@hublo/sentinel 1.2.0-alpha.9 → 1.2.0

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-6RH3LZQZ.js";
+} from "./chunk-Z5I6SEKF.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -1,6 +1,20 @@
 import { UserConfig, Plugin } from 'vite';
 export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
 
+/** A transformer as the target declares it, passed through to the config unchanged. */
+interface TransformerDeclaration$1 {
+    name: string;
+    options?: Record<string, unknown>;
+}
+/** An asset as the target declares it, in `@nx/webpack`'s own shape. */
+interface AssetDeclaration {
+    glob: string;
+    /** Relative to the workspace root, as the target declares it. */
+    input: string;
+    /** Relative to the output directory. */
+    output: string;
+}
+
 interface NestServiceOptions {
     /** The nx project name. Keys the dependency graph, and names the module in messages. */
     project: string;
@@ -18,6 +32,23 @@ interface NestServiceOptions {
     tsconfig?: string;
     /** Output directory, relative to `workspaceRoot`. */
     outDir?: string;
+    /**
+     * TypeScript transformers this service compiles with, as its build target declared them.
+     *
+     * Read off the webpack target by `--init` and written here, never inferred: what a service
+     * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,
+     * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building
+     * without it succeeds and silently costs them most of their published contract (measured on
+     * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).
+     */
+    transformers?: readonly TransformerDeclaration$1[];
+    /**
+     * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.
+     *
+     * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders
+     * printed documents from. Without them the service starts and fails on its first print.
+     */
+    assets?: readonly AssetDeclaration[];
     /**
      * Anything this service needs that the shape does not give it.
      *
@@ -29,6 +60,13 @@ interface NestServiceOptions {
 }
 declare const nestService: (options: NestServiceOptions) => UserConfig;
 
+/** A TypeScript transformer a service runs at build time, as its build target declares it. */
+interface TransformerDeclaration {
+    /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */
+    name: string;
+    /** Passed to the transformer's own factory, unread here. */
+    options?: Record<string, unknown>;
+}
 interface DecoratorMetadataOptions {
     /** The module being built. Its tsconfig is the one whose emit must be preserved. */
     root: string;
@@ -38,6 +76,8 @@ interface DecoratorMetadataOptions {
      * Relative paths resolve against `root`.
      */
     tsconfig?: string;
+    /** The transformers this service declared, translated from its webpack target. */
+    transformers?: readonly TransformerDeclaration[];
 }
 declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
 

package/dist/roles/build/nest/toolchain.js

@@ -1,37 +1,121 @@
 // src/roles/build/nest/nest-service.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { mergeConfig } from "vite";
 
+// src/roles/build/nest/copy-assets.ts
+import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+import { dirname, join, relative, sep } from "path";
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let index = 0; index < glob.length; index++) {
+    const char = glob[index] ?? "";
+    if (char === "*") {
+      if (glob[index + 1] === "*") {
+        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
+        index += glob[index + 2] === "/" ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "{") {
+      const close = glob.indexOf("}", index);
+      if (close === -1)
+        throw new Error(`sentinel build(nest): unbalanced \`{\` in asset glob ${glob}`);
+      const alternatives = glob.slice(index + 1, close).split(",");
+      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+      index = close;
+      continue;
+    }
+    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function filesUnder(root) {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      if (statSync(full).isDirectory()) walk(full);
+      else found.push(relative(root, full).split(sep).join("/"));
+    }
+  };
+  walk(root);
+  return found;
+}
+function resolveAssets(options) {
+  const copies = [];
+  for (const asset of options.assets) {
+    const input = join(options.workspaceRoot, asset.input);
+    if (!existsSync(input)) {
+      throw new Error(
+        `sentinel build(nest): the build target declares an asset from \`${asset.input}\`, which does not exist. webpack copied it into the output, so the built service would be missing files it reads at runtime.`
+      );
+    }
+    const matcher = globToRegExp(asset.glob);
+    const matched = filesUnder(input).filter((file) => matcher.test(file));
+    if (matched.length === 0) {
+      throw new Error(
+        `sentinel build(nest): the asset glob \`${asset.glob}\` under \`${asset.input}\` matches no file. An entry that matches nothing is the same silent loss as no entry at all.`
+      );
+    }
+    for (const file of matched) {
+      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) });
+    }
+  }
+  return copies;
+}
+var copyAssets = (options) => ({
+  name: "sentinel:copy-assets",
+  // After the bundle is written and the output directory has stopped being emptied.
+  closeBundle() {
+    for (const { from, to } of resolveAssets(options)) {
+      mkdirSync(dirname(to), { recursive: true });
+      cpSync(from, to);
+    }
+  }
+});
+
 // src/roles/build/nest/decorator-metadata.ts
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
+import { createRequire } from "module";
 import path from "path";
-import ts from "typescript";
 var TYPESCRIPT_SOURCE = /\.ts$/;
 var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
-var assertCompilerApi = () => {
-  if (typeof ts.transpileModule === "function") return;
-  throw new Error(
-    `sentinel build(nest): the resolved typescript (${ts.version ?? "unknown version"}) has no transpileModule API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Sentinel pins its own compiler, so this means one was substituted, usually by a pnpm override or an alias on \`typescript\`.`
-  );
-};
-var resolveTsconfig = (options) => {
+function loadCompiler(root) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  let compiler;
+  try {
+    compiler = require2("typescript");
+  } catch {
+    throw new Error(
+      `sentinel build(nest): no \`typescript\` resolvable from ${root}. The build emits decorator metadata with the module's own compiler, so one has to be installed there.`
+    );
+  }
+  if (typeof compiler.createProgram !== "function") {
+    throw new Error(
+      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? "unknown"}) has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Point this module's \`typescript\` at a compiler with an emit API, which is the one its \`typecheck\` target already uses.`
+    );
+  }
+  return compiler;
+}
+function resolveTsconfig(options) {
   if (options.tsconfig) {
     const explicit = path.resolve(options.root, options.tsconfig);
-    if (!existsSync(explicit)) {
+    if (!existsSync2(explicit)) {
       throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
     }
     return explicit;
   }
   for (const candidate of TSCONFIG_CANDIDATES) {
     const found = path.join(options.root, candidate);
-    if (existsSync(found)) return found;
+    if (existsSync2(found)) return found;
   }
   throw new Error(
     `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
   );
-};
-var readCompilerOptions = (options) => {
-  assertCompilerApi();
+}
+function readConfig(ts, options) {
   const configPath = resolveTsconfig(options);
   const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
     ...ts.sys,
@@ -42,52 +126,120 @@ var readCompilerOptions = (options) => {
     }
   });
   return {
-    ...parsed?.options,
-    // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
-    // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
-    module: ts.ModuleKind.ESNext,
-    // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
-    sourceMap: true,
-    inlineSourceMap: false,
-    inlineSources: false,
-    // Types are another target's job, and `transpileModule` could not emit them anyway.
-    declaration: false,
-    declarationMap: false,
-    emitDeclarationOnly: false,
-    noEmit: false,
-    // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
-    // incremental build here to inform.
-    composite: false,
-    incremental: false
+    fileNames: parsed?.fileNames ?? [],
+    compilerOptions: {
+      ...parsed?.options,
+      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
+      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
+      module: ts.ModuleKind.ESNext,
+      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
+      sourceMap: true,
+      inlineSourceMap: false,
+      inlineSources: false,
+      // Types are another target's job, and emitting them here would write into the source tree.
+      declaration: false,
+      declarationMap: false,
+      emitDeclarationOnly: false,
+      noEmit: false,
+      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
+      // incremental build here to inform.
+      composite: false,
+      incremental: false
+    }
   };
-};
+}
+function loadTransformers(root, program, declared) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  return declared.map(({ name, options }) => {
+    let loaded;
+    try {
+      loaded = require2(name);
+    } catch (error) {
+      throw new Error(
+        `sentinel build(nest): the build target declares the transformer \`${name}\`, which cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+    if (typeof loaded.before !== "function") {
+      throw new Error(
+        `sentinel build(nest): \`${name}\` exports no \`before\` factory, so it cannot run as a TypeScript transformer. Building without it would drop whatever it contributes.`
+      );
+    }
+    const factory = loaded.before;
+    return factory(options, program);
+  });
+}
 var decoratorMetadata = (options) => {
+  const typeAware = (options.transformers ?? []).length > 0;
+  let ts;
+  let program;
   let compilerOptions;
+  let before = [];
+  const withoutTypes = [];
   return {
     name: "sentinel:decorator-metadata",
-    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle.
+    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so
+    // the source this plugin reads from the Program is still the source on disk.
     enforce: "pre",
+    buildStart() {
+      ts = loadCompiler(options.root);
+      const config = readConfig(ts, options);
+      compilerOptions = config.compilerOptions;
+      if (!typeAware) return;
+      program = ts.createProgram(config.fileNames, config.compilerOptions);
+      before = loadTransformers(options.root, program, options.transformers ?? []);
+    },
     transform(code, id) {
-      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) {
-        return null;
+      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) return null;
+      if (ts === void 0 || compilerOptions === void 0) {
+        throw new Error(
+          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with defaults rather than this module's tsconfig.`
+        );
+      }
+      const sourceFile = program?.getSourceFile(id);
+      if (program === void 0 || sourceFile === void 0 || sourceFile.text !== code) {
+        if (typeAware) withoutTypes.push(id);
+        const output = ts.transpileModule(code, { fileName: id, compilerOptions });
+        return { code: output.outputText, map: output.sourceMapText ?? null };
+      }
+      let emitted;
+      let map;
+      program.emit(
+        sourceFile,
+        (fileName, text) => {
+          if (fileName.endsWith(".map")) map = text;
+          else emitted = text;
+        },
+        void 0,
+        false,
+        { before }
+      );
+      if (emitted === void 0) {
+        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`);
       }
-      compilerOptions ??= readCompilerOptions(options);
-      const output = ts.transpileModule(code, { fileName: id, compilerOptions });
-      return { code: output.outputText, map: output.sourceMapText ?? null };
+      return { code: emitted, map: map ?? null };
+    },
+    closeBundle() {
+      if (withoutTypes.length === 0) return;
+      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file));
+      this.warn(
+        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type information, so their decorator metadata may differ from what ts-loader produced (${shown.join(", ")}${withoutTypes.length > shown.length ? ", \u2026" : ""}). They are outside this module's tsconfig, or another plugin rewrote them first.`
+      );
     }
   };
 };
 
 // src/roles/build/nest/node-manifest.ts
-import { existsSync as existsSync2, writeFileSync } from "fs";
+import { existsSync as existsSync3, writeFileSync } from "fs";
 import { isBuiltin } from "module";
-import { join } from "path";
+import { join as join2 } from "path";
 var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
 var externalPackages = (bundle) => {
   const emitted = new Set(Object.keys(bundle));
   const packages = /* @__PURE__ */ new Set();
-  for (const chunk of Object.values(bundle)) {
-    for (const imported of chunk.imports ?? []) {
+  for (const emittedFile of Object.values(bundle)) {
+    if (emittedFile.type !== "chunk") continue;
+    for (const imported of emittedFile.imports) {
       if (emitted.has(imported)) continue;
       if (imported.startsWith(".") || imported.startsWith("/")) continue;
       if (isBuiltin(imported)) continue;
@@ -99,7 +251,7 @@ var externalPackages = (bundle) => {
   return packages;
 };
 var nodeManifest = (options) => {
-  let required = /* @__PURE__ */ new Set();
+  let required;
   return {
     name: "sentinel:node-manifest",
     apply: "build",
@@ -107,7 +259,8 @@ var nodeManifest = (options) => {
       required = externalPackages(bundle);
     },
     async closeBundle() {
-      if (!existsSync2(options.outDir)) return;
+      const entry = options.entry ?? "main.js";
+      if (!existsSync3(join2(options.outDir, entry))) return;
       const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
       const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
       const graph = await createProjectGraphAsync({ exitOnError: false });
@@ -115,12 +268,17 @@ var nodeManifest = (options) => {
         root: options.workspaceRoot,
         isProduction: true
       });
-      manifest.main = options.entry ?? "main.js";
+      manifest.main = entry;
+      if (required === void 0) {
+        throw new Error(
+          `sentinel build(nest): the bundle was written but never inspected, so the manifest could not be checked against what it requires. Refusing to write one that might not install.`
+        );
+      }
       assertManifestCovers(required, manifest, options);
-      writeFileSync(join(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+      writeFileSync(join2(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
 `);
       writeFileSync(
-        join(options.outDir, getLockFileName("pnpm")),
+        join2(options.outDir, getLockFileName("pnpm")),
         createLockFile(manifest, graph, "pnpm")
       );
     }
@@ -138,17 +296,17 @@ var assertManifestCovers = (required, manifest, options) => {
 
 // src/roles/build/nest/tsconfig-aliases.ts
 import { readFileSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
 var toAlias = (workspaceRoot, pattern, target) => {
   const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
   return {
     find: new RegExp(`^${escaped}$`),
-    replacement: join2(workspaceRoot, target.replace(/\*/g, "$1"))
+    replacement: join3(workspaceRoot, target.replace(/\*/g, "$1"))
   };
 };
 var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
-  const raw = readFileSync(join2(workspaceRoot, file), "utf8");
+  const raw = readFileSync(join3(workspaceRoot, file), "utf8");
   const { compilerOptions } = JSON.parse(stripLineComments(raw));
   return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
     const [target] = targets;
@@ -158,11 +316,16 @@ var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
 
 // src/roles/build/nest/nest-service.ts
 var baseConfig = (options) => {
-  const outDir = join3(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
-  const entry = join3(options.root, options.entry ?? "src/main.ts");
+  const outDir = join4(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join4(options.root, options.entry ?? "src/main.ts");
   return {
     plugins: [
-      decoratorMetadata({ root: options.root, tsconfig: options.tsconfig }),
+      decoratorMetadata({
+        root: options.root,
+        tsconfig: options.tsconfig,
+        transformers: options.transformers
+      }),
+      ...options.assets?.length ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })] : [],
       nodeManifest({
         project: options.project,
         workspaceRoot: options.workspaceRoot,

package/dist/roles/test/react/toolchain.d.ts

@@ -0,0 +1,2 @@
+export { ConfigEnv, TestUserConfig, ViteUserConfig, defineConfig, mergeConfig } from 'vitest/config';
+export { loadEnv } from 'vite';

package/dist/roles/test/react/toolchain.js

@@ -0,0 +1,9 @@
+// src/roles/test/react/toolchain.ts
+import { defineConfig, mergeConfig } from "vitest/config";
+import { loadEnv } from "vite";
+export {
+  defineConfig,
+  loadEnv,
+  mergeConfig
+};
+//# sourceMappingURL=toolchain.js.map

package/lint/react-lib.json

@@ -58,6 +58,7 @@
       "all"
     ],
     "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
     "jest-dom/prefer-checked": "error",
     "jest-dom/prefer-empty": "error",
     "jest-dom/prefer-enabled-disabled": "error",
@@ -348,7 +349,8 @@
     {
       "name": "storybook",
       "specifier": "eslint-plugin-storybook"
-    }
+    },
+    "../plugins/hublo.js"
   ],
   "overrides": [
     {

package/lint/react.json

@@ -58,6 +58,8 @@
       "all"
     ],
     "for-direction": "error",
+    "hublo/no-palette-common": "off",
+    "hublo/no-regex-lookbehind": "error",
     "jest/expect-expect": "off",
     "jest/no-alias-methods": "off",
     "jest/no-commented-out-tests": "off",
@@ -469,6 +471,7 @@
     {
       "name": "react-refresh",
       "specifier": "eslint-plugin-react-refresh"
-    }
+    },
+    "../plugins/hublo.js"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.9",
+  "version": "1.2.0",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -45,6 +45,10 @@
     "./build/nest": {
       "types": "./dist/roles/build/nest/toolchain.d.ts",
       "import": "./dist/roles/build/nest/toolchain.js"
+    },
+    "./test/react": {
+      "types": "./dist/roles/test/react/toolchain.d.ts",
+      "import": "./dist/roles/test/react/toolchain.js"
     }
   },
   "files": [
@@ -71,8 +75,9 @@
     "oxlint": "1.77.0",
     "oxlint-tsgolint": "7.0.2001",
     "typescript": "5.9.3",
-    "vite": "8.0.8",
-    "vite-plugin-svgr": "5.2.0"
+    "vite": "8.2.2",
+    "vite-plugin-svgr": "5.2.0",
+    "vitest": "4.1.4"
   },
   "devDependencies": {
     "@hublo/sentinel": "link:.",
@@ -80,8 +85,7 @@
     "nx": "^23.1.0",
     "tsup": "^8.3.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.9.0",
-    "vitest": "^2.1.0"
+    "typescript": "^5.9.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -102,8 +106,8 @@
     }
   },
   "peerDependencies": {
-    "nx": ">= 21",
-    "@nx/js": ">= 21"
+    "@nx/js": ">= 21",
+    "nx": ">= 21"
   },
   "peerDependenciesMeta": {
     "nx": {

package/plugins/hublo.js

@@ -10,6 +10,12 @@
  * sentinel exists to remove. The cost is that `@hublo/sentinel` carries a rule about Hublo's
  * colour palette, which is honest for a package named after the company.
  *
+ * It now hosts a SECOND, unrelated rule. `no-regex-lookbehind` is not a carried-over selector
+ * but a browser-support rule: regex lookbehind is Safari 16.4+, and unlike everything else a
+ * preset controls it can be neither transpiled nor polyfilled, because no bundler rewrites the
+ * contents of a regex literal. It is here for the same reason as the palette rule — a house
+ * rule is code, not configuration — and because lint is the only layer left that can catch it.
+ *
  * The original selectors, and where each is handled below:
  *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
  *        …[computed=true][property.value='common']                                      theme.palette['common']
@@ -25,6 +31,15 @@ const MESSAGE =
 const COLOUR_PROPS =
   /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
 
+/**
+ * Lookbehind, positive or negative. NOT named groups `(?<name>)`, which Safari has had since
+ * 11.3: the class is exactly `(?<` followed by `=` or `!`.
+ */
+const LOOKBEHIND = /\(\?<[=!]/
+
+const LOOKBEHIND_MESSAGE =
+  'Regex lookbehind ((?<=) / (?<!)) is Safari 16.4+ and can be neither transpiled nor polyfilled: on older iOS the literal is a parse-time SyntaxError that takes the whole chunk with it. Rewrite the pattern. Named groups (?<name>) are fine.'
+
 /** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
 const isCommonPath = (node) =>
   node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
@@ -82,6 +97,59 @@ const plugin = {
         }
       },
     },
+
+    'no-regex-lookbehind': {
+      meta: {
+        docs: {
+          description: 'Ban regex lookbehind, unsupported by Safari below 16.4.',
+        },
+      },
+      create(context) {
+        const report = (node) => context.report({ node, message: LOOKBEHIND_MESSAGE })
+
+        /**
+         * `new RegExp(...)` and `RegExp(...)`, when the pattern is readable statically: a
+         * string, or a template whose fixed parts carry the lookbehind.
+         *
+         * Each template chunk is tested on its own rather than joined. Joining invents a
+         * `(?<=` that the runtime string never has, across an interpolation boundary:
+         * `` `(?<${op}=x)` `` would read as one.
+         */
+        const isStaticLookbehind = (pattern) => {
+          if (pattern?.type === 'Literal') {
+            return typeof pattern.value === 'string' && LOOKBEHIND.test(pattern.value)
+          }
+          if (pattern?.type === 'TemplateLiteral') {
+            return (pattern.quasis ?? []).some((quasi) =>
+              LOOKBEHIND.test(quasi.value?.cooked ?? quasi.value?.raw ?? ''),
+            )
+          }
+          return false
+        }
+
+        const checkRegExpCall = (node) => {
+          if (node.callee?.name !== 'RegExp') {
+            return
+          }
+          const pattern = node.arguments?.[0]
+          if (isStaticLookbehind(pattern)) {
+            report(pattern)
+          }
+        }
+
+        return {
+          // The case that actually breaks a page: a literal is an EARLY error, so the whole
+          // chunk fails to parse rather than the one call site failing.
+          Literal(node) {
+            if (node.regex && LOOKBEHIND.test(node.regex.pattern)) {
+              report(node)
+            }
+          },
+          NewExpression: checkRegExpCall,
+          CallExpression: checkRegExpCall,
+        }
+      },
+    },
   },
 }