@hublo/sentinel 1.2.0-alpha.0 → 1.2.0-alpha.10

package/dist/index.js

@@ -7,8 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-TWL6T237.js";
-import "./chunk-XSCDJZDY.js";
+} from "./chunk-7WB7MQHD.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -0,0 +1,90 @@
+import { UserConfig, Plugin } from 'vite';
+export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
+
+interface NestServiceOptions {
+    /** The nx project name. Keys the dependency graph, and names the module in messages. */
+    project: string;
+    /** Absolute path to the module's directory, normally `__dirname`. */
+    root: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Entry point, relative to `root`. */
+    entry?: string;
+    /**
+     * The tsconfig whose emit must be preserved, when the service uses neither conventional name.
+     *
+     * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.
+     */
+    tsconfig?: string;
+    /** Output directory, relative to `workspaceRoot`. */
+    outDir?: string;
+    /**
+     * Anything this service needs that the shape does not give it.
+     *
+     * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate
+     * and aliases stack the way Vite does it everywhere else, so there is no second set of
+     * semantics to learn or to document.
+     */
+    overrides?: UserConfig;
+}
+declare const nestService: (options: NestServiceOptions) => UserConfig;
+
+interface DecoratorMetadataOptions {
+    /** The module being built. Its tsconfig is the one whose emit must be preserved. */
+    root: string;
+    /**
+     * An explicit tsconfig, when the service does not use either conventional name.
+     *
+     * Relative paths resolve against `root`.
+     */
+    tsconfig?: string;
+}
+declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
+
+interface NodeManifestOptions {
+    /** The nx project name, which is how the graph is keyed. */
+    project: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Where the bundle is written; the two files land beside it. */
+    outDir: string;
+    /** Entry file name, written as `main` so `node .` resolves inside the image. */
+    entry?: string;
+    /**
+     * Packages the IMAGE provides, which are therefore allowed to be required without being
+     * declared in the manifest.
+     *
+     * The generated Prisma clients are the case this exists for: the Dockerfile copies
+     * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module
+     * declares them. Everything else that is required and undeclared is a bug, and the check
+     * below refuses the build.
+     */
+    providedByImage?: readonly string[];
+}
+/**
+ * Writes the manifest and lockfile once the bundle is on disk.
+ *
+ * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the
+ * directory and cannot be cleared by `emptyOutDir`.
+ *
+ * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left
+ * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it
+ * became the one Vite printed, hiding the failure that actually stopped the build. It cost two
+ * diagnoses before being recognised, so the missing directory is now read as what it is: the
+ * bundle was never written, and this plugin has nothing to say about why.
+ */
+declare const nodeManifest: (options: NodeManifestOptions) => Plugin;
+
+interface Alias {
+    find: RegExp;
+    replacement: string;
+}
+/**
+ * Read the mappings from the workspace's base tsconfig.
+ *
+ * Longest pattern first, because Vite takes the first alias that matches and the mappings
+ * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.
+ */
+declare const tsconfigAliases: (workspaceRoot: string, file?: string) => Alias[];
+
+export { type Alias, type DecoratorMetadataOptions, type NestServiceOptions, type NodeManifestOptions, decoratorMetadata, nestService, nodeManifest, tsconfigAliases };

package/dist/roles/build/nest/toolchain.js

@@ -0,0 +1,253 @@
+// src/roles/build/nest/nest-service.ts
+import { join as join3 } from "path";
+import { mergeConfig } from "vite";
+
+// src/roles/build/nest/decorator-metadata.ts
+import { existsSync } from "fs";
+import path from "path";
+import ts from "typescript";
+var TYPESCRIPT_SOURCE = /\.ts$/;
+var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
+var assertCompilerApi = () => {
+  if (typeof ts.transpileModule === "function") return;
+  throw new Error(
+    `sentinel build(nest): the resolved typescript (${ts.version ?? "unknown version"}) has no transpileModule API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Sentinel pins its own compiler, so this means one was substituted, usually by a pnpm override or an alias on \`typescript\`.`
+  );
+};
+var resolveTsconfig = (options) => {
+  if (options.tsconfig) {
+    const explicit = path.resolve(options.root, options.tsconfig);
+    if (!existsSync(explicit)) {
+      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
+    }
+    return explicit;
+  }
+  for (const candidate of TSCONFIG_CANDIDATES) {
+    const found = path.join(options.root, candidate);
+    if (existsSync(found)) return found;
+  }
+  throw new Error(
+    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
+  );
+};
+var readCompilerOptions = (options) => {
+  assertCompilerApi();
+  const configPath = resolveTsconfig(options);
+  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+    ...ts.sys,
+    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+      throw new Error(
+        `sentinel build(nest): could not read ${configPath}: ` + ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")
+      );
+    }
+  });
+  return {
+    ...parsed?.options,
+    // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
+    // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
+    module: ts.ModuleKind.ESNext,
+    // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
+    sourceMap: true,
+    inlineSourceMap: false,
+    inlineSources: false,
+    // Types are another target's job, and `transpileModule` could not emit them anyway.
+    declaration: false,
+    declarationMap: false,
+    emitDeclarationOnly: false,
+    noEmit: false,
+    // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
+    // incremental build here to inform.
+    composite: false,
+    incremental: false
+  };
+};
+var decoratorMetadata = (options) => {
+  let compilerOptions;
+  return {
+    name: "sentinel:decorator-metadata",
+    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle.
+    enforce: "pre",
+    buildStart() {
+      compilerOptions = readCompilerOptions(options);
+    },
+    transform(code, id) {
+      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) {
+        return null;
+      }
+      if (compilerOptions === void 0) {
+        throw new Error(
+          `sentinel build(nest): compiler options were never read, so ${id} would be transpiled with defaults rather than this module's tsconfig.`
+        );
+      }
+      const output = ts.transpileModule(code, { fileName: id, compilerOptions });
+      return { code: output.outputText, map: output.sourceMapText ?? null };
+    }
+  };
+};
+
+// src/roles/build/nest/node-manifest.ts
+import { existsSync as existsSync2, writeFileSync } from "fs";
+import { isBuiltin } from "module";
+import { join } from "path";
+var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
+var externalPackages = (bundle) => {
+  const emitted = new Set(Object.keys(bundle));
+  const packages = /* @__PURE__ */ new Set();
+  for (const chunk of Object.values(bundle)) {
+    for (const imported of chunk.imports ?? []) {
+      if (emitted.has(imported)) continue;
+      if (imported.startsWith(".") || imported.startsWith("/")) continue;
+      if (isBuiltin(imported)) continue;
+      const parts = imported.split("/");
+      const name = imported.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+      if (name) packages.add(name);
+    }
+  }
+  return packages;
+};
+var nodeManifest = (options) => {
+  let required;
+  return {
+    name: "sentinel:node-manifest",
+    apply: "build",
+    generateBundle(_outputOptions, bundle) {
+      required = externalPackages(bundle);
+    },
+    async closeBundle() {
+      const entry = options.entry ?? "main.js";
+      if (!existsSync2(join(options.outDir, entry))) return;
+      const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
+      const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
+      const graph = await createProjectGraphAsync({ exitOnError: false });
+      const manifest = createPackageJson(options.project, graph, {
+        root: options.workspaceRoot,
+        isProduction: true
+      });
+      manifest.main = entry;
+      if (required === void 0) {
+        throw new Error(
+          `sentinel build(nest): the bundle was written but never inspected, so the manifest could not be checked against what it requires. Refusing to write one that might not install.`
+        );
+      }
+      assertManifestCovers(required, manifest, options);
+      writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+      writeFileSync(
+        join(options.outDir, getLockFileName("pnpm")),
+        createLockFile(manifest, graph, "pnpm")
+      );
+    }
+  };
+};
+var assertManifestCovers = (required, manifest, options) => {
+  const declared = new Set(Object.keys(manifest.dependencies ?? {}));
+  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE;
+  const missing = [...required].filter((name) => !declared.has(name)).filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`))).sort();
+  if (missing.length === 0) return;
+  throw new Error(
+    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated manifest does not declare, so the image would not install them: ${missing.join(", ")}. Either declare them in the module's package.json, inline them with \`ssr.noExternal\`, or list them in \`providedByImage\` if the Dockerfile copies them in.`
+  );
+};
+
+// src/roles/build/nest/tsconfig-aliases.ts
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
+var toAlias = (workspaceRoot, pattern, target) => {
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
+  return {
+    find: new RegExp(`^${escaped}$`),
+    replacement: join2(workspaceRoot, target.replace(/\*/g, "$1"))
+  };
+};
+var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
+  const raw = readFileSync(join2(workspaceRoot, file), "utf8");
+  const { compilerOptions } = JSON.parse(stripLineComments(raw));
+  return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
+    const [target] = targets;
+    return target === void 0 ? [] : [toAlias(workspaceRoot, pattern, target)];
+  }).sort((a, b) => b.find.source.length - a.find.source.length);
+};
+
+// src/roles/build/nest/nest-service.ts
+var baseConfig = (options) => {
+  const outDir = join3(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join3(options.root, options.entry ?? "src/main.ts");
+  return {
+    plugins: [
+      decoratorMetadata({ root: options.root, tsconfig: options.tsconfig }),
+      nodeManifest({
+        project: options.project,
+        workspaceRoot: options.workspaceRoot,
+        outDir
+      })
+    ],
+    resolve: { alias: tsconfigAliases(options.workspaceRoot) },
+    ssr: {
+      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require("tslib")`
+      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into
+      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and
+      // the manifest nx generates from the project graph does not list it, because no module
+      // DECLARES tslib. The image therefore did not install it and the service died on its first
+      // require, only in the image: locally and in CI the workspace root has tslib.
+      noExternal: ["tslib"]
+    },
+    build: {
+      // An SSR build targets Node and leaves real packages external, which is what
+      // `webpack-node-externals` did: the image installs them from the generated manifest.
+      ssr: entry,
+      outDir,
+      emptyOutDir: true,
+      sourcemap: true,
+      target: "node20",
+      // The bundle is read by humans when a stack trace points into it, and minifying a
+      // server bundle buys nothing: it is never downloaded.
+      minify: false,
+      rollupOptions: {
+        output: {
+          format: "cjs",
+          // One output file per source module, instead of hoisting everything into one scope.
+          //
+          // This is not a preference, it is the only shape that keeps the OpenAPI contract.
+          // Merging every module into one scope forces Rollup to rename duplicate class names,
+          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently
+          // becomes a renamed schema in the published API. Measured on `network`, which has two
+          // such collisions: single bundle renames `InvalidPermissionError` and
+          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the
+          // committed contract byte for byte.
+          //
+          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under
+          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.
+          preserveModules: true,
+          // The image runs `./dist/main.js`, so the entry keeps that name at the root while
+          // every other module keeps its own path. Under `preserveModules` a plain string here
+          // would be applied to all of them, which numbers them (`main962.js`) and loses the
+          // entry.
+          entryFileNames: (chunk) => chunk.facadeModuleId === entry ? "main.js" : "[name].js"
+        },
+        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog
+        // when its module loads, and nothing references that module afterwards. Rollup may
+        // drop such a module; webpack never did.
+        //
+        // Measured on the first migrated service this changes nothing, so it is insurance
+        // rather than a fix, and it is recorded as such rather than credited with the smaller
+        // bundle (that comes from barrel re-exports the service does not use).
+        treeshake: { moduleSideEffects: true }
+      }
+    }
+  };
+};
+var nestService = (options) => options.overrides === void 0 ? baseConfig(options) : mergeConfig(baseConfig(options), options.overrides);
+
+// src/roles/build/nest/toolchain.ts
+import { defineConfig, loadEnv, mergeConfig as mergeConfig2 } from "vite";
+export {
+  decoratorMetadata,
+  defineConfig,
+  loadEnv,
+  mergeConfig2 as mergeConfig,
+  nestService,
+  nodeManifest,
+  tsconfigAliases
+};
+//# sourceMappingURL=toolchain.js.map

package/dist/roles/build/toolchain.d.ts

@@ -0,0 +1,5 @@
+export { default as tailwindcss } from '@tailwindcss/vite';
+export { default as react } from '@vitejs/plugin-react';
+export { nitro } from 'nitro/vite';
+export { default as svgr } from 'vite-plugin-svgr';
+export { Plugin, PluginOption, SassPreprocessorOptions, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';

package/dist/roles/build/toolchain.js

@@ -0,0 +1,16 @@
+// src/roles/build/toolchain.ts
+import { default as default2 } from "@tailwindcss/vite";
+import { default as default3 } from "@vitejs/plugin-react";
+import { nitro } from "nitro/vite";
+import { default as default4 } from "vite-plugin-svgr";
+import { defineConfig, loadEnv, mergeConfig } from "vite";
+export {
+  defineConfig,
+  loadEnv,
+  mergeConfig,
+  nitro,
+  default3 as react,
+  default4 as svgr,
+  default2 as tailwindcss
+};
+//# sourceMappingURL=toolchain.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.0",
+  "version": "1.2.0-alpha.10",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -39,8 +39,12 @@
       "default": "./dist/tsconfig/node.json"
     },
     "./build/react": {
-      "types": "./dist/roles/build/react-app.d.ts",
-      "import": "./dist/roles/build/react-app.js"
+      "types": "./dist/roles/build/toolchain.d.ts",
+      "import": "./dist/roles/build/toolchain.js"
+    },
+    "./build/nest": {
+      "types": "./dist/roles/build/nest/toolchain.d.ts",
+      "import": "./dist/roles/build/nest/toolchain.js"
     }
   },
   "files": [
@@ -62,9 +66,11 @@
     "eslint-plugin-styled-components-a11y": "2.2.0",
     "jsonc-parser": "^3.3.1",
     "nitro": "3.0.260415-beta",
+    "oxc-parser": "0.147.0",
     "oxfmt": "0.63.0",
     "oxlint": "1.77.0",
     "oxlint-tsgolint": "7.0.2001",
+    "typescript": "5.9.3",
     "vite": "8.0.8",
     "vite-plugin-svgr": "5.2.0"
   },
@@ -95,6 +101,18 @@
       }
     }
   },
+  "peerDependencies": {
+    "nx": ">= 21",
+    "@nx/js": ">= 21"
+  },
+  "peerDependenciesMeta": {
+    "nx": {
+      "optional": true
+    },
+    "@nx/js": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsup && tsx scripts/build-presets.ts",
     "dev": "tsup --watch",

package/dist/chunk-XSCDJZDY.js

@@ -1,26 +0,0 @@
-// src/roles/build/presets/base.json
-var base_default = {
-  target: "chrome89",
-  allowedHosts: [".hubpreprod.com", ".playground-hublo.com"],
-  publicAssets: [
-    {
-      dir: "public/branding",
-      baseURL: "/branding",
-      maxAge: 31536e3
-    }
-  ]
-};
-
-// src/roles/build/preset-data.ts
-var REACT_APP_DEFAULTS = base_default;
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-export {
-  REACT_APP_DEFAULTS,
-  isPlainObject
-};
-//# sourceMappingURL=chunk-XSCDJZDY.js.map

package/dist/roles/build/react-app.d.ts

@@ -1,116 +0,0 @@
-import { PluginOption, UserConfig } from 'vite';
-export { defineConfig, loadEnv } from 'vite';
-
-/** The convention values, in one place so `--inspect` can report what an app departs from. */
-declare const REACT_APP_DEFAULTS: {
-    target: string;
-    allowedHosts: string[];
-    publicAssets: {
-        dir: string;
-        baseURL: string;
-        maxAge: number;
-    }[];
-};
-
-/** Where the router's routes live and where it writes its generated tree. */
-interface RouterPaths {
-    routesDirectory: string;
-    generatedRouteTree: string;
-    /** Extra lines appended to the generated tree. Two of the three apps use it. */
-    routeTreeFileFooter?: string[];
-}
-/**
- * The TanStack factories, supplied by the app.
- *
- * Typed loosely on purpose: sentinel decides WHEN to call them and with what, and has no
- * business asserting their return shape. Narrowing this would only couple sentinel to a
- * version of a package it does not own.
- */
-interface TanstackFactories {
-    start: (options: {
-        router: RouterPaths;
-    }) => PluginOption[];
-    router: (options: RouterPaths & {
-        target: string;
-        autoCodeSplitting: boolean;
-    }) => PluginOption;
-}
-/** Everything an app declares. */
-interface ReactAppOptions {
-    /** The app's own directory. Always `__dirname`. */
-    root: string;
-    /** Vite's `mode`, from the config callback. */
-    mode: string;
-    /** Served under, e.g. `/console/`. */
-    base: string;
-    /** Dev server port. */
-    port: number;
-    /** HMR port. Explicit, NOT `port + 1`: career goes DOWN to 9998 where the others go up. */
-    hmrPort: number;
-    router: RouterPaths;
-    tanstack: TanstackFactories;
-    /**
-     * Sourcemaps: a boolean, however the app decided it.
-     *
-     * The three apps disagree on how — two use a mode allowlist, one reads an env var. That is
-     * an inconsistency in the repo rather than a requirement, and encoding both would make
-     * sentinel the owner of a decision it should not hold.
-     */
-    sourcemap?: boolean;
-    /** Passed through verbatim, never read. See the note above. */
-    alias?: unknown[];
-    /** The app's own plugins (branding, babel). Appended AFTER the base set. */
-    plugins?: PluginOption[];
-    /** Conventions the app may override. */
-    target?: string;
-    allowedHosts?: string[];
-    /**
-     * Anything else this app needs, merged over the preset LAST.
-     *
-     * The preset is a starting point, not a cage. Two things an app must be able to do and
-     * could not before: override a NESTED attribute without losing its siblings, and add an
-     * attribute the preset knows nothing about.
-     *
-     * Objects merge, everything else replaces — see `merge-config` for why arrays replace
-     * rather than concatenate. Whatever lands here is reported by `--inspect --build`, so an
-     * override is a visible, countable decision instead of something found by reading a config.
-     *
-     * Real cases today: console needs `ssr`, `optimizeDeps` and `preview`; career needs
-     * `css.preprocessorOptions` for Sass; all three need their own `nitro.publicAssets`.
-     */
-    overrides?: Record<string, unknown>;
-}
-
-/**
- * The environment, loaded the way all three apps already load it.
- *
- * `production` is normalised to `prd` because that is this repository's deployment tag: it is
- * the `.env.prd` the build reads and the SSM path segment the values come from. Not a
- * preference, a fact about the repo — which is exactly why it belongs in the preset rather
- * than being retyped in every config.
- */
-declare function appEnv(root: string, mode: string): Record<string, string>;
-/** True when this run is a test rather than a real build. */
-declare function isTestMode(mode: string, env?: NodeJS.ProcessEnv): boolean;
-/**
- * WHICH plugins run, as names, in order.
- *
- * Split out from building them so the rule can be tested without instantiating a single
- * plugin. The rule is the part that must not diverge between apps; the instances are just
- * function calls.
- *
- * Under test the router plugin runs alone: `tanstackStart` and `nitro` bring a server the
- * tests neither need nor can run. All three apps already do this, identically.
- */
-declare function pluginPlan(isTest: boolean, extras?: number): string[];
-/**
- * The Vite config for a React app, minus the plugins.
- *
- * Pure and separately testable: everything here is data in, data out, so the composition
- * rules can be asserted without a bundler anywhere near the test.
- */
-declare function reactAppConfig(options: ReactAppOptions): Omit<UserConfig, 'plugins'>;
-/** The config an app spreads into `defineConfig`. */
-declare function reactApp(options: ReactAppOptions): UserConfig;
-
-export { REACT_APP_DEFAULTS, type ReactAppOptions, type RouterPaths, type TanstackFactories, appEnv, isTestMode, pluginPlan, reactApp, reactAppConfig };

package/dist/roles/build/react-app.js

@@ -1,111 +0,0 @@
-import {
-  REACT_APP_DEFAULTS,
-  isPlainObject
-} from "../../chunk-XSCDJZDY.js";
-
-// src/roles/build/react-app.ts
-import tailwindcss from "@tailwindcss/vite";
-import react from "@vitejs/plugin-react";
-import { nitro } from "nitro/vite";
-import { loadEnv } from "vite";
-import svgr from "vite-plugin-svgr";
-
-// src/roles/build/merge-config.ts
-function mergeConfig(base, overrides) {
-  if (!overrides) return base;
-  const out = { ...base };
-  for (const [key, value] of Object.entries(overrides)) {
-    if (value === void 0) {
-      delete out[key];
-      continue;
-    }
-    const current = out[key];
-    out[key] = isPlainObject(current) && isPlainObject(value) ? mergeConfig(current, value) : value;
-  }
-  return out;
-}
-
-// src/roles/build/react-app.ts
-import { defineConfig, loadEnv as loadEnv2 } from "vite";
-function appEnv(root, mode) {
-  return loadEnv(mode === "production" ? "prd" : mode, root, "");
-}
-function isTestMode(mode, env = process.env) {
-  return mode === "test" || env.VITEST === "true";
-}
-function pluginPlan(isTest, extras = 0) {
-  return [
-    "tailwindcss",
-    ...isTest ? ["tanstackRouter"] : ["tanstackStart", "nitro"],
-    "react",
-    "svgr",
-    ...Array.from({ length: extras }, (_, at) => `app:${at}`)
-  ];
-}
-function basePlugins(options, isTest) {
-  const { tanstack, router } = options;
-  return [
-    tailwindcss(),
-    ...isTest ? [tanstack.router({ ...router, target: "react", autoCodeSplitting: true })] : [...tanstack.start({ router }), nitro()],
-    react(),
-    svgr(),
-    ...options.plugins ?? []
-  ];
-}
-function reactAppConfig(options) {
-  const preset = {
-    base: options.base,
-    root: options.root,
-    define: {
-      // Development only. In a build this would leak a browser global into SSR output.
-      ...options.mode === "development" ? { global: "window" } : {}
-    },
-    server: {
-      port: options.port,
-      allowedHosts: options.allowedHosts ?? [...REACT_APP_DEFAULTS.allowedHosts],
-      hmr: { host: "localhost", protocol: "ws", port: options.hmrPort }
-    },
-    build: {
-      target: options.target ?? REACT_APP_DEFAULTS.target,
-      sourcemap: options.sourcemap ?? false
-    },
-    /*
-     * Nitro's two settings are sentinel's, and both were measured across the three apps rather
-     * than assumed.
-     *
-     * `baseURL` is always the app's `base`, without exception: `/console/`, `/` and `/admin/`.
-     * It is derived, so an app cannot get them out of step.
-     *
-     * `publicAssets` is byte-identical in all three — the branding directory, its URL and a
-     * one-year max-age. That is a convention about where branding lives, not data about an
-     * app, and it was sitting in three `overrides` blocks saying the same thing.
-     *
-     * An app that needs MORE from nitro overrides the key: career adds `externals` to keep the
-     * SSR sanitisation chain out of the server bundle. `mergeConfig` merges objects, so adding
-     * one key does not take these two away.
-     */
-    nitro: {
-      baseURL: options.base,
-      publicAssets: [...REACT_APP_DEFAULTS.publicAssets]
-    },
-    ...options.alias ? { resolve: { alias: options.alias } } : {}
-  };
-  return mergeConfig(preset, options.overrides);
-}
-function reactApp(options) {
-  return {
-    ...reactAppConfig(options),
-    plugins: basePlugins(options, isTestMode(options.mode))
-  };
-}
-export {
-  REACT_APP_DEFAULTS,
-  appEnv,
-  defineConfig,
-  isTestMode,
-  loadEnv2 as loadEnv,
-  pluginPlan,
-  reactApp,
-  reactAppConfig
-};
-//# sourceMappingURL=react-app.js.map