@lenne.tech/cli 1.48.0 → 1.50.0

package/build/lib/migrate-scripts.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILD_GUARD_FILE = exports.COMPILED_MIGRATE_ARGS = exports.MIGRATE_ENVIRONMENTS = void 0;
+exports.deployedMigrateScripts = deployedMigrateScripts;
+exports.missingBuildGuardWarning = missingBuildGuardWarning;
+const path_1 = require("path");
+const cross_env_1 = require("./cross-env");
+/** Script suffix → `NODE_ENV` value. `prod` maps to `production`, the name Nest config keys off. */
+exports.MIGRATE_ENVIRONMENTS = [
+    ['develop', 'develop'],
+    ['test', 'test'],
+    ['preview', 'preview'],
+    ['prod', 'production'],
+];
+/** Where the build puts the compiled migrations and the store helper. */
+exports.COMPILED_MIGRATE_ARGS = '--store ./dist/migrations-utils/migrate.js --migrations-dir ./dist/migrations';
+/**
+ * Build guard in front of every deployed script — the same wiring nest-server-starter
+ * uses (`node scripts/… && <migrate>`), so the chain fails BEFORE migrate starts and
+ * `dp:prod` never reaches the server start.
+ *
+ * It is needed because the failure is otherwise SILENT: measured with nest-server
+ * 11.41.2, a missing migrations directory prints "treating as empty" and a missing or
+ * empty one both end in "No pending migrations", exit 0. An unbuilt checkout would
+ * report a successful migration run that never happened, and the server would then come
+ * up against an unmigrated database.
+ */
+exports.BUILD_GUARD_FILE = 'require-built-migrations.mjs';
+const BUILD_GUARD = `node scripts/${exports.BUILD_GUARD_FILE} && `;
+/**
+ * Build the four deployed migrate scripts.
+ *
+ * @param invocation How this project starts the migrate CLI: `'migrate'` in npm mode
+ *                   (the binary of `@lenne.tech/nest-server`, a production dependency),
+ *                   `'node ./dist/bin/migrate.js'` in vendor mode (the shim `copy:bin`
+ *                   ships into `dist/`).
+ */
+function deployedMigrateScripts(invocation) {
+    const scripts = {};
+    for (const [scriptEnv, nodeEnv] of exports.MIGRATE_ENVIRONMENTS) {
+        scripts[`migrate:${scriptEnv}:up`] =
+            BUILD_GUARD + (0, cross_env_1.withCrossEnv)({ NODE_ENV: nodeEnv }, `${invocation} up ${exports.COMPILED_MIGRATE_ARGS}`);
+    }
+    return scripts;
+}
+/**
+ * Warn when the build guard the deployed scripts call is not in the project.
+ *
+ * The file ships with nest-server-starter, which BOTH modes clone as their base
+ * (`server.ts`: "Both npm and vendor mode clone nest-server-starter as the base"), and
+ * nothing in the conversion prunes `scripts/` wholesale — only
+ * `strip-api-mode-markers.mjs`, `scripts/vendor/` and, in REST mode,
+ * `run-spectaql.mjs`. So the CLI does NOT ship its own copy: a second, nearly identical
+ * file is exactly the drift we are trying to avoid.
+ *
+ * What it does instead is fail loudly if the assumption stops holding — e.g. a project
+ * built from an older starter. Same treatment as `migrations-utils/mongo-uri.js`:
+ * without the file every deployed migrate script dies at the first `&&`.
+ *
+ * @returns A warning message, or null when the guard is present.
+ */
+function missingBuildGuardWarning(filesystem, projectDir) {
+    if (filesystem.exists((0, path_1.join)(projectDir, 'scripts', exports.BUILD_GUARD_FILE))) {
+        return null;
+    }
+    return (`  ⚠ scripts/${exports.BUILD_GUARD_FILE} is missing — the deployed migrate:<env>:up scripts call it ` +
+        'before migrating and would fail immediately. It ships with nest-server-starter; add it ' +
+        '(or update the starter this project was created from).');
+}

package/build/lib/module-specifiers.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileImportedSpecifiers = fileImportedSpecifiers;
+exports.importedSpecifiers = importedSpecifiers;
+exports.isPackageImport = isPackageImport;
+exports.isRelativeCoreImport = isRelativeCoreImport;
+/**
+ * The module specifiers a file imports — read from the syntax tree, never from text.
+ *
+ * The detectors that ask "does this file still import X?" used to search the raw source
+ * and blank out comments first, because a docblock that DOCUMENTS the conversion quotes
+ * the very syntax they look for (`nest-server-starter`'s
+ * `tests/unit/bootstrap-diagnostics.spec.ts` names `from '@lenne.tech/nest-server'` in
+ * prose, and the detector told the user to rewrite imports that file does not have).
+ *
+ * That workaround does not hold. `stripComments` drives a standalone `ts.createScanner`
+ * in a plain `scan()` loop, and a template literal WITH a substitution cannot be read
+ * that way: the scanner hands back `TemplateHead` and needs `reScanTemplateToken()` to
+ * continue. Without it every token after the first `` `x${…}` `` is misread, so comments
+ * from there on pass through verbatim. Bisected on `src/templates/check/check.mjs`: the
+ * first surviving comment appears right after `` `${s.toFixed(1)}s` `` on line 70, and a
+ * two-line fixture reproduces it. A plain template without substitution is fine; regex
+ * literals and division — the first suspects — are not the cause.
+ * Since template literals are everywhere, degradation was present in 23 of 76 real
+ * frontend files and 21 of 50 backend files; only the absence of a needle-quoting
+ * comment BELOW such a template kept it from producing false alarms.
+ *
+ * Asking the parser removes the whole class: a comment is not part of the AST, so there
+ * is nothing to strip and nothing to get wrong.
+ */
+const ts = __importStar(require("typescript"));
+/** `<script>` / `<script setup>` blocks of a Vue SFC, which is not valid TypeScript as a whole. */
+const VUE_SCRIPT_BLOCK = /<script\b[^>]*>([\s\S]*?)<\/script>/gi;
+/**
+ * Same, for a file on disk. A `.vue` SFC is not valid TypeScript, so its `<script>`
+ * blocks are extracted first and parsed individually — the template and style blocks
+ * cannot contain imports and are skipped. Everything else is parsed as-is.
+ *
+ * @returns The specifiers, or `[]` when the file cannot be read.
+ */
+function fileImportedSpecifiers(filePath, read) {
+    const source = read(filePath);
+    if (!source) {
+        return [];
+    }
+    if (!filePath.endsWith('.vue')) {
+        return importedSpecifiers(source, filePath);
+    }
+    const specifiers = [];
+    for (const [, block] of source.matchAll(VUE_SCRIPT_BLOCK)) {
+        specifiers.push(...importedSpecifiers(block, `${filePath}.ts`));
+    }
+    return specifiers;
+}
+/**
+ * Every module specifier `source` imports, exports from, dynamically imports or
+ * requires. Duplicates are preserved; order follows the file.
+ *
+ * Covers `import x from 'y'`, `import 'y'`, `export … from 'y'`, `export * from 'y'`,
+ * `import y = require('y')`, `await import('y')` and `require('y')`.
+ *
+ * @param source The file's text.
+ * @param fileName Only used to pick the parser dialect (`.tsx` vs `.ts`).
+ */
+function importedSpecifiers(source, fileName = 'file.ts') {
+    const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+    const specifiers = [];
+    const literalText = (node) => node && ts.isStringLiteralLike(node) ? node.text : null;
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+            const text = literalText(node.moduleSpecifier);
+            if (text !== null) {
+                specifiers.push(text);
+            }
+        }
+        else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
+            const text = literalText(node.moduleReference.expression);
+            if (text !== null) {
+                specifiers.push(text);
+            }
+        }
+        else if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const isRequire = ts.isIdentifier(callee) && callee.text === 'require';
+            const isDynamicImport = callee.kind === ts.SyntaxKind.ImportKeyword;
+            if (isRequire || isDynamicImport) {
+                const text = literalText(node.arguments[0]);
+                if (text !== null) {
+                    specifiers.push(text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return specifiers;
+}
+/** True when `specifier` is `pkg` itself or a deep import of it (`pkg/sub/path`). */
+function isPackageImport(specifier, pkg) {
+    return specifier === pkg || specifier.startsWith(`${pkg}/`);
+}
+/**
+ * True when `specifier` is a relative path whose last segment is `core`, or that leads
+ * into a `core` directory — `./core`, `../core`, `../../core/utils`.
+ */
+function isRelativeCoreImport(specifier) {
+    if (!specifier.startsWith('.')) {
+        return false;
+    }
+    return specifier.split('/').includes('core');
+}

package/build/lib/platform.js

@@ -1,10 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findExecutable = findExecutable;
 exports.isWindows = isWindows;
+exports.spawnCmd = spawnCmd;
 exports.spawnCmdSync = spawnCmdSync;
 exports.windowsAppData = windowsAppData;
-const cross_spawn_1 = require("cross-spawn");
+const cross_spawn_1 = __importStar(require("cross-spawn"));
 const fs_1 = require("fs");
 const path_1 = require("path");
 const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
@@ -48,6 +82,24 @@ function findExecutable(name, options = {}) {
 function isWindows(platform = process.platform) {
     return platform === 'win32';
 }
+/**
+ * `spawn` that also runs `.cmd`/`.bat` shims on Windows.
+ *
+ * The asynchronous counterpart of `spawnCmdSync`, with the same delegation and
+ * the same argument limit — see there. Needed because every long-running child
+ * the CLI starts (`pnpm run dev`, `pnpm start`, a Playwright run) is spawned
+ * asynchronously, and `pnpm` is `pnpm.cmd` on Windows: Node refuses to exec a
+ * `.cmd` directly (CVE-2024-27980, `EINVAL`), so without this nothing starts
+ * there at all.
+ *
+ * `detached` and `stdio` pass through unchanged, so a caller keeps its process
+ * group and its log-file descriptors. On Windows cross-spawn interposes
+ * `cmd.exe /c`, which means the reported pid is that of `cmd.exe` — the child
+ * tree, not a process group, is what a killer has to walk there.
+ */
+function spawnCmd(command, args = [], options = {}) {
+    return (0, cross_spawn_1.default)(command, [...args], options);
+}
 /**
  * `spawnSync` that also runs `.cmd`/`.bat` shims on Windows.
  *

package/build/lib/spinner-lifetime.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSpinnerLeaks = findSpinnerLeaks;
+/**
+ * Finds progress spinners that can be left running.
+ *
+ * gluegun's `spin(text)` is `require('ora')(text).start()`. ora 4.0.2 with the
+ * default `discardStdin: true` does three things on start that only a stop undoes:
+ * it puts the terminal into raw mode (remembering the value it found), it calls
+ * `stdin.resume()` and adds a `data` listener, and it starts a `setInterval` for
+ * the animation.
+ *
+ * A spinner that is never stopped therefore does not merely look untidy — the
+ * interval and the resumed stdin keep the Node event loop alive, so the process
+ * never exits, and the terminal stays in raw mode. That combination is how
+ * `lt fullstack init` could reach the end of its work and simply not return, with
+ * a spinner still turning. `failRun` deliberately sets `process.exitCode` instead
+ * of calling `process.exit()` (so a failure message is never truncated), which
+ * means "the event loop drains" is a precondition the CLI relies on.
+ *
+ * ## What "stopped" means here
+ *
+ * This is a dominance approximation, not a full control-flow analysis, and it is
+ * deliberately conservative in the direction that avoids false alarms — a guard
+ * that flags correct code gets switched off. A statement list definitely stops a
+ * spinner when it contains a direct stop call, or an `if` whose BOTH branches
+ * stop, or a `try` whose body and `catch` both stop (or whose `finally` stops).
+ * Anything else does not count.
+ *
+ * Two questions are asked per spinner:
+ *
+ * 1. Can the end of its enclosing block be reached without a stop? That is the
+ *    silent case — the command falls off the end, exit code 0, spinner running.
+ * 2. Is there a `return` after it that no stop dominates? That is the early-exit
+ *    case — an error path that prints and leaves.
+ *
+ * Returns inside a nested function are ignored: they leave the callback, not the
+ * command.
+ */
+const ts = __importStar(require("typescript"));
+/** Methods that stop an ora spinner. `stopAndPersist` is what `succeed`/`fail`/… call. */
+const STOP_METHODS = new Set(['fail', 'info', 'stop', 'stopAndPersist', 'succeed', 'warn']);
+/**
+ * Every spinner in `source` that can outlive the code path that started it.
+ *
+ * @param source The file's text.
+ * @param fileName Only used to pick the parser dialect.
+ */
+function findSpinnerLeaks(source, fileName = 'file.ts') {
+    const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+    const leaks = [];
+    const lineOf = (node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+    for (const declaration of spinnerDeclarations(sourceFile)) {
+        const name = declaration.name.getText(sourceFile);
+        const block = enclosingBlock(declaration);
+        if (!block) {
+            continue;
+        }
+        const returns = returnsAfter(block, declaration);
+        // `return spinner;` hands ownership to the caller, which is then responsible
+        // for stopping it — a factory like `logger.ts#spin` is not a leak. One such
+        // return exempts the whole declaration, because the spinner's lifetime is no
+        // longer decided in this function.
+        if (returns.some((statement) => handsOverOwnership(statement, name))) {
+            continue;
+        }
+        const after = statementsAfter(block, declaration);
+        if (!after.some((statement) => definitelyStops(statement, name, sourceFile))) {
+            leaks.push({
+                line: lineOf(declaration),
+                reason: after.length === 0 ? 'never-stopped' : 'falls-through',
+                spinner: name,
+            });
+        }
+        for (const returnStatement of returns) {
+            if (!dominatedByStop(returnStatement, block, declaration, name, sourceFile)) {
+                leaks.push({ line: lineOf(returnStatement), reason: 'return-without-stop', spinner: name });
+            }
+        }
+    }
+    return leaks.sort((a, b) => a.line - b.line);
+}
+/**
+ * True when executing `statement` always stops `name`.
+ *
+ * Only the shapes the CLI actually uses are recognised. Everything unrecognised
+ * answers false, so an unusual construct produces a finding to look at rather
+ * than a silent pass.
+ */
+function definitelyStops(statement, name, sourceFile) {
+    if (ts.isExpressionStatement(statement)) {
+        return isStopCall(statement.expression, name, sourceFile);
+    }
+    if (ts.isBlock(statement)) {
+        return statement.statements.some((child) => definitelyStops(child, name, sourceFile));
+    }
+    if (ts.isIfStatement(statement)) {
+        // Only an if/else that stops on BOTH sides stops unconditionally.
+        return (!!statement.elseStatement &&
+            definitelyStops(statement.thenStatement, name, sourceFile) &&
+            definitelyStops(statement.elseStatement, name, sourceFile));
+    }
+    if (ts.isTryStatement(statement)) {
+        if (statement.finallyBlock && definitelyStops(statement.finallyBlock, name, sourceFile)) {
+            return true;
+        }
+        return (definitelyStops(statement.tryBlock, name, sourceFile) &&
+            !!statement.catchClause &&
+            definitelyStops(statement.catchClause.block, name, sourceFile));
+    }
+    return false;
+}
+/**
+ * True when some stop of `name` is guaranteed to run before `returnStatement`.
+ *
+ * Walks out from the return towards `block`, and at each level checks the
+ * statements that precede the one we came from — a stop in any of them dominates.
+ */
+function dominatedByStop(returnStatement, block, declaration, name, sourceFile) {
+    let child = returnStatement;
+    let parent = returnStatement.parent;
+    while (parent) {
+        if (ts.isBlock(parent) || ts.isSourceFile(parent)) {
+            for (const statement of parent.statements) {
+                if (statement === child || statement.getStart(sourceFile) >= child.getStart(sourceFile)) {
+                    break;
+                }
+                if (statement.getStart(sourceFile) > declaration.getStart(sourceFile) &&
+                    definitelyStops(statement, name, sourceFile)) {
+                    return true;
+                }
+            }
+        }
+        if (parent === block) {
+            return false;
+        }
+        child = parent;
+        parent = parent.parent;
+    }
+    return false;
+}
+/** The nearest enclosing block of a declaration — the scope its spinner must not outlive. */
+function enclosingBlock(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isBlock(current)) {
+            return current;
+        }
+        current = current.parent;
+    }
+    return undefined;
+}
+/** True for `return spinner;` — the caller becomes responsible for stopping it. */
+function handsOverOwnership(statement, name) {
+    return !!statement.expression && ts.isIdentifier(statement.expression) && statement.expression.text === name;
+}
+/** True for `x.succeed(…)` / `x.fail(…)` / … on the spinner called `name`. */
+function isStopCall(expression, name, sourceFile) {
+    if (!ts.isCallExpression(expression) || !ts.isPropertyAccessExpression(expression.expression)) {
+        return false;
+    }
+    const access = expression.expression;
+    return access.expression.getText(sourceFile) === name && STOP_METHODS.has(access.name.text);
+}
+/** Every `return` after `declaration` inside `block`, skipping nested functions. */
+function returnsAfter(block, declaration) {
+    const found = [];
+    const start = declaration.getStart();
+    const visit = (node) => {
+        if (ts.isFunctionLike(node)) {
+            return; // A return there leaves the callback, not the command.
+        }
+        if (ts.isReturnStatement(node) && node.getStart() > start) {
+            found.push(node);
+        }
+        ts.forEachChild(node, visit);
+    };
+    for (const statement of block.statements) {
+        if (statement.getStart() > start) {
+            visit(statement);
+        }
+    }
+    return found;
+}
+/** `const x = spin(…)` declarations, including `toolbox.print.spin(…)`. */
+function spinnerDeclarations(sourceFile) {
+    const found = [];
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.initializer &&
+            ts.isCallExpression(node.initializer)) {
+            const callee = node.initializer.expression;
+            const name = ts.isPropertyAccessExpression(callee)
+                ? callee.name.text
+                : ts.isIdentifier(callee)
+                    ? callee.text
+                    : '';
+            if (name === 'spin') {
+                found.push(node);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return found;
+}
+/** The statements of `block` that follow `declaration`. */
+function statementsAfter(block, declaration) {
+    const start = declaration.getStart();
+    return block.statements.filter((statement) => statement.getStart() > start);
+}

package/build/templates/check/check.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @lt-check-wrapper 3.13.0
+// @lt-check-wrapper 3.13.1
 /**
  * Quiet, report-driven wrapper around the project `check` pipeline.
  *
@@ -33,7 +33,7 @@
  * scripts/check-wrapper-version.test.mjs fails when it drifts from
  * package.json. In a generated project it keeps the release it came from.
  */
-import { execSync, spawn } from 'node:child_process';
+import { execFileSync, execSync, spawn } from 'node:child_process';
 import { readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -84,6 +84,12 @@ function fmtDuration(ms) {
 // binds only to the first simple command, so a step written with `;` or a
 // leading `cd` would be reported as pinned and run unpinned. Both carry the
 // same value, so they cannot disagree.
+//
+// On Windows only the second level exists: cmd.exe has no `VAR=value cmd`
+// syntax and would run the assignment as a command, so `pinCheckBuildDir`
+// writes no prefix there and `stepEnv` carries the pin alone. That is why
+// `stepEnv` keys on the command rather than on the presence of a prefix —
+// scripts/check-windows.test.mjs holds the two together.
 const CHECK_BUILD_DIR = '.nuxt-check';
 
 // Deliberately narrow: a blanket prefix would override the dirs the package.json
@@ -123,8 +129,15 @@ export const PM_INVOCATION = new RegExp(`${PM_INSTALL.source}|${PM_AUDIT.source}
  * existing-pin test is NOT anchored to the start of the string, because the
  * shape the nuxt starter actually ships is `cross-env NUXT_BUILD_DIR=… pnpm …`,
  * which a `^` anchor does not see.
+ *
+ * On Windows there is no prefix at all: `VAR=value cmd` is POSIX shell syntax,
+ * and cmd.exe reads the assignment as the command name ('NUXT_BUILD_DIR' is not
+ * recognized as an internal or external command). `stepEnv` below hands the
+ * same value to the child as a real environment variable, which is what every
+ * step relies on there.
  */
-export function pinCheckBuildDir(cmd) {
+export function pinCheckBuildDir(cmd, platform = process.platform) {
+  if (platform === 'win32') return cmd;
   if (!PM_INVOCATION.test(cmd) || /(^|\s)NUXT_BUILD_DIR=/.test(cmd)) return cmd;
   return `NUXT_BUILD_DIR=${CHECK_BUILD_DIR} ${cmd}`;
 }
@@ -132,13 +145,22 @@ export function pinCheckBuildDir(cmd) {
 /**
  * The environment a step needs beyond the inherited one.
  *
- * Mirrors the textual pin so a shell construct the prefix cannot reach (a `;`
- * separator, a leading `cd`) still gets the isolated build dir. Only for
- * commands the pin applies to — a step that pins itself keeps its own value,
- * because the prefix check already declined to touch it.
+ * Keyed on the COMMAND, not on the textual pin. Two reasons, and the second is
+ * why reading the text was not enough:
+ *
+ *  - a shell construct the prefix cannot reach (a `;` separator, a leading
+ *    `cd`) would be reported as pinned and run unpinned;
+ *  - on Windows `pinCheckBuildDir` writes no prefix, so a predicate that looks
+ *    for one would find nothing and hand the step NO build dir — the pin would
+ *    silently disappear on exactly the platform that cannot use the prefix.
+ *
+ * A step that pins itself keeps its own value: the textual prefix wins over the
+ * inherited environment, and `cross-env` sets the variable itself.
  */
-function stepEnv(step) {
-  return /(^|\s)NUXT_BUILD_DIR=/.test(step.cmd) ? { NUXT_BUILD_DIR: CHECK_BUILD_DIR } : null;
+export function stepEnv(step) {
+  return PM_INVOCATION.test(step.cmd) || /(^|\s)NUXT_BUILD_DIR=/.test(step.cmd)
+    ? { NUXT_BUILD_DIR: CHECK_BUILD_DIR }
+    : null;
 }
 
 // ── step classification ────────────────────────────────────────────────────
@@ -407,11 +429,39 @@ const IDLE_TIMEOUT_MS = (() => {
 // ── command runner ─────────────────────────────────────────────────────────
 const RUNNING = new Set();
 
+/**
+ * How to kill a process tree on this platform.
+ *
+ * Windows has neither `pgrep` nor signals: `process.kill(pid, 'SIGTERM')` there ends the one
+ * process and orphans its children, and `taskkill /T` alone was measured to leave the tree
+ * running ("Die Beendigung dieses Prozesses muss erzwungen werden") with the port still held.
+ * `/F` is what actually frees it, so the whole tree is force-killed in one call.
+ *
+ * The consequence is worth stating, because it is a behaviour difference and not an
+ * implementation detail: on Windows there is no graceful stage. The SIGTERM call already
+ * terminates, so a child's graceful-shutdown hook does not run — a server gets no chance to
+ * close connections or flush. The SIGKILL escalation five seconds later then finds nothing.
+ *
+ * Split out as a pure function so both branches can be tested from either platform.
+ */
+export function killTreePlan(pid, signal, platform = process.platform) {
+  return platform === 'win32' ? { args: ['/PID', String(pid), '/T', '/F'], command: 'taskkill' } : { signal };
+}
+
 // Best-effort kill of a child's whole process tree (sh → pnpm → vitest →
 // fork workers). Killing only the direct child orphans the tree — exactly the
 // zombie workers a deadlock leaves behind. Children are collected via pgrep
 // and killed leaves-first.
 function killTree(child, signal = 'SIGTERM') {
+  const plan = killTreePlan(child.pid, signal);
+  if (plan.command) {
+    try {
+      execFileSync(plan.command, plan.args, { stdio: 'ignore' });
+    } catch {
+      /* already gone, or taskkill refused — nothing further to try */
+    }
+    return;
+  }
   const pids = [];
   const collect = (pid) => {
     pids.push(pid);

package/build/templates/check/lt-monorepo-pin.json

@@ -1,13 +1,13 @@
 {
-  "commit": "61f8c9f9b3292cca71d9bfdfbf18e11d47a9a4a8",
+  "commit": "fcf7c83cffa37b09db88481833e7ccc0dd2fbe0f",
   "files": {
     "build-test-gate.mjs": "865bf1b9dd28151f53b9f2dfe4c3c46d29b9303fb1c2f497ce0e3136bcd37d71",
-    "check.mjs": "783dce99aad1d2faf3d880184e43422c6b8433afcfa50c1f652b2d8ef6b2a1db",
+    "check.mjs": "fed669a625b56d907ab2e3693c2e5797a877c460588bd79f89249d88c568c178",
     "lib/ansi.mjs": "f997ee6e9bf1c7ee54ab612d4040fcc778064ec160eae19bf5c3960a75a6e2ff",
     "lib/audit-report.mjs": "503825c3342dec1ee5d8d70e5af21b73e798faee320426b2492190cde0801df2",
     "lib/workspace-packages.mjs": "ccdd133622a88186c924bc8271d35cf1f8357dc26d4a607998ca5e91fce5bf88"
   },
-  "ref": "v3.13.0",
+  "ref": "v3.13.1",
   "repository": "lenneTech/lt-monorepo",
-  "version": "3.13.0"
+  "version": "3.13.1"
 }