@hublo/sentinel 1.2.0-alpha.7 → 1.2.0-alpha.8

package/dist/roles/build/nest/toolchain.d.ts

@@ -50,6 +50,16 @@ interface NodeManifestOptions {
     outDir: string;
     /** Entry file name, written as `main` so `node .` resolves inside the image. */
     entry?: string;
+    /**
+     * Packages the IMAGE provides, which are therefore allowed to be required without being
+     * declared in the manifest.
+     *
+     * The generated Prisma clients are the case this exists for: the Dockerfile copies
+     * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module
+     * declares them. Everything else that is required and undeclared is a bug, and the check
+     * below refuses the build.
+     */
+    providedByImage?: readonly string[];
 }
 /**
  * Writes the manifest and lockfile once the bundle is on disk.

package/dist/roles/build/nest/toolchain.js

@@ -80,28 +80,61 @@ var decoratorMetadata = (options) => {
 
 // src/roles/build/nest/node-manifest.ts
 import { existsSync as existsSync2, writeFileSync } from "fs";
+import { isBuiltin } from "module";
 import { join } from "path";
-var nodeManifest = (options) => ({
-  name: "sentinel:node-manifest",
-  apply: "build",
-  async closeBundle() {
-    if (!existsSync2(options.outDir)) return;
-    const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
-    const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
-    const graph = await createProjectGraphAsync({ exitOnError: false });
-    const manifest = createPackageJson(options.project, graph, {
-      root: options.workspaceRoot,
-      isProduction: true
-    });
-    manifest.main = options.entry ?? "main.js";
-    writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
-`);
-    writeFileSync(
-      join(options.outDir, getLockFileName("pnpm")),
-      createLockFile(manifest, graph, "pnpm")
-    );
+var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
+var externalPackages = (bundle) => {
+  const emitted = new Set(Object.keys(bundle));
+  const packages = /* @__PURE__ */ new Set();
+  for (const chunk of Object.values(bundle)) {
+    for (const imported of chunk.imports ?? []) {
+      if (emitted.has(imported)) continue;
+      if (imported.startsWith(".") || imported.startsWith("/")) continue;
+      if (isBuiltin(imported)) continue;
+      const parts = imported.split("/");
+      const name = imported.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+      if (name) packages.add(name);
+    }
   }
-});
+  return packages;
+};
+var nodeManifest = (options) => {
+  let required = /* @__PURE__ */ new Set();
+  return {
+    name: "sentinel:node-manifest",
+    apply: "build",
+    generateBundle(_outputOptions, bundle) {
+      required = externalPackages(bundle);
+    },
+    async closeBundle() {
+      if (!existsSync2(options.outDir)) return;
+      const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
+      const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
+      const graph = await createProjectGraphAsync({ exitOnError: false });
+      const manifest = createPackageJson(options.project, graph, {
+        root: options.workspaceRoot,
+        isProduction: true
+      });
+      manifest.main = options.entry ?? "main.js";
+      assertManifestCovers(required, manifest, options);
+      writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+      writeFileSync(
+        join(options.outDir, getLockFileName("pnpm")),
+        createLockFile(manifest, graph, "pnpm")
+      );
+    }
+  };
+};
+var assertManifestCovers = (required, manifest, options) => {
+  const declared = new Set(Object.keys(manifest.dependencies ?? {}));
+  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE;
+  const missing = [...required].filter((name) => !declared.has(name)).filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`))).sort();
+  if (missing.length === 0) return;
+  throw new Error(
+    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated manifest does not declare, so the image would not install them: ${missing.join(", ")}. Either declare them in the module's package.json, inline them with \`ssr.noExternal\`, or list them in \`providedByImage\` if the Dockerfile copies them in.`
+  );
+};
 
 // src/roles/build/nest/tsconfig-aliases.ts
 import { readFileSync } from "fs";
@@ -137,6 +170,15 @@ var baseConfig = (options) => {
       })
     ],
     resolve: { alias: tsconfigAliases(options.workspaceRoot) },
+    ssr: {
+      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require("tslib")`
+      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into
+      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and
+      // the manifest nx generates from the project graph does not list it, because no module
+      // DECLARES tslib. The image therefore did not install it and the service died on its first
+      // require, only in the image: locally and in CI the workspace root has tslib.
+      noExternal: ["tslib"]
+    },
     build: {
       // An SSR build targets Node and leaves real packages external, which is what
       // `webpack-node-externals` did: the image installs them from the generated manifest.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.7",
+  "version": "1.2.0-alpha.8",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",