@hublo/sentinel 1.3.0 → 1.4.0-alpha.1

package/dist/chunk-PWV3BMDA.js

@@ -0,0 +1,15 @@
+// src/roles/test/setup/msw.ts
+import { setupServer } from "msw/node";
+var server = setupServer();
+var LISTEN_OPTIONS = { onUnhandledRequest: "error" };
+function installMswLifecycle(hooks) {
+  server.listen(LISTEN_OPTIONS);
+  hooks.beforeAll(() => server.listen(LISTEN_OPTIONS));
+  hooks.afterAll(() => server.close());
+}
+
+export {
+  server,
+  installMswLifecycle
+};
+//# sourceMappingURL=chunk-PWV3BMDA.js.map

package/dist/chunk-WLFE5RUU.js

@@ -0,0 +1,264 @@
+// src/shared/package-json.ts
+import { existsSync, readFileSync } from "fs";
+import { basename, dirname, join } from "path";
+import { fileURLToPath } from "url";
+function readOwnPackage() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (typeof pkg.version === "string") {
+          const bin = typeof pkg.bin === "string" ? pkg.bin : Object.values(pkg.bin ?? {})[0];
+          return { name: pkg.name ?? "@hublo/sentinel", version: pkg.version, bin };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return { name: "@hublo/sentinel", version: "0.0.0" };
+    dir = parent;
+  }
+}
+function readOwnVersion() {
+  return readOwnPackage().version;
+}
+function readProjectPackageJson(dir) {
+  const path = join(dir, "package.json");
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.
+`);
+    return {};
+  }
+}
+function readNxProjectName(dir) {
+  const path = join(dir, "project.json");
+  if (!existsSync(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function moduleName(dir) {
+  const declared = readProjectPackageJson(dir).name;
+  return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
+}
+
+// src/core/workspace-prep.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2, relative } from "path";
+
+// src/core/settings.ts
+var WORKSPACE_ROOT_MARKER = "nx.json";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+
+// src/core/workspace-prep.ts
+var OVERRIDE_KEY = "i18next>typescript";
+var NATIVE_TS_ALIAS = "@typescript/native";
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
+var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
+var MAP_ENTRY = /^(\s+)(.*?):\s+(.*?)\s*$/;
+function findWorkspaceRoot(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync2(join2(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function declaredNativeTs(pkg) {
+  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
+  if (!spec) return void 0;
+  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
+  return version || void 0;
+}
+function ensureI18nextSingleton(root, dryRun) {
+  const pkgPath = join2(root, "package.json");
+  if (!existsSync2(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+  const want = declaredNativeTs(pkg);
+  if (!want) return void 0;
+  const yamlPath = join2(root, WORKSPACE_YAML);
+  if (!existsSync2(yamlPath)) return void 0;
+  const lines = readFileSync2(yamlPath, "utf8").split("\n");
+  const entry = findOverrideEntry(lines);
+  if (entry.valueIdx !== void 0 && entry.value === want) return void 0;
+  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`;
+  applyOverride(lines, entry, want);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`;
+}
+function findOverrideEntry(lines) {
+  const blockIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === "overrides:");
+  if (blockIdx === -1) return { indent: "  " };
+  let lastEntryIdx = blockIdx;
+  let indent = "  ";
+  for (let i = blockIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(MAP_ENTRY);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastEntryIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === OVERRIDE_KEY) {
+      return {
+        valueIdx: i,
+        value: (match[3] ?? "").replace(/^['"]|['"]$/g, ""),
+        blockIdx,
+        lastEntryIdx,
+        indent
+      };
+    }
+  }
+  return { blockIdx, lastEntryIdx, indent };
+}
+function applyOverride(lines, entry, want) {
+  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`;
+  if (entry.valueIdx !== void 0) {
+    lines[entry.valueIdx] = line;
+    return;
+  }
+  if (entry.lastEntryIdx !== void 0) {
+    lines.splice(entry.lastEntryIdx + 1, 0, line);
+    return;
+  }
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  lines.push("overrides:", line, "");
+}
+function ensureReleaseAgeAllowList(root, dryRun) {
+  const yamlPath = join2(root, WORKSPACE_YAML);
+  if (!existsSync2(yamlPath)) return void 0;
+  const own = readOwnPackage().name;
+  const lines = readFileSync2(yamlPath, "utf8").split("\n");
+  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
+  if (keyIdx === -1) return void 0;
+  let lastItemIdx = keyIdx;
+  let indent = "  ";
+  for (let i = keyIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(LIST_ITEM);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastItemIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
+  }
+  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
+  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
+}
+var PRETTIER_IGNORE = ".prettierignore";
+var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
+var ROOT_PRETTIER_CONFIGS = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function ensureFormatterExclusion(root, moduleDir, dryRun) {
+  const rel = relative(root, moduleDir).replaceAll("\\", "/");
+  if (rel === "" || rel.startsWith("..")) return void 0;
+  const ignorePath = join2(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync2(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync2(join2(root, name)));
+  if (!hasPrettier) return void 0;
+  const pattern = `/${rel}/`;
+  const existing = existsSync2(ignorePath) ? readFileSync2(ignorePath, "utf8") : "";
+  const lines = existing.split("\n");
+  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
+    return void 0;
+  }
+  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
+  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
+  if (headerIdx === -1) {
+    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
+
+`;
+    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
+${pattern}
+`);
+  } else {
+    let end = headerIdx + 1;
+    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
+    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
+    writeFileSync(
+      ignorePath,
+      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
+    );
+  }
+  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
+}
+function ensureWorkspacePrep(opts) {
+  const dryRun = Boolean(opts.dryRun);
+  return [
+    ensureI18nextSingleton(opts.root, dryRun),
+    ensureReleaseAgeAllowList(opts.root, dryRun),
+    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
+  ].filter((message) => message !== void 0);
+}
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join2(root, "package.json");
+  if (existsSync2(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
+  }
+  const yamlPath = join2(root, WORKSPACE_YAML);
+  const yaml = existsSync2(yamlPath) ? readFileSync2(yamlPath, "utf8") : void 0;
+  const pinned = yaml === void 0 ? void 0 : findOverrideEntry(yaml.split("\n")).value;
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `${WORKSPACE_YAML} \u2192 overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
+  }
+  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (legacy !== void 0) {
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: `pinned to ${legacy}, but pnpm 11 no longer reads the \`pnpm\` field of package.json and says nothing about it, so this override is not applied. Move it to ${WORKSPACE_YAML} under \`overrides:\`, which pnpm 10 and 11 both read.`
+    });
+  }
+  const own = readOwnPackage().name;
+  if (yaml !== void 0) {
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
+}
+
+export {
+  readOwnPackage,
+  readOwnVersion,
+  readProjectPackageJson,
+  readNxProjectName,
+  moduleName,
+  WORKSPACE_ROOT_MARKER,
+  DEFAULT_MAX_DIAGNOSTICS,
+  findWorkspaceRoot,
+  ensureWorkspacePrep,
+  inspectWorkspacePrep
+};
+//# sourceMappingURL=chunk-WLFE5RUU.js.map

package/dist/index.js

@@ -7,7 +7,8 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-676GBPMS.js";
+} from "./chunk-O3XCQGTJ.js";
+import "./chunk-WLFE5RUU.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -1,8 +1,9 @@
 import { UserConfig, Plugin } from 'vite';
 export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
+export { A as Alias, D as DecoratorMetadataOptions, d as decoratorMetadata, t as tsconfigAliases } from '../../../tsconfig-aliases-Ce6axdJ4.js';
 
 /** A transformer as the target declares it, passed through to the config unchanged. */
-interface TransformerDeclaration$1 {
+interface TransformerDeclaration {
     name: string;
     options?: Record<string, unknown>;
 }
@@ -41,7 +42,7 @@ interface NestServiceOptions {
      * without it succeeds and silently costs them most of their published contract (measured on
      * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).
      */
-    transformers?: readonly TransformerDeclaration$1[];
+    transformers?: readonly TransformerDeclaration[];
     /**
      * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.
      *
@@ -60,27 +61,6 @@ interface NestServiceOptions {
 }
 declare const nestService: (options: NestServiceOptions) => UserConfig;
 
-/** A TypeScript transformer a service runs at build time, as its build target declares it. */
-interface TransformerDeclaration {
-    /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */
-    name: string;
-    /** Passed to the transformer's own factory, unread here. */
-    options?: Record<string, unknown>;
-}
-interface DecoratorMetadataOptions {
-    /** The module being built. Its tsconfig is the one whose emit must be preserved. */
-    root: string;
-    /**
-     * An explicit tsconfig, when the service does not use either conventional name.
-     *
-     * Relative paths resolve against `root`.
-     */
-    tsconfig?: string;
-    /** The transformers this service declared, translated from its webpack target. */
-    transformers?: readonly TransformerDeclaration[];
-}
-declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
-
 interface NodeManifestOptions {
     /** The nx project name, which is how the graph is keyed. */
     project: string;
@@ -115,16 +95,4 @@ interface NodeManifestOptions {
  */
 declare const nodeManifest: (options: NodeManifestOptions) => Plugin;
 
-interface Alias {
-    find: RegExp;
-    replacement: string;
-}
-/**
- * Read the mappings from the workspace's base tsconfig.
- *
- * Longest pattern first, because Vite takes the first alias that matches and the mappings
- * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.
- */
-declare const tsconfigAliases: (workspaceRoot: string, file?: string) => Alias[];
-
-export { type Alias, type DecoratorMetadataOptions, type NestServiceOptions, type NodeManifestOptions, decoratorMetadata, nestService, nodeManifest, tsconfigAliases };
+export { type NestServiceOptions, type NodeManifestOptions, nestService, nodeManifest };

package/dist/roles/build/nest/toolchain.js

@@ -1,5 +1,10 @@
+import {
+  decoratorMetadata,
+  tsconfigAliases
+} from "../../../chunk-3TDUIKVQ.js";
+
 // src/roles/build/nest/nest-service.ts
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 import { mergeConfig } from "vite";
 
 // src/roles/build/nest/copy-assets.ts
@@ -76,161 +81,8 @@ var copyAssets = (options) => ({
   }
 });
 
-// src/roles/build/nest/decorator-metadata.ts
-import { existsSync as existsSync2 } from "fs";
-import { createRequire } from "module";
-import path from "path";
-var TYPESCRIPT_SOURCE = /\.ts$/;
-var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
-function loadCompiler(root) {
-  const require2 = createRequire(path.join(root, "noop.js"));
-  let compiler;
-  try {
-    compiler = require2("typescript");
-  } catch {
-    throw new Error(
-      `sentinel build(nest): no \`typescript\` resolvable from ${root}. The build emits decorator metadata with the module's own compiler, so one has to be installed there.`
-    );
-  }
-  if (typeof compiler.createProgram !== "function") {
-    throw new Error(
-      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? "unknown"}) has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Point this module's \`typescript\` at a compiler with an emit API, which is the one its \`typecheck\` target already uses.`
-    );
-  }
-  return compiler;
-}
-function resolveTsconfig(options) {
-  if (options.tsconfig) {
-    const explicit = path.resolve(options.root, options.tsconfig);
-    if (!existsSync2(explicit)) {
-      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
-    }
-    return explicit;
-  }
-  for (const candidate of TSCONFIG_CANDIDATES) {
-    const found = path.join(options.root, candidate);
-    if (existsSync2(found)) return found;
-  }
-  throw new Error(
-    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
-  );
-}
-function readConfig(ts, options) {
-  const configPath = resolveTsconfig(options);
-  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
-    ...ts.sys,
-    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
-      throw new Error(
-        `sentinel build(nest): could not read ${configPath}: ` + ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")
-      );
-    }
-  });
-  return {
-    fileNames: parsed?.fileNames ?? [],
-    compilerOptions: {
-      ...parsed?.options,
-      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
-      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
-      module: ts.ModuleKind.ESNext,
-      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
-      sourceMap: true,
-      inlineSourceMap: false,
-      inlineSources: false,
-      // Types are another target's job, and emitting them here would write into the source tree.
-      declaration: false,
-      declarationMap: false,
-      emitDeclarationOnly: false,
-      noEmit: false,
-      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
-      // incremental build here to inform.
-      composite: false,
-      incremental: false
-    }
-  };
-}
-function loadTransformers(root, program, declared) {
-  const require2 = createRequire(path.join(root, "noop.js"));
-  return declared.map(({ name, options }) => {
-    let loaded;
-    try {
-      loaded = require2(name);
-    } catch (error) {
-      throw new Error(
-        `sentinel build(nest): the build target declares the transformer \`${name}\`, which cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error }
-      );
-    }
-    if (typeof loaded.before !== "function") {
-      throw new Error(
-        `sentinel build(nest): \`${name}\` exports no \`before\` factory, so it cannot run as a TypeScript transformer. Building without it would drop whatever it contributes.`
-      );
-    }
-    const factory = loaded.before;
-    return factory(options, program);
-  });
-}
-var decoratorMetadata = (options) => {
-  const typeAware = (options.transformers ?? []).length > 0;
-  let ts;
-  let program;
-  let compilerOptions;
-  let before = [];
-  const withoutTypes = [];
-  return {
-    name: "sentinel:decorator-metadata",
-    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so
-    // the source this plugin reads from the Program is still the source on disk.
-    enforce: "pre",
-    buildStart() {
-      ts = loadCompiler(options.root);
-      const config = readConfig(ts, options);
-      compilerOptions = config.compilerOptions;
-      if (!typeAware) return;
-      program = ts.createProgram(config.fileNames, config.compilerOptions);
-      before = loadTransformers(options.root, program, options.transformers ?? []);
-    },
-    transform(code, id) {
-      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) return null;
-      if (ts === void 0 || compilerOptions === void 0) {
-        throw new Error(
-          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with defaults rather than this module's tsconfig.`
-        );
-      }
-      const sourceFile = program?.getSourceFile(id);
-      if (program === void 0 || sourceFile === void 0 || sourceFile.text !== code) {
-        if (typeAware) withoutTypes.push(id);
-        const output = ts.transpileModule(code, { fileName: id, compilerOptions });
-        return { code: output.outputText, map: output.sourceMapText ?? null };
-      }
-      let emitted;
-      let map;
-      program.emit(
-        sourceFile,
-        (fileName, text) => {
-          if (fileName.endsWith(".map")) map = text;
-          else emitted = text;
-        },
-        void 0,
-        false,
-        { before }
-      );
-      if (emitted === void 0) {
-        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`);
-      }
-      return { code: emitted, map: map ?? null };
-    },
-    closeBundle() {
-      if (withoutTypes.length === 0) return;
-      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file));
-      this.warn(
-        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type information, so their decorator metadata may differ from what ts-loader produced (${shown.join(", ")}${withoutTypes.length > shown.length ? ", \u2026" : ""}). They are outside this module's tsconfig, or another plugin rewrote them first.`
-      );
-    }
-  };
-};
-
 // src/roles/build/nest/node-manifest.ts
-import { existsSync as existsSync3, writeFileSync } from "fs";
+import { existsSync as existsSync2, writeFileSync } from "fs";
 import { isBuiltin } from "module";
 import { join as join2 } from "path";
 var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
@@ -260,7 +112,7 @@ var nodeManifest = (options) => {
     },
     async closeBundle() {
       const entry = options.entry ?? "main.js";
-      if (!existsSync3(join2(options.outDir, entry))) return;
+      if (!existsSync2(join2(options.outDir, entry))) return;
       const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
       const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
       const graph = await createProjectGraphAsync({ exitOnError: false });
@@ -294,30 +146,10 @@ var assertManifestCovers = (required, manifest, options) => {
   );
 };
 
-// src/roles/build/nest/tsconfig-aliases.ts
-import { readFileSync } from "fs";
-import { join as join3 } from "path";
-var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
-var toAlias = (workspaceRoot, pattern, target) => {
-  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
-  return {
-    find: new RegExp(`^${escaped}$`),
-    replacement: join3(workspaceRoot, target.replace(/\*/g, "$1"))
-  };
-};
-var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
-  const raw = readFileSync(join3(workspaceRoot, file), "utf8");
-  const { compilerOptions } = JSON.parse(stripLineComments(raw));
-  return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
-    const [target] = targets;
-    return target === void 0 ? [] : [toAlias(workspaceRoot, pattern, target)];
-  }).sort((a, b) => b.find.source.length - a.find.source.length);
-};
-
 // src/roles/build/nest/nest-service.ts
 var baseConfig = (options) => {
-  const outDir = join4(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
-  const entry = join4(options.root, options.entry ?? "src/main.ts");
+  const outDir = join3(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join3(options.root, options.entry ?? "src/main.ts");
   return {
     plugins: [
       decoratorMetadata({

package/dist/roles/build/nest/toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/roles/build/nest/nest-service.ts","../../../../src/roles/build/nest/copy-assets.ts","../../../../src/roles/build/nest/node-manifest.ts","../../../../src/roles/build/nest/toolchain.ts"],"sourcesContent":["/**\n * The whole Vite config for a Nest service, so an adopted module holds two lines.\n *\n * ## Why a shape here, and pieces on the React side\n *\n * It looks inconsistent until you measure the two families. The four React apps each carry a\n * heavy, genuinely different config: one has a plugin wedged between two shared ones, another\n * has two different route-tree footers on the branches of one ternary. Two attempts at a\n * shared shape for them were abandoned, and the rule that survived is that sentinel rewrites\n * their IMPORTS and touches nothing else.\n *\n * The Nest side is the opposite by measurement: 38 services, one shared 25-line webpack config\n * between them, and nothing per-module to preserve. Owning the shape there is not a different\n * philosophy, it is the same one applied to a different fact: sentinel provides the FORM where\n * the form is shared, and the PIECES where it is not.\n *\n * The consequences are the point. An adopted module is readable in review. A correction to the\n * form is one publish instead of 38 diffs. And the day Nest becomes ESM-native, `format`\n * changes here rather than in 38 configs.\n *\n * ## It is a composition, not a block\n *\n * `nestService` assembles the same plugins this module exports individually. A service that\n * needs something else can pass `overrides`, or drop to the pieces entirely. And if the React\n * configs ever converge, a `reactApp()` can be built the same way with no new mechanism.\n */\nimport { join } from 'node:path'\n\nimport { mergeConfig, type UserConfig } from 'vite'\n\nimport { copyAssets } from './copy-assets.js'\nimport { decoratorMetadata } from './decorator-metadata.js'\nimport { nodeManifest } from './node-manifest.js'\nimport type { AssetDeclaration, TransformerDeclaration } from './nx-target.js'\nimport { tsconfigAliases } from './tsconfig-aliases.js'\n\nexport interface NestServiceOptions {\n  /** The nx project name. Keys the dependency graph, and names the module in messages. */\n  project: string\n  /** Absolute path to the module's directory, normally `__dirname`. */\n  root: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Entry point, relative to `root`. */\n  entry?: string\n  /**\n   * The tsconfig whose emit must be preserved, when the service uses neither conventional name.\n   *\n   * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.\n   */\n  tsconfig?: string\n  /** Output directory, relative to `workspaceRoot`. */\n  outDir?: string\n  /**\n   * TypeScript transformers this service compiles with, as its build target declared them.\n   *\n   * Read off the webpack target by `--init` and written here, never inferred: what a service\n   * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,\n   * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building\n   * without it succeeds and silently costs them most of their published contract (measured on\n   * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).\n   */\n  transformers?: readonly TransformerDeclaration[]\n  /**\n   * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.\n   *\n   * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders\n   * printed documents from. Without them the service starts and fails on its first print.\n   */\n  assets?: readonly AssetDeclaration[]\n  /**\n   * Anything this service needs that the shape does not give it.\n   *\n   * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate\n   * and aliases stack the way Vite does it everywhere else, so there is no second set of\n   * semantics to learn or to document.\n   */\n  overrides?: UserConfig\n}\n\nconst baseConfig = (options: NestServiceOptions): UserConfig => {\n  const outDir = join(options.workspaceRoot, options.outDir ?? `dist/${options.project}`)\n  const entry = join(options.root, options.entry ?? 'src/main.ts')\n  return {\n    plugins: [\n      decoratorMetadata({\n        root: options.root,\n        tsconfig: options.tsconfig,\n        transformers: options.transformers,\n      }),\n      ...(options.assets?.length\n        ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })]\n        : []),\n      nodeManifest({\n        project: options.project,\n        workspaceRoot: options.workspaceRoot,\n        outDir,\n      }),\n    ],\n    resolve: { alias: tsconfigAliases(options.workspaceRoot) },\n    ssr: {\n      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require(\"tslib\")`\n      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into\n      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and\n      // the manifest nx generates from the project graph does not list it, because no module\n      // DECLARES tslib. The image therefore did not install it and the service died on its first\n      // require, only in the image: locally and in CI the workspace root has tslib.\n      noExternal: ['tslib'],\n    },\n    build: {\n      // An SSR build targets Node and leaves real packages external, which is what\n      // `webpack-node-externals` did: the image installs them from the generated manifest.\n      ssr: entry,\n      outDir,\n      emptyOutDir: true,\n      sourcemap: true,\n      target: 'node20',\n      // The bundle is read by humans when a stack trace points into it, and minifying a\n      // server bundle buys nothing: it is never downloaded.\n      minify: false,\n      rollupOptions: {\n        output: {\n          format: 'cjs',\n          // One output file per source module, instead of hoisting everything into one scope.\n          //\n          // This is not a preference, it is the only shape that keeps the OpenAPI contract.\n          // Merging every module into one scope forces Rollup to rename duplicate class names,\n          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently\n          // becomes a renamed schema in the published API. Measured on `network`, which has two\n          // such collisions: single bundle renames `InvalidPermissionError` and\n          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the\n          // committed contract byte for byte.\n          //\n          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under\n          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.\n          preserveModules: true,\n          // The image runs `./dist/main.js`, so the entry keeps that name at the root while\n          // every other module keeps its own path. Under `preserveModules` a plain string here\n          // would be applied to all of them, which numbers them (`main962.js`) and loses the\n          // entry.\n          entryFileNames: (chunk) => (chunk.facadeModuleId === entry ? 'main.js' : '[name].js'),\n        },\n        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog\n        // when its module loads, and nothing references that module afterwards. Rollup may\n        // drop such a module; webpack never did.\n        //\n        // Measured on the first migrated service this changes nothing, so it is insurance\n        // rather than a fix, and it is recorded as such rather than credited with the smaller\n        // bundle (that comes from barrel re-exports the service does not use).\n        treeshake: { moduleSideEffects: true },\n      },\n    },\n  }\n}\n\nexport const nestService = (options: NestServiceOptions): UserConfig =>\n  options.overrides === undefined\n    ? baseConfig(options)\n    : mergeConfig(baseConfig(options), options.overrides)\n","/**\n * The files a service ships beside its bundle, which webpack copied and a bundler does not.\n *\n * `@nx/webpack` takes an `assets` list and copies each match into the output. Nothing in a Vite\n * build does that for a Node target: `publicDir` is a browser concept and is disabled for SSR\n * builds, so an unmigrated `assets` entry is not a smaller output, it is a service that starts\n * and then fails the first time it reaches for a file that is not there.\n *\n * One service in this repo declares it. `planning-period` ships the pug templates, stylesheet and\n * font it renders printed documents from, under `templates/`. Dropping them leaves a build that\n * succeeds, an image that boots, and a printing feature that throws.\n *\n * ## Copied at `closeBundle`, and only what the target declared\n *\n * The declaration is carried through from the webpack target unchanged, globs and all, so this\n * plugin has nothing to decide: it resolves each `input` against the workspace root, matches the\n * glob, and writes under `output` inside the bundle's directory. `closeBundle` because that is\n * when the output directory exists and Vite has finished emptying it.\n *\n * An entry matching nothing FAILS the build. A glob that has quietly stopped matching is the same\n * silent loss as no glob at all, and the point of this file is that this class of loss is loud.\n */\nimport { cpSync, existsSync, mkdirSync, readdirSync, statSync } from 'node:fs'\nimport { dirname, join, relative, sep } from 'node:path'\n\nimport type { Plugin } from 'vite'\n\nimport type { AssetDeclaration } from './nx-target.js'\n\nexport interface CopyAssetsOptions {\n  /** Absolute path to the workspace root, which `input` is relative to. */\n  workspaceRoot: string\n  /** Absolute path to the build's output directory. */\n  outDir: string\n  assets: readonly AssetDeclaration[]\n}\n\n/**\n * `@nx/webpack`'s glob dialect, reduced to what it means for a file name.\n *\n * Only the forms the declarations here use are supported, and anything else is rejected at build\n * time rather than silently matching nothing: `**` for any depth, `*` within a segment, and a\n * `{a,b}` alternation. Written out rather than pulled from a glob library because the whole\n * dependency would exist to read one line of configuration.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let pattern = ''\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index] ?? ''\n    if (char === '*') {\n      if (glob[index + 1] === '*') {\n        // `**/` matches any number of directories, including none.\n        pattern += glob[index + 2] === '/' ? '(?:.*/)?' : '.*'\n        index += glob[index + 2] === '/' ? 2 : 1\n      } else {\n        pattern += '[^/]*'\n      }\n      continue\n    }\n    if (char === '{') {\n      const close = glob.indexOf('}', index)\n      if (close === -1)\n        throw new Error(`sentinel build(nest): unbalanced \\`{\\` in asset glob ${glob}`)\n      const alternatives = glob.slice(index + 1, close).split(',')\n      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')).join('|')})`\n      index = close\n      continue\n    }\n    pattern += char.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  }\n  return new RegExp(`^${pattern}$`)\n}\n\n/** Every file under `root`, as paths relative to it and with forward slashes. */\nfunction filesUnder(root: string): string[] {\n  const found: string[] = []\n  const walk = (dir: string): void => {\n    for (const entry of readdirSync(dir)) {\n      const full = join(dir, entry)\n      if (statSync(full).isDirectory()) walk(full)\n      else found.push(relative(root, full).split(sep).join('/'))\n    }\n  }\n  walk(root)\n  return found\n}\n\n/** What each declaration copies, or the reason it cannot. */\nexport function resolveAssets(options: CopyAssetsOptions): { from: string; to: string }[] {\n  const copies: { from: string; to: string }[] = []\n  for (const asset of options.assets) {\n    const input = join(options.workspaceRoot, asset.input)\n    if (!existsSync(input)) {\n      throw new Error(\n        `sentinel build(nest): the build target declares an asset from \\`${asset.input}\\`, which ` +\n          `does not exist. webpack copied it into the output, so the built service would be ` +\n          `missing files it reads at runtime.`,\n      )\n    }\n    const matcher = globToRegExp(asset.glob)\n    const matched = filesUnder(input).filter((file) => matcher.test(file))\n    if (matched.length === 0) {\n      throw new Error(\n        `sentinel build(nest): the asset glob \\`${asset.glob}\\` under \\`${asset.input}\\` matches ` +\n          `no file. An entry that matches nothing is the same silent loss as no entry at all.`,\n      )\n    }\n    for (const file of matched) {\n      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) })\n    }\n  }\n  return copies\n}\n\nexport const copyAssets = (options: CopyAssetsOptions): Plugin => ({\n  name: 'sentinel:copy-assets',\n  // After the bundle is written and the output directory has stopped being emptied.\n  closeBundle() {\n    for (const { from, to } of resolveAssets(options)) {\n      mkdirSync(dirname(to), { recursive: true })\n      cpSync(from, to)\n    }\n  },\n})\n","/**\n * The pruned `package.json` and lockfile a Node image installs from.\n *\n * This is the half that made the nx executor look load-bearing. `--generatePackageJson` was an\n * option of `@nx/webpack:webpack`, and the backend image is built on its two outputs:\n *\n *   COPY --from=build /app/dist/apps/nest/<service>/package.json   /app/package.json\n *   COPY --from=build /app/dist/apps/nest/<service>/pnpm-lock.yaml /app/pnpm-lock.yaml\n *   RUN pnpm i --prod=true --frozen-lockfile\n *\n * It is not bound to the executor. The executor supplies one thing, the project graph, and\n * every function that does the work is exported by `@nx/js`. So the same two files can be\n * produced from a Vite plugin, and `--frozen-lockfile` accepting them afterwards is the proof\n * that they agree with each other: pnpm refuses the install otherwise.\n *\n * ## Why the graph, and not something simpler\n *\n * A Nest service here declares almost nothing of its own: measured, one dependency in its\n * manifest against 1463 installed in its image. Everything it uses is declared at the\n * workspace root and reaches it through source imports. So the dependency list can only be\n * computed from what the code imports, which is what the graph knows.\n *\n * Deriving it from the bundle's own externals is not equivalent either: measured on the first\n * service, the bundle statically requires 42 packages while the correct manifest holds 65. The\n * 23 missing ones are transitive or required dynamically at runtime (`fastify` behind\n * `@nestjs/platform-fastify`, `jsonwebtoken`, the LaunchDarkly SDK). Shipping the short list\n * fails in production, not in the build.\n */\nimport { existsSync, writeFileSync } from 'node:fs'\nimport { isBuiltin } from 'node:module'\nimport { join } from 'node:path'\n\nimport type { Plugin, Rollup } from 'vite'\n\nexport interface NodeManifestOptions {\n  /** The nx project name, which is how the graph is keyed. */\n  project: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Where the bundle is written; the two files land beside it. */\n  outDir: string\n  /** Entry file name, written as `main` so `node .` resolves inside the image. */\n  entry?: string\n  /**\n   * Packages the IMAGE provides, which are therefore allowed to be required without being\n   * declared in the manifest.\n   *\n   * The generated Prisma clients are the case this exists for: the Dockerfile copies\n   * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module\n   * declares them. Everything else that is required and undeclared is a bug, and the check\n   * below refuses the build.\n   */\n  providedByImage?: readonly string[]\n}\n\n/** What the Dockerfile copies in itself, so requiring it without declaring it is legitimate. */\nconst DEFAULT_PROVIDED_BY_IMAGE = ['@prisma'] as const\n\n/**\n * Every real package the emitted output requires, from Rollup's own record rather than a scan\n * of the text.\n *\n * `chunk.imports` mixes three things, and only the third is a dependency:\n *\n *  - other EMITTED chunks. Under `preserveModules` these are relative output paths that do not\n *    begin with `.`, so `apps/…`, `libs/…` and `_virtual/…` read exactly like package names.\n *    They are recognised by being keys of the bundle itself.\n *  - Node BUILTINS, which appear both bare (`crypto`) and prefixed (`node:crypto`).\n *  - genuine external packages, which is what the manifest has to cover.\n */\nconst externalPackages = (bundle: Rollup.OutputBundle): Set<string> => {\n  const emitted = new Set(Object.keys(bundle))\n  const packages = new Set<string>()\n\n  for (const emittedFile of Object.values(bundle)) {\n    // Assets carry no imports, and the bundle holds both. Narrowing on the discriminant is what\n    // replaced a cast through `unknown`, which asserted the same thing without checking it.\n    if (emittedFile.type !== 'chunk') continue\n\n    for (const imported of emittedFile.imports) {\n      if (emitted.has(imported)) continue\n      if (imported.startsWith('.') || imported.startsWith('/')) continue\n      if (isBuiltin(imported)) continue\n\n      const parts = imported.split('/')\n      const name = imported.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]\n      if (name) packages.add(name)\n    }\n  }\n  return packages\n}\n\n/**\n * Writes the manifest and lockfile once the bundle is on disk.\n *\n * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the\n * directory and cannot be cleared by `emptyOutDir`.\n *\n * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left\n * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it\n * became the one Vite printed, hiding the failure that actually stopped the build. It cost two\n * diagnoses before being recognised, so the missing directory is now read as what it is: the\n * bundle was never written, and this plugin has nothing to say about why.\n */\nexport const nodeManifest = (options: NodeManifestOptions): Plugin => {\n  /*\n   * Captured while the bundle still exists in memory, and read back once the manifest is built.\n   *\n   * `undefined` until `generateBundle` runs, deliberately: an empty SET would make the coverage\n   * check below pass by having seen nothing, which is the worst way for a guard to succeed. The\n   * two states have to be told apart.\n   */\n  let required: Set<string> | undefined\n\n  return {\n    name: 'sentinel:node-manifest',\n    apply: 'build',\n\n    generateBundle(_outputOptions, bundle) {\n      required = externalPackages(bundle)\n    },\n\n    async closeBundle() {\n      // `closeBundle` runs after a FAILED build too. The ENTRY is what says a bundle was really\n      // written: `emptyOutDir` leaves the directory in place, so its existence alone would let a\n      // failed build still produce a manifest describing nothing.\n      const entry = options.entry ?? 'main.js'\n      if (!existsSync(join(options.outDir, entry))) return\n\n      // Imported here rather than at module scope: a front config importing this file must not\n      // pay for loading the nx graph machinery it will never call.\n      const { createProjectGraphAsync } = await import('nx/src/devkit-exports.js')\n      const { createPackageJson, createLockFile, getLockFileName } = await import('@nx/js')\n\n      const graph = await createProjectGraphAsync({ exitOnError: false })\n      const manifest = createPackageJson(options.project, graph, {\n        root: options.workspaceRoot,\n        isProduction: true,\n      })\n      manifest.main = entry\n\n      if (required === undefined) {\n        throw new Error(\n          `sentinel build(nest): the bundle was written but never inspected, so the manifest ` +\n            `could not be checked against what it requires. Refusing to write one that might ` +\n            `not install.`,\n        )\n      }\n      assertManifestCovers(required, manifest, options)\n\n      writeFileSync(join(options.outDir, 'package.json'), `${JSON.stringify(manifest, null, 2)}\\n`)\n      writeFileSync(\n        join(options.outDir, getLockFileName('pnpm')),\n        createLockFile(manifest, graph, 'pnpm'),\n      )\n    },\n  }\n}\n\n/**\n * Refuse a bundle that requires something the image will not install.\n *\n * The manifest is derived from the project GRAPH, so it lists what modules declare. The bundle\n * requires what the bundler left external. Those two sets agreeing is an assumption, and it was\n * wrong: `tslib` arrives through `importHelpers` in the workspace tsconfig without any module\n * declaring it, so the manifest omitted it and the service died on its first require.\n *\n * It died only in the image. Locally and in CI the workspace root has the package, so the gap is\n * invisible until a container starts, which is the most expensive place to discover it. Checking\n * here turns that into a build failure naming the package.\n */\nconst assertManifestCovers = (\n  required: ReadonlySet<string>,\n  manifest: { dependencies?: Record<string, string> },\n  options: NodeManifestOptions,\n): void => {\n  const declared = new Set(Object.keys(manifest.dependencies ?? {}))\n  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE\n  const missing = [...required]\n    .filter((name) => !declared.has(name))\n    .filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`)))\n    .sort()\n\n  if (missing.length === 0) return\n\n  throw new Error(\n    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated ` +\n      `manifest does not declare, so the image would not install them: ${missing.join(', ')}. ` +\n      `Either declare them in the module's package.json, inline them with ` +\n      `\\`ssr.noExternal\\`, or list them in \\`providedByImage\\` if the Dockerfile copies them in.`,\n  )\n}\n","/**\n * What `@hublo/sentinel/build/nest` gives an adopted service.\n *\n * The sibling `build/react` entry is a re-export surface: the module keeps its own config and\n * only its import lines move. This one carries a shape as well, because 38 Nest services share\n * one config and have nothing of their own to preserve. See `nest-service.ts` for why the two\n * answers differ, and why that is one rule rather than two.\n *\n * Its own entry point, like the React one, so importing it at build time never drags the CLI\n * and its adapters into a Vite config.\n */\nexport { nestService, type NestServiceOptions } from './nest-service.js'\n\n// The pieces the shape is built from, exported individually so a service that needs something\n// the shape does not give it can compose its own without leaving sentinel.\nexport { decoratorMetadata, type DecoratorMetadataOptions } from './decorator-metadata.js'\nexport { nodeManifest, type NodeManifestOptions } from './node-manifest.js'\nexport { tsconfigAliases, type Alias } from './tsconfig-aliases.js'\n\n// Vite's own, so an adopted config imports everything from one place and the module can drop\n// `vite` from its dependencies.\nexport { defineConfig, loadEnv, mergeConfig } from 'vite'\nexport type { Plugin, PluginOption, UserConfig, UserConfigExport } from 'vite'\n"],"mappings":";;;;;;AA0BA,SAAS,QAAAA,aAAY;AAErB,SAAS,mBAAoC;;;ACN7C,SAAS,QAAQ,YAAY,WAAW,aAAa,gBAAgB;AACrE,SAAS,SAAS,MAAM,UAAU,WAAW;AAsB7C,SAAS,aAAa,MAAsB;AAC1C,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,QAAI,SAAS,KAAK;AAChB,UAAI,KAAK,QAAQ,CAAC,MAAM,KAAK;AAE3B,mBAAW,KAAK,QAAQ,CAAC,MAAM,MAAM,aAAa;AAClD,iBAAS,KAAK,QAAQ,CAAC,MAAM,MAAM,IAAI;AAAA,MACzC,OAAO;AACL,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB,YAAM,QAAQ,KAAK,QAAQ,KAAK,KAAK;AACrC,UAAI,UAAU;AACZ,cAAM,IAAI,MAAM,wDAAwD,IAAI,EAAE;AAChF,YAAM,eAAe,KAAK,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3D,iBAAW,MAAM,aAAa,IAAI,CAAC,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,cAAQ;AACR;AAAA,IACF;AACA,eAAW,KAAK,QAAQ,sBAAsB,MAAM;AAAA,EACtD;AACA,SAAO,IAAI,OAAO,IAAI,OAAO,GAAG;AAClC;AAGA,SAAS,WAAW,MAAwB;AAC1C,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,QAAsB;AAClC,eAAW,SAAS,YAAY,GAAG,GAAG;AACpC,YAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,UAAI,SAAS,IAAI,EAAE,YAAY,EAAG,MAAK,IAAI;AAAA,UACtC,OAAM,KAAK,SAAS,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,OAAK,IAAI;AACT,SAAO;AACT;AAGO,SAAS,cAAc,SAA4D;AACxF,QAAM,SAAyC,CAAC;AAChD,aAAW,SAAS,QAAQ,QAAQ;AAClC,UAAM,QAAQ,KAAK,QAAQ,eAAe,MAAM,KAAK;AACrD,QAAI,CAAC,WAAW,KAAK,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,mEAAmE,MAAM,KAAK;AAAA,MAGhF;AAAA,IACF;AACA,UAAM,UAAU,aAAa,MAAM,IAAI;AACvC,UAAM,UAAU,WAAW,KAAK,EAAE,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AACrE,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,0CAA0C,MAAM,IAAI,cAAc,MAAM,KAAK;AAAA,MAE/E;AAAA,IACF;AACA,eAAW,QAAQ,SAAS;AAC1B,aAAO,KAAK,EAAE,MAAM,KAAK,OAAO,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,MAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,aAAa,CAAC,aAAwC;AAAA,EACjE,MAAM;AAAA;AAAA,EAEN,cAAc;AACZ,eAAW,EAAE,MAAM,GAAG,KAAK,cAAc,OAAO,GAAG;AACjD,gBAAU,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1C,aAAO,MAAM,EAAE;AAAA,IACjB;AAAA,EACF;AACF;;;AC/FA,SAAS,cAAAC,aAAY,qBAAqB;AAC1C,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AA0BrB,IAAM,4BAA4B,CAAC,SAAS;AAc5C,IAAM,mBAAmB,CAAC,WAA6C;AACrE,QAAM,UAAU,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AAEjC,aAAW,eAAe,OAAO,OAAO,MAAM,GAAG;AAG/C,QAAI,YAAY,SAAS,QAAS;AAElC,eAAW,YAAY,YAAY,SAAS;AAC1C,UAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,UAAI,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,GAAG,EAAG;AAC1D,UAAI,UAAU,QAAQ,EAAG;AAEzB,YAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,YAAM,OAAO,SAAS,WAAW,GAAG,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC;AAC7E,UAAI,KAAM,UAAS,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAcO,IAAM,eAAe,CAAC,YAAyC;AAQpE,MAAI;AAEJ,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IAEP,eAAe,gBAAgB,QAAQ;AACrC,iBAAW,iBAAiB,MAAM;AAAA,IACpC;AAAA,IAEA,MAAM,cAAc;AAIlB,YAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAI,CAACD,YAAWC,MAAK,QAAQ,QAAQ,KAAK,CAAC,EAAG;AAI9C,YAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,0BAA0B;AAC3E,YAAM,EAAE,mBAAmB,gBAAgB,gBAAgB,IAAI,MAAM,OAAO,QAAQ;AAEpF,YAAM,QAAQ,MAAM,wBAAwB,EAAE,aAAa,MAAM,CAAC;AAClE,YAAM,WAAW,kBAAkB,QAAQ,SAAS,OAAO;AAAA,QACzD,MAAM,QAAQ;AAAA,QACd,cAAc;AAAA,MAChB,CAAC;AACD,eAAS,OAAO;AAEhB,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,2BAAqB,UAAU,UAAU,OAAO;AAEhD,oBAAcA,MAAK,QAAQ,QAAQ,cAAc,GAAG,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5F;AAAA,QACEA,MAAK,QAAQ,QAAQ,gBAAgB,MAAM,CAAC;AAAA,QAC5C,eAAe,UAAU,OAAO,MAAM;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAcA,IAAM,uBAAuB,CAC3B,UACA,UACA,YACS;AACT,QAAM,WAAW,IAAI,IAAI,OAAO,KAAK,SAAS,gBAAgB,CAAC,CAAC,CAAC;AACjE,QAAM,WAAW,QAAQ,mBAAmB;AAC5C,QAAM,UAAU,CAAC,GAAG,QAAQ,EACzB,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,EACpC,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC,EAC7F,KAAK;AAER,MAAI,QAAQ,WAAW,EAAG;AAE1B,QAAM,IAAI;AAAA,IACR,6CAA6C,QAAQ,MAAM,6FACU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAGzF;AACF;;;AF/GA,IAAM,aAAa,CAAC,YAA4C;AAC9D,QAAM,SAASC,MAAK,QAAQ,eAAe,QAAQ,UAAU,QAAQ,QAAQ,OAAO,EAAE;AACtF,QAAM,QAAQA,MAAK,QAAQ,MAAM,QAAQ,SAAS,aAAa;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,MACP,kBAAkB;AAAA,QAChB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,GAAI,QAAQ,QAAQ,SAChB,CAAC,WAAW,EAAE,eAAe,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACrF,CAAC;AAAA,MACL,aAAa;AAAA,QACX,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,SAAS,EAAE,OAAO,gBAAgB,QAAQ,aAAa,EAAE;AAAA,IACzD,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOH,YAAY,CAAC,OAAO;AAAA,IACtB;AAAA,IACA,OAAO;AAAA;AAAA;AAAA,MAGL,KAAK;AAAA,MACL;AAAA,MACA,aAAa;AAAA,MACb,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA;AAAA,MAGR,QAAQ;AAAA,MACR,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAaR,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,UAKjB,gBAAgB,CAAC,UAAW,MAAM,mBAAmB,QAAQ,YAAY;AAAA,QAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,WAAW,EAAE,mBAAmB,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,cAAc,CAAC,YAC1B,QAAQ,cAAc,SAClB,WAAW,OAAO,IAClB,YAAY,WAAW,OAAO,GAAG,QAAQ,SAAS;;;AGzIxD,SAAS,cAAc,SAAS,eAAAC,oBAAmB;","names":["join","existsSync","join","join","mergeConfig"]}

package/dist/roles/build/toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/roles/build/toolchain.ts"],"sourcesContent":["/**\n * The build toolchain, re-exported so an app imports it from sentinel instead of from the\n * workspace root.\n *\n * This is what makes adoption a REFACTOR rather than a rewrite, and it is the whole point.\n * Today `vite`, `@vitejs/plugin-react`, `@tailwindcss/vite`, `vite-plugin-svgr` and `nitro`\n * sit in the monorepo's root `package.json`, which is what stops any front app from being\n * built or moved on its own. An app adopts by changing WHERE its tools come from, and nothing\n * else: every attribute of its config, every alias, every path stays exactly as it was.\n *\n * The alternative was to read the app's config and rebuild it around `reactApp`. That was\n * designed and rejected, correctly: it means understanding a file that is code rather than\n * configuration, and its failure mode is a build that SUCCEEDS and ships the wrong bundle.\n * Here there is nothing to understand, so there is nothing to lose. The two configs are\n * equivalent by construction, because only the import specifiers changed.\n *\n * `reactApp` remains, and stays optional: an app that wants the shared composition adopts it\n * as a second, separate step, with `--inspect --build` to check the result. Nobody has to do\n * that to unblock the root.\n *\n * TanStack is deliberately NOT here. 48 app source files import `@tanstack/react-start`\n * directly, so it is a framework the app codes against rather than a tool that builds it, and\n * the router plugin generates the app's own route tree. Same for `@rolldown/plugin-babel` and\n * `@locator/babel-jsx`, which the apps declare themselves: verified, neither is at the root,\n * so neither is sentinel's to take.\n */\nexport { default as tailwindcss } from '@tailwindcss/vite'\nexport { default as react } from '@vitejs/plugin-react'\nexport { nitro } from 'nitro/vite'\nexport { default as svgr } from 'vite-plugin-svgr'\n\n/**\n * Vite's own API, re-exported for the same reason.\n *\n * `defineConfig`, `loadEnv` and `mergeConfig` are what the configs in this repo import from\n * `vite`; once the root drops the package, those imports are the ones that stop resolving.\n * `mergeConfig` is here because of a file the build role nearly missed: `vitest.config.ts`.\n * Three of them import from `vite` (career and host-admin take `loadEnv`, `libs/front/ui`\n * takes `mergeConfig`), and they are a SECOND door into the same toolchain. Note that\n * `vitest/config` exports a `mergeConfig` of its own, which is vitest's and stays put: the\n * rewriter matches on the specifier, never on the name. The types travel\n * with them, because a config that imports `PluginOption` from a package it no longer declares\n * fails to typecheck even though it builds.\n */\nexport { defineConfig, loadEnv, mergeConfig } from 'vite'\nexport type {\n  Plugin,\n  PluginOption,\n  SassPreprocessorOptions,\n  UserConfig,\n  UserConfigExport,\n} from 'vite'\n"],"mappings":";AA0BA,SAAoB,WAAXA,gBAA8B;AACvC,SAAoB,WAAXA,gBAAwB;AACjC,SAAS,aAAa;AACtB,SAAoB,WAAXA,gBAAuB;AAehC,SAAS,cAAc,SAAS,mBAAmB;","names":["default"]}