@hublo/sentinel 1.2.0-alpha.3 → 1.2.0-alpha.5

package/dist/bin/sentinel.js

@@ -21,7 +21,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-YZ4EKBK7.js";
+} from "../chunk-XPWM77PB.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-YZ4EKBK7.js → chunk-XPWM77PB.js}

@@ -467,9 +467,13 @@ var BUILD_CONFIG_FILES = [
   "vite.config.js",
   "vite.config.mjs"
 ];
-var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_PRESET_SPECIFIERS = {
+  react: "@hublo/sentinel/build/react",
+  nest: "@hublo/sentinel/build/nest"
+};
+var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
 var BUILD_SCRIPT_NAME = "build";
-var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
 function buildTarget() {
@@ -524,12 +528,15 @@ function importsSpecifier(source, specifier) {
   return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
 }
 function importsPreset(source) {
-  return importsSpecifier(source, BUILD_PRESET_SPECIFIER);
+  return Object.values(BUILD_PRESET_SPECIFIERS).some(
+    (specifier) => importsSpecifier(source, specifier)
+  );
 }
 var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
   const source = readBuildConfigSource(cwd);
   if (source === void 0) return void 0;
+  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
   if (importsPreset(source)) return "react";
   return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
 }
@@ -559,7 +566,9 @@ function readBuildAdoption(cwd) {
   );
   return {
     configFile,
-    preset: "react",
+    // Read from the config rather than assumed: the two presets are adopted the same way and
+    // reporting the wrong one would make `--inspect` lie about what a module builds.
+    preset: declaredBuildPreset(cwd) ?? "react",
     adopted: true,
     conformant: ownDeclarations.length === 0,
     drift: ownDeclarations.map(
@@ -726,7 +735,9 @@ function buildScripts(cwd) {
     const own2 = moduleName(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
-      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
+      // Trailing `--` for the same reason as the build script: whatever the caller appends
+      // reaches Vite, not sentinel's parser. It goes after `--module`, which is sentinel's own.
+      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2} --`
     );
   }
   return scripts;
@@ -840,11 +851,17 @@ var ViteRoleAdapter = class extends BaseAdapter {
    * resolution let it run at all — filtering here would give "no adapter for preset svelte",
    * which tells nobody what to do about it.
    *
-   * Nest, node and tools are genuinely declined: there is nothing to bundle, and no version
-   * would change that.
+   * Nest it now serves too, through `@hublo/sentinel/build/nest`. It used to be declined on the
+   * grounds that "there is nothing to bundle", which was never true: those 38 services bundle
+   * with webpack. What changed is that Nx v24 removes the `@nx/webpack:webpack` executor and
+   * the `composePlugins` / `withNx` helpers their shared config is built on, and nx's own
+   * migration generator refuses every one of them because they use `@nx/js:node`
+   * (nrwl/nx#36389). So the way out runs through here.
+   *
+   * `node` and `tools` remain genuinely declined: nothing under them bundles at all.
    */
   appliesTo(preset) {
-    return preset === "react" || preset === "svelte";
+    return preset === "react" || preset === "svelte" || preset === "nest";
   }
   /**
    * `react`, read from the module's Vite config rather than from its dependencies.
@@ -935,22 +952,24 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
     return "dev";
   }
   /**
-   * There is no such thing as adopting the dev server on its own.
+   * `--init --dev` does the same thing as `--init --build`, and now says so.
    *
-   * `ViteRoleAdapter.plan()` is shared with `--build` because everything else about the two
-   * targets is shared, and inheriting it here made `--init --dev` perform the FULL build
-   * adoption, silently, under a message that only ever mentioned the build. Exiting 0 on that
-   * is the worst of the options: it teaches that dev can be adopted by itself, and that belief
-   * is what produces the half-migrated module this role exists to prevent (see the class
-   * comment above, and `registerBuild`).
-   *
-   * A single plan writes both scripts, so the honest answer is to name the command that does
-   * it rather than to do it under a different name.
+   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
+   * because adopting one without the other leaves the module half-migrated. What was missing
+   * was only the telling: the run printed a message about the build and nothing about `serve`,
+   * so a developer could believe the dev server had been adopted on its own. Refusing was the
+   * wrong correction, it added friction to a command that already produced the right result.
    */
-  plan() {
-    throw new Error(
-      "the dev server is adopted together with the build, never on its own. Run --init --build: one plan writes both the `build` and the `serve` scripts."
-    );
+  plan(context) {
+    const planned = super.plan(context);
+    if (planned.operations.length === 0) return planned;
+    return {
+      ...planned,
+      notes: [
+        ...planned.notes ?? [],
+        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
+      ]
+    };
   }
   /**
    * Start the dev server. It does not return until stopped, so there is no verdict to report
@@ -6261,4 +6280,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-YZ4EKBK7.js.map
+//# sourceMappingURL=chunk-XPWM77PB.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-YZ4EKBK7.js";
+} from "./chunk-XPWM77PB.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -0,0 +1,80 @@
+import { UserConfig, Plugin } from 'vite';
+export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
+
+interface NestServiceOptions {
+    /** The nx project name. Keys the dependency graph, and names the module in messages. */
+    project: string;
+    /** Absolute path to the module's directory, normally `__dirname`. */
+    root: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Entry point, relative to `root`. */
+    entry?: string;
+    /**
+     * The tsconfig whose emit must be preserved, when the service uses neither conventional name.
+     *
+     * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.
+     */
+    tsconfig?: string;
+    /** Output directory, relative to `workspaceRoot`. */
+    outDir?: string;
+    /**
+     * Anything this service needs that the shape does not give it.
+     *
+     * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate
+     * and aliases stack the way Vite does it everywhere else, so there is no second set of
+     * semantics to learn or to document.
+     */
+    overrides?: UserConfig;
+}
+declare const nestService: (options: NestServiceOptions) => UserConfig;
+
+interface DecoratorMetadataOptions {
+    /** The module being built. Its tsconfig is the one whose emit must be preserved. */
+    root: string;
+    /**
+     * An explicit tsconfig, when the service does not use either conventional name.
+     *
+     * Relative paths resolve against `root`.
+     */
+    tsconfig?: string;
+}
+declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
+
+interface NodeManifestOptions {
+    /** The nx project name, which is how the graph is keyed. */
+    project: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Where the bundle is written; the two files land beside it. */
+    outDir: string;
+    /** Entry file name, written as `main` so `node .` resolves inside the image. */
+    entry?: string;
+}
+/**
+ * Writes the manifest and lockfile once the bundle is on disk.
+ *
+ * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the
+ * directory and cannot be cleared by `emptyOutDir`.
+ *
+ * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left
+ * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it
+ * became the one Vite printed, hiding the failure that actually stopped the build. It cost two
+ * diagnoses before being recognised, so the missing directory is now read as what it is: the
+ * bundle was never written, and this plugin has nothing to say about why.
+ */
+declare const nodeManifest: (options: NodeManifestOptions) => Plugin;
+
+interface Alias {
+    find: RegExp;
+    replacement: string;
+}
+/**
+ * Read the mappings from the workspace's base tsconfig.
+ *
+ * Longest pattern first, because Vite takes the first alias that matches and the mappings
+ * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.
+ */
+declare const tsconfigAliases: (workspaceRoot: string, file?: string) => Alias[];
+
+export { type Alias, type DecoratorMetadataOptions, type NestServiceOptions, type NodeManifestOptions, decoratorMetadata, nestService, nodeManifest, tsconfigAliases };

package/dist/roles/build/nest/toolchain.js

@@ -0,0 +1,198 @@
+// src/roles/build/nest/nest-service.ts
+import { join as join3 } from "path";
+import { mergeConfig } from "vite";
+
+// src/roles/build/nest/decorator-metadata.ts
+import { existsSync } from "fs";
+import path from "path";
+import ts from "typescript";
+var TYPESCRIPT_SOURCE = /\.ts$/;
+var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
+var assertCompilerApi = () => {
+  if (typeof ts.transpileModule === "function") return;
+  throw new Error(
+    `sentinel build(nest): the resolved typescript (${ts.version ?? "unknown version"}) has no transpileModule API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Sentinel pins its own compiler, so this means one was substituted, usually by a pnpm override or an alias on \`typescript\`.`
+  );
+};
+var resolveTsconfig = (options) => {
+  if (options.tsconfig) {
+    const explicit = path.resolve(options.root, options.tsconfig);
+    if (!existsSync(explicit)) {
+      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
+    }
+    return explicit;
+  }
+  for (const candidate of TSCONFIG_CANDIDATES) {
+    const found = path.join(options.root, candidate);
+    if (existsSync(found)) return found;
+  }
+  throw new Error(
+    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
+  );
+};
+var readCompilerOptions = (options) => {
+  assertCompilerApi();
+  const configPath = resolveTsconfig(options);
+  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+    ...ts.sys,
+    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+      throw new Error(
+        `sentinel build(nest): could not read ${configPath}: ` + ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")
+      );
+    }
+  });
+  return {
+    ...parsed?.options,
+    // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
+    // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
+    module: ts.ModuleKind.ESNext,
+    // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
+    sourceMap: true,
+    inlineSourceMap: false,
+    inlineSources: false,
+    // Types are another target's job, and `transpileModule` could not emit them anyway.
+    declaration: false,
+    declarationMap: false,
+    emitDeclarationOnly: false,
+    noEmit: false,
+    // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
+    // incremental build here to inform.
+    composite: false,
+    incremental: false
+  };
+};
+var decoratorMetadata = (options) => {
+  let compilerOptions;
+  return {
+    name: "sentinel:decorator-metadata",
+    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle.
+    enforce: "pre",
+    transform(code, id) {
+      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) {
+        return null;
+      }
+      compilerOptions ??= readCompilerOptions(options);
+      const output = ts.transpileModule(code, { fileName: id, compilerOptions });
+      return { code: output.outputText, map: output.sourceMapText ?? null };
+    }
+  };
+};
+
+// src/roles/build/nest/node-manifest.ts
+import { existsSync as existsSync2, writeFileSync } from "fs";
+import { join } from "path";
+var nodeManifest = (options) => ({
+  name: "sentinel:node-manifest",
+  apply: "build",
+  async closeBundle() {
+    if (!existsSync2(options.outDir)) return;
+    const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
+    const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
+    const graph = await createProjectGraphAsync({ exitOnError: false });
+    const manifest = createPackageJson(options.project, graph, {
+      root: options.workspaceRoot,
+      isProduction: true
+    });
+    manifest.main = options.entry ?? "main.js";
+    writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+    writeFileSync(
+      join(options.outDir, getLockFileName("pnpm")),
+      createLockFile(manifest, graph, "pnpm")
+    );
+  }
+});
+
+// src/roles/build/nest/tsconfig-aliases.ts
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
+var toAlias = (workspaceRoot, pattern, target) => {
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
+  return {
+    find: new RegExp(`^${escaped}$`),
+    replacement: join2(workspaceRoot, target.replace(/\*/g, "$1"))
+  };
+};
+var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
+  const raw = readFileSync(join2(workspaceRoot, file), "utf8");
+  const { compilerOptions } = JSON.parse(stripLineComments(raw));
+  return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
+    const [target] = targets;
+    return target === void 0 ? [] : [toAlias(workspaceRoot, pattern, target)];
+  }).sort((a, b) => b.find.source.length - a.find.source.length);
+};
+
+// src/roles/build/nest/nest-service.ts
+var baseConfig = (options) => {
+  const outDir = join3(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join3(options.root, options.entry ?? "src/main.ts");
+  return {
+    plugins: [
+      decoratorMetadata({ root: options.root, tsconfig: options.tsconfig }),
+      nodeManifest({
+        project: options.project,
+        workspaceRoot: options.workspaceRoot,
+        outDir
+      })
+    ],
+    resolve: { alias: tsconfigAliases(options.workspaceRoot) },
+    build: {
+      // An SSR build targets Node and leaves real packages external, which is what
+      // `webpack-node-externals` did: the image installs them from the generated manifest.
+      ssr: entry,
+      outDir,
+      emptyOutDir: true,
+      sourcemap: true,
+      target: "node20",
+      // The bundle is read by humans when a stack trace points into it, and minifying a
+      // server bundle buys nothing: it is never downloaded.
+      minify: false,
+      rollupOptions: {
+        output: {
+          format: "cjs",
+          // One output file per source module, instead of hoisting everything into one scope.
+          //
+          // This is not a preference, it is the only shape that keeps the OpenAPI contract.
+          // Merging every module into one scope forces Rollup to rename duplicate class names,
+          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently
+          // becomes a renamed schema in the published API. Measured on `network`, which has two
+          // such collisions: single bundle renames `InvalidPermissionError` and
+          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the
+          // committed contract byte for byte.
+          //
+          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under
+          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.
+          preserveModules: true,
+          // The image runs `./dist/main.js`, so the entry keeps that name at the root while
+          // every other module keeps its own path. Under `preserveModules` a plain string here
+          // would be applied to all of them, which numbers them (`main962.js`) and loses the
+          // entry.
+          entryFileNames: (chunk) => chunk.facadeModuleId === entry ? "main.js" : "[name].js"
+        },
+        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog
+        // when its module loads, and nothing references that module afterwards. Rollup may
+        // drop such a module; webpack never did.
+        //
+        // Measured on the first migrated service this changes nothing, so it is insurance
+        // rather than a fix, and it is recorded as such rather than credited with the smaller
+        // bundle (that comes from barrel re-exports the service does not use).
+        treeshake: { moduleSideEffects: true }
+      }
+    }
+  };
+};
+var nestService = (options) => options.overrides === void 0 ? baseConfig(options) : mergeConfig(baseConfig(options), options.overrides);
+
+// src/roles/build/nest/toolchain.ts
+import { defineConfig, loadEnv, mergeConfig as mergeConfig2 } from "vite";
+export {
+  decoratorMetadata,
+  defineConfig,
+  loadEnv,
+  mergeConfig2 as mergeConfig,
+  nestService,
+  nodeManifest,
+  tsconfigAliases
+};
+//# sourceMappingURL=toolchain.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.3",
+  "version": "1.2.0-alpha.5",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,10 @@
     "./build/react": {
       "types": "./dist/roles/build/toolchain.d.ts",
       "import": "./dist/roles/build/toolchain.js"
+    },
+    "./build/nest": {
+      "types": "./dist/roles/build/nest/toolchain.d.ts",
+      "import": "./dist/roles/build/nest/toolchain.js"
     }
   },
   "files": [
@@ -66,6 +70,7 @@
     "oxfmt": "0.63.0",
     "oxlint": "1.77.0",
     "oxlint-tsgolint": "7.0.2001",
+    "typescript": "5.9.3",
     "vite": "8.0.8",
     "vite-plugin-svgr": "5.2.0"
   },
@@ -96,6 +101,18 @@
       }
     }
   },
+  "peerDependencies": {
+    "nx": ">= 21",
+    "@nx/js": ">= 21"
+  },
+  "peerDependenciesMeta": {
+    "nx": {
+      "optional": true
+    },
+    "@nx/js": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsup && tsx scripts/build-presets.ts",
     "dev": "tsup --watch",