@hublo/sentinel 1.2.0-alpha.12 → 1.2.0-alpha.14

package/dist/bin/sentinel.d.ts

@@ -4,3 +4,4 @@ import '@vitejs/plugin-react';
 import 'nitro/vite';
 import 'vite-plugin-svgr';
 import 'vite';
+import 'vitest/config';

package/dist/bin/sentinel.js

@@ -22,7 +22,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-I4ATYZKK.js";
+} from "../chunk-RV34GQVH.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-I4ATYZKK.js → chunk-RV34GQVH.js}

@@ -67,19 +67,6 @@ function resolve(target, preset, runner) {
   return matching[0];
 }
 
-// src/core/base-adapter.ts
-var BaseAdapter = class {
-  inspect(_ctx) {
-    throw new Error(`${this.runner}: --inspect not implemented yet`);
-  }
-  report(_ctx) {
-    throw new Error(`${this.runner}: --report not implemented yet`);
-  }
-  status(_ctx) {
-    throw new Error(`${this.runner}: --status not implemented yet`);
-  }
-};
-
 // src/shared/package-json.ts
 import { existsSync, readFileSync } from "fs";
 import { basename, dirname, join } from "path";
@@ -132,6 +119,19 @@ function moduleName(dir) {
   return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
 }
 
+// src/core/base-adapter.ts
+var BaseAdapter = class {
+  inspect(_ctx) {
+    throw new Error(`${this.runner}: --inspect not implemented yet`);
+  }
+  report(_ctx) {
+    throw new Error(`${this.runner}: --report not implemented yet`);
+  }
+  status(_ctx) {
+    throw new Error(`${this.runner}: --status not implemented yet`);
+  }
+};
+
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
 var TARGETS = [
@@ -165,11 +165,263 @@ function palette(stream) {
   };
 }
 
+// src/roles/build/nest/nx-target.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2, relative } from "path";
+var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
+var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
+var readProjectJson = (cwd) => {
+  const path = join2(cwd, "project.json");
+  if (!existsSync2(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+function webpackBuildTarget(cwd) {
+  const project = readProjectJson(cwd);
+  const target = project?.targets?.build;
+  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
+  const { outputPath, main, webpackConfig } = target.options ?? {};
+  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
+    return void 0;
+  }
+  return {
+    project: project.name,
+    outputPath,
+    main,
+    webpackConfig,
+    configurations: target.configurations
+  };
+}
+function refusalFor(cwd, target) {
+  if (workspaceRootFor(cwd, target) === void 0) {
+    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
+  }
+  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
+    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
+  }
+  const live = liveFileReplacements(cwd, target);
+  if (live.length > 0) {
+    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
+  }
+  return void 0;
+}
+function liveFileReplacements(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) return [];
+  const configurations = target.configurations ?? {};
+  const live = [];
+  for (const configuration of Object.values(configurations)) {
+    for (const replacement of configuration.fileReplacements ?? []) {
+      const exists = existsSync2(join2(workspaceRoot, replacement.replace)) || existsSync2(join2(workspaceRoot, replacement.with));
+      if (exists) live.push(replacement.replace);
+    }
+  }
+  return live;
+}
+function workspaceRootFor(cwd, target) {
+  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
+  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
+  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
+}
+function workspaceRootHops(cwd, target) {
+  const root = workspaceRootFor(cwd, target);
+  if (root === void 0) {
+    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
+  }
+  const rel = relative(root, cwd);
+  return rel === "" ? 0 : rel.split(/[\\/]/).length;
+}
+
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+
+// src/roles/build/presets/requirements.json
+var requirements_default = {
+  svelte: {
+    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
+    requires: {
+      "@sveltejs/vite-plugin-svelte": "7.0.0",
+      svelte: "5.46.4"
+    }
+  }
+};
+
+// src/roles/build/presets/toolchain.json
+var toolchain_default = {
+  $comment: "The build toolchain sentinel owns. One table, because three places used to hold parts of it: the list to remove from a module's package.json, the list of import specifiers to rewrite, and the map from a default import to the name sentinel re-exports it under. A package added to one and not the others gives a removal with no rewrite, or an import pointing at a package the module no longer declares.",
+  owned: [
+    {
+      package: "vite",
+      specifier: "vite",
+      named: ["defineConfig", "loadEnv", "mergeConfig"],
+      types: [
+        "Plugin",
+        "PluginOption",
+        "SassPreprocessorOptions",
+        "UserConfig",
+        "UserConfigExport"
+      ],
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+    },
+    {
+      package: "@vitejs/plugin-react",
+      specifier: "@vitejs/plugin-react",
+      default: "react",
+      why: "the React transform. Bound to the Vite that runs it, so it has to come from the same install."
+    },
+    {
+      package: "@tailwindcss/vite",
+      specifier: "@tailwindcss/vite",
+      default: "tailwindcss",
+      why: "the Tailwind pipeline, identical in all three front apps."
+    },
+    {
+      package: "vite-plugin-svgr",
+      specifier: "vite-plugin-svgr",
+      default: "svgr",
+      why: "SVG as components, identical in all three front apps."
+    },
+    {
+      package: "nitro",
+      specifier: "nitro/vite",
+      named: ["nitro"],
+      why: "the SSR server. Note the package and the import specifier differ, which is exactly the kind of split that made three separate lists disagree."
+    }
+  ],
+  add: [
+    {
+      package: "@hublo/sentinel",
+      why: "the module now gets its toolchain from here, so it declares it. Pinned by the installer rather than by us: `--init` writes the dependency, `pnpm install` resolves it."
+    }
+  ],
+  $notOwned: {
+    "@rolldown/plugin-babel": "declared by career and host-admin themselves, not at the root. It supports LocatorJS, a development convenience gated on LOCATORJS=true, not shared build infrastructure. Removing it would remove a feature from two teams, which is their call and must not ride along inside an adoption.",
+    "@locator/babel-jsx": "same, and same owners.",
+    "@tanstack/react-start": "a framework the apps code against: 48 source files import it directly.",
+    "@tanstack/router-plugin": "generates the app's own route tree.",
+    "vite-bundle-analyzer": "at the root at 1.3.7 and imported nowhere, the only mention being a commented-out line in host-admin. Not a candidate to re-export, a candidate to delete from the root."
+  }
+};
+
+// src/roles/build/preset-data.ts
+var REQUIREMENTS = requirements_default;
+var OWNED_PACKAGES = toolchain_default.owned;
+
+// src/roles/build/config-policy.ts
+var COMPANION_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs"
+];
+var BUILD_CONFIG_FILES = [
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs"
+];
+var BUILD_PRESET_SPECIFIERS = {
+  react: "@hublo/sentinel/build/react",
+  nest: "@hublo/sentinel/build/nest"
+};
+var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
+var BUILD_SCRIPT_NAME = "build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
+var DEV_SCRIPT_NAME = "serve";
+var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
+function buildTarget(configFiles = BUILD_CONFIG_FILES) {
+  return {
+    [BUILD_SCRIPT_NAME]: {
+      cache: true,
+      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)]
+    }
+  };
+}
+var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
+  (entry) => entry.package
+);
+
+// src/roles/build/read-adoption.ts
+var NOT_ADOPTED = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  ownDeclarations: [],
+  unreadable
+});
+function buildConfigFile(cwd) {
+  return BUILD_CONFIG_FILES.find((name) => existsSync3(join3(cwd, name)));
+}
+function importsSpecifier(source, specifier) {
+  const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
+}
+function importsPreset(source) {
+  return Object.values(BUILD_PRESET_SPECIFIERS).some(
+    (specifier) => importsSpecifier(source, specifier)
+  );
+}
+var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
+function declaredBuildPreset(cwd) {
+  const source = readBuildConfigSource(cwd);
+  if (source === void 0) {
+    if (buildConfigFile(cwd) !== void 0) return void 0;
+    return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
+  }
+  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
+  if (importsPreset(source)) return "react";
+  return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
+}
+function readBuildConfigSource(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return void 0;
+  try {
+    return readFileSync3(join3(cwd, configFile), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function readBuildAdoption(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return NOT_ADOPTED(null);
+  let source;
+  try {
+    source = readFileSync3(join3(cwd, configFile), "utf8");
+  } catch (error) {
+    return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
+  }
+  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
+  const manifest = readProjectPackageJson(cwd);
+  const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+  const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
+    (name) => ({ name, version: declared[name] })
+  );
+  return {
+    configFile,
+    // Read from the config rather than assumed: the two presets are adopted the same way and
+    // reporting the wrong one would make `--inspect` lie about what a module builds.
+    preset: declaredBuildPreset(cwd) ?? "react",
+    adopted: true,
+    conformant: ownDeclarations.length === 0,
+    drift: ownDeclarations.map(
+      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
+    ),
+    ownDeclarations,
+    unreadable: null
+  };
+}
+
 // src/roles/build/adapters/vite/vite-role.adapter.ts
 import { spawnSync } from "child_process";
 
 // src/core/config/tool-args.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { isAbsolute, resolve as resolve2 } from "path";
 function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
   const takesValue = new Set(valueFlags);
@@ -179,7 +431,7 @@ function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
   for (const arg of toolArgs) {
     const looksLikeOption = arg.startsWith("-");
     const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
-    if (!previousTakesValue && !looksLikeOption && existsSync2(target)) paths.push(arg);
+    if (!previousTakesValue && !looksLikeOption && existsSync4(target)) paths.push(arg);
     else options.push(arg);
     previousTakesValue = !arg.includes("=") && takesValue.has(arg);
   }
@@ -187,15 +439,15 @@ function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
 }
 
 // src/shared/resolve-bin.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { createRequire } from "module";
-import { delimiter, dirname as dirname2, join as join2 } from "path";
+import { delimiter, dirname as dirname2, join as join4 } from "path";
 var require2 = createRequire(import.meta.url);
 function resolveBin(fromDir, name) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join2(dir, "node_modules", ".bin", name);
-    if (existsSync3(candidate)) return candidate;
+    const candidate = join4(dir, "node_modules", ".bin", name);
+    if (existsSync5(candidate)) return candidate;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -207,8 +459,8 @@ function binFromOwnInstall(packageName, binName) {
     const bin = require2(manifest).bin;
     const relative6 = typeof bin === "string" ? bin : bin?.[binName];
     if (!relative6) return void 0;
-    const executable = join2(dirname2(manifest), relative6);
-    return existsSync3(executable) ? executable : void 0;
+    const executable = join4(dirname2(manifest), relative6);
+    return existsSync5(executable) ? executable : void 0;
   } catch {
     return void 0;
   }
@@ -224,8 +476,8 @@ import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { join as join8 } from "path";
 
 // src/core/config/existing-command.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 
 // src/shared/jsonc.ts
 import { parse, printParseErrorCode } from "jsonc-parser";
@@ -240,11 +492,11 @@ function parseJsonc(text, source = "config") {
 }
 
 // src/core/config/manifest.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { basename as basename2, join as join3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { basename as basename2, join as join5 } from "path";
 function moduleScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(join5(cwd, "package.json"), "utf8"));
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -252,7 +504,7 @@ function moduleScripts(cwd) {
 }
 function moduleName2(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(join5(cwd, "package.json"), "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -272,7 +524,7 @@ function manifestOperation(cwd, scripts) {
     scripts,
     devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
   };
-  if (existsSync4(join3(cwd, "package.json"))) {
+  if (existsSync6(join5(cwd, "package.json"))) {
     return { kind: "merge-json", path: "package.json", value };
   }
   return {
@@ -287,7 +539,7 @@ function nxTargetCommand(cwd, target) {
   let project;
   try {
     project = parseJsonc(
-      readFileSync3(join4(cwd, "project.json"), "utf8"),
+      readFileSync5(join6(cwd, "project.json"), "utf8"),
       "project.json"
     );
   } catch {
@@ -300,193 +552,88 @@ function nxTargetCommand(cwd, target) {
   if (typeof command === "string" && command.trim() !== "") {
     return { command: command.trim(), ranInModule };
   }
-  if (Array.isArray(commands)) {
-    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
-    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
-  }
-  return void 0;
-}
-function rootedForScript(command) {
-  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
-}
-function existingCommand(cwd, target) {
-  const script = moduleScripts(cwd)[target];
-  if (script !== void 0 && script.trim() !== "") return script;
-  const fromTarget = nxTargetCommand(cwd, target);
-  if (fromTarget === void 0) return void 0;
-  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
-}
-
-// src/core/config/nx-target.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
-function nxTargetOperations(options) {
-  const { cwd, targets } = options;
-  const names = Object.keys(targets);
-  if (names.length === 0) return [];
-  const operations = [];
-  if (existsSync5(join5(cwd, "project.json"))) {
-    operations.push({
-      kind: "remove-json-keys",
-      path: "project.json",
-      keys: names.map((name) => ["targets", name])
-    });
-  }
-  operations.push({
-    kind: "merge-json",
-    path: "package.json",
-    value: { nx: { targets } }
-  });
-  return operations;
-}
-
-// src/core/config/tool-script.ts
-var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
-function isSeparatorAt(index) {
-  return index % 2 === 1;
-}
-function invokes(segment, binary) {
-  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
-}
-function isSentinelSegment(segment, roleFlag) {
-  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
-  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
-}
-function composeToolScript(existing, options) {
-  const { command } = options;
-  if (!existing || existing.trim() === "") return command;
-  const { roleFlag } = options;
-  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
-  const parts = existing.split(SEGMENT_SEPARATOR);
-  const commands = parts.filter((_, index) => !isSeparatorAt(index));
-  if (!commands.some(isReplaceable)) return existing;
-  let replacedOnce = false;
-  const rebuilt = parts.map((part, index) => {
-    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
-    if (replacedOnce) return null;
-    replacedOnce = true;
-    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
-  });
-  const kept = [];
-  for (let index = 0; index < rebuilt.length; index += 1) {
-    const part = rebuilt[index];
-    if (part === null) {
-      if (kept.length > 0) kept.pop();
-      continue;
-    }
-    kept.push(part);
-  }
-  return kept.join("").trim();
-}
-function keepsOtherCommands(script, sentinelCommand) {
-  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
-}
-
-// src/roles/build/presets/requirements.json
-var requirements_default = {
-  svelte: {
-    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
-    requires: {
-      "@sveltejs/vite-plugin-svelte": "7.0.0",
-      svelte: "5.46.4"
-    }
-  }
-};
-
-// src/roles/build/presets/toolchain.json
-var toolchain_default = {
-  $comment: "The build toolchain sentinel owns. One table, because three places used to hold parts of it: the list to remove from a module's package.json, the list of import specifiers to rewrite, and the map from a default import to the name sentinel re-exports it under. A package added to one and not the others gives a removal with no rewrite, or an import pointing at a package the module no longer declares.",
-  owned: [
-    {
-      package: "vite",
-      specifier: "vite",
-      named: ["defineConfig", "loadEnv", "mergeConfig"],
-      types: [
-        "Plugin",
-        "PluginOption",
-        "SassPreprocessorOptions",
-        "UserConfig",
-        "UserConfigExport"
-      ],
-      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
-    },
-    {
-      package: "@vitejs/plugin-react",
-      specifier: "@vitejs/plugin-react",
-      default: "react",
-      why: "the React transform. Bound to the Vite that runs it, so it has to come from the same install."
-    },
-    {
-      package: "@tailwindcss/vite",
-      specifier: "@tailwindcss/vite",
-      default: "tailwindcss",
-      why: "the Tailwind pipeline, identical in all three front apps."
-    },
-    {
-      package: "vite-plugin-svgr",
-      specifier: "vite-plugin-svgr",
-      default: "svgr",
-      why: "SVG as components, identical in all three front apps."
-    },
-    {
-      package: "nitro",
-      specifier: "nitro/vite",
-      named: ["nitro"],
-      why: "the SSR server. Note the package and the import specifier differ, which is exactly the kind of split that made three separate lists disagree."
-    }
-  ],
-  add: [
-    {
-      package: "@hublo/sentinel",
-      why: "the module now gets its toolchain from here, so it declares it. Pinned by the installer rather than by us: `--init` writes the dependency, `pnpm install` resolves it."
-    }
-  ],
-  $notOwned: {
-    "@rolldown/plugin-babel": "declared by career and host-admin themselves, not at the root. It supports LocatorJS, a development convenience gated on LOCATORJS=true, not shared build infrastructure. Removing it would remove a feature from two teams, which is their call and must not ride along inside an adoption.",
-    "@locator/babel-jsx": "same, and same owners.",
-    "@tanstack/react-start": "a framework the apps code against: 48 source files import it directly.",
-    "@tanstack/router-plugin": "generates the app's own route tree.",
-    "vite-bundle-analyzer": "at the root at 1.3.7 and imported nowhere, the only mention being a commented-out line in host-admin. Not a candidate to re-export, a candidate to delete from the root."
+  if (Array.isArray(commands)) {
+    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
+    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
   }
-};
+  return void 0;
+}
+function rootedForScript(command) {
+  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
+}
+function existingCommand(cwd, target) {
+  const script = moduleScripts(cwd)[target];
+  if (script !== void 0 && script.trim() !== "") return script;
+  const fromTarget = nxTargetCommand(cwd, target);
+  if (fromTarget === void 0) return void 0;
+  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+}
 
-// src/roles/build/preset-data.ts
-var REQUIREMENTS = requirements_default;
-var OWNED_PACKAGES = toolchain_default.owned;
+// src/core/config/nx-target.ts
+import { existsSync as existsSync7 } from "fs";
+import { join as join7 } from "path";
+function nxTargetMetadataOperations(options) {
+  const { targets } = options;
+  if (Object.keys(targets).length === 0) return [];
+  return [{ kind: "merge-json", path: "package.json", value: { nx: { targets } } }];
+}
+function nxTargetOperations(options) {
+  const { cwd, targets } = options;
+  const names = Object.keys(targets);
+  if (names.length === 0) return [];
+  const operations = [];
+  if (existsSync7(join7(cwd, "project.json"))) {
+    operations.push({
+      kind: "remove-json-keys",
+      path: "project.json",
+      keys: names.map((name) => ["targets", name])
+    });
+  }
+  operations.push(...nxTargetMetadataOperations(options));
+  return operations;
+}
 
-// src/roles/build/config-policy.ts
-var COMPANION_CONFIG_FILES = [
-  "vitest.config.ts",
-  "vitest.config.mts",
-  "vitest.config.js",
-  "vitest.config.mjs"
-];
-var BUILD_CONFIG_FILES = [
-  "vite.config.ts",
-  "vite.config.mts",
-  "vite.config.js",
-  "vite.config.mjs"
-];
-var BUILD_PRESET_SPECIFIERS = {
-  react: "@hublo/sentinel/build/react",
-  nest: "@hublo/sentinel/build/nest"
-};
-var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
-var BUILD_SCRIPT_NAME = "build";
-var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
-var DEV_SCRIPT_NAME = "serve";
-var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
-function buildTarget() {
-  return {
-    [BUILD_SCRIPT_NAME]: {
-      cache: true,
-      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
+// src/core/config/tool-script.ts
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function invokes(segment, binary) {
+  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
+}
+function isSentinelSegment(segment, roleFlag) {
+  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
+  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
+}
+function composeToolScript(existing, options) {
+  const { command } = options;
+  if (!existing || existing.trim() === "") return command;
+  const { roleFlag } = options;
+  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isReplaceable)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
     }
-  };
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script, sentinelCommand) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
-var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
-  (entry) => entry.package
-);
 
 // src/roles/build/dev-script.ts
 var CHAIN = " -- ";
@@ -510,78 +657,6 @@ function composeDevScript(existing, command) {
 
 // src/roles/build/nest/adopt.ts
 import { relative as relative2 } from "path";
-
-// src/roles/build/nest/nx-target.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join6, relative } from "path";
-var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
-var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
-var readProjectJson = (cwd) => {
-  const path = join6(cwd, "project.json");
-  if (!existsSync6(path)) return void 0;
-  try {
-    return JSON.parse(readFileSync4(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-};
-function webpackBuildTarget(cwd) {
-  const project = readProjectJson(cwd);
-  const target = project?.targets?.build;
-  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
-  const { outputPath, main, webpackConfig } = target.options ?? {};
-  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
-    return void 0;
-  }
-  return {
-    project: project.name,
-    outputPath,
-    main,
-    webpackConfig,
-    configurations: target.configurations
-  };
-}
-function refusalFor(cwd, target) {
-  if (workspaceRootFor(cwd, target) === void 0) {
-    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
-  }
-  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
-    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
-  }
-  const live = liveFileReplacements(cwd, target);
-  if (live.length > 0) {
-    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
-  }
-  return void 0;
-}
-function liveFileReplacements(cwd, target) {
-  const workspaceRoot = workspaceRootFor(cwd, target);
-  if (workspaceRoot === void 0) return [];
-  const configurations = target.configurations ?? {};
-  const live = [];
-  for (const configuration of Object.values(configurations)) {
-    for (const replacement of configuration.fileReplacements ?? []) {
-      const exists = existsSync6(join6(workspaceRoot, replacement.replace)) || existsSync6(join6(workspaceRoot, replacement.with));
-      if (exists) live.push(replacement.replace);
-    }
-  }
-  return live;
-}
-function workspaceRootFor(cwd, target) {
-  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
-  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
-  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
-}
-function workspaceRootHops(cwd, target) {
-  const root = workspaceRootFor(cwd, target);
-  if (root === void 0) {
-    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
-  }
-  const rel = relative(root, cwd);
-  return rel === "" ? 0 : rel.split(/[\\/]/).length;
-}
-
-// src/roles/build/nest/adopt.ts
 var NEST_CONFIG_FILE = "vite.config.mts";
 function nestConfigSource(cwd, target) {
   const hops = workspaceRootHops(cwd, target);
@@ -628,80 +703,6 @@ function nestAdoptionOperations(cwd, target) {
   ];
 }
 
-// src/roles/build/read-adoption.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
-var NOT_ADOPTED = (configFile, unreadable = null) => ({
-  configFile,
-  preset: null,
-  adopted: false,
-  conformant: false,
-  drift: [],
-  ownDeclarations: [],
-  unreadable
-});
-function buildConfigFile(cwd) {
-  return BUILD_CONFIG_FILES.find((name) => existsSync7(join7(cwd, name)));
-}
-function importsSpecifier(source, specifier) {
-  const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
-}
-function importsPreset(source) {
-  return Object.values(BUILD_PRESET_SPECIFIERS).some(
-    (specifier) => importsSpecifier(source, specifier)
-  );
-}
-var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
-function declaredBuildPreset(cwd) {
-  const source = readBuildConfigSource(cwd);
-  if (source === void 0) {
-    if (buildConfigFile(cwd) !== void 0) return void 0;
-    return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
-  }
-  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
-  if (importsPreset(source)) return "react";
-  return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
-}
-function readBuildConfigSource(cwd) {
-  const configFile = buildConfigFile(cwd);
-  if (!configFile) return void 0;
-  try {
-    return readFileSync5(join7(cwd, configFile), "utf8");
-  } catch {
-    return void 0;
-  }
-}
-function readBuildAdoption(cwd) {
-  const configFile = buildConfigFile(cwd);
-  if (!configFile) return NOT_ADOPTED(null);
-  let source;
-  try {
-    source = readFileSync5(join7(cwd, configFile), "utf8");
-  } catch (error) {
-    return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
-  }
-  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
-  const manifest = readProjectPackageJson(cwd);
-  const declared = { ...manifest.dependencies, ...manifest.devDependencies };
-  const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
-    (name) => ({ name, version: declared[name] })
-  );
-  return {
-    configFile,
-    // Read from the config rather than assumed: the two presets are adopted the same way and
-    // reporting the wrong one would make `--inspect` lie about what a module builds.
-    preset: declaredBuildPreset(cwd) ?? "react",
-    adopted: true,
-    conformant: ownDeclarations.length === 0,
-    drift: ownDeclarations.map(
-      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
-    ),
-    ownDeclarations,
-    unreadable: null
-  };
-}
-
 // src/roles/build/requirements.ts
 function atLeast(declared, needed) {
   const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -730,32 +731,31 @@ function describeUnmet(preset, unmet) {
   return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
 }
 
-// src/roles/build/rewrite-imports.ts
+// src/core/config/rewrite-imports.ts
 import { parseSync } from "oxc-parser";
-var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
+var movedSpecifiers = (toolchain) => new Set(toolchain.owned.map((entry) => entry.specifier));
 function esmBlocker(fileName, packageType) {
   if (/\.(mts|mjs)$/.test(fileName)) return void 0;
   if (packageType === "module") return void 0;
   return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
 }
-var DEFAULT_EXPORT_NAMES = Object.fromEntries(
-  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
-    entry.specifier,
-    entry.default
-  ])
+var defaultExportNames = (toolchain) => Object.fromEntries(
+  toolchain.owned.filter((entry) => entry.default !== void 0).map((entry) => [entry.specifier, entry.default])
 );
-function renderImport(bindings) {
+function renderImport(bindings, presetSpecifier) {
   const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
   const values = bindings.filter((b) => !b.typeOnly);
   const types = bindings.filter((b) => b.typeOnly);
   const lines = [];
-  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${presetSpecifier}'`);
   if (types.length > 0) {
-    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+    lines.push(`import type { ${render(types)} } from '${presetSpecifier}'`);
   }
   return lines.join("\n");
 }
-function rewriteBuildImports(source, fileName = "vite.config.ts") {
+function rewriteToolchainImports(toolchain, source, fileName) {
+  const moved = movedSpecifiers(toolchain);
+  const defaults = defaultExportNames(toolchain);
   const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
   if (errors.length > 0) {
     return {
@@ -766,10 +766,10 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   const imports = program.body.filter(
     (node) => node.type === "ImportDeclaration"
   );
-  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+  if (imports.some((node) => node.source.value === toolchain.presetSpecifier)) {
     return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
   }
-  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  const moving = imports.filter((node) => moved.has(node.source.value));
   if (moving.length === 0) {
     return {
       kind: "unchanged",
@@ -786,7 +786,7 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     for (const spec of specifiers) {
       const typeOnly = node.importKind === "type" || spec.importKind === "type";
       if (spec.type === "ImportDefaultSpecifier") {
-        const exported = DEFAULT_EXPORT_NAMES[from];
+        const exported = defaults[from];
         if (!exported) {
           return {
             kind: "blocked",
@@ -818,7 +818,7 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
     out = out.slice(0, span.start) + out.slice(span.end + after);
   }
-  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  out = out.slice(0, first.start) + renderImport(bindings, toolchain.presetSpecifier) + out.slice(first.end);
   return {
     kind: "rewritten",
     source: out,
@@ -826,6 +826,15 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   };
 }
 
+// src/roles/build/rewrite-imports.ts
+var BUILD_TOOLCHAIN = {
+  presetSpecifier: BUILD_PRESET_SPECIFIER,
+  owned: OWNED_PACKAGES
+};
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  return rewriteToolchainImports(BUILD_TOOLCHAIN, source, fileName);
+}
+
 // src/roles/build/plan.ts
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
@@ -889,7 +898,7 @@ function plan(context) {
   if (configFile === void 0) {
     return {
       operations: [],
-      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (36 services here build through \`@nx/webpack\`), the build role does not apply to it.`
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through \`@nx/webpack\`), the build role does not apply to it.`
     };
   }
   return planReactApp(context, configFile);
@@ -949,7 +958,16 @@ function planNestService(context, configFile, webpackTarget) {
   if (refusal !== void 0) return { operations: [], blocked: refusal };
   const dropped = Object.keys(webpackTarget.configurations ?? {});
   return {
-    operations: nestAdoptionOperations(context.cwd, webpackTarget),
+    operations: [
+      ...nestAdoptionOperations(context.cwd, webpackTarget),
+      // The same nx metadata the React path writes, and for the same reason: declaring `inputs`
+      // at all REPLACES nx's default `['default','^default']`, so a target that declares none
+      // runs on defaults while every other target this module has declares them. The Nest path
+      // wrote none, which left its build the one target that could replay a stale bundle after a
+      // dependency changed. One name, because a Nest service's config can only be `.mts`.
+      ...nxTargetMetadataOperations({ cwd: context.cwd, targets: buildTarget([NEST_CONFIG_FILE]) }),
+      manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND })
+    ],
     notes: [
       `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
       ...dropped.length > 0 ? [
@@ -1003,7 +1021,7 @@ var ViteRoleAdapter = class extends BaseAdapter {
    * which tells nobody what to do about it.
    *
    * Nest it now serves too, through `@hublo/sentinel/build/nest`. It used to be declined on the
-   * grounds that "there is nothing to bundle", which was never true: those 36 services bundle
+   * grounds that "there is nothing to bundle", which was never true: those 38 services bundle
    * with webpack. What changed is that Nx v24 removes the `@nx/webpack:webpack` executor and
    * the `composePlugins` / `withNx` helpers their shared config is built on, and nx's own
    * migration generator refuses every one of them because they use `@nx/js:node`
@@ -1112,6 +1130,12 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
    * wrong correction, it added friction to a command that already produced the right result.
    */
   plan(context) {
+    if (declaredBuildPreset(context.cwd) === "nest" || webpackBuildTarget(context.cwd)) {
+      return {
+        operations: [],
+        skipped: `a Nest service has no dev server, so --dev has nothing to adopt here. Its build is \`sentinel --init --build\`, and it runs as a Node process afterwards.`
+      };
+    }
     const planned = super.plan(context);
     if (planned.operations.length === 0) return planned;
     return {
@@ -6412,12 +6436,12 @@ export {
   declaredPresetFor,
   availableTargets,
   resolve,
-  BaseAdapter,
-  resolveBin,
   readOwnVersion,
   readProjectPackageJson,
   moduleName,
   buildConfigFile,
+  BaseAdapter,
+  resolveBin,
   VERBS,
   TARGETS,
   LONG_RUNNING_TARGETS,
@@ -6433,4 +6457,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-I4ATYZKK.js.map
+//# sourceMappingURL=chunk-RV34GQVH.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-I4ATYZKK.js";
+} from "./chunk-RV34GQVH.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/test/react/toolchain.d.ts

@@ -0,0 +1,2 @@
+export { ConfigEnv, TestUserConfig, ViteUserConfig, defineConfig, mergeConfig } from 'vitest/config';
+export { loadEnv } from 'vite';

package/dist/roles/test/react/toolchain.js

@@ -0,0 +1,9 @@
+// src/roles/test/react/toolchain.ts
+import { defineConfig, mergeConfig } from "vitest/config";
+import { loadEnv } from "vite";
+export {
+  defineConfig,
+  loadEnv,
+  mergeConfig
+};
+//# sourceMappingURL=toolchain.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.12",
+  "version": "1.2.0-alpha.14",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -45,6 +45,10 @@
     "./build/nest": {
       "types": "./dist/roles/build/nest/toolchain.d.ts",
       "import": "./dist/roles/build/nest/toolchain.js"
+    },
+    "./test/react": {
+      "types": "./dist/roles/test/react/toolchain.d.ts",
+      "import": "./dist/roles/test/react/toolchain.js"
     }
   },
   "files": [
@@ -72,7 +76,8 @@
     "oxlint-tsgolint": "7.0.2001",
     "typescript": "5.9.3",
     "vite": "8.0.8",
-    "vite-plugin-svgr": "5.2.0"
+    "vite-plugin-svgr": "5.2.0",
+    "vitest": "4.1.4"
   },
   "devDependencies": {
     "@hublo/sentinel": "link:.",