@hublo/sentinel 1.2.0-alpha.18 → 1.2.0-alpha.19

package/dist/bin/sentinel.js

@@ -22,7 +22,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-MJ3S7LQT.js";
+} from "../chunk-RKVGZNJ7.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-MJ3S7LQT.js → chunk-RKVGZNJ7.js}

@@ -183,7 +183,7 @@ function webpackBuildTarget(cwd) {
   const project = readProjectJson(cwd);
   const target = project?.targets?.build;
   if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
-  const { outputPath, main, webpackConfig } = target.options ?? {};
+  const { outputPath, main, webpackConfig, transformers, assets } = target.options ?? {};
   if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
     return void 0;
   }
@@ -192,7 +192,9 @@ function webpackBuildTarget(cwd) {
     outputPath,
     main,
     webpackConfig,
-    configurations: target.configurations
+    configurations: target.configurations,
+    transformers,
+    assets
   };
 }
 function refusalFor(cwd, target) {
@@ -673,6 +675,8 @@ var NEST_CONFIG_FILE = "vite.config.mts";
 function nestConfigSource(cwd, target) {
   const hops = workspaceRootHops(cwd, target);
   const up = Array.from({ length: hops }, () => "..").join("/");
+  const carried = (name, value) => value === void 0 || value.length === 0 ? "" : `  ${name}: ${JSON.stringify(value)},
+`;
   return `import path from 'node:path'
 
 import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
@@ -682,7 +686,7 @@ export default nestService({
   root: __dirname,
   workspaceRoot: path.resolve(__dirname, '${up}'),
   outDir: '${target.outputPath}',
-})
+${carried("transformers", target.transformers)}${carried("assets", target.assets)}})
 `;
 }
 function nestBuildOutputs(target) {
@@ -6516,4 +6520,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-MJ3S7LQT.js.map
+//# sourceMappingURL=chunk-RKVGZNJ7.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-MJ3S7LQT.js";
+} from "./chunk-RKVGZNJ7.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -1,6 +1,20 @@
 import { UserConfig, Plugin } from 'vite';
 export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
 
+/** A transformer as the target declares it, passed through to the config unchanged. */
+interface TransformerDeclaration$1 {
+    name: string;
+    options?: Record<string, unknown>;
+}
+/** An asset as the target declares it, in `@nx/webpack`'s own shape. */
+interface AssetDeclaration {
+    glob: string;
+    /** Relative to the workspace root, as the target declares it. */
+    input: string;
+    /** Relative to the output directory. */
+    output: string;
+}
+
 interface NestServiceOptions {
     /** The nx project name. Keys the dependency graph, and names the module in messages. */
     project: string;
@@ -18,6 +32,23 @@ interface NestServiceOptions {
     tsconfig?: string;
     /** Output directory, relative to `workspaceRoot`. */
     outDir?: string;
+    /**
+     * TypeScript transformers this service compiles with, as its build target declared them.
+     *
+     * Read off the webpack target by `--init` and written here, never inferred: what a service
+     * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,
+     * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building
+     * without it succeeds and silently costs them most of their published contract (measured on
+     * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).
+     */
+    transformers?: readonly TransformerDeclaration$1[];
+    /**
+     * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.
+     *
+     * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders
+     * printed documents from. Without them the service starts and fails on its first print.
+     */
+    assets?: readonly AssetDeclaration[];
     /**
      * Anything this service needs that the shape does not give it.
      *
@@ -29,6 +60,13 @@ interface NestServiceOptions {
 }
 declare const nestService: (options: NestServiceOptions) => UserConfig;
 
+/** A TypeScript transformer a service runs at build time, as its build target declares it. */
+interface TransformerDeclaration {
+    /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */
+    name: string;
+    /** Passed to the transformer's own factory, unread here. */
+    options?: Record<string, unknown>;
+}
 interface DecoratorMetadataOptions {
     /** The module being built. Its tsconfig is the one whose emit must be preserved. */
     root: string;
@@ -38,6 +76,8 @@ interface DecoratorMetadataOptions {
      * Relative paths resolve against `root`.
      */
     tsconfig?: string;
+    /** The transformers this service declared, translated from its webpack target. */
+    transformers?: readonly TransformerDeclaration[];
 }
 declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
 

package/dist/roles/build/nest/toolchain.js

@@ -1,37 +1,121 @@
 // src/roles/build/nest/nest-service.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { mergeConfig } from "vite";
 
+// src/roles/build/nest/copy-assets.ts
+import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+import { dirname, join, relative, sep } from "path";
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let index = 0; index < glob.length; index++) {
+    const char = glob[index] ?? "";
+    if (char === "*") {
+      if (glob[index + 1] === "*") {
+        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
+        index += glob[index + 2] === "/" ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "{") {
+      const close = glob.indexOf("}", index);
+      if (close === -1)
+        throw new Error(`sentinel build(nest): unbalanced \`{\` in asset glob ${glob}`);
+      const alternatives = glob.slice(index + 1, close).split(",");
+      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+      index = close;
+      continue;
+    }
+    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function filesUnder(root) {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      if (statSync(full).isDirectory()) walk(full);
+      else found.push(relative(root, full).split(sep).join("/"));
+    }
+  };
+  walk(root);
+  return found;
+}
+function resolveAssets(options) {
+  const copies = [];
+  for (const asset of options.assets) {
+    const input = join(options.workspaceRoot, asset.input);
+    if (!existsSync(input)) {
+      throw new Error(
+        `sentinel build(nest): the build target declares an asset from \`${asset.input}\`, which does not exist. webpack copied it into the output, so the built service would be missing files it reads at runtime.`
+      );
+    }
+    const matcher = globToRegExp(asset.glob);
+    const matched = filesUnder(input).filter((file) => matcher.test(file));
+    if (matched.length === 0) {
+      throw new Error(
+        `sentinel build(nest): the asset glob \`${asset.glob}\` under \`${asset.input}\` matches no file. An entry that matches nothing is the same silent loss as no entry at all.`
+      );
+    }
+    for (const file of matched) {
+      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) });
+    }
+  }
+  return copies;
+}
+var copyAssets = (options) => ({
+  name: "sentinel:copy-assets",
+  // After the bundle is written and the output directory has stopped being emptied.
+  closeBundle() {
+    for (const { from, to } of resolveAssets(options)) {
+      mkdirSync(dirname(to), { recursive: true });
+      cpSync(from, to);
+    }
+  }
+});
+
 // src/roles/build/nest/decorator-metadata.ts
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
+import { createRequire } from "module";
 import path from "path";
-import ts from "typescript";
 var TYPESCRIPT_SOURCE = /\.ts$/;
 var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
-var assertCompilerApi = () => {
-  if (typeof ts.transpileModule === "function") return;
-  throw new Error(
-    `sentinel build(nest): the resolved typescript (${ts.version ?? "unknown version"}) has no transpileModule API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Sentinel pins its own compiler, so this means one was substituted, usually by a pnpm override or an alias on \`typescript\`.`
-  );
-};
-var resolveTsconfig = (options) => {
+function loadCompiler(root) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  let compiler;
+  try {
+    compiler = require2("typescript");
+  } catch {
+    throw new Error(
+      `sentinel build(nest): no \`typescript\` resolvable from ${root}. The build emits decorator metadata with the module's own compiler, so one has to be installed there.`
+    );
+  }
+  if (typeof compiler.createProgram !== "function") {
+    throw new Error(
+      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? "unknown"}) has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Point this module's \`typescript\` at a compiler with an emit API, which is the one its \`typecheck\` target already uses.`
+    );
+  }
+  return compiler;
+}
+function resolveTsconfig(options) {
   if (options.tsconfig) {
     const explicit = path.resolve(options.root, options.tsconfig);
-    if (!existsSync(explicit)) {
+    if (!existsSync2(explicit)) {
       throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
     }
     return explicit;
   }
   for (const candidate of TSCONFIG_CANDIDATES) {
     const found = path.join(options.root, candidate);
-    if (existsSync(found)) return found;
+    if (existsSync2(found)) return found;
   }
   throw new Error(
     `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
   );
-};
-var readCompilerOptions = (options) => {
-  assertCompilerApi();
+}
+function readConfig(ts, options) {
   const configPath = resolveTsconfig(options);
   const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
     ...ts.sys,
@@ -42,53 +126,111 @@ var readCompilerOptions = (options) => {
     }
   });
   return {
-    ...parsed?.options,
-    // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
-    // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
-    module: ts.ModuleKind.ESNext,
-    // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
-    sourceMap: true,
-    inlineSourceMap: false,
-    inlineSources: false,
-    // Types are another target's job, and `transpileModule` could not emit them anyway.
-    declaration: false,
-    declarationMap: false,
-    emitDeclarationOnly: false,
-    noEmit: false,
-    // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
-    // incremental build here to inform.
-    composite: false,
-    incremental: false
+    fileNames: parsed?.fileNames ?? [],
+    compilerOptions: {
+      ...parsed?.options,
+      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
+      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
+      module: ts.ModuleKind.ESNext,
+      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
+      sourceMap: true,
+      inlineSourceMap: false,
+      inlineSources: false,
+      // Types are another target's job, and emitting them here would write into the source tree.
+      declaration: false,
+      declarationMap: false,
+      emitDeclarationOnly: false,
+      noEmit: false,
+      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
+      // incremental build here to inform.
+      composite: false,
+      incremental: false
+    }
   };
-};
+}
+function loadTransformers(root, program, declared) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  return declared.map(({ name, options }) => {
+    let loaded;
+    try {
+      loaded = require2(name);
+    } catch (error) {
+      throw new Error(
+        `sentinel build(nest): the build target declares the transformer \`${name}\`, which cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+    if (typeof loaded.before !== "function") {
+      throw new Error(
+        `sentinel build(nest): \`${name}\` exports no \`before\` factory, so it cannot run as a TypeScript transformer. Building without it would drop whatever it contributes.`
+      );
+    }
+    const factory = loaded.before;
+    return factory(options, program);
+  });
+}
 var decoratorMetadata = (options) => {
+  let ts;
+  let program;
   let compilerOptions;
+  let before = [];
+  const withoutTypes = [];
   return {
     name: "sentinel:decorator-metadata",
-    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle.
+    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so
+    // the source this plugin reads from the Program is still the source on disk.
     enforce: "pre",
     buildStart() {
-      compilerOptions = readCompilerOptions(options);
+      ts = loadCompiler(options.root);
+      const config = readConfig(ts, options);
+      compilerOptions = config.compilerOptions;
+      program = ts.createProgram(config.fileNames, config.compilerOptions);
+      before = loadTransformers(options.root, program, options.transformers ?? []);
     },
     transform(code, id) {
-      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) {
-        return null;
-      }
-      if (compilerOptions === void 0) {
+      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) return null;
+      if (ts === void 0 || program === void 0 || compilerOptions === void 0) {
         throw new Error(
-          `sentinel build(nest): compiler options were never read, so ${id} would be transpiled with defaults rather than this module's tsconfig.`
+          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with defaults rather than this module's tsconfig.`
         );
       }
-      const output = ts.transpileModule(code, { fileName: id, compilerOptions });
-      return { code: output.outputText, map: output.sourceMapText ?? null };
+      const sourceFile = program.getSourceFile(id);
+      if (sourceFile === void 0 || sourceFile.text !== code) {
+        withoutTypes.push(id);
+        const output = ts.transpileModule(code, { fileName: id, compilerOptions });
+        return { code: output.outputText, map: output.sourceMapText ?? null };
+      }
+      let emitted;
+      let map;
+      program.emit(
+        sourceFile,
+        (fileName, text) => {
+          if (fileName.endsWith(".map")) map = text;
+          else emitted = text;
+        },
+        void 0,
+        false,
+        { before }
+      );
+      if (emitted === void 0) {
+        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`);
+      }
+      return { code: emitted, map: map ?? null };
+    },
+    closeBundle() {
+      if (withoutTypes.length === 0) return;
+      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file));
+      this.warn(
+        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type information, so their decorator metadata may differ from what ts-loader produced (${shown.join(", ")}${withoutTypes.length > shown.length ? ", \u2026" : ""}). They are outside this module's tsconfig, or another plugin rewrote them first.`
+      );
     }
   };
 };
 
 // src/roles/build/nest/node-manifest.ts
-import { existsSync as existsSync2, writeFileSync } from "fs";
+import { existsSync as existsSync3, writeFileSync } from "fs";
 import { isBuiltin } from "module";
-import { join } from "path";
+import { join as join2 } from "path";
 var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
 var externalPackages = (bundle) => {
   const emitted = new Set(Object.keys(bundle));
@@ -116,7 +258,7 @@ var nodeManifest = (options) => {
     },
     async closeBundle() {
       const entry = options.entry ?? "main.js";
-      if (!existsSync2(join(options.outDir, entry))) return;
+      if (!existsSync3(join2(options.outDir, entry))) return;
       const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
       const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
       const graph = await createProjectGraphAsync({ exitOnError: false });
@@ -131,10 +273,10 @@ var nodeManifest = (options) => {
         );
       }
       assertManifestCovers(required, manifest, options);
-      writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+      writeFileSync(join2(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
 `);
       writeFileSync(
-        join(options.outDir, getLockFileName("pnpm")),
+        join2(options.outDir, getLockFileName("pnpm")),
         createLockFile(manifest, graph, "pnpm")
       );
     }
@@ -152,17 +294,17 @@ var assertManifestCovers = (required, manifest, options) => {
 
 // src/roles/build/nest/tsconfig-aliases.ts
 import { readFileSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
 var toAlias = (workspaceRoot, pattern, target) => {
   const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
   return {
     find: new RegExp(`^${escaped}$`),
-    replacement: join2(workspaceRoot, target.replace(/\*/g, "$1"))
+    replacement: join3(workspaceRoot, target.replace(/\*/g, "$1"))
   };
 };
 var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
-  const raw = readFileSync(join2(workspaceRoot, file), "utf8");
+  const raw = readFileSync(join3(workspaceRoot, file), "utf8");
   const { compilerOptions } = JSON.parse(stripLineComments(raw));
   return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
     const [target] = targets;
@@ -172,11 +314,16 @@ var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
 
 // src/roles/build/nest/nest-service.ts
 var baseConfig = (options) => {
-  const outDir = join3(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
-  const entry = join3(options.root, options.entry ?? "src/main.ts");
+  const outDir = join4(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join4(options.root, options.entry ?? "src/main.ts");
   return {
     plugins: [
-      decoratorMetadata({ root: options.root, tsconfig: options.tsconfig }),
+      decoratorMetadata({
+        root: options.root,
+        tsconfig: options.tsconfig,
+        transformers: options.transformers
+      }),
+      ...options.assets?.length ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })] : [],
       nodeManifest({
         project: options.project,
         workspaceRoot: options.workspaceRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.18",
+  "version": "1.2.0-alpha.19",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",