        if (!(sibling in pin.files)) {
+            problems.push(`${sibling}: STARTED by the template (\`node scripts/${sibling}\`) but not shipped — ` +
+                'a generated project would call a file it does not have. Decide deliberately: add it to the ' +
+                'template, or have lt-monorepo drop the call.');
+        }
+    }
     const version = (0, heal_check_wrapper_1.readWrapperVersion)((0, path_1.join)(templateDir, 'check.mjs'));
     if (version !== pin.version) {
         problems.push(`check.mjs: marker ${version !== null && version !== void 0 ? version : '(none)'} does not match pinned version ${pin.version}`);

package/build/lib/config-env-graphql.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.disableGraphQlInEveryEnvBlock = disableGraphQlInEveryEnvBlock;
+exports.envBlocksWithoutGraphQlDisabled = envBlocksWithoutGraphQlDisabled;
+/**
+ * Add `graphQl: false` to every environment block that has no `graphQl` property, and
+ * replace a `graphQl: { … }` that survived with `false`.
+ *
+ * Line endings are preserved: a CRLF file stays CRLF.
+ */
+function disableGraphQlInEveryEnvBlock(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const added = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        if (!property) {
+            block.insertPropertyAssignment(0, { initializer: 'false', name: 'graphQl' });
+            added.push(name);
+            continue;
+        }
+        const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (initializer && initializer.getText() !== 'false') {
+            property.setInitializer('false');
+            added.push(name);
+        }
+    }
+    const written = added.length > 0 ? sourceFile.getFullText() : content;
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return { added, content: restoreLineEndings(content, written) };
+}
+/**
+ * Environment blocks that do NOT disable GraphQL — empty when the file is fine.
+ * Used as the conversion's final check.
+ */
+function envBlocksWithoutGraphQlDisabled(content) {
+    var _a, _b, _c;
+    const { project, sourceFile } = parse(content);
+    const offenders = [];
+    for (const [name, block] of envBlocks(sourceFile)) {
+        const property = block.getProperty('graphQl');
+        const initializer = property && ((_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a));
+        if (!initializer || initializer.getText() !== 'false') {
+            offenders.push(name);
+        }
+    }
+    (_c = project.removeSourceFile) === null || _c === void 0 ? void 0 : _c.call(project, sourceFile);
+    return offenders;
+}
+/**
+ * The environment blocks of a `config.env.ts`: the object-literal properties of the
+ * exported `config` object, including the ones passed to a `merge(…)` call (the shape
+ * the starter uses). Only direct children count — a nested `mongoose: { … }` is not an
+ * environment.
+ */
+function envBlocks(sourceFile) {
+    var _a, _b;
+    const { SyntaxKind } = require('ts-morph');
+    const roots = [];
+    for (const statement of sourceFile.getVariableStatements()) {
+        for (const declaration of statement.getDeclarations()) {
+            if (declaration.getName() !== 'config') {
+                continue;
+            }
+            const initializer = declaration.getInitializer();
+            if (!initializer) {
+                continue;
+            }
+            if (initializer.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                roots.push(initializer);
+            }
+            if (initializer.getKind() === SyntaxKind.CallExpression) {
+                for (const argument of initializer.getArguments()) {
+                    if (argument.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                        roots.push(argument);
+                    }
+                }
+            }
+        }
+    }
+    const blocks = [];
+    for (const root of roots) {
+        for (const property of root.getProperties()) {
+            if (property.getKind() !== SyntaxKind.PropertyAssignment) {
+                continue;
+            }
+            const initializer = (_b = (_a = property).getInitializer) === null || _b === void 0 ? void 0 : _b.call(_a);
+            if ((initializer === null || initializer === void 0 ? void 0 : initializer.getKind()) === SyntaxKind.ObjectLiteralExpression) {
+                blocks.push([property.getName(), initializer]);
+            }
+        }
+    }
+    return blocks;
+}
+function parse(content) {
+    const { Project } = require('ts-morph');
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: true });
+    return { project, sourceFile: project.createSourceFile('config.env.ts', content, { overwrite: true }) };
+}
+/** ts-morph writes LF; a file that came in as CRLF goes back out as CRLF. */
+function restoreLineEndings(original, written) {
+    if (!original.includes('\r\n')) {
+        return written;
+    }
+    return written.replace(/\r?\n/g, '\r\n');
+}

package/build/lib/cross-env.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_PREFIX = exports.CROSS_ENV_PACKAGE = exports.CROSS_ENV_VERSION = void 0;
+exports.bareEnvPrefixes = bareEnvPrefixes;
+exports.ensureCrossEnvDependency = ensureCrossEnvDependency;
+exports.usesPosixEnvPrefix = usesPosixEnvPrefix;
+exports.withCrossEnv = withCrossEnv;
+/**
+ * Environment prefixes in GENERATED package.json scripts.
+ *
+ * npm and pnpm run scripts through cmd.exe on Windows, which knows no
+ * `VAR=value command` form: it reads `NODE_ENV` as the program name and aborts
+ * with "'NODE_ENV' is not recognized as an internal or external command"
+ * (reported from a Windows laptop, 2026-09-16, on a project generated by lt
+ * 1.47.0: `pnpm run start:local` died there).
+ *
+ * `cross-env` sets the variable in the child process instead, so the same script
+ * works in bash, zsh, PowerShell and cmd.exe.
+ */
+/** Pinned exactly: an override target or dependency of ours is never a range (repo rule). */
+exports.CROSS_ENV_VERSION = '10.1.0';
+exports.CROSS_ENV_PACKAGE = 'cross-env';
+/**
+ * A POSIX env assignment in front of a command — the form cmd.exe cannot run.
+ *
+ * Deliberately NOT anchored to the start of the script: the mistake that actually
+ * happens when converting is an `&&` chain in which only the first link was
+ * wrapped (`cross-env NODE_ENV=x a && NODE_ENV=x b`), and an anchored expression
+ * reports that as clean.
+ */
+exports.ENV_PREFIX = /(^|[\s;&|(])[A-Z_][A-Z0-9_]*=\S/;
+/** `cross-env` plus the assignments it carries — those are the covered ones. */
+const CROSS_ENV_ASSIGNMENTS = /cross-env\s+(?:[A-Z_][A-Z0-9_]*=\S+\s+)+/g;
+/**
+ * Bare `VAR=value` prefixes in `script`, i.e. the ones cmd.exe would choke on.
+ * Assignments that `cross-env` carries are removed first, so a correctly
+ * converted script — including `cross-env A=1 B=2 cmd` — reports nothing.
+ */
+function bareEnvPrefixes(script) {
+    const rest = script.replace(CROSS_ENV_ASSIGNMENTS, '');
+    const found = [];
+    for (const match of rest.matchAll(/(?:^|[\s;&|(])([A-Z_][A-Z0-9_]*=\S+)/g)) {
+        found.push(match[1]);
+    }
+    return found;
+}
+/**
+ * Make sure a generated project can run the scripts we just wrote.
+ *
+ * Lands in `dependencies`, NOT `devDependencies`: production trees are installed
+ * without dev packages — the starter's Dockerfile uses
+ * `pnpm install --frozen-lockfile --prod` and `pnpm deploy --prod` — and the scripts
+ * run there (`start:prod`, `dp:prod` → `migrate:prod:up`) are exactly the env-carrying
+ * ones. Measured by the starter session on two real `--prod` installs from one
+ * lockfile: as a devDependency `node_modules/.bin/cross-env` is missing, as a
+ * dependency it is there. (The framework repos keep it in devDependencies: their
+ * scripts never reach a customer image, and nest-server is published to npm, where a
+ * production dependency would be forced on every consumer.)
+ *
+ * Only added when the project does not declare it anywhere already — the starters ship
+ * it themselves, and a second entry would fight theirs on every update. An existing
+ * entry keeps its group and version, devDependencies included.
+ *
+ * @param pkg Parsed package.json of the generated project; mutated in place.
+ * @returns true when the dependency was added.
+ */
+function ensureCrossEnvDependency(pkg) {
+    const declared = [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies, pkg.optionalDependencies].some((group) => group && typeof group === 'object' && exports.CROSS_ENV_PACKAGE in group);
+    if (declared) {
+        return false;
+    }
+    if (!pkg.dependencies || typeof pkg.dependencies !== 'object') {
+        pkg.dependencies = {};
+    }
+    pkg.dependencies[exports.CROSS_ENV_PACKAGE] = exports.CROSS_ENV_VERSION;
+    pkg.dependencies = Object.fromEntries(Object.entries(pkg.dependencies).sort(([a], [b]) => a.localeCompare(b)));
+    return true;
+}
+/** True when `script` still carries a bare `VAR=value` prefix. */
+function usesPosixEnvPrefix(script) {
+    return bareEnvPrefixes(script).length > 0;
+}
+/**
+ * Prefix a command with `cross-env VAR=value …`.
+ *
+ * @param env     Variables to set, e.g. `{ NODE_ENV: 'production' }`.
+ * @param command The command to run.
+ */
+function withCrossEnv(env, command) {
+    const assignments = Object.entries(env)
+        .map(([name, value]) => `${name}=${value}`)
+        .join(' ');
+    return `cross-env ${assignments} ${command}`;
+}

package/build/lib/dev-api-launch.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyPendingMigrations = applyPendingMigrations;
 exports.findCompiledEntry = findCompiledEntry;
 exports.isApiCompiledRequested = isApiCompiledRequested;
 exports.resolveApiRuntime = resolveApiRuntime;
@@ -29,6 +30,33 @@ const node_path_1 = require("node:path");
 const dev_process_1 = require("./dev-process");
 /** Candidate compiled entry points, in preference order. Single-sourced so `lt dev test` agrees. */
 const COMPILED_ENTRIES = ['dist/src/main.js', 'dist/main.js'];
+/**
+ * Apply the project's pending migrations (`<pm> run migrate:up`) ahead of an API
+ * that is started WITHOUT its own `start` script.
+ *
+ * lt projects chain the migration into that script (`migrate:up && start:local`),
+ * so every path that starts the compiled bundle directly — `lt dev up
+ * --api-compiled` and `lt dev test` — drops the migration along with it. On a
+ * database that outlives the run, that leaves the API on a state no deployed
+ * environment has: a changed unique index never reached the `lt dev test` DB, and
+ * the suite failed with a 409 that looked like a bug in the feature (DEV-3289).
+ *
+ * `env` must be the environment the API itself gets. The migration store resolves
+ * its database from the same `config.env.ts` + `NSC__MONGOOSE__URI` merge, so
+ * sharing the env is what makes both reach the same database.
+ *
+ * A project without a `migrate:up` script is `skipped`, never an error — nest-base
+ * (Prisma) projects have none. A migration killed by a signal (`null`) is `failed`.
+ */
+function applyPendingMigrations(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { apiDir, env, pm } = options;
+        if (!hasScript(apiDir, 'migrate:up'))
+            return { status: 'skipped' };
+        const exitCode = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('migrate:up'), { cwd: apiDir, env });
+        return exitCode === 0 ? { status: 'applied' } : { exitCode, status: 'failed' };
+    });
+}
 /** Resolve the compiled API entry point in `apiDir`, or `undefined` if none was built. */
 function findCompiledEntry(apiDir) {
     return COMPILED_ENTRIES.map((rel) => (0, node_path_1.join)(apiDir, rel)).find((candidate) => (0, node_fs_1.existsSync)(candidate));
@@ -106,14 +134,12 @@ function startCompiledApi(options) {
         const build = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('build'), { cwd: apiDir, env });
         const entry = findCompiledEntry(apiDir);
         if (build === 0 && entry) {
-            if (hasScript(apiDir, 'migrate:up')) {
-                const migrate = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('migrate:up'), { cwd: apiDir, env });
-                if (migrate !== 0) {
-                    // Parity with `migrate:up && start:local`: a failed migration must PREVENT the server
-                    // from starting rather than boot it against a half-migrated DB behind a "Started" banner.
-                    log.warn(`migrate:up failed (exit ${String(migrate)}) — API NOT started (would run on an un-migrated DB).`);
-                    return undefined;
-                }
+            const migration = yield applyPendingMigrations({ apiDir, env, pm });
+            if (migration.status === 'failed') {
+                // Parity with `migrate:up && start:local`: a failed migration must PREVENT the server
+                // from starting rather than boot it against a half-migrated DB behind a "Started" banner.
+                log.warn(`migrate:up failed (exit ${String(migration.exitCode)}) — API NOT started (would run on an un-migrated DB).`);
+                return undefined;
             }
             return (0, dev_process_1.spawnDetached)(resolveApiRuntime(apiDir), [entry], {
                 cwd: apiDir,

package/build/lib/dev-env-bridge.js

@@ -97,6 +97,13 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
         // Legacy aliases — see dev-env.ts for the rationale.
         'API_URL',
         'SITE_URL',
+        // The loopback addresses. An external runner that RESOLVES a URL from Node —
+        // an API helper, a seeding script, a readiness check — needs these: on Windows
+        // `*.localhost` does not resolve for Node at all, only for browsers. The
+        // public names above stay, because browser-facing values (a Playwright
+        // `baseURL`, a link a developer opens) must keep them. See `dev-env.ts#internalUrl`.
+        'LT_DEV_API_INTERNAL_URL',
+        'LT_DEV_APP_INTERNAL_URL',
     ];
     for (const key of exported) {
         const v = devEnv.app.env[key];