@hublo/sentinel 1.2.0-alpha.21 → 1.2.0-alpha.22

package/dist/bin/sentinel.js

@@ -22,7 +22,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-RKVGZNJ7.js";
+} from "../chunk-YBJLWNTQ.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-RKVGZNJ7.js → chunk-YBJLWNTQ.js}

@@ -267,7 +267,8 @@ var toolchain_default = {
         "UserConfig",
         "UserConfigExport"
       ],
-      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck.",
+      floor: "Never below 8.2.2. Vite 8.0.8 resolves rolldown 1.0.0-rc.15, a release candidate whose deferred-module-initialisation codegen is broken: it wrapped a plain re-export barrel in an init helper, then required the module without binding its exports before calling the very function that binding provides. Measured, that crashed 7 of the 8 Nest services with a transformer at their first require (`init_<module> is not defined`), and quietly moved the published contract of 4 others. 8.2.2 resolves rolldown 1.2.6 and all 35 services regenerate their committed OpenAPI document identically. The version is not a preference, it is the floor at which those measurements hold."
     },
     {
       package: "@vitejs/plugin-react",
@@ -956,6 +957,9 @@ function planReactApp(context, configFile) {
       `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
     );
   }
+  notes.push(
+    `this config is code, and it runs before the build does: any environment variable it reads has to be present wherever you build, including a fresh clone, another CI job or an image. Adoption does not change what it reads, but a failure there arrives early and names this role rather than the variable.`
+  );
   return { operations, notes };
 }
 function planNestService(context, webpackTarget) {
@@ -1180,7 +1184,7 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
 };
 
 // src/roles/build/declared-outputs.ts
-import { existsSync as existsSync11, statSync } from "fs";
+import { existsSync as existsSync11, rmSync, statSync, writeFileSync as writeFileSync2 } from "fs";
 import { join as join11 } from "path";
 
 // src/core/workspace-prep.ts
@@ -1350,6 +1354,17 @@ function resolveOutputToken(token, cwd) {
   }
   return join11(cwd, token);
 }
+function buildStamp(cwd) {
+  const marker = join11(cwd, `.sentinel-build-stamp-${process.pid}`);
+  try {
+    writeFileSync2(marker, "");
+    const stamp = statSync(marker).mtimeMs;
+    rmSync(marker, { force: true });
+    return stamp;
+  } catch {
+    return Date.now();
+  }
+}
 function writtenSince(path, startedAt) {
   if (!existsSync11(path)) return false;
   try {
@@ -1420,7 +1435,7 @@ var ViteAdapter = class extends ViteRoleAdapter {
       );
       return { ok: false, code: prerequisite.code };
     }
-    const startedAt = Date.now();
+    const startedAt = buildStamp(ctx.cwd);
     const result = await this.spawnVite(ctx, ready.vite, ["build"], 1);
     if (!result.ok) return result;
     const problem = outputsProblem(ctx.cwd, startedAt);
@@ -2348,7 +2363,7 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync21, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync21, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { join as join27 } from "path";
 
 // src/core/config/deferred-rules.ts
@@ -2885,7 +2900,8 @@ var react_lib_default = {
     {
       name: "storybook",
       specifier: "eslint-plugin-storybook"
-    }
+    },
+    "../plugins/hublo.js"
   ],
   settings: null,
   renames: {
@@ -2894,6 +2910,7 @@ var react_lib_default = {
   rules: {
     curly: ["error", "all"],
     "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
     "jest-dom/prefer-checked": "error",
     "jest-dom/prefer-empty": "error",
     "jest-dom/prefer-enabled-disabled": "error",
@@ -3245,7 +3262,7 @@ var react_lib_default = {
   ],
   uncovered: {
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, which is why the app tier hosts `../plugins/hublo.js`. The library tier enforces none of those rules today, so it hosts nothing.",
+    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, so this tier hosts `../plugins/hublo.js` too. It enforces exactly one of them: `hublo/no-regex-lookbehind`, because a library is where that bug is WRITTEN and it reaches an app tier only by being imported (HUB-43431 shipped from libs/front/components into the worker app). The palette selectors stay app-tier only.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -3309,6 +3326,7 @@ var react_default = {
       severity: "off",
       reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
     },
+    "hublo/no-regex-lookbehind": "error",
     "jest/expect-expect": {
       severity: "off",
       reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
@@ -3795,7 +3813,7 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Two are hosted today: the eight palette selectors as `hublo/no-palette-common`, and the lookbehind selector as `hublo/no-regex-lookbehind`. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -5105,7 +5123,7 @@ ${result.stderr ?? ""}`);
     const measurePath = join27(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
-      writeFileSync2(
+      writeFileSync3(
         measurePath,
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
@@ -5123,7 +5141,7 @@ ${result.stderr ?? ""}`);
         { cwd: ctx.cwd, encoding: "utf8", env, maxBuffer: CAPTURE_MAX_BUFFER }
       );
     } finally {
-      rmSync(measurePath, { force: true });
+      rmSync2(measurePath, { force: true });
     }
     if (measured.error || !(measured.stdout ?? "").includes('"diagnostics"')) {
       process.stderr.write(
@@ -5137,15 +5155,15 @@ ${result.stderr ?? ""}`);
     const holds = holdsFrom(errorCountsByConfigRule(measured.stdout ?? ""));
     const next = extendsWithBaseline(current, holds.length > 0);
     if (holds.length > 0) {
-      writeFileSync2(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      writeFileSync3(baselinePath, renderBaseline(holds, readOwnPackage().version));
       process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
 `);
     } else {
-      rmSync(baselinePath, { force: true });
+      rmSync2(baselinePath, { force: true });
     }
     if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
-      writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
+      writeFileSync3(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
@@ -6161,7 +6179,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync25, readFileSync as readFileSync24, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync24, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -6282,14 +6300,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync3(tempPath, contents);
+  writeFileSync4(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync2(file.absolutePath, { force: true });
+      rmSync3(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -6520,4 +6538,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-RKVGZNJ7.js.map
+//# sourceMappingURL=chunk-YBJLWNTQ.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-RKVGZNJ7.js";
+} from "./chunk-YBJLWNTQ.js";
 export {
   BaseAdapter,
   all,

package/lint/react-lib.json

@@ -58,6 +58,7 @@
       "all"
     ],
     "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
     "jest-dom/prefer-checked": "error",
     "jest-dom/prefer-empty": "error",
     "jest-dom/prefer-enabled-disabled": "error",
@@ -348,7 +349,8 @@
     {
       "name": "storybook",
       "specifier": "eslint-plugin-storybook"
-    }
+    },
+    "../plugins/hublo.js"
   ],
   "overrides": [
     {

package/lint/react.json

@@ -58,6 +58,8 @@
       "all"
     ],
     "for-direction": "error",
+    "hublo/no-palette-common": "off",
+    "hublo/no-regex-lookbehind": "error",
     "jest/expect-expect": "off",
     "jest/no-alias-methods": "off",
     "jest/no-commented-out-tests": "off",
@@ -469,6 +471,7 @@
     {
       "name": "react-refresh",
       "specifier": "eslint-plugin-react-refresh"
-    }
+    },
+    "../plugins/hublo.js"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.21",
+  "version": "1.2.0-alpha.22",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -85,8 +85,7 @@
     "nx": "^23.1.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.9.0",
-    "vitest": "^2.1.0"
+    "typescript": "^5.9.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/plugins/hublo.js

@@ -10,6 +10,12 @@
  * sentinel exists to remove. The cost is that `@hublo/sentinel` carries a rule about Hublo's
  * colour palette, which is honest for a package named after the company.
  *
+ * It now hosts a SECOND, unrelated rule. `no-regex-lookbehind` is not a carried-over selector
+ * but a browser-support rule: regex lookbehind is Safari 16.4+, and unlike everything else a
+ * preset controls it can be neither transpiled nor polyfilled, because no bundler rewrites the
+ * contents of a regex literal. It is here for the same reason as the palette rule — a house
+ * rule is code, not configuration — and because lint is the only layer left that can catch it.
+ *
  * The original selectors, and where each is handled below:
  *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
  *        …[computed=true][property.value='common']                                      theme.palette['common']
@@ -25,6 +31,15 @@ const MESSAGE =
 const COLOUR_PROPS =
   /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
 
+/**
+ * Lookbehind, positive or negative. NOT named groups `(?<name>)`, which Safari has had since
+ * 11.3: the class is exactly `(?<` followed by `=` or `!`.
+ */
+const LOOKBEHIND = /\(\?<[=!]/
+
+const LOOKBEHIND_MESSAGE =
+  'Regex lookbehind ((?<=) / (?<!)) is Safari 16.4+ and can be neither transpiled nor polyfilled: on older iOS the literal is a parse-time SyntaxError that takes the whole chunk with it. Rewrite the pattern. Named groups (?<name>) are fine.'
+
 /** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
 const isCommonPath = (node) =>
   node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
@@ -82,6 +97,59 @@ const plugin = {
         }
       },
     },
+
+    'no-regex-lookbehind': {
+      meta: {
+        docs: {
+          description: 'Ban regex lookbehind, unsupported by Safari below 16.4.',
+        },
+      },
+      create(context) {
+        const report = (node) => context.report({ node, message: LOOKBEHIND_MESSAGE })
+
+        /**
+         * `new RegExp(...)` and `RegExp(...)`, when the pattern is readable statically: a
+         * string, or a template whose fixed parts carry the lookbehind.
+         *
+         * Each template chunk is tested on its own rather than joined. Joining invents a
+         * `(?<=` that the runtime string never has, across an interpolation boundary:
+         * `` `(?<${op}=x)` `` would read as one.
+         */
+        const isStaticLookbehind = (pattern) => {
+          if (pattern?.type === 'Literal') {
+            return typeof pattern.value === 'string' && LOOKBEHIND.test(pattern.value)
+          }
+          if (pattern?.type === 'TemplateLiteral') {
+            return (pattern.quasis ?? []).some((quasi) =>
+              LOOKBEHIND.test(quasi.value?.cooked ?? quasi.value?.raw ?? ''),
+            )
+          }
+          return false
+        }
+
+        const checkRegExpCall = (node) => {
+          if (node.callee?.name !== 'RegExp') {
+            return
+          }
+          const pattern = node.arguments?.[0]
+          if (isStaticLookbehind(pattern)) {
+            report(pattern)
+          }
+        }
+
+        return {
+          // The case that actually breaks a page: a literal is an EARLY error, so the whole
+          // chunk fails to parse rather than the one call site failing.
+          Literal(node) {
+            if (node.regex && LOOKBEHIND.test(node.regex.pattern)) {
+              report(node)
+            }
+          },
+          NewExpression: checkRegExpCall,
+          CallExpression: checkRegExpCall,
+        }
+      },
+    },
   },
 }