@hublo/sentinel 1.2.0-alpha.1 → 1.2.0-alpha.2

package/README.md

@@ -151,7 +151,7 @@ pnpm dlx @hublo/sentinel@<exact-version> --inspect --typescript --module <name>
 - [`docs/using-sentinel.md`](docs/using-sentinel.md) — every verb for every role, scoping a run to some files, what a fully adopted module looks like, and how versions move between modules.
 - [`docs/lint-adoption.md`](docs/lint-adoption.md) — migrating a module from ESLint to Oxlint: the two steps, what `--init` writes and removes, the two react tiers, and the failures worth recognising.
 - [`docs/format-adoption.md`](docs/format-adoption.md) — migrating a module from Prettier to oxfmt: why this config is materialized rather than a stub, how a module keeps its own formatting, and what did not survive the move.
-- [`docs/build-adoption.md`](docs/build-adoption.md) — moving a React app's Vite toolchain into sentinel: what the config becomes, what sentinel owns versus what stays the app's, why overriding merges instead of spreading, and why an existing config is not rewritten.
+- [`docs/build-adoption.md`](docs/build-adoption.md) — moving a React app's Vite toolchain into sentinel: adoption changes the config's IMPORTS and nothing else, what sentinel owns versus what stays the app's, and why reading nothing is what makes losing nothing a guarantee.
 - [`docs/typescript-adoption.md`](docs/typescript-adoption.md) — the adoption cheat sheet: the two adoption steps, the command model (verb x type x location), options, reading a report, and troubleshooting.
 - [`docs/typescript-traces.md`](docs/typescript-traces.md) — a **generated, versioned** reference of live command + output traces (every verb, option, config result and edge case) against the mock monorepo. Regenerate after CLI changes with `pnpm docs:traces`.
 
@@ -161,7 +161,7 @@ Every check is described by three layers:
 
 | Layer                | Flag                        | What it is                                  | Examples                                                                                                                                                     |
 | -------------------- | --------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                 | `lint` `format` `typescript` `build` `test` `static-analysis` `runtime-analysis`                                                                             |
+| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                 | `lint` `format` `typescript` `build` `dev` `test` `static-analysis` `runtime-analysis`                                                                       |
 | **runner** (adapter) | `--runner=<tool>`           | the _tool_ behind the target, swappable     | lint: `eslint`/`biome`/`oxlint` · types: `tsc`/`tsgo` · build: `vite` · test: `vitest`                                                                       |
 | **preset** (preset)  | detected / `--preset`       | the _variant_ per stack (strict by default) | `react` `nest` `node` `svelte` (svelte: lint + format; no tsconfig preset yet, so the TypeScript role stands aside on those modules and the other two adopt) |
 

package/dist/bin/sentinel.d.ts

@@ -1 +1,6 @@
 #!/usr/bin/env node
+import '@tailwindcss/vite';
+import '@vitejs/plugin-react';
+import 'nitro/vite';
+import 'vite-plugin-svgr';
+import 'vite';

package/dist/bin/sentinel.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  LONG_RUNNING_TARGETS,
   PRESET_NAMES,
   PresetUnsupportedError,
   SWEEPABLE_TARGETS,
@@ -20,8 +21,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-FLJ2QNFF.js";
-import "../chunk-XVDOQ3G3.js";
+} from "../chunk-SA2RMTVI.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -463,6 +463,15 @@ async function runVerb(ctx) {
   const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: ctx.ci });
   const out = palette(process.stdout);
   const err = palette(process.stderr);
+  const longRunning = ctx.targets.filter((target) => LONG_RUNNING_TARGETS.includes(target));
+  if (longRunning.length > 0 && modules.length > 1) {
+    process.stderr.write(
+      err.fail(
+        `sentinel: ${longRunning.map((t) => `--${t}`).join(", ")} starts a server that does not return, so it runs against ONE module. This resolved to ${modules.length} [${scope}]. Run it from inside the module's directory, or pass --module <name>.`
+      ) + "\n"
+    );
+    return 1;
+  }
   const shaped = ctx.verb === "run" && ctx.json ? "report" : ctx.verb;
   const replacement = {
     report: "--run --json",
@@ -579,6 +588,17 @@ registerAdapters();
 var separator = process.argv.indexOf("--");
 var toolArgs = separator === -1 ? [] : process.argv.slice(separator + 1);
 var cliArgv = separator === -1 ? process.argv : process.argv.slice(0, separator);
+var TARGET_HELP = {
+  lint: "linting",
+  format: "formatting",
+  typescript: "type checking",
+  build: "build",
+  dev: "dev server (long-running: never swept by an unqualified --run)",
+  test: "tests",
+  "static-analysis": "cycles, complexity, duplication, centrality",
+  "runtime-analysis": "bundle, Lighthouse, web vitals",
+  arch: "architecture boundaries"
+};
 program.name("sentinel").description("One CLI that guards code health: presets, analysis, and arch checks.").version(readOwnVersion()).configureHelp({ sortOptions: false }).showSuggestionAfterError(true).showHelpAfterError('(run "sentinel --help" for usage)').addHelpText(
   "before",
   [
@@ -589,7 +609,7 @@ program.name("sentinel").description("One CLI that guards code health: presets,
     "          --ci (affected), or all modules. --init targets one module only.",
     ""
   ].join("\n")
-).option("--run", "execute the target tool").option("--inspect", "show the resolved configuration").option("--init", "set up a module: write its config stubs + the workspace prep it needs").option("--migrate", "planned: change an already-initialized setup (not available yet)").option("--report", "deprecated: use --run --json").option("--status", "deprecated: use --inspect").option("--lint", "linting").option("--format", "formatting").option("--typescript", "type checking").option("--build", "build").option("--test", "tests").option("--static-analysis", "cycles, complexity, duplication, centrality").option("--runtime-analysis", "bundle, Lighthouse, web vitals").option("--arch", "architecture boundaries").option("--all", "every target").option(
+).option("--run", "execute the target tool").option("--inspect", "show the resolved configuration").option("--init", "set up a module: write its config stubs + the workspace prep it needs").option("--migrate", "planned: change an already-initialized setup (not available yet)").option("--report", "deprecated: use --run --json").option("--status", "deprecated: use --inspect").option(
   "--module <name>",
   "from the workspace root: scope to one module (omit = all; inside a module dir, drop this)"
 ).option("--preset <name>", `the stack preset to apply (${PRESET_NAMES.join(", ")})`).option("--flavour <name>", "deprecated: use --preset").option("--runner <tool>", "override the default runner (e.g. eslint, biome)").option("--ci", "CI mode: from the root, only the affected modules; non-zero exit on failure").option("--fix", "auto-fix where applicable").option("--dry-run", "preview the changes without writing (--init)").option("--json", "machine-readable output, for every verb").option(
@@ -621,7 +641,10 @@ program.name("sentinel").description("One CLI that guards code health: presets,
     `Available now: ${available.length ? available.map((t) => `--${t}`).join(", ") : "(none yet)"}`,
     planned.length ? `Planned (ship in later tickets): ${planned.map((t) => `--${t}`).join(", ")}` : ""
   ].filter(Boolean).join("\n");
-}).parse(cliArgv);
+});
+for (const target of TARGETS) program.option(`--${target}`, TARGET_HELP[target]);
+program.option("--all", "every target");
+program.parse(cliArgv);
 var opts = program.opts();
 function toCamel(flag) {
   return flag.replace(/-([a-z])/g, (_, c) => c.toUpperCase());

package/dist/{chunk-FLJ2QNFF.js → chunk-SA2RMTVI.js}

@@ -1,9 +1,3 @@
-import {
-  REACT_APP_DEFAULTS,
-  REQUIREMENTS,
-  isPlainObject
-} from "./chunk-XVDOQ3G3.js";
-
 // src/core/registry.ts
 var adapters = [];
 var PresetUnsupportedError = class extends Error {
@@ -223,7 +217,7 @@ function binSearchPath(cwd) {
 
 // src/roles/build/plan.ts
 import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { basename as basename2, join as join7 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -384,7 +378,85 @@ function keepsOtherCommands(script, sentinelCommand) {
   return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
 
+// src/roles/build/presets/requirements.json
+var requirements_default = {
+  svelte: {
+    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
+    requires: {
+      "@sveltejs/vite-plugin-svelte": "7.0.0",
+      svelte: "5.46.4"
+    }
+  }
+};
+
+// src/roles/build/presets/toolchain.json
+var toolchain_default = {
+  $comment: "The build toolchain sentinel owns. One table, because three places used to hold parts of it: the list to remove from a module's package.json, the list of import specifiers to rewrite, and the map from a default import to the name sentinel re-exports it under. A package added to one and not the others gives a removal with no rewrite, or an import pointing at a package the module no longer declares.",
+  owned: [
+    {
+      package: "vite",
+      specifier: "vite",
+      named: ["defineConfig", "loadEnv", "mergeConfig"],
+      types: [
+        "Plugin",
+        "PluginOption",
+        "SassPreprocessorOptions",
+        "UserConfig",
+        "UserConfigExport"
+      ],
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+    },
+    {
+      package: "@vitejs/plugin-react",
+      specifier: "@vitejs/plugin-react",
+      default: "react",
+      why: "the React transform. Bound to the Vite that runs it, so it has to come from the same install."
+    },
+    {
+      package: "@tailwindcss/vite",
+      specifier: "@tailwindcss/vite",
+      default: "tailwindcss",
+      why: "the Tailwind pipeline, identical in all three front apps."
+    },
+    {
+      package: "vite-plugin-svgr",
+      specifier: "vite-plugin-svgr",
+      default: "svgr",
+      why: "SVG as components, identical in all three front apps."
+    },
+    {
+      package: "nitro",
+      specifier: "nitro/vite",
+      named: ["nitro"],
+      why: "the SSR server. Note the package and the import specifier differ, which is exactly the kind of split that made three separate lists disagree."
+    }
+  ],
+  add: [
+    {
+      package: "@hublo/sentinel",
+      why: "the module now gets its toolchain from here, so it declares it. Pinned by the installer rather than by us: `--init` writes the dependency, `pnpm install` resolves it."
+    }
+  ],
+  $notOwned: {
+    "@rolldown/plugin-babel": "declared by career and host-admin themselves, not at the root. It supports LocatorJS, a development convenience gated on LOCATORJS=true, not shared build infrastructure. Removing it would remove a feature from two teams, which is their call and must not ride along inside an adoption.",
+    "@locator/babel-jsx": "same, and same owners.",
+    "@tanstack/react-start": "a framework the apps code against: 48 source files import it directly.",
+    "@tanstack/router-plugin": "generates the app's own route tree.",
+    "vite-bundle-analyzer": "at the root at 1.3.7 and imported nowhere, the only mention being a commented-out line in host-admin. Not a candidate to re-export, a candidate to delete from the root."
+  }
+};
+
+// src/roles/build/preset-data.ts
+var REQUIREMENTS = requirements_default;
+var OWNED_PACKAGES = toolchain_default.owned;
+
 // src/roles/build/config-policy.ts
+var COMPANION_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs"
+];
 var BUILD_CONFIG_FILES = [
   "vite.config.ts",
   "vite.config.mts",
@@ -404,13 +476,9 @@ function buildTarget() {
     }
   };
 }
-var SENTINEL_OWNED_BUILD_PACKAGES = [
-  "vite",
-  "@vitejs/plugin-react",
-  "@tailwindcss/vite",
-  "vite-plugin-svgr",
-  "nitro"
-];
+var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
+  (entry) => entry.package
+);
 
 // src/roles/build/dev-script.ts
 var CHAIN = " -- ";
@@ -418,17 +486,17 @@ var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
 var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
 function appOptions(rest) {
   const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
-  const kept = tokens.filter((token, at2) => !(at2 === 0 && DEV_SUBCOMMANDS.has(token)));
+  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
   return kept.join(" ");
 }
 function composeDevScript(existing, command) {
   if (existing === void 0 || existing.trim() === "") return command;
   const chunks = existing.trim().split(CHAIN);
-  const at2 = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
-  if (at2 === -1) return existing;
-  const rest = (chunks[at2] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at === -1) return existing;
+  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
   const options = appOptions(rest);
-  chunks[at2] = options === "" ? command : `${command} -- ${options}`;
+  chunks[at] = options === "" ? command : `${command} -- ${options}`;
   return chunks.join(CHAIN);
 }
 
@@ -502,9 +570,9 @@ function atLeast(declared, needed) {
   const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
   const left = parse2(declared);
   const right = parse2(needed);
-  for (let at2 = 0; at2 < Math.max(left.length, right.length); at2++) {
-    const a = left[at2] ?? 0;
-    const b = right[at2] ?? 0;
+  for (let at = 0; at < Math.max(left.length, right.length); at++) {
+    const a = left[at] ?? 0;
+    const b = right[at] ?? 0;
     if (a !== b) return a > b;
   }
   return true;
@@ -525,43 +593,103 @@ function describeUnmet(preset, unmet) {
   return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
 }
 
-// src/roles/build/plan.ts
-function scaffold() {
-  return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
-import { tanstackStart } from '@tanstack/react-start/plugin/vite'
-import { tanstackRouter } from '@tanstack/router-plugin/vite'
-import path from 'node:path'
-
-/*
- * Composition comes from sentinel: which plugins run under test and which under a real build,
- * the order they run in, and how the env is read. The values below are this app's own.
- *
- * TanStack is passed IN rather than imported by sentinel, because the app codes against it
- * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
- * Anything sentinel does not set goes in \`overrides\`, which merges over the preset last.
- */
-export default defineConfig(({ mode }) =>
-  reactApp({
-    root: __dirname,
-    mode,
-    base: '/',
-    port: 3000,
-    // Explicit, NOT port + 1: the three apps in this repo disagree, one of them goes down.
-    hmrPort: 3001,
-    router: {
-      routesDirectory: path.resolve(__dirname, 'src/routes'),
-      generatedRouteTree: path.resolve(__dirname, 'src/routeTree.gen.ts'),
-    },
-    tanstack: { start: tanstackStart, router: tanstackRouter },
-    alias: [],
-  }),
-)
-
-// If this app reads environment variables, use \`appEnv(__dirname, mode)\` rather than Vite's
-// \`loadEnv\`: it applies the production -> prd normalisation this repo deploys under, which
-// every app was otherwise retyping.
-`;
+// src/roles/build/rewrite-imports.ts
+import { parseSync } from "oxc-parser";
+var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
+function esmBlocker(fileName, packageType) {
+  if (/\.(mts|mjs)$/.test(fileName)) return void 0;
+  if (packageType === "module") return void 0;
+  return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
+}
+var DEFAULT_EXPORT_NAMES = Object.fromEntries(
+  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
+    entry.specifier,
+    entry.default
+  ])
+);
+function renderImport(bindings) {
+  const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
+  const values = bindings.filter((b) => !b.typeOnly);
+  const types = bindings.filter((b) => b.typeOnly);
+  const lines = [];
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (types.length > 0) {
+    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  }
+  return lines.join("\n");
+}
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return {
+      kind: "blocked",
+      why: `${fileName} does not parse: ${errors[0]?.message ?? "unknown"}`
+    };
+  }
+  const imports = program.body.filter(
+    (node) => node.type === "ImportDeclaration"
+  );
+  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+    return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
+  }
+  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  if (moving.length === 0) {
+    return {
+      kind: "unchanged",
+      why: "this config imports none of the packages sentinel owns, so there is nothing to move"
+    };
+  }
+  const bindings = [];
+  for (const node of moving) {
+    const from = node.source.value;
+    const specifiers = node.specifiers ?? [];
+    if (specifiers.length === 0) {
+      return { kind: "blocked", why: `\`import '${from}'\` has no bindings to move` };
+    }
+    for (const spec of specifiers) {
+      const typeOnly = node.importKind === "type" || spec.importKind === "type";
+      if (spec.type === "ImportDefaultSpecifier") {
+        const exported = DEFAULT_EXPORT_NAMES[from];
+        if (!exported) {
+          return {
+            kind: "blocked",
+            why: `no sentinel export for the default import of \`${from}\``
+          };
+        }
+        bindings.push({ exported, local: spec.local.name, typeOnly });
+        continue;
+      }
+      if (spec.type === "ImportSpecifier") {
+        bindings.push({
+          exported: spec.imported?.name ?? spec.imported?.value ?? spec.local.name,
+          local: spec.local.name,
+          typeOnly
+        });
+        continue;
+      }
+      return {
+        kind: "blocked",
+        why: `\`import * as ${spec.local.name} from '${from}'\` cannot be mapped onto sentinel's named exports`
+      };
+    }
+  }
+  const spans = moving.map((node) => ({ start: node.start, end: node.end })).sort((left, right) => left.start - right.start);
+  const first = spans[0];
+  const rest = spans.slice(1);
+  let out = source;
+  for (const span of rest.slice().reverse()) {
+    const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
+    out = out.slice(0, span.start) + out.slice(span.end + after);
+  }
+  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  return {
+    kind: "rewritten",
+    source: out,
+    moved: [...new Set(moving.map((node) => node.source.value))].sort()
+  };
 }
+
+// src/roles/build/plan.ts
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -590,9 +718,10 @@ function buildScripts(cwd) {
   };
   const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
   if (existingDev !== void 0) {
+    const own2 = basename2(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
-      selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND
+      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
     );
   }
   return scripts;
@@ -616,14 +745,41 @@ function plan(context) {
   const operations = [];
   const configFile = buildConfigFile(context.cwd);
   if (configFile === void 0) {
-    operations.push({ kind: "write", path: BUILD_CONFIG_FILES[0], contents: scaffold() });
-    notes.push(
-      `wrote ${BUILD_CONFIG_FILES[0]} as a starting point. Fill in this app's own values (base, ports, routes); sentinel owns the composition, not the data.`
-    );
-  } else if (!readsPreset(context.cwd, configFile)) {
-    notes.push(
-      `${configFile} is this app's own, so it was left alone. To adopt: import \`reactApp\` from \`${BUILD_PRESET_SPECIFIER}\` and pass it this app's values, keeping \`alias\` and your own plugins verbatim. \`sentinel --inspect --build\` reports what the resolved config departs from and what it adds, before and after.`
-    );
+    return {
+      operations: [],
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 projects here build through \`@nx/webpack\`), the build role does not apply to it.`
+    };
+  } else {
+    const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
+    if (notEsm !== void 0) return { operations: [], skipped: notEsm };
+    const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+    if (rewrite.kind === "blocked") {
+      return {
+        operations: [],
+        skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
+      };
+    }
+    if (rewrite.kind === "rewritten") {
+      operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+    }
+    for (const name of COMPANION_CONFIG_FILES) {
+      const source = readConfigSource(context.cwd, name);
+      if (source === "") continue;
+      const companion = rewriteBuildImports(source, name);
+      if (companion.kind === "rewritten") {
+        operations.push({ kind: "write", path: name, contents: companion.source });
+        notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
+      } else if (companion.kind === "blocked") {
+        notes.push(
+          `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
+        );
+      }
+    }
+    if (rewrite.kind === "rewritten") {
+      notes.push(
+        `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+      );
+    }
   }
   operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
   operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
@@ -636,12 +792,12 @@ function plan(context) {
   }
   return { operations, notes };
 }
-function readsPreset(cwd, configFile) {
-  if (!existsSync7(join7(cwd, configFile))) return false;
+function readConfigSource(cwd, configFile) {
+  if (!existsSync7(join7(cwd, configFile))) return "";
   try {
-    return readFileSync5(join7(cwd, configFile), "utf8").includes(BUILD_PRESET_SPECIFIER);
+    return readFileSync5(join7(cwd, configFile), "utf8");
   } catch {
-    return false;
+    return "";
   }
 }
 
@@ -791,48 +947,6 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
   }
 };
 
-// src/roles/build/owned-paths.ts
-var PRESET_OWNED_KEYS = [
-  "base",
-  "root",
-  "define",
-  "server",
-  "build",
-  "nitro",
-  "resolve",
-  "plugins"
-];
-function describeDepartures(config, defaults) {
-  const departures = [];
-  const build = asRecord(config.build);
-  const target = build?.target;
-  if (typeof target === "string" && target !== defaults.target) {
-    departures.push({
-      rule: "build.target",
-      reason: `${target}, where the convention is ${defaults.target}`
-    });
-  }
-  const server = asRecord(config.server);
-  const hosts = server?.allowedHosts;
-  if (Array.isArray(hosts) && !sameStrings(hosts, defaults.allowedHosts)) {
-    departures.push({
-      rule: "server.allowedHosts",
-      reason: `${JSON.stringify(hosts)}, where the convention is ${JSON.stringify(defaults.allowedHosts)}`
-    });
-  }
-  return departures;
-}
-function appAdditions(config) {
-  const owned = new Set(PRESET_OWNED_KEYS);
-  return Object.keys(config).filter((key) => !owned.has(key)).sort();
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-}
-function sameStrings(a, b) {
-  return a.length === b.length && a.every((value, at2) => value === b[at2]);
-}
-
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
 var PREBUILD_SCRIPT_NAME = `pre${BUILD_SCRIPT_NAME}`;
@@ -859,23 +973,6 @@ function runPrerequisite(cwd, env = process.env) {
   return { kind: "ran" };
 }
 
-// src/roles/build/resolve-config.ts
-async function resolveBuildConfig(cwd) {
-  try {
-    const { loadConfigFromFile } = await import("vite");
-    const loaded = await loadConfigFromFile(
-      { command: "build", mode: "production" },
-      void 0,
-      cwd,
-      "silent"
-    );
-    if (!loaded) return { kind: "failed", reason: "Vite found no config file in this module" };
-    return { kind: "loaded", config: loaded.config, from: loaded.path };
-  } catch (error) {
-    return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-  }
-}
-
 // src/roles/build/adapters/vite/vite.adapter.ts
 var ViteAdapter = class extends ViteRoleAdapter {
   target = "build";
@@ -901,25 +998,30 @@ var ViteAdapter = class extends ViteRoleAdapter {
     return this.spawnVite(ctx, ready.vite, ["build"], 1);
   }
   /**
-   * What this module builds with, without building it.
+   * What this module builds with, WITHOUT loading its config.
    *
-   * `--inspect` reads the committed config for every role, and the moment `--build` was wired
-   * it joined the sweep — so leaving this to throw would have broken `sentinel --inspect` on
-   * every React module, for a role that had only just arrived. Cheap and honest is the bar.
+   * Everything reported here is read from the manifest and from the config's text: whether the
+   * module imports its toolchain from sentinel, which Vite install would answer, what it still
+   * declares of its own, and whether it has a `prebuild` step.
    *
-   * `vite` is the interesting field and the one nothing else reports: an adopted config takes
-   * its plugins from sentinel, so a module answering `module` here is one build away from the
-   * two-copies failure, and this is where that is visible before it happens.
+   * It used to also load the config through Vite and report where it departed from a preset
+   * and what it added on top. Both were dropped with the preset itself. Adoption changes a
+   * config's IMPORTS and nothing else, so there is no preset the app signed up to and no
+   * distance from it to measure; and computing it meant EXECUTING an app's config, which is
+   * expensive and can fail on its own terms (career throws without `VITE_BRAND_ID`). Reading
+   * a file to report on it must not be able to break.
    *
-   * The resolved config comes from Vite's own loader rather than from parsing the file. See
-   * `resolve-config` for why that is the only honest answer here, and what it costs.
+   * They come back with the shared base, when there is again something an app has chosen to
+   * adopt and can therefore depart from.
    */
   async inspect(ctx) {
     const adoption = readBuildAdoption(ctx.cwd);
-    const base = {
+    return {
       runner: "vite",
       configFile: adoption.configFile,
       ...adoption.unreadable ? { unreadable: adoption.unreadable } : {},
+      // The field nothing else reports: an adopted config takes its plugins from sentinel, so
+      // a module answering `module` here is one build away from the two-copies failure.
       vite: viteOrigin(ctx.cwd),
       // Rendered as a labelled block by the shared renderer, the same shape the lint role's
       // parked rules and the format role's overrides already use.
@@ -929,36 +1031,6 @@ var ViteAdapter = class extends ViteRoleAdapter {
       })),
       prerequisite: moduleScripts(ctx.cwd)[PREBUILD_SCRIPT_NAME] ?? null
     };
-    if (adoption.configFile === null) return base;
-    const resolved = await resolveBuildConfig(ctx.cwd);
-    if (resolved.kind === "failed") {
-      return { ...base, configError: resolved.reason };
-    }
-    const config = resolved.config;
-    return {
-      ...base,
-      // What the app departs from, and what it adds, are different facts. A DEPARTURE is a
-      // disagreement with an opinion the preset holds; an ADDITION is the app needing
-      // something the preset never claimed, which is the preset working rather than being
-      // worked around.
-      departures: describeDepartures(config, REACT_APP_DEFAULTS),
-      additions: appAdditions(config),
-      resolved: {
-        base: at(config, "base") ?? null,
-        target: at(config, "build", "target") ?? null,
-        sourcemap: at(config, "build", "sourcemap") ?? null,
-        port: at(config, "server", "port") ?? null,
-        // The one number nothing else reports and that no formula predicts: career goes DOWN
-        // to 9998 where the others go up, which is why it is data rather than `port + 1`.
-        hmrPort: at(config, "server", "hmr", "port") ?? null,
-        // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
-        // would bury everything above it. The count is what tells you whether it moved.
-        aliases: countOf(at(config, "resolve", "alias")),
-        // Flattened without a depth limit: Vite lets a plugin be an arbitrarily nested array,
-        // and a magic number here would silently undercount the day someone nests one deeper.
-        plugins: countOf(at(config, "plugins"))
-      }
-    };
   }
   /**
    * Adoption as data, WITHOUT building.
@@ -984,17 +1056,6 @@ var ViteAdapter = class extends ViteRoleAdapter {
     };
   }
 };
-function at(config, ...path) {
-  let value = config;
-  for (const key of path) {
-    if (typeof value !== "object" || value === null) return void 0;
-    value = value[key];
-  }
-  return value;
-}
-function countOf(value) {
-  return Array.isArray(value) ? value.flat(Number.POSITIVE_INFINITY).length : 0;
-}
 
 // src/roles/build/register.ts
 function registerBuild() {
@@ -4180,8 +4241,7 @@ import { join as join23 } from "path";
 // src/roles/lint/eslint-ignores.ts
 import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
 import { join as join21 } from "path";
-var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
-var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
+import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
   return pattern.replace(/^\.\//, "");
@@ -4201,15 +4261,62 @@ function readEslintIgnores(cwd) {
     return { patterns: [], unresolved: [] };
   }
   const patterns = /* @__PURE__ */ new Set();
-  for (const block of IGNORE_BLOCKS) {
-    for (const [, body] of source.matchAll(block)) {
-      for (const [, literal] of (body ?? "").matchAll(STRING_LITERAL)) {
-        if (literal) patterns.add(toOxlintPattern(literal));
+  const unresolved = new Set([...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]));
+  const { program, errors } = parseSync2(config, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return { patterns: [], unresolved: [`${config} could not be parsed`] };
+  }
+  walk(program, (node) => {
+    if (node.type === "CallExpression" && calleeName(node) === "globalIgnores") {
+      for (const literal of stringLiterals(firstArrayArgument(node))) {
+        patterns.add(toOxlintPattern(literal));
       }
+      return;
     }
+    if (node.type !== "ObjectExpression") return;
+    const keys = objectKeys(node);
+    if (!keys.includes("ignores")) return;
+    const values = arrayValues(node, "ignores");
+    if (keys.length > 1) {
+      unresolved.add(
+        `ignores scoped to one config block (with ${keys.filter((k) => k !== "ignores").join(", ")}): ${values.join(", ")} \u2014 exempt from those RULES, not excluded from linting`
+      );
+      return;
+    }
+    for (const literal of values) patterns.add(toOxlintPattern(literal));
+  });
+  return { patterns: [...patterns], unresolved: [...unresolved] };
+}
+function walk(node, visit) {
+  if (!node || typeof node !== "object") return;
+  const current = node;
+  if (typeof current.type === "string") visit(current);
+  for (const key of Object.keys(current)) {
+    const value = current[key];
+    if (Array.isArray(value)) for (const entry of value) walk(entry, visit);
+    else if (value && typeof value === "object") walk(value, visit);
   }
-  const unresolved = [...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]);
-  return { patterns: [...patterns], unresolved: [...new Set(unresolved)] };
+}
+function calleeName(node) {
+  const callee = node.callee;
+  return callee?.type === "Identifier" ? callee.name : void 0;
+}
+function firstArrayArgument(node) {
+  const args = node.arguments ?? [];
+  return args.find((argument) => argument?.type === "ArrayExpression");
+}
+function stringLiterals(array) {
+  const elements = array?.elements ?? [];
+  return elements.filter((element) => element?.type === "Literal" && typeof element.value === "string").map((element) => element.value);
+}
+function objectKeys(node) {
+  const properties = node.properties ?? [];
+  return properties.filter((property) => property?.type === "Property" && !property.computed).map((property) => property.key?.name ?? String(property.key?.value ?? "")).filter(Boolean);
+}
+function arrayValues(node, name) {
+  const properties = node.properties ?? [];
+  const found = properties.find((property) => property.key?.name === name);
+  return stringLiterals(found?.value);
 }
 
 // src/roles/lint/lint-script.ts
@@ -4755,7 +4862,7 @@ ${result.stderr ?? ""}`);
     } else {
       rmSync(baselinePath, { force: true });
     }
-    if (next.length !== current.length || next.some((entry, at2) => entry !== current[at2])) {
+    if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
       writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
 `);
@@ -5717,7 +5824,7 @@ function detectFramework(packageJson) {
 }
 
 // src/core/dispatch.ts
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 
 // src/shared/text.ts
 function ensureLines(current, lines) {
@@ -5776,6 +5883,13 @@ function replaceLines(current, replacements) {
 import { existsSync as existsSync22, readFileSync as readFileSync22, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
+
+// src/shared/deep-merge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve4(cwd);
   const absolutePath = resolve4(root, relativePath);
@@ -6086,7 +6200,7 @@ async function dispatch(opts) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
 `);
     await adapter.afterInit({
-      module: basename2(opts.cwd),
+      module: basename3(opts.cwd),
       cwd: opts.cwd,
       preset,
       ci: false,
@@ -6111,6 +6225,7 @@ export {
   readNxProjectName,
   VERBS,
   TARGETS,
+  LONG_RUNNING_TARGETS,
   SWEEPABLE_TARGETS,
   PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
@@ -6123,4 +6238,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-FLJ2QNFF.js.map
+//# sourceMappingURL=chunk-SA2RMTVI.js.map

package/dist/index.js

@@ -7,8 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-FLJ2QNFF.js";
-import "./chunk-XVDOQ3G3.js";
+} from "./chunk-SA2RMTVI.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/toolchain.d.ts

@@ -0,0 +1,5 @@
+export { default as tailwindcss } from '@tailwindcss/vite';
+export { default as react } from '@vitejs/plugin-react';
+export { nitro } from 'nitro/vite';
+export { default as svgr } from 'vite-plugin-svgr';
+export { Plugin, PluginOption, SassPreprocessorOptions, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';

package/dist/roles/build/toolchain.js

@@ -0,0 +1,16 @@
+// src/roles/build/toolchain.ts
+import { default as default2 } from "@tailwindcss/vite";
+import { default as default3 } from "@vitejs/plugin-react";
+import { nitro } from "nitro/vite";
+import { default as default4 } from "vite-plugin-svgr";
+import { defineConfig, loadEnv, mergeConfig } from "vite";
+export {
+  defineConfig,
+  loadEnv,
+  mergeConfig,
+  nitro,
+  default3 as react,
+  default4 as svgr,
+  default2 as tailwindcss
+};
+//# sourceMappingURL=toolchain.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.1",
+  "version": "1.2.0-alpha.2",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -39,8 +39,8 @@
       "default": "./dist/tsconfig/node.json"
     },
     "./build/react": {
-      "types": "./dist/roles/build/react-app.d.ts",
-      "import": "./dist/roles/build/react-app.js"
+      "types": "./dist/roles/build/toolchain.d.ts",
+      "import": "./dist/roles/build/toolchain.js"
     }
   },
   "files": [
@@ -62,6 +62,7 @@
     "eslint-plugin-styled-components-a11y": "2.2.0",
     "jsonc-parser": "^3.3.1",
     "nitro": "3.0.260415-beta",
+    "oxc-parser": "0.147.0",
     "oxfmt": "0.63.0",
     "oxlint": "1.77.0",
     "oxlint-tsgolint": "7.0.2001",

package/dist/chunk-XVDOQ3G3.js

@@ -1,39 +0,0 @@
-// src/roles/build/presets/requirements.json
-var requirements_default = {
-  svelte: {
-    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
-    requires: {
-      "@sveltejs/vite-plugin-svelte": "7.0.0",
-      svelte: "5.46.4"
-    }
-  }
-};
-
-// src/roles/build/presets/shared.json
-var shared_default = {
-  target: "chrome89",
-  allowedHosts: [".hubpreprod.com", ".playground-hublo.com"],
-  publicAssets: [
-    {
-      dir: "public/branding",
-      baseURL: "/branding",
-      maxAge: 31536e3
-    }
-  ]
-};
-
-// src/roles/build/preset-data.ts
-var REACT_APP_DEFAULTS = shared_default;
-var REQUIREMENTS = requirements_default;
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-export {
-  REACT_APP_DEFAULTS,
-  REQUIREMENTS,
-  isPlainObject
-};
-//# sourceMappingURL=chunk-XVDOQ3G3.js.map

package/dist/roles/build/react-app.d.ts

@@ -1,112 +0,0 @@
-import { PluginOption, UserConfig } from 'vite';
-export { defineConfig, loadEnv } from 'vite';
-
-/** The convention values, in one place so `--inspect` can report what an app departs from. */
-declare const REACT_APP_DEFAULTS: {
-    target: string;
-    allowedHosts: string[];
-    publicAssets: {
-        dir: string;
-        baseURL: string;
-        maxAge: number;
-    }[];
-};
-
-/** Where the router's routes live and where it writes its generated tree. */
-interface RouterPaths {
-    routesDirectory: string;
-    generatedRouteTree: string;
-    /** Extra lines appended to the generated tree. Two of the three apps use it. */
-    routeTreeFileFooter?: string[];
-}
-/**
- * The TanStack factories, supplied by the app.
- *
- * Typed loosely on purpose: sentinel decides WHEN to call them and with what, and has no
- * business asserting their return shape. Narrowing this would only couple sentinel to a
- * version of a package it does not own.
- */
-interface TanstackFactories {
-    start: (options: {
-        router: RouterPaths;
-    }) => PluginOption[];
-    router: (options: RouterPaths & {
-        target: string;
-        autoCodeSplitting: boolean;
-    }) => PluginOption;
-}
-/** Everything an app declares. */
-interface ReactAppOptions {
-    /** The app's own directory. Always `__dirname`. */
-    root: string;
-    /** Vite's `mode`, from the config callback. */
-    mode: string;
-    /** Served under, e.g. `/console/`. */
-    base: string;
-    /** Dev server port. */
-    port: number;
-    /** HMR port. Explicit, NOT `port + 1`: career goes DOWN to 9998 where the others go up. */
-    hmrPort: number;
-    router: RouterPaths;
-    tanstack: TanstackFactories;
-    /**
-     * Sourcemaps: a boolean, however the app decided it.
-     *
-     * The three apps disagree on how — two use a mode allowlist, one reads an env var. That is
-     * an inconsistency in the repo rather than a requirement, and encoding both would make
-     * sentinel the owner of a decision it should not hold.
-     */
-    sourcemap?: boolean;
-    /** Passed through verbatim, never read. See the note above. */
-    alias?: unknown[];
-    /** The app's own plugins (branding, babel). Appended AFTER the base set. */
-    plugins?: PluginOption[];
-    /** Conventions the app may override. */
-    target?: string;
-    allowedHosts?: string[];
-    /**
-     * Anything else this app needs, merged over the preset LAST.
-     *
-     * The preset is a starting point, not a cage. Two things an app must be able to do and
-     * could not before: override a NESTED attribute without losing its siblings, and add an
-     * attribute the preset knows nothing about.
-     *
-     * Objects merge, everything else replaces — see `merge-config` for why arrays replace
-     * rather than concatenate. Whatever lands here is reported by `--inspect --build`, so an
-     * override is a visible, countable decision instead of something found by reading a config.
-     *
-     * Real cases today: console needs `ssr`, `optimizeDeps` and `preview`; career needs
-     * `css.preprocessorOptions` for Sass; all three need their own `nitro.publicAssets`.
-     */
-    overrides?: Record<string, unknown>;
-}
-
-/**
- * The environment, loaded the way all three apps already load it.
- *
- * `production` is normalised to `prd` because that is this repository's deployment tag: it is
- * the `.env.prd` the build reads and the SSM path segment the values come from. Not a
- * preference, a fact about the repo — which is exactly why it belongs in the preset rather
- * than being retyped in every config.
- */
-declare function appEnv(root: string, mode: string): Record<string, string>;
-/** True when this run is a test rather than a real build. */
-declare function isTestMode(mode: string, env?: NodeJS.ProcessEnv): boolean;
-/**
- * The plugin names in the order they run, which is what `--inspect` reports.
- *
- * `extras` is how many plugins the app appends of its own; they are named positionally
- * because sentinel has no way to name a function someone else passed in.
- */
-declare function pluginPlan(isTest: boolean, extras?: number): string[];
-/**
- * The Vite config for a React app, minus the plugins.
- *
- * Pure and separately testable: everything here is data in, data out, so the composition
- * rules can be asserted without a bundler anywhere near the test.
- */
-declare function reactAppConfig(options: ReactAppOptions): Omit<UserConfig, 'plugins'>;
-/** The config an app spreads into `defineConfig`. */
-declare function reactApp(options: ReactAppOptions): UserConfig;
-
-export { REACT_APP_DEFAULTS, type ReactAppOptions, type RouterPaths, type TanstackFactories, appEnv, isTestMode, pluginPlan, reactApp, reactAppConfig };

package/dist/roles/build/react-app.js

@@ -1,126 +0,0 @@
-import {
-  REACT_APP_DEFAULTS,
-  isPlainObject
-} from "../../chunk-XVDOQ3G3.js";
-
-// src/roles/build/react-app.ts
-import tailwindcss from "@tailwindcss/vite";
-import react from "@vitejs/plugin-react";
-import { nitro } from "nitro/vite";
-import { loadEnv } from "vite";
-import svgr from "vite-plugin-svgr";
-
-// src/roles/build/merge-config.ts
-function mergeConfig(base, overrides) {
-  if (!overrides) return base;
-  const out = { ...base };
-  for (const [key, value] of Object.entries(overrides)) {
-    if (value === void 0) {
-      delete out[key];
-      continue;
-    }
-    const current = out[key];
-    out[key] = isPlainObject(current) && isPlainObject(value) ? mergeConfig(current, value) : value;
-  }
-  return out;
-}
-
-// src/roles/build/react-app.ts
-import { defineConfig, loadEnv as loadEnv2 } from "vite";
-function appEnv(root, mode) {
-  return loadEnv(mode === "production" ? "prd" : mode, root, "");
-}
-function isTestMode(mode, env = process.env) {
-  return mode === "test" || env.VITEST === "true";
-}
-function pluginEntries(options, isTest) {
-  const { tanstack, router } = options;
-  return [
-    { name: "tailwindcss", build: () => tailwindcss() },
-    ...isTest ? [
-      {
-        name: "tanstackRouter",
-        build: () => tanstack.router({ ...router, target: "react", autoCodeSplitting: true })
-      }
-    ] : [
-      { name: "tanstackStart", build: () => tanstack.start({ router }) },
-      { name: "nitro", build: () => nitro() }
-    ],
-    { name: "react", build: () => react() },
-    { name: "svgr", build: () => svgr() }
-  ];
-}
-function pluginPlan(isTest, extras = 0) {
-  const entries = pluginEntries(
-    { tanstack: { start: () => [], router: () => null }, router: STUB_ROUTER },
-    isTest
-  );
-  return [
-    ...entries.map((entry) => entry.name),
-    ...Array.from({ length: extras }, (_, at) => `app:${at}`)
-  ];
-}
-var STUB_ROUTER = { routesDirectory: "", generatedRouteTree: "" };
-function basePlugins(options, isTest) {
-  return [
-    ...pluginEntries(options, isTest).flatMap((entry) => entry.build()),
-    ...options.plugins ?? []
-  ];
-}
-function reactAppConfig(options) {
-  const preset = {
-    base: options.base,
-    root: options.root,
-    define: {
-      // Development only. In a build this would leak a browser global into SSR output.
-      ...options.mode === "development" ? { global: "window" } : {}
-    },
-    server: {
-      port: options.port,
-      allowedHosts: options.allowedHosts ?? [...REACT_APP_DEFAULTS.allowedHosts],
-      hmr: { host: "localhost", protocol: "ws", port: options.hmrPort }
-    },
-    build: {
-      target: options.target ?? REACT_APP_DEFAULTS.target,
-      sourcemap: options.sourcemap ?? false
-    },
-    /*
-     * Nitro's two settings are sentinel's, and both were measured across the three apps rather
-     * than assumed.
-     *
-     * `baseURL` is always the app's `base`, without exception: `/console/`, `/` and `/admin/`.
-     * It is derived, so an app cannot get them out of step.
-     *
-     * `publicAssets` is byte-identical in all three — the branding directory, its URL and a
-     * one-year max-age. That is a convention about where branding lives, not data about an
-     * app, and it was sitting in three `overrides` blocks saying the same thing.
-     *
-     * An app that needs MORE from nitro overrides the key: career adds `externals` to keep the
-     * SSR sanitisation chain out of the server bundle. `mergeConfig` merges objects, so adding
-     * one key does not take these two away.
-     */
-    nitro: {
-      baseURL: options.base,
-      publicAssets: [...REACT_APP_DEFAULTS.publicAssets]
-    },
-    ...options.alias ? { resolve: { alias: options.alias } } : {}
-  };
-  return mergeConfig(preset, options.overrides);
-}
-function reactApp(options) {
-  return {
-    ...reactAppConfig(options),
-    plugins: basePlugins(options, isTestMode(options.mode))
-  };
-}
-export {
-  REACT_APP_DEFAULTS,
-  appEnv,
-  defineConfig,
-  isTestMode,
-  loadEnv2 as loadEnv,
-  pluginPlan,
-  reactApp,
-  reactAppConfig
-};
-//# sourceMappingURL=react-app.js.map