@hublo/sentinel 1.4.0-alpha.30 → 1.4.0-alpha.32

package/README.md

@@ -24,6 +24,7 @@ A large monorepo accumulates:
 - **One source of truth for config** — every project just `extends @hublo/sentinel/...`; the actual rules live in one versioned place. Change a rule once, everyone gets it on the next version bump.
 - **One source of truth for tooling dependencies** — a project depends on `@hublo/sentinel`, not on a scattered pile of eslint / vitest / plugin devDeps. Bump one version and the whole toolchain moves, atomically, tested in isolation first.
 - **`--init` sets a module up** — the one command generates the stubs the first time (**adopt**), regenerates them after a change like a runner swap (**refresh**), and applies the workspace prep the module needs. Run it module by module to roll out gradually. (`--migrate`, for changing an already-initialized setup, is a reserved future verb.)
+- **`--validate` proves the move did not change anything** — a verb of its own, because what separates it from `--init` is what SURVIVES the run: `--init` and `--migrate` write state that REMAINS, `--validate` may instrument the module it is proving provided nothing it writes stays. Run before a migration it records what the module does today; run after, it compares and refuses a run that lost a test or invented one. It composes with every type, and answers "not available yet" for the ones without a proof rather than calling a valid command wrong.
 - **Move one module at a time** — installed per module, so you adopt at your pace; a module can adopt sentinel while its neighbour keeps the old setup. No big-bang.
 - **Swap tools without touching projects** — change eslint → biome (or benchmark them) in one place; `--init` regenerates the stubs.
 - **No silent drift** — the guard keeps every project's config converged on the source of truth.

package/dist/bin/sentinel.js

@@ -15,10 +15,11 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-Y2EKU6OE.js";
+} from "../chunk-SPW4KIQX.js";
 import {
   resolveContext
-} from "../chunk-GCZKG4B2.js";
+} from "../chunk-ORESQJAU.js";
+import "../chunk-O7REVMOC.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
@@ -143,7 +144,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-ONAQPYJB.js");
+  const { validateModuleTests } = await import("../validate-5GABSOYH.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/chunk-O7REVMOC.js

@@ -0,0 +1,38 @@
+// src/shared/glob.ts
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let index = 0; index < glob.length; index++) {
+    const char = glob[index] ?? "";
+    if (char === "*") {
+      if (glob[index + 1] === "*") {
+        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
+        index += glob[index + 2] === "/" ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "{") {
+      const close = glob.indexOf("}", index);
+      if (close === -1) throw new Error(`sentinel: unbalanced \`{\` in glob ${glob}`);
+      const alternatives = glob.slice(index + 1, close).split(",");
+      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+      index = close;
+      continue;
+    }
+    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function matchesTsconfigPattern(pattern, relative) {
+  const cleaned = pattern.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (globToRegExp(cleaned).test(relative)) return true;
+  const asDirectory = cleaned.endsWith("/**") ? cleaned.slice(0, -3) : cleaned;
+  return globToRegExp(`${asDirectory}/**/*`).test(relative);
+}
+
+export {
+  globToRegExp,
+  matchesTsconfigPattern
+};
+//# sourceMappingURL=chunk-O7REVMOC.js.map

package/dist/chunk-O7REVMOC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/glob.ts"],"sourcesContent":["/**\n * The glob dialect a config file uses for a FILE NAME, reduced to what that needs.\n *\n * Shared because two roles read globs out of configuration and neither needs a glob library: the\n * build role reads `@nx/webpack`'s asset declarations, and the test role reads a tsconfig's\n * `include` and `exclude`. A second copy of this would drift from the first, which is a mistake\n * this package has already made once with the binary resolver.\n *\n * Three forms, and anything else is taken literally: `**` for any depth, `*` within a segment, and\n * a `{a,b}` alternation. A pattern that uses something else matches nothing rather than matching\n * by accident, which is the behaviour a caller can check.\n */\nexport function globToRegExp(glob: string): RegExp {\n  let pattern = ''\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index] ?? ''\n    if (char === '*') {\n      if (glob[index + 1] === '*') {\n        // `**/` matches any number of directories, including none.\n        pattern += glob[index + 2] === '/' ? '(?:.*/)?' : '.*'\n        index += glob[index + 2] === '/' ? 2 : 1\n      } else {\n        pattern += '[^/]*'\n      }\n      continue\n    }\n    if (char === '{') {\n      const close = glob.indexOf('}', index)\n      if (close === -1) throw new Error(`sentinel: unbalanced \\`{\\` in glob ${glob}`)\n      const alternatives = glob.slice(index + 1, close).split(',')\n      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')).join('|')})`\n      index = close\n      continue\n    }\n    pattern += char.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  }\n  return new RegExp(`^${pattern}$`)\n}\n\n/**\n * A tsconfig's `include` / `exclude`, applied to a path relative to that config.\n *\n * ⚠️ A tsconfig pattern ending in a DIRECTORY matches everything under it, and one naming no\n * extension matches the TypeScript ones. `src/tests/functional/**` and `src/tests` both have to\n * claim `src/tests/functional/a.spec.ts`, which a plain file-name match does not do.\n */\nexport function matchesTsconfigPattern(pattern: string, relative: string): boolean {\n  const cleaned = pattern.replace(/^\\.\\//, '').replace(/\\/+$/, '')\n  if (globToRegExp(cleaned).test(relative)) return true\n  // A directory, named with or without a trailing `/**`, claims everything beneath it.\n  const asDirectory = cleaned.endsWith('/**') ? cleaned.slice(0, -3) : cleaned\n  return globToRegExp(`${asDirectory}/**/*`).test(relative)\n}\n"],"mappings":";AAYO,SAAS,aAAa,MAAsB;AACjD,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,QAAI,SAAS,KAAK;AAChB,UAAI,KAAK,QAAQ,CAAC,MAAM,KAAK;AAE3B,mBAAW,KAAK,QAAQ,CAAC,MAAM,MAAM,aAAa;AAClD,iBAAS,KAAK,QAAQ,CAAC,MAAM,MAAM,IAAI;AAAA,MACzC,OAAO;AACL,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB,YAAM,QAAQ,KAAK,QAAQ,KAAK,KAAK;AACrC,UAAI,UAAU,GAAI,OAAM,IAAI,MAAM,sCAAsC,IAAI,EAAE;AAC9E,YAAM,eAAe,KAAK,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3D,iBAAW,MAAM,aAAa,IAAI,CAAC,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,cAAQ;AACR;AAAA,IACF;AACA,eAAW,KAAK,QAAQ,sBAAsB,MAAM;AAAA,EACtD;AACA,SAAO,IAAI,OAAO,IAAI,OAAO,GAAG;AAClC;AASO,SAAS,uBAAuB,SAAiB,UAA2B;AACjF,QAAM,UAAU,QAAQ,QAAQ,SAAS,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAC/D,MAAI,aAAa,OAAO,EAAE,KAAK,QAAQ,EAAG,QAAO;AAEjD,QAAM,cAAc,QAAQ,SAAS,KAAK,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACrE,SAAO,aAAa,GAAG,WAAW,OAAO,EAAE,KAAK,QAAQ;AAC1D;","names":[]}

package/dist/{chunk-GCZKG4B2.js → chunk-ORESQJAU.js}

@@ -1,3 +1,6 @@
+import {
+  matchesTsconfigPattern
+} from "./chunk-O7REVMOC.js";
 import {
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
@@ -208,11 +211,11 @@ function readTestConfigSource(cwd, fileName) {
     return "";
   }
 }
-function importsPreset(source) {
-  return ALL_TEST_PRESET_SPECIFIERS.some((specifier) => {
+function importedTestPreset(source) {
+  return Object.entries(TEST_PRESET_SPECIFIERS).find(([, specifier]) => {
     const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     return new RegExp(String.raw`(?:from|import)\s*\(?\s*['"]${escaped}['"]`).test(source);
-  });
+  })?.[0];
 }
 function readTestAdoption(cwd) {
   const manifest = readProjectPackageJson(cwd);
@@ -254,11 +257,12 @@ function readTestAdoption(cwd) {
       ownDeclarations
     };
   }
-  const adopted = importsPreset(source);
+  const preset = importedTestPreset(source);
+  const adopted = preset !== void 0;
   const script = moduleScripts(cwd)["test"];
   return {
     configFile,
-    preset: adopted ? "react" : null,
+    preset: preset ?? null,
     adopted,
     conformant: adopted && script !== void 0 && jestConfigs.length === 0,
     drift: [],
@@ -558,15 +562,32 @@ function unusableAsBaseline(snapshot) {
   }
   return void 0;
 }
+var EXAMPLE_LIMIT = 60;
+function oneLine(text) {
+  return text.replaceAll(/\s+/g, " ").trim();
+}
+function capped(text) {
+  if (text.length <= EXAMPLE_LIMIT) return text;
+  const half = Math.floor((EXAMPLE_LIMIT - 1) / 2);
+  return `${text.slice(0, half)}\u2026${text.slice(-half)}`;
+}
 function renamedExample(before, after) {
-  let shared = 0;
-  while (shared < before.length && shared < after.length && before[shared] === after[shared]) {
-    shared += 1;
-  }
-  const boundary = before.lastIndexOf(" ", shared);
-  const from = boundary > 0 ? boundary + 1 : 0;
-  const ellipsis = from > 0 ? "\u2026" : "";
-  return `"${ellipsis}${before.slice(from)}" -> "${ellipsis}${after.slice(from)}"`;
+  const from = oneLine(before);
+  const to = oneLine(after);
+  let head = 0;
+  while (head < from.length && head < to.length && from[head] === to[head]) head += 1;
+  const headBoundary = from.lastIndexOf(" ", head - 1);
+  const start = headBoundary > 0 ? headBoundary + 1 : 0;
+  let tail = 0;
+  const room = Math.min(from.length, to.length) - start;
+  while (tail < room && from.at(-1 - tail) === to.at(-1 - tail)) tail += 1;
+  const tailBoundary = from.indexOf(" ", from.length - tail);
+  const cut = tailBoundary > start ? from.length - tailBoundary : 0;
+  const lead = start > 0 ? "\u2026" : "";
+  const trail = cut > 0 ? "\u2026" : "";
+  const left = capped(from.slice(start, from.length - cut));
+  const right = capped(to.slice(start, to.length - cut));
+  return `"${lead}${left}${trail}" -> "${lead}${right}${trail}"`;
 }
 function describeComparison(comparison) {
   const firstRename = comparison.renamed[0];
@@ -650,7 +671,10 @@ function captureReference(cwd, config) {
   if (unusable !== void 0) {
     return {
       captured: false,
-      message: `no reference recorded: ${unusable} The migration is applied anyway, unproved.`
+      // The period matters: every `unusableAsBaseline` reason is a full sentence and none of them
+      // ends in one, so concatenating ran the cause straight into the consequence. Measured on
+      // `recruitment [functional]`: "…no claim to preserve The migration is applied anyway".
+      message: `no reference recorded: ${unusable}. The migration is applied anyway, unproved.`
     };
   }
   const stored = {
@@ -899,9 +923,11 @@ function vitestSupportName(relative6) {
   return `${directory}${VITEST_PREFIX}${base.slice(JEST_PREFIX.length)}`;
 }
 
-// src/roles/test/codemod/migrate-file.ts
-import { dirname as dirname6 } from "node:path";
-import { parseSync as parseSync6 } from "oxc-parser";
+// src/roles/test/codemod/inject-type-import.ts
+import { parseSync as parseSync3 } from "oxc-parser";
+
+// src/roles/test/codemod/rename.ts
+import { parseSync as parseSync2 } from "oxc-parser";
 
 // src/shared/ast.ts
 var SKIP = /* @__PURE__ */ Symbol("skip-subtree");
@@ -918,6 +944,186 @@ function walk(node, visit) {
   }
 }
 
+// src/roles/test/codemod/rename.ts
+var VITEST_TYPE_SOURCE = "vitest";
+var RUNTIME_RENAMES = /* @__PURE__ */ new Set([
+  // Mocks
+  "clearAllMocks",
+  "doMock",
+  "fn",
+  "mock",
+  "mocked",
+  "resetAllMocks",
+  "resetModules",
+  "restoreAllMocks",
+  "spyOn",
+  "unmock",
+  /*
+   * Timers, as a family rather than as the two the corpus happens to use today. Running this over
+   * the repo reported `jest.runAllTimers` as unknown, which was a hole in the table rather than a
+   * finding about the code. Each name here was then checked against a running Vitest, so adding the
+   * siblings is not speculation: a file gaining one tomorrow gets the same answer as one using it
+   * today, instead of a report about a member that was always going to be a rename.
+   */
+  "advanceTimersByTime",
+  "advanceTimersByTimeAsync",
+  "advanceTimersToNextTimer",
+  "clearAllTimers",
+  "getRealSystemTime",
+  "getTimerCount",
+  "runAllTimers",
+  "runAllTimersAsync",
+  "runOnlyPendingTimers",
+  "setSystemTime",
+  "useFakeTimers",
+  "useRealTimers"
+]);
+var TYPE_RENAMES = {
+  Mock: "Mock",
+  MockedClass: "MockedClass",
+  MockedFunction: "MockedFunction",
+  MockedObject: "MockedObject",
+  Mocked: "Mocked",
+  SpiedFunction: "MockInstance",
+  SpyInstance: "MockInstance"
+};
+var NAMED_RULE = {
+  requireActual: `await vi.importActual(...), which makes the surrounding factory async`,
+  requireMock: `await vi.importMock(...), which makes the surrounding factory async`,
+  setTimeout: `vi.setConfig({ testTimeout: ... }), which is configuration rather than a call`
+};
+var OWNED_BY_A_LATER_PASS = /* @__PURE__ */ new Set(["isolateModules", "isolateModulesAsync"]);
+function lineOf(source, offset) {
+  let line = 1;
+  for (let index = 0; index < offset && index < source.length; index++) {
+    if (source[index] === "\n") line++;
+  }
+  return line;
+}
+function valueEdit(node, source, outcome) {
+  const object = node.object;
+  const property = node.property;
+  if (object?.type !== "Identifier" || object.name !== "jest") return void 0;
+  if (property?.type !== "Identifier") return void 0;
+  const member = property.name;
+  if (RUNTIME_RENAMES.has(member)) {
+    outcome.rewritten++;
+    return { start: object.start, end: object.end, text: "vi" };
+  }
+  if (OWNED_BY_A_LATER_PASS.has(member)) return void 0;
+  outcome.unhandled.push({
+    member: `jest.${member}`,
+    line: lineOf(source, object.start),
+    ...NAMED_RULE[member] === void 0 ? {} : { rule: NAMED_RULE[member] }
+  });
+  return void 0;
+}
+function typeEdit(node, source, outcome, needed) {
+  const left = node.left;
+  const right = node.right;
+  if (left?.type !== "Identifier" || left.name !== "jest") return void 0;
+  if (right?.type !== "Identifier") return void 0;
+  const member = right.name;
+  const replacement = TYPE_RENAMES[member];
+  if (replacement === void 0) {
+    outcome.unhandled.push({ member: `jest.${member}`, line: lineOf(source, node.start) });
+    return void 0;
+  }
+  needed.add(replacement);
+  outcome.rewritten++;
+  return { start: node.start, end: node.end, text: replacement };
+}
+function renameJestToVitest(fileName, source) {
+  const outcome = { source, typeImports: [], rewritten: 0, unhandled: [] };
+  const { program, errors } = parseSync2(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) return outcome;
+  const edits = [];
+  const needed = /* @__PURE__ */ new Set();
+  walk(program, (node) => {
+    if (node.type === "MemberExpression" || node.type === "StaticMemberExpression") {
+      const edit = valueEdit(node, source, outcome);
+      if (edit !== void 0) edits.push(edit);
+      return;
+    }
+    if (node.type === "TSQualifiedName") {
+      const edit = typeEdit(node, source, outcome, needed);
+      if (edit !== void 0) edits.push(edit);
+    }
+  });
+  outcome.typeImports = [...needed].sort();
+  let rewritten = source;
+  for (const edit of edits.sort((a, b) => b.start - a.start)) {
+    rewritten = rewritten.slice(0, edit.start) + edit.text + rewritten.slice(edit.end);
+  }
+  outcome.source = rewritten;
+  return outcome;
+}
+
+// src/roles/test/codemod/inject-type-import.ts
+function renderTypeImport(names, semi) {
+  return `import type { ${names.join(", ")} } from '${VITEST_TYPE_SOURCE}'${semi ? ";" : ""}`;
+}
+function renderValueImport(semi) {
+  return `import { vi } from '${VITEST_TYPE_SOURCE}'${semi ? ";" : ""}`;
+}
+function importDeclarations(program) {
+  return (program.body ?? []).filter((node) => node.type === "ImportDeclaration");
+}
+function usesSemicolons(source, imports) {
+  const first = imports[0];
+  if (first === void 0) return false;
+  return source.slice(first.start, first.end).trimEnd().endsWith(";");
+}
+function existingVitestImport(imports) {
+  return imports.find(
+    (node) => node.source?.value === VITEST_TYPE_SOURCE
+  );
+}
+function alreadyImported(declaration) {
+  return (declaration.specifiers ?? []).filter((specifier) => specifier.type === "ImportSpecifier").map((specifier) => specifier.imported?.name).filter((name) => name !== void 0);
+}
+function injectTypeImport(fileName, source, typeNames) {
+  if (typeNames.length === 0) return source;
+  const { program, errors } = parseSync3(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) return source;
+  const imports = importDeclarations(program);
+  const semi = usesSemicolons(source, imports);
+  const existing = existingVitestImport(imports);
+  if (existing !== void 0) {
+    const merged = [.../* @__PURE__ */ new Set([...alreadyImported(existing), ...typeNames])].sort();
+    if (merged.length === alreadyImported(existing).length) return source;
+    return source.slice(0, existing.start) + renderTypeImport(merged, semi) + source.slice(existing.end);
+  }
+  const line = renderTypeImport([...new Set(typeNames)].sort(), semi);
+  const first = imports[0];
+  if (first === void 0) return `${line}
+
+${source}`;
+  return source.slice(0, first.start) + line + "\n" + source.slice(first.start);
+}
+function injectViImport(fileName, source) {
+  const { program, errors } = parseSync3(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) return source;
+  const imports = importDeclarations(program);
+  const existing = existingVitestImport(imports);
+  if (existing !== void 0) {
+    const named = (existing.specifiers ?? []).some(
+      (specifier) => specifier.type === "ImportSpecifier" && specifier.imported?.name === "vi"
+    );
+    if (named && existing.importKind !== "type") return source;
+  }
+  const line = renderValueImport(usesSemicolons(source, imports));
+  const first = imports[0];
+  if (first === void 0) return `${line}
+
+${source}`;
+  return source.slice(0, first.start) + line + "\n" + source.slice(first.start);
+}
+
+// src/roles/test/codemod/migrate-file.ts
+import { dirname as dirname6 } from "node:path";
+import { parseSync as parseSync6 } from "oxc-parser";
+
 // src/roles/test/codemod/assertion-return-value.ts
 var MEMBER_TYPES = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
 function rootedAtExpect(node) {
@@ -1089,6 +1295,20 @@ function assertedMockedClass(source, node) {
   if (object === void 0) return false;
   return /\bMockedClass\b/.test(source.slice(object.start, object.end));
 }
+function classValuedProperties(factories) {
+  const found = [];
+  for (const factory of factories) {
+    walk(factory, (node) => {
+      if (node.type !== "Property" && node.type !== "ObjectProperty") return;
+      const key = node.key;
+      const name = key?.type === "Identifier" ? key.name : key?.type === "StringLiteral" || key?.type === "Literal" ? String(key.value) : void 0;
+      if (name === void 0 || !/^[A-Z]/.test(name)) return;
+      const value = node.value;
+      if (value !== void 0) found.push(value);
+    });
+  }
+  return found;
+}
 function readsThis(node) {
   let found = false;
   walk(node, (inner) => {
@@ -1101,7 +1321,7 @@ function rewriteConstructibleMocks(source, program, factories) {
   const refusals = [];
   let rewritten = 0;
   const seen = /* @__PURE__ */ new Set();
-  const subtrees = [...factories];
+  const subtrees = [...classValuedProperties(factories)];
   walk(program, (node) => {
     if (assertedMockedClass(source, node)) subtrees.push(node);
   });
@@ -1660,165 +1880,6 @@ function rewriteHookReturnValue(source, program) {
   return { source: result, rewritten: edits.length };
 }
 
-// src/roles/test/codemod/inject-type-import.ts
-import { parseSync as parseSync3 } from "oxc-parser";
-
-// src/roles/test/codemod/rename.ts
-import { parseSync as parseSync2 } from "oxc-parser";
-var VITEST_TYPE_SOURCE = "vitest";
-var RUNTIME_RENAMES = /* @__PURE__ */ new Set([
-  // Mocks
-  "clearAllMocks",
-  "doMock",
-  "fn",
-  "mock",
-  "mocked",
-  "resetAllMocks",
-  "resetModules",
-  "restoreAllMocks",
-  "spyOn",
-  "unmock",
-  /*
-   * Timers, as a family rather than as the two the corpus happens to use today. Running this over
-   * the repo reported `jest.runAllTimers` as unknown, which was a hole in the table rather than a
-   * finding about the code. Each name here was then checked against a running Vitest, so adding the
-   * siblings is not speculation: a file gaining one tomorrow gets the same answer as one using it
-   * today, instead of a report about a member that was always going to be a rename.
-   */
-  "advanceTimersByTime",
-  "advanceTimersByTimeAsync",
-  "advanceTimersToNextTimer",
-  "clearAllTimers",
-  "getRealSystemTime",
-  "getTimerCount",
-  "runAllTimers",
-  "runAllTimersAsync",
-  "runOnlyPendingTimers",
-  "setSystemTime",
-  "useFakeTimers",
-  "useRealTimers"
-]);
-var TYPE_RENAMES = {
-  Mock: "Mock",
-  MockedClass: "MockedClass",
-  MockedFunction: "MockedFunction",
-  MockedObject: "MockedObject",
-  Mocked: "Mocked",
-  SpiedFunction: "MockInstance",
-  SpyInstance: "MockInstance"
-};
-var NAMED_RULE = {
-  requireActual: `await vi.importActual(...), which makes the surrounding factory async`,
-  requireMock: `await vi.importMock(...), which makes the surrounding factory async`,
-  setTimeout: `vi.setConfig({ testTimeout: ... }), which is configuration rather than a call`
-};
-var OWNED_BY_A_LATER_PASS = /* @__PURE__ */ new Set(["isolateModules", "isolateModulesAsync"]);
-function lineOf(source, offset) {
-  let line = 1;
-  for (let index = 0; index < offset && index < source.length; index++) {
-    if (source[index] === "\n") line++;
-  }
-  return line;
-}
-function valueEdit(node, source, outcome) {
-  const object = node.object;
-  const property = node.property;
-  if (object?.type !== "Identifier" || object.name !== "jest") return void 0;
-  if (property?.type !== "Identifier") return void 0;
-  const member = property.name;
-  if (RUNTIME_RENAMES.has(member)) {
-    outcome.rewritten++;
-    return { start: object.start, end: object.end, text: "vi" };
-  }
-  if (OWNED_BY_A_LATER_PASS.has(member)) return void 0;
-  outcome.unhandled.push({
-    member: `jest.${member}`,
-    line: lineOf(source, object.start),
-    ...NAMED_RULE[member] === void 0 ? {} : { rule: NAMED_RULE[member] }
-  });
-  return void 0;
-}
-function typeEdit(node, source, outcome, needed) {
-  const left = node.left;
-  const right = node.right;
-  if (left?.type !== "Identifier" || left.name !== "jest") return void 0;
-  if (right?.type !== "Identifier") return void 0;
-  const member = right.name;
-  const replacement = TYPE_RENAMES[member];
-  if (replacement === void 0) {
-    outcome.unhandled.push({ member: `jest.${member}`, line: lineOf(source, node.start) });
-    return void 0;
-  }
-  needed.add(replacement);
-  outcome.rewritten++;
-  return { start: node.start, end: node.end, text: replacement };
-}
-function renameJestToVitest(fileName, source) {
-  const outcome = { source, typeImports: [], rewritten: 0, unhandled: [] };
-  const { program, errors } = parseSync2(fileName, source, { sourceType: "module" });
-  if (errors.length > 0) return outcome;
-  const edits = [];
-  const needed = /* @__PURE__ */ new Set();
-  walk(program, (node) => {
-    if (node.type === "MemberExpression" || node.type === "StaticMemberExpression") {
-      const edit = valueEdit(node, source, outcome);
-      if (edit !== void 0) edits.push(edit);
-      return;
-    }
-    if (node.type === "TSQualifiedName") {
-      const edit = typeEdit(node, source, outcome, needed);
-      if (edit !== void 0) edits.push(edit);
-    }
-  });
-  outcome.typeImports = [...needed].sort();
-  let rewritten = source;
-  for (const edit of edits.sort((a, b) => b.start - a.start)) {
-    rewritten = rewritten.slice(0, edit.start) + edit.text + rewritten.slice(edit.end);
-  }
-  outcome.source = rewritten;
-  return outcome;
-}
-
-// src/roles/test/codemod/inject-type-import.ts
-function renderTypeImport(names, semi) {
-  return `import type { ${names.join(", ")} } from '${VITEST_TYPE_SOURCE}'${semi ? ";" : ""}`;
-}
-function importDeclarations(program) {
-  return (program.body ?? []).filter((node) => node.type === "ImportDeclaration");
-}
-function usesSemicolons(source, imports) {
-  const first = imports[0];
-  if (first === void 0) return false;
-  return source.slice(first.start, first.end).trimEnd().endsWith(";");
-}
-function existingVitestImport(imports) {
-  return imports.find(
-    (node) => node.source?.value === VITEST_TYPE_SOURCE
-  );
-}
-function alreadyImported(declaration) {
-  return (declaration.specifiers ?? []).filter((specifier) => specifier.type === "ImportSpecifier").map((specifier) => specifier.imported?.name).filter((name) => name !== void 0);
-}
-function injectTypeImport(fileName, source, typeNames) {
-  if (typeNames.length === 0) return source;
-  const { program, errors } = parseSync3(fileName, source, { sourceType: "module" });
-  if (errors.length > 0) return source;
-  const imports = importDeclarations(program);
-  const semi = usesSemicolons(source, imports);
-  const existing = existingVitestImport(imports);
-  if (existing !== void 0) {
-    const merged = [.../* @__PURE__ */ new Set([...alreadyImported(existing), ...typeNames])].sort();
-    if (merged.length === alreadyImported(existing).length) return source;
-    return source.slice(0, existing.start) + renderTypeImport(merged, semi) + source.slice(existing.end);
-  }
-  const line = renderTypeImport([...new Set(typeNames)].sort(), semi);
-  const first = imports[0];
-  if (first === void 0) return `${line}
-
-${source}`;
-  return source.slice(0, first.start) + line + "\n" + source.slice(first.start);
-}
-
 // src/roles/test/codemod/named-rules.ts
 import { existsSync as existsSync10, readFileSync as readFileSync7 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
@@ -1939,6 +2000,11 @@ function argumentText(source, call) {
   const last = args[args.length - 1];
   return source.slice(first.start, last.end);
 }
+function typeArgumentText(source, call) {
+  const node = call.typeArguments ?? call.typeParameters;
+  if (node?.start === void 0 || node.end === void 0) return "";
+  return source.slice(node.start, node.end);
+}
 function applyEdits(source, edits) {
   let result = source;
   for (const edit of [...edits].sort((left, right) => right.start - left.start)) {
@@ -2033,7 +2099,10 @@ function applyNamedRules(source, program, fileName = "") {
       edits.push({
         start: node.start,
         end: node.end,
-        text: placed(node, `await vi.${asyncReplacement}(${argumentText(source, node)})`)
+        text: placed(
+          node,
+          `await vi.${asyncReplacement}${typeArgumentText(source, node)}(${argumentText(source, node)})`
+        )
       });
       applied.add(`jest.${member}`);
       if (enclosing !== void 0 && enclosing.async !== true) asyncify.add(enclosing);
@@ -2951,6 +3020,7 @@ function rewriteSetupStaticImports(fileName, source, program, workspaceRoot) {
 var SPY_TYPES = /* @__PURE__ */ new Set(["SpyInstance"]);
 var QUALIFIED_ONLY = /* @__PURE__ */ new Set(["Mock"]);
 var VITEST_NAME = { SpyInstance: "MockInstance", Mock: "Mock" };
+var MEMBER_TYPES16 = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
 function typeNameOf(source, node) {
   const name = node.typeName;
   if (name === void 0) return void 0;
@@ -2989,6 +3059,32 @@ function rewriteSpyInstanceType(source, program) {
     typeImports: [...new Set(edits.map((edit) => edit.imports))]
   };
 }
+function rewriteMockFactoryGenerics(source, program) {
+  const edits = [];
+  walk(program, (node) => {
+    if (node.type !== "CallExpression") return;
+    const callee = node.callee;
+    if (callee === void 0 || !MEMBER_TYPES16.has(callee.type)) return;
+    const object = callee.object;
+    const property = callee.property;
+    if (object?.type !== "Identifier" || object.name !== "jest") return;
+    if (property?.type !== "Identifier" || property.name !== "fn") return;
+    const holder = node.typeArguments ?? node.typeParameters;
+    const args = holder?.params;
+    if (holder === void 0 || args === void 0 || args.length !== 2) return;
+    const text = (argument) => source.slice(argument.start, argument.end);
+    edits.push({
+      start: holder.start,
+      end: holder.end,
+      text: `<(...args: ${text(args[1])}) => ${text(args[0])}>`
+    });
+  });
+  let result = source;
+  for (const edit of [...edits].sort((left, right) => right.start - left.start)) {
+    result = `${result.slice(0, edit.start)}${edit.text}${result.slice(edit.end)}`;
+  }
+  return { source: result, rewritten: edits.length, typeImports: [] };
+}
 
 // src/roles/test/codemod/migrate-file.ts
 function mockFactories(program) {
@@ -3050,7 +3146,10 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
   const spyTypes = rewriteSpyInstanceType(tables.source, afterTables);
   const afterSpyTypes = parse3(fileName, spyTypes.source);
   if (afterSpyTypes === void 0) return unparsable("SpyInstance types");
-  const ruled = applyNamedRules(spyTypes.source, afterSpyTypes, fileName);
+  const factoryGenerics = rewriteMockFactoryGenerics(spyTypes.source, afterSpyTypes);
+  const afterFactoryGenerics = parse3(fileName, factoryGenerics.source);
+  if (afterFactoryGenerics === void 0) return unparsable("mock factory generics");
+  const ruled = applyNamedRules(factoryGenerics.source, afterFactoryGenerics, fileName);
   const renamed = renameJestToVitest(fileName, ruled.source);
   const afterRename = parse3(fileName, renamed.source);
   if (afterRename === void 0) return unparsable("jest to vi rename");
@@ -3344,7 +3443,8 @@ function migrateModuleTests(cwd, setupFiles = []) {
     }
     files++;
     renamed += migrated.renamed;
-    operations.push({ kind: "write", path: renamedTo, contents: migrated.source });
+    const contents = /\bvi\./.test(migrated.source) ? injectViImport(join15(cwd, renamedTo), migrated.source) : migrated.source;
+    operations.push({ kind: "write", path: renamedTo, contents });
   }
   for (const relative6 of listTestFiles(cwd)) {
     const source = read2(join15(cwd, relative6));
@@ -4205,6 +4305,51 @@ function shippedTypesPath(cwd, declaration) {
   }
   return `./node_modules/@hublo/sentinel/${declaration}`;
 }
+function helpersStillCallingJest(cwd) {
+  const found = [];
+  const skip = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".git", ".nx", ".vite"]);
+  const walk2 = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync6(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join22(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!skip.has(entry.name)) walk2(path);
+        continue;
+      }
+      if (!/\.[cm]?tsx?$/.test(entry.name)) continue;
+      if (/[.-](spec|test)\.[cm]?[jt]sx?$/.test(entry.name)) continue;
+      if (/^(jest|vitest)\./.test(entry.name)) continue;
+      let source;
+      try {
+        source = readFileSync17(path, "utf8");
+      } catch {
+        continue;
+      }
+      if (/\bjest\./.test(source)) {
+        found.push(relative5(cwd, path).replaceAll("\\", "/"));
+      }
+    }
+  };
+  walk2(cwd);
+  return found;
+}
+function compilesATestHelper(cwd, config) {
+  const helpers = helpersStillCallingJest(cwd);
+  if (helpers.length === 0) return false;
+  const include = Array.isArray(config?.include) ? config.include : void 0;
+  const exclude = Array.isArray(config?.exclude) ? config.exclude : [];
+  if (include !== void 0 && include.length === 0) return false;
+  return helpers.some((file) => {
+    const included = include === void 0 || include.some((pattern) => matchesTsconfigPattern(pattern, file));
+    if (!included) return false;
+    return !exclude.some((pattern) => matchesTsconfigPattern(pattern, file));
+  });
+}
 function tsconfigFileListOperations(cwd) {
   const operations = [];
   let names;
@@ -4226,7 +4371,8 @@ function tsconfigFileListOperations(cwd) {
     const include = Array.isArray(config?.include) ? rewriteFileList(config.include) : void 0;
     const exclude = Array.isArray(config?.exclude) ? rewriteFileList(config.exclude) : void 0;
     const files = Array.isArray(config?.files) ? rewriteFileList(config.files) : void 0;
-    const withTypes = name === SPEC_TSCONFIG ? withShippedTypes(cwd, files ?? config?.files) : void 0;
+    const wantsTypes = name === SPEC_TSCONFIG || compilesATestHelper(cwd, config);
+    const withTypes = wantsTypes ? withShippedTypes(cwd, files ?? config?.files) : void 0;
     if (include === void 0 && exclude === void 0 && files === void 0 && withTypes === void 0)
       continue;
     operations.push({
@@ -4364,6 +4510,9 @@ function planJestMigration(context, adoption) {
       `no style is declared here, by this module or its workspace, so what was written keeps the shape it was written in, and the Vitest type imports sit beside the existing ones rather than where your \`import/order\` wants them. That rule is classified by a prefix list this package cannot read, so it is left to the tool that owns it: run your module's own lint fixer (\`nx run <module>:lint --fix\` here) and its formatter before committing.`
     );
   }
+  notes.push(
+    `run \`pnpm install\` BEFORE the suite. This wrote \`@hublo/sentinel\` into the module's manifest and a config that imports subpaths of it, and a subpath only exists once that version is physically installed. Skip it and Vitest reports \`Cannot find module '<module>/@hublo/sentinel/test/setup/...'\`, which looks like a missing file rather than a missing install.`
+  );
   notes.push(
     `then run this module's TYPECHECK, not only its tests. The migration rewrites types as well as calls, and a wrong type is invisible to a green suite: measured on a real module, \`--run --test\` passed while \`--run --typescript\` reported ten errors it had not had before.`
   );

package/dist/{chunk-Y2EKU6OE.js → chunk-SPW4KIQX.js}

@@ -27,7 +27,7 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-GCZKG4B2.js";
+} from "./chunk-ORESQJAU.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   findWorkspaceRoot,

package/dist/index.js

@@ -6,10 +6,11 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-Y2EKU6OE.js";
+} from "./chunk-SPW4KIQX.js";
 import {
   BaseAdapter
-} from "./chunk-GCZKG4B2.js";
+} from "./chunk-ORESQJAU.js";
+import "./chunk-O7REVMOC.js";
 import "./chunk-NW6UHNYX.js";
 export {
   BaseAdapter,

package/dist/roles/build/nest/toolchain.js

@@ -1,3 +1,6 @@
+import {
+  globToRegExp
+} from "../../../chunk-O7REVMOC.js";
 import {
   decoratorMetadata,
   tsconfigAliases
@@ -10,32 +13,6 @@ import { mergeConfig } from "vite";
 // src/roles/build/nest/copy-assets.ts
 import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
-function globToRegExp(glob) {
-  let pattern = "";
-  for (let index = 0; index < glob.length; index++) {
-    const char = glob[index] ?? "";
-    if (char === "*") {
-      if (glob[index + 1] === "*") {
-        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
-        index += glob[index + 2] === "/" ? 2 : 1;
-      } else {
-        pattern += "[^/]*";
-      }
-      continue;
-    }
-    if (char === "{") {
-      const close = glob.indexOf("}", index);
-      if (close === -1)
-        throw new Error(`sentinel build(nest): unbalanced \`{\` in asset glob ${glob}`);
-      const alternatives = glob.slice(index + 1, close).split(",");
-      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
-      index = close;
-      continue;
-    }
-    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-  }
-  return new RegExp(`^${pattern}$`);
-}
 function filesUnder(root) {
   const found = [];
   const walk = (dir) => {

package/dist/roles/build/nest/toolchain.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/roles/build/nest/nest-service.ts","../../../../src/roles/build/nest/copy-assets.ts","../../../../src/roles/build/nest/node-manifest.ts","../../../../src/roles/build/nest/toolchain.ts"],"sourcesContent":["/**\n * The whole Vite config for a Nest service, so an adopted module holds two lines.\n *\n * ## Why a shape here, and pieces on the React side\n *\n * It looks inconsistent until you measure the two families. The four React apps each carry a\n * heavy, genuinely different config: one has a plugin wedged between two shared ones, another\n * has two different route-tree footers on the branches of one ternary. Two attempts at a\n * shared shape for them were abandoned, and the rule that survived is that sentinel rewrites\n * their IMPORTS and touches nothing else.\n *\n * The Nest side is the opposite by measurement: 38 services, one shared 25-line webpack config\n * between them, and nothing per-module to preserve. Owning the shape there is not a different\n * philosophy, it is the same one applied to a different fact: sentinel provides the FORM where\n * the form is shared, and the PIECES where it is not.\n *\n * The consequences are the point. An adopted module is readable in review. A correction to the\n * form is one publish instead of 38 diffs. And the day Nest becomes ESM-native, `format`\n * changes here rather than in 38 configs.\n *\n * ## It is a composition, not a block\n *\n * `nestService` assembles the same plugins this module exports individually. A service that\n * needs something else can pass `overrides`, or drop to the pieces entirely. And if the React\n * configs ever converge, a `reactApp()` can be built the same way with no new mechanism.\n */\nimport { join } from 'node:path'\n\nimport { mergeConfig, type UserConfig } from 'vite'\n\nimport { copyAssets } from './copy-assets.js'\nimport { decoratorMetadata } from './decorator-metadata.js'\nimport { nodeManifest } from './node-manifest.js'\nimport type { AssetDeclaration, TransformerDeclaration } from './nx-target.js'\nimport { tsconfigAliases } from './tsconfig-aliases.js'\n\nexport interface NestServiceOptions {\n  /** The nx project name. Keys the dependency graph, and names the module in messages. */\n  project: string\n  /** Absolute path to the module's directory, normally `__dirname`. */\n  root: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Entry point, relative to `root`. */\n  entry?: string\n  /**\n   * The tsconfig whose emit must be preserved, when the service uses neither conventional name.\n   *\n   * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.\n   */\n  tsconfig?: string\n  /** Output directory, relative to `workspaceRoot`. */\n  outDir?: string\n  /**\n   * TypeScript transformers this service compiles with, as its build target declared them.\n   *\n   * Read off the webpack target by `--init` and written here, never inferred: what a service\n   * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,\n   * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building\n   * without it succeeds and silently costs them most of their published contract (measured on\n   * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).\n   */\n  transformers?: readonly TransformerDeclaration[]\n  /**\n   * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.\n   *\n   * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders\n   * printed documents from. Without them the service starts and fails on its first print.\n   */\n  assets?: readonly AssetDeclaration[]\n  /**\n   * Anything this service needs that the shape does not give it.\n   *\n   * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate\n   * and aliases stack the way Vite does it everywhere else, so there is no second set of\n   * semantics to learn or to document.\n   */\n  overrides?: UserConfig\n}\n\nconst baseConfig = (options: NestServiceOptions): UserConfig => {\n  const outDir = join(options.workspaceRoot, options.outDir ?? `dist/${options.project}`)\n  const entry = join(options.root, options.entry ?? 'src/main.ts')\n  return {\n    plugins: [\n      decoratorMetadata({\n        root: options.root,\n        tsconfig: options.tsconfig,\n        transformers: options.transformers,\n      }),\n      ...(options.assets?.length\n        ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })]\n        : []),\n      nodeManifest({\n        project: options.project,\n        workspaceRoot: options.workspaceRoot,\n        outDir,\n      }),\n    ],\n    resolve: { alias: tsconfigAliases(options.workspaceRoot) },\n    ssr: {\n      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require(\"tslib\")`\n      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into\n      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and\n      // the manifest nx generates from the project graph does not list it, because no module\n      // DECLARES tslib. The image therefore did not install it and the service died on its first\n      // require, only in the image: locally and in CI the workspace root has tslib.\n      noExternal: ['tslib'],\n    },\n    build: {\n      // An SSR build targets Node and leaves real packages external, which is what\n      // `webpack-node-externals` did: the image installs them from the generated manifest.\n      ssr: entry,\n      outDir,\n      emptyOutDir: true,\n      sourcemap: true,\n      target: 'node20',\n      // The bundle is read by humans when a stack trace points into it, and minifying a\n      // server bundle buys nothing: it is never downloaded.\n      minify: false,\n      rollupOptions: {\n        output: {\n          format: 'cjs',\n          // One output file per source module, instead of hoisting everything into one scope.\n          //\n          // This is not a preference, it is the only shape that keeps the OpenAPI contract.\n          // Merging every module into one scope forces Rollup to rename duplicate class names,\n          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently\n          // becomes a renamed schema in the published API. Measured on `network`, which has two\n          // such collisions: single bundle renames `InvalidPermissionError` and\n          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the\n          // committed contract byte for byte.\n          //\n          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under\n          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.\n          preserveModules: true,\n          // The image runs `./dist/main.js`, so the entry keeps that name at the root while\n          // every other module keeps its own path. Under `preserveModules` a plain string here\n          // would be applied to all of them, which numbers them (`main962.js`) and loses the\n          // entry.\n          entryFileNames: (chunk) => (chunk.facadeModuleId === entry ? 'main.js' : '[name].js'),\n        },\n        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog\n        // when its module loads, and nothing references that module afterwards. Rollup may\n        // drop such a module; webpack never did.\n        //\n        // Measured on the first migrated service this changes nothing, so it is insurance\n        // rather than a fix, and it is recorded as such rather than credited with the smaller\n        // bundle (that comes from barrel re-exports the service does not use).\n        treeshake: { moduleSideEffects: true },\n      },\n    },\n  }\n}\n\nexport const nestService = (options: NestServiceOptions): UserConfig =>\n  options.overrides === undefined\n    ? baseConfig(options)\n    : mergeConfig(baseConfig(options), options.overrides)\n","/**\n * The files a service ships beside its bundle, which webpack copied and a bundler does not.\n *\n * `@nx/webpack` takes an `assets` list and copies each match into the output. Nothing in a Vite\n * build does that for a Node target: `publicDir` is a browser concept and is disabled for SSR\n * builds, so an unmigrated `assets` entry is not a smaller output, it is a service that starts\n * and then fails the first time it reaches for a file that is not there.\n *\n * One service in this repo declares it. `planning-period` ships the pug templates, stylesheet and\n * font it renders printed documents from, under `templates/`. Dropping them leaves a build that\n * succeeds, an image that boots, and a printing feature that throws.\n *\n * ## Copied at `closeBundle`, and only what the target declared\n *\n * The declaration is carried through from the webpack target unchanged, globs and all, so this\n * plugin has nothing to decide: it resolves each `input` against the workspace root, matches the\n * glob, and writes under `output` inside the bundle's directory. `closeBundle` because that is\n * when the output directory exists and Vite has finished emptying it.\n *\n * An entry matching nothing FAILS the build. A glob that has quietly stopped matching is the same\n * silent loss as no glob at all, and the point of this file is that this class of loss is loud.\n */\nimport { cpSync, existsSync, mkdirSync, readdirSync, statSync } from 'node:fs'\nimport { dirname, join, relative, sep } from 'node:path'\n\nimport type { Plugin } from 'vite'\n\nimport type { AssetDeclaration } from './nx-target.js'\n\nexport interface CopyAssetsOptions {\n  /** Absolute path to the workspace root, which `input` is relative to. */\n  workspaceRoot: string\n  /** Absolute path to the build's output directory. */\n  outDir: string\n  assets: readonly AssetDeclaration[]\n}\n\n/**\n * `@nx/webpack`'s glob dialect, reduced to what it means for a file name.\n *\n * Only the forms the declarations here use are supported, and anything else is rejected at build\n * time rather than silently matching nothing: `**` for any depth, `*` within a segment, and a\n * `{a,b}` alternation. Written out rather than pulled from a glob library because the whole\n * dependency would exist to read one line of configuration.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let pattern = ''\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index] ?? ''\n    if (char === '*') {\n      if (glob[index + 1] === '*') {\n        // `**/` matches any number of directories, including none.\n        pattern += glob[index + 2] === '/' ? '(?:.*/)?' : '.*'\n        index += glob[index + 2] === '/' ? 2 : 1\n      } else {\n        pattern += '[^/]*'\n      }\n      continue\n    }\n    if (char === '{') {\n      const close = glob.indexOf('}', index)\n      if (close === -1)\n        throw new Error(`sentinel build(nest): unbalanced \\`{\\` in asset glob ${glob}`)\n      const alternatives = glob.slice(index + 1, close).split(',')\n      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')).join('|')})`\n      index = close\n      continue\n    }\n    pattern += char.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  }\n  return new RegExp(`^${pattern}$`)\n}\n\n/** Every file under `root`, as paths relative to it and with forward slashes. */\nfunction filesUnder(root: string): string[] {\n  const found: string[] = []\n  const walk = (dir: string): void => {\n    for (const entry of readdirSync(dir)) {\n      const full = join(dir, entry)\n      if (statSync(full).isDirectory()) walk(full)\n      else found.push(relative(root, full).split(sep).join('/'))\n    }\n  }\n  walk(root)\n  return found\n}\n\n/** What each declaration copies, or the reason it cannot. */\nexport function resolveAssets(options: CopyAssetsOptions): { from: string; to: string }[] {\n  const copies: { from: string; to: string }[] = []\n  for (const asset of options.assets) {\n    const input = join(options.workspaceRoot, asset.input)\n    if (!existsSync(input)) {\n      throw new Error(\n        `sentinel build(nest): the build target declares an asset from \\`${asset.input}\\`, which ` +\n          `does not exist. webpack copied it into the output, so the built service would be ` +\n          `missing files it reads at runtime.`,\n      )\n    }\n    const matcher = globToRegExp(asset.glob)\n    const matched = filesUnder(input).filter((file) => matcher.test(file))\n    if (matched.length === 0) {\n      throw new Error(\n        `sentinel build(nest): the asset glob \\`${asset.glob}\\` under \\`${asset.input}\\` matches ` +\n          `no file. An entry that matches nothing is the same silent loss as no entry at all.`,\n      )\n    }\n    for (const file of matched) {\n      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) })\n    }\n  }\n  return copies\n}\n\nexport const copyAssets = (options: CopyAssetsOptions): Plugin => ({\n  name: 'sentinel:copy-assets',\n  // After the bundle is written and the output directory has stopped being emptied.\n  closeBundle() {\n    for (const { from, to } of resolveAssets(options)) {\n      mkdirSync(dirname(to), { recursive: true })\n      cpSync(from, to)\n    }\n  },\n})\n","/**\n * The pruned `package.json` and lockfile a Node image installs from.\n *\n * This is the half that made the nx executor look load-bearing. `--generatePackageJson` was an\n * option of `@nx/webpack:webpack`, and the backend image is built on its two outputs:\n *\n *   COPY --from=build /app/dist/apps/nest/<service>/package.json   /app/package.json\n *   COPY --from=build /app/dist/apps/nest/<service>/pnpm-lock.yaml /app/pnpm-lock.yaml\n *   RUN pnpm i --prod=true --frozen-lockfile\n *\n * It is not bound to the executor. The executor supplies one thing, the project graph, and\n * every function that does the work is exported by `@nx/js`. So the same two files can be\n * produced from a Vite plugin, and `--frozen-lockfile` accepting them afterwards is the proof\n * that they agree with each other: pnpm refuses the install otherwise.\n *\n * ## Why the graph, and not something simpler\n *\n * A Nest service here declares almost nothing of its own: measured, one dependency in its\n * manifest against 1463 installed in its image. Everything it uses is declared at the\n * workspace root and reaches it through source imports. So the dependency list can only be\n * computed from what the code imports, which is what the graph knows.\n *\n * Deriving it from the bundle's own externals is not equivalent either: measured on the first\n * service, the bundle statically requires 42 packages while the correct manifest holds 65. The\n * 23 missing ones are transitive or required dynamically at runtime (`fastify` behind\n * `@nestjs/platform-fastify`, `jsonwebtoken`, the LaunchDarkly SDK). Shipping the short list\n * fails in production, not in the build.\n */\nimport { existsSync, writeFileSync } from 'node:fs'\nimport { isBuiltin } from 'node:module'\nimport { join } from 'node:path'\n\nimport type { Plugin, Rollup } from 'vite'\n\nexport interface NodeManifestOptions {\n  /** The nx project name, which is how the graph is keyed. */\n  project: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Where the bundle is written; the two files land beside it. */\n  outDir: string\n  /** Entry file name, written as `main` so `node .` resolves inside the image. */\n  entry?: string\n  /**\n   * Packages the IMAGE provides, which are therefore allowed to be required without being\n   * declared in the manifest.\n   *\n   * The generated Prisma clients are the case this exists for: the Dockerfile copies\n   * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module\n   * declares them. Everything else that is required and undeclared is a bug, and the check\n   * below refuses the build.\n   */\n  providedByImage?: readonly string[]\n}\n\n/** What the Dockerfile copies in itself, so requiring it without declaring it is legitimate. */\nconst DEFAULT_PROVIDED_BY_IMAGE = ['@prisma'] as const\n\n/**\n * Every real package the emitted output requires, from Rollup's own record rather than a scan\n * of the text.\n *\n * `chunk.imports` mixes three things, and only the third is a dependency:\n *\n *  - other EMITTED chunks. Under `preserveModules` these are relative output paths that do not\n *    begin with `.`, so `apps/…`, `libs/…` and `_virtual/…` read exactly like package names.\n *    They are recognised by being keys of the bundle itself.\n *  - Node BUILTINS, which appear both bare (`crypto`) and prefixed (`node:crypto`).\n *  - genuine external packages, which is what the manifest has to cover.\n */\nconst externalPackages = (bundle: Rollup.OutputBundle): Set<string> => {\n  const emitted = new Set(Object.keys(bundle))\n  const packages = new Set<string>()\n\n  for (const emittedFile of Object.values(bundle)) {\n    // Assets carry no imports, and the bundle holds both. Narrowing on the discriminant is what\n    // replaced a cast through `unknown`, which asserted the same thing without checking it.\n    if (emittedFile.type !== 'chunk') continue\n\n    for (const imported of emittedFile.imports) {\n      if (emitted.has(imported)) continue\n      if (imported.startsWith('.') || imported.startsWith('/')) continue\n      if (isBuiltin(imported)) continue\n\n      const parts = imported.split('/')\n      const name = imported.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]\n      if (name) packages.add(name)\n    }\n  }\n  return packages\n}\n\n/**\n * Writes the manifest and lockfile once the bundle is on disk.\n *\n * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the\n * directory and cannot be cleared by `emptyOutDir`.\n *\n * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left\n * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it\n * became the one Vite printed, hiding the failure that actually stopped the build. It cost two\n * diagnoses before being recognised, so the missing directory is now read as what it is: the\n * bundle was never written, and this plugin has nothing to say about why.\n */\nexport const nodeManifest = (options: NodeManifestOptions): Plugin => {\n  /*\n   * Captured while the bundle still exists in memory, and read back once the manifest is built.\n   *\n   * `undefined` until `generateBundle` runs, deliberately: an empty SET would make the coverage\n   * check below pass by having seen nothing, which is the worst way for a guard to succeed. The\n   * two states have to be told apart.\n   */\n  let required: Set<string> | undefined\n\n  return {\n    name: 'sentinel:node-manifest',\n    apply: 'build',\n\n    generateBundle(_outputOptions, bundle) {\n      required = externalPackages(bundle)\n    },\n\n    async closeBundle() {\n      // `closeBundle` runs after a FAILED build too. The ENTRY is what says a bundle was really\n      // written: `emptyOutDir` leaves the directory in place, so its existence alone would let a\n      // failed build still produce a manifest describing nothing.\n      const entry = options.entry ?? 'main.js'\n      if (!existsSync(join(options.outDir, entry))) return\n\n      // Imported here rather than at module scope: a front config importing this file must not\n      // pay for loading the nx graph machinery it will never call.\n      const { createProjectGraphAsync } = await import('nx/src/devkit-exports.js')\n      const { createPackageJson, createLockFile, getLockFileName } = await import('@nx/js')\n\n      const graph = await createProjectGraphAsync({ exitOnError: false })\n      const manifest = createPackageJson(options.project, graph, {\n        root: options.workspaceRoot,\n        isProduction: true,\n      })\n      manifest.main = entry\n\n      if (required === undefined) {\n        throw new Error(\n          `sentinel build(nest): the bundle was written but never inspected, so the manifest ` +\n            `could not be checked against what it requires. Refusing to write one that might ` +\n            `not install.`,\n        )\n      }\n      assertManifestCovers(required, manifest, options)\n\n      writeFileSync(join(options.outDir, 'package.json'), `${JSON.stringify(manifest, null, 2)}\\n`)\n      writeFileSync(\n        join(options.outDir, getLockFileName('pnpm')),\n        createLockFile(manifest, graph, 'pnpm'),\n      )\n    },\n  }\n}\n\n/**\n * Refuse a bundle that requires something the image will not install.\n *\n * The manifest is derived from the project GRAPH, so it lists what modules declare. The bundle\n * requires what the bundler left external. Those two sets agreeing is an assumption, and it was\n * wrong: `tslib` arrives through `importHelpers` in the workspace tsconfig without any module\n * declaring it, so the manifest omitted it and the service died on its first require.\n *\n * It died only in the image. Locally and in CI the workspace root has the package, so the gap is\n * invisible until a container starts, which is the most expensive place to discover it. Checking\n * here turns that into a build failure naming the package.\n */\nconst assertManifestCovers = (\n  required: ReadonlySet<string>,\n  manifest: { dependencies?: Record<string, string> },\n  options: NodeManifestOptions,\n): void => {\n  const declared = new Set(Object.keys(manifest.dependencies ?? {}))\n  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE\n  const missing = [...required]\n    .filter((name) => !declared.has(name))\n    .filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`)))\n    .sort()\n\n  if (missing.length === 0) return\n\n  throw new Error(\n    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated ` +\n      `manifest does not declare, so the image would not install them: ${missing.join(', ')}. ` +\n      `Either declare them in the module's package.json, inline them with ` +\n      `\\`ssr.noExternal\\`, or list them in \\`providedByImage\\` if the Dockerfile copies them in.`,\n  )\n}\n","/**\n * What `@hublo/sentinel/build/nest` gives an adopted service.\n *\n * The sibling `build/react` entry is a re-export surface: the module keeps its own config and\n * only its import lines move. This one carries a shape as well, because 38 Nest services share\n * one config and have nothing of their own to preserve. See `nest-service.ts` for why the two\n * answers differ, and why that is one rule rather than two.\n *\n * Its own entry point, like the React one, so importing it at build time never drags the CLI\n * and its adapters into a Vite config.\n */\nexport { nestService, type NestServiceOptions } from './nest-service.js'\n\n// The pieces the shape is built from, exported individually so a service that needs something\n// the shape does not give it can compose its own without leaving sentinel.\nexport { decoratorMetadata, type DecoratorMetadataOptions } from './decorator-metadata.js'\nexport { nodeManifest, type NodeManifestOptions } from './node-manifest.js'\nexport { tsconfigAliases, type Alias } from './tsconfig-aliases.js'\n\n// Vite's own, so an adopted config imports everything from one place and the module can drop\n// `vite` from its dependencies.\nexport { defineConfig, loadEnv, mergeConfig } from 'vite'\nexport type { Plugin, PluginOption, UserConfig, UserConfigExport } from 'vite'\n"],"mappings":";;;;;;AA0BA,SAAS,QAAAA,aAAY;AAErB,SAAS,mBAAoC;;;ACN7C,SAAS,QAAQ,YAAY,WAAW,aAAa,gBAAgB;AACrE,SAAS,SAAS,MAAM,UAAU,WAAW;AAsB7C,SAAS,aAAa,MAAsB;AAC1C,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,QAAI,SAAS,KAAK;AAChB,UAAI,KAAK,QAAQ,CAAC,MAAM,KAAK;AAE3B,mBAAW,KAAK,QAAQ,CAAC,MAAM,MAAM,aAAa;AAClD,iBAAS,KAAK,QAAQ,CAAC,MAAM,MAAM,IAAI;AAAA,MACzC,OAAO;AACL,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB,YAAM,QAAQ,KAAK,QAAQ,KAAK,KAAK;AACrC,UAAI,UAAU;AACZ,cAAM,IAAI,MAAM,wDAAwD,IAAI,EAAE;AAChF,YAAM,eAAe,KAAK,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3D,iBAAW,MAAM,aAAa,IAAI,CAAC,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,cAAQ;AACR;AAAA,IACF;AACA,eAAW,KAAK,QAAQ,sBAAsB,MAAM;AAAA,EACtD;AACA,SAAO,IAAI,OAAO,IAAI,OAAO,GAAG;AAClC;AAGA,SAAS,WAAW,MAAwB;AAC1C,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,QAAsB;AAClC,eAAW,SAAS,YAAY,GAAG,GAAG;AACpC,YAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,UAAI,SAAS,IAAI,EAAE,YAAY,EAAG,MAAK,IAAI;AAAA,UACtC,OAAM,KAAK,SAAS,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,OAAK,IAAI;AACT,SAAO;AACT;AAGO,SAAS,cAAc,SAA4D;AACxF,QAAM,SAAyC,CAAC;AAChD,aAAW,SAAS,QAAQ,QAAQ;AAClC,UAAM,QAAQ,KAAK,QAAQ,eAAe,MAAM,KAAK;AACrD,QAAI,CAAC,WAAW,KAAK,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,mEAAmE,MAAM,KAAK;AAAA,MAGhF;AAAA,IACF;AACA,UAAM,UAAU,aAAa,MAAM,IAAI;AACvC,UAAM,UAAU,WAAW,KAAK,EAAE,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AACrE,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,0CAA0C,MAAM,IAAI,cAAc,MAAM,KAAK;AAAA,MAE/E;AAAA,IACF;AACA,eAAW,QAAQ,SAAS;AAC1B,aAAO,KAAK,EAAE,MAAM,KAAK,OAAO,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,MAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,aAAa,CAAC,aAAwC;AAAA,EACjE,MAAM;AAAA;AAAA,EAEN,cAAc;AACZ,eAAW,EAAE,MAAM,GAAG,KAAK,cAAc,OAAO,GAAG;AACjD,gBAAU,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1C,aAAO,MAAM,EAAE;AAAA,IACjB;AAAA,EACF;AACF;;;AC/FA,SAAS,cAAAC,aAAY,qBAAqB;AAC1C,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AA0BrB,IAAM,4BAA4B,CAAC,SAAS;AAc5C,IAAM,mBAAmB,CAAC,WAA6C;AACrE,QAAM,UAAU,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AAEjC,aAAW,eAAe,OAAO,OAAO,MAAM,GAAG;AAG/C,QAAI,YAAY,SAAS,QAAS;AAElC,eAAW,YAAY,YAAY,SAAS;AAC1C,UAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,UAAI,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,GAAG,EAAG;AAC1D,UAAI,UAAU,QAAQ,EAAG;AAEzB,YAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,YAAM,OAAO,SAAS,WAAW,GAAG,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC;AAC7E,UAAI,KAAM,UAAS,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAcO,IAAM,eAAe,CAAC,YAAyC;AAQpE,MAAI;AAEJ,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IAEP,eAAe,gBAAgB,QAAQ;AACrC,iBAAW,iBAAiB,MAAM;AAAA,IACpC;AAAA,IAEA,MAAM,cAAc;AAIlB,YAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAI,CAACD,YAAWC,MAAK,QAAQ,QAAQ,KAAK,CAAC,EAAG;AAI9C,YAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,0BAA0B;AAC3E,YAAM,EAAE,mBAAmB,gBAAgB,gBAAgB,IAAI,MAAM,OAAO,QAAQ;AAEpF,YAAM,QAAQ,MAAM,wBAAwB,EAAE,aAAa,MAAM,CAAC;AAClE,YAAM,WAAW,kBAAkB,QAAQ,SAAS,OAAO;AAAA,QACzD,MAAM,QAAQ;AAAA,QACd,cAAc;AAAA,MAChB,CAAC;AACD,eAAS,OAAO;AAEhB,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,2BAAqB,UAAU,UAAU,OAAO;AAEhD,oBAAcA,MAAK,QAAQ,QAAQ,cAAc,GAAG,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5F;AAAA,QACEA,MAAK,QAAQ,QAAQ,gBAAgB,MAAM,CAAC;AAAA,QAC5C,eAAe,UAAU,OAAO,MAAM;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAcA,IAAM,uBAAuB,CAC3B,UACA,UACA,YACS;AACT,QAAM,WAAW,IAAI,IAAI,OAAO,KAAK,SAAS,gBAAgB,CAAC,CAAC,CAAC;AACjE,QAAM,WAAW,QAAQ,mBAAmB;AAC5C,QAAM,UAAU,CAAC,GAAG,QAAQ,EACzB,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,EACpC,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC,EAC7F,KAAK;AAER,MAAI,QAAQ,WAAW,EAAG;AAE1B,QAAM,IAAI;AAAA,IACR,6CAA6C,QAAQ,MAAM,6FACU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAGzF;AACF;;;AF/GA,IAAM,aAAa,CAAC,YAA4C;AAC9D,QAAM,SAASC,MAAK,QAAQ,eAAe,QAAQ,UAAU,QAAQ,QAAQ,OAAO,EAAE;AACtF,QAAM,QAAQA,MAAK,QAAQ,MAAM,QAAQ,SAAS,aAAa;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,MACP,kBAAkB;AAAA,QAChB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,GAAI,QAAQ,QAAQ,SAChB,CAAC,WAAW,EAAE,eAAe,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACrF,CAAC;AAAA,MACL,aAAa;AAAA,QACX,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,SAAS,EAAE,OAAO,gBAAgB,QAAQ,aAAa,EAAE;AAAA,IACzD,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOH,YAAY,CAAC,OAAO;AAAA,IACtB;AAAA,IACA,OAAO;AAAA;AAAA;AAAA,MAGL,KAAK;AAAA,MACL;AAAA,MACA,aAAa;AAAA,MACb,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA;AAAA,MAGR,QAAQ;AAAA,MACR,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAaR,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,UAKjB,gBAAgB,CAAC,UAAW,MAAM,mBAAmB,QAAQ,YAAY;AAAA,QAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,WAAW,EAAE,mBAAmB,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,cAAc,CAAC,YAC1B,QAAQ,cAAc,SAClB,WAAW,OAAO,IAClB,YAAY,WAAW,OAAO,GAAG,QAAQ,SAAS;;;AGzIxD,SAAS,cAAc,SAAS,eAAAC,oBAAmB;","names":["join","existsSync","join","join","mergeConfig"]}
+{"version":3,"sources":["../../../../src/roles/build/nest/nest-service.ts","../../../../src/roles/build/nest/copy-assets.ts","../../../../src/roles/build/nest/node-manifest.ts","../../../../src/roles/build/nest/toolchain.ts"],"sourcesContent":["/**\n * The whole Vite config for a Nest service, so an adopted module holds two lines.\n *\n * ## Why a shape here, and pieces on the React side\n *\n * It looks inconsistent until you measure the two families. The four React apps each carry a\n * heavy, genuinely different config: one has a plugin wedged between two shared ones, another\n * has two different route-tree footers on the branches of one ternary. Two attempts at a\n * shared shape for them were abandoned, and the rule that survived is that sentinel rewrites\n * their IMPORTS and touches nothing else.\n *\n * The Nest side is the opposite by measurement: 38 services, one shared 25-line webpack config\n * between them, and nothing per-module to preserve. Owning the shape there is not a different\n * philosophy, it is the same one applied to a different fact: sentinel provides the FORM where\n * the form is shared, and the PIECES where it is not.\n *\n * The consequences are the point. An adopted module is readable in review. A correction to the\n * form is one publish instead of 38 diffs. And the day Nest becomes ESM-native, `format`\n * changes here rather than in 38 configs.\n *\n * ## It is a composition, not a block\n *\n * `nestService` assembles the same plugins this module exports individually. A service that\n * needs something else can pass `overrides`, or drop to the pieces entirely. And if the React\n * configs ever converge, a `reactApp()` can be built the same way with no new mechanism.\n */\nimport { join } from 'node:path'\n\nimport { mergeConfig, type UserConfig } from 'vite'\n\nimport { copyAssets } from './copy-assets.js'\nimport { decoratorMetadata } from './decorator-metadata.js'\nimport { nodeManifest } from './node-manifest.js'\nimport type { AssetDeclaration, TransformerDeclaration } from './nx-target.js'\nimport { tsconfigAliases } from './tsconfig-aliases.js'\n\nexport interface NestServiceOptions {\n  /** The nx project name. Keys the dependency graph, and names the module in messages. */\n  project: string\n  /** Absolute path to the module's directory, normally `__dirname`. */\n  root: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Entry point, relative to `root`. */\n  entry?: string\n  /**\n   * The tsconfig whose emit must be preserved, when the service uses neither conventional name.\n   *\n   * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.\n   */\n  tsconfig?: string\n  /** Output directory, relative to `workspaceRoot`. */\n  outDir?: string\n  /**\n   * TypeScript transformers this service compiles with, as its build target declared them.\n   *\n   * Read off the webpack target by `--init` and written here, never inferred: what a service\n   * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,\n   * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building\n   * without it succeeds and silently costs them most of their published contract (measured on\n   * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).\n   */\n  transformers?: readonly TransformerDeclaration[]\n  /**\n   * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.\n   *\n   * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders\n   * printed documents from. Without them the service starts and fails on its first print.\n   */\n  assets?: readonly AssetDeclaration[]\n  /**\n   * Anything this service needs that the shape does not give it.\n   *\n   * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate\n   * and aliases stack the way Vite does it everywhere else, so there is no second set of\n   * semantics to learn or to document.\n   */\n  overrides?: UserConfig\n}\n\nconst baseConfig = (options: NestServiceOptions): UserConfig => {\n  const outDir = join(options.workspaceRoot, options.outDir ?? `dist/${options.project}`)\n  const entry = join(options.root, options.entry ?? 'src/main.ts')\n  return {\n    plugins: [\n      decoratorMetadata({\n        root: options.root,\n        tsconfig: options.tsconfig,\n        transformers: options.transformers,\n      }),\n      ...(options.assets?.length\n        ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })]\n        : []),\n      nodeManifest({\n        project: options.project,\n        workspaceRoot: options.workspaceRoot,\n        outDir,\n      }),\n    ],\n    resolve: { alias: tsconfigAliases(options.workspaceRoot) },\n    ssr: {\n      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require(\"tslib\")`\n      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into\n      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and\n      // the manifest nx generates from the project graph does not list it, because no module\n      // DECLARES tslib. The image therefore did not install it and the service died on its first\n      // require, only in the image: locally and in CI the workspace root has tslib.\n      noExternal: ['tslib'],\n    },\n    build: {\n      // An SSR build targets Node and leaves real packages external, which is what\n      // `webpack-node-externals` did: the image installs them from the generated manifest.\n      ssr: entry,\n      outDir,\n      emptyOutDir: true,\n      sourcemap: true,\n      target: 'node20',\n      // The bundle is read by humans when a stack trace points into it, and minifying a\n      // server bundle buys nothing: it is never downloaded.\n      minify: false,\n      rollupOptions: {\n        output: {\n          format: 'cjs',\n          // One output file per source module, instead of hoisting everything into one scope.\n          //\n          // This is not a preference, it is the only shape that keeps the OpenAPI contract.\n          // Merging every module into one scope forces Rollup to rename duplicate class names,\n          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently\n          // becomes a renamed schema in the published API. Measured on `network`, which has two\n          // such collisions: single bundle renames `InvalidPermissionError` and\n          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the\n          // committed contract byte for byte.\n          //\n          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under\n          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.\n          preserveModules: true,\n          // The image runs `./dist/main.js`, so the entry keeps that name at the root while\n          // every other module keeps its own path. Under `preserveModules` a plain string here\n          // would be applied to all of them, which numbers them (`main962.js`) and loses the\n          // entry.\n          entryFileNames: (chunk) => (chunk.facadeModuleId === entry ? 'main.js' : '[name].js'),\n        },\n        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog\n        // when its module loads, and nothing references that module afterwards. Rollup may\n        // drop such a module; webpack never did.\n        //\n        // Measured on the first migrated service this changes nothing, so it is insurance\n        // rather than a fix, and it is recorded as such rather than credited with the smaller\n        // bundle (that comes from barrel re-exports the service does not use).\n        treeshake: { moduleSideEffects: true },\n      },\n    },\n  }\n}\n\nexport const nestService = (options: NestServiceOptions): UserConfig =>\n  options.overrides === undefined\n    ? baseConfig(options)\n    : mergeConfig(baseConfig(options), options.overrides)\n","/**\n * The files a service ships beside its bundle, which webpack copied and a bundler does not.\n *\n * `@nx/webpack` takes an `assets` list and copies each match into the output. Nothing in a Vite\n * build does that for a Node target: `publicDir` is a browser concept and is disabled for SSR\n * builds, so an unmigrated `assets` entry is not a smaller output, it is a service that starts\n * and then fails the first time it reaches for a file that is not there.\n *\n * One service in this repo declares it. `planning-period` ships the pug templates, stylesheet and\n * font it renders printed documents from, under `templates/`. Dropping them leaves a build that\n * succeeds, an image that boots, and a printing feature that throws.\n *\n * ## Copied at `closeBundle`, and only what the target declared\n *\n * The declaration is carried through from the webpack target unchanged, globs and all, so this\n * plugin has nothing to decide: it resolves each `input` against the workspace root, matches the\n * glob, and writes under `output` inside the bundle's directory. `closeBundle` because that is\n * when the output directory exists and Vite has finished emptying it.\n *\n * An entry matching nothing FAILS the build. A glob that has quietly stopped matching is the same\n * silent loss as no glob at all, and the point of this file is that this class of loss is loud.\n */\nimport { cpSync, existsSync, mkdirSync, readdirSync, statSync } from 'node:fs'\nimport { dirname, join, relative, sep } from 'node:path'\n\nimport type { Plugin } from 'vite'\n\nimport { globToRegExp } from '../../../shared/glob.js'\n\nimport type { AssetDeclaration } from './nx-target.js'\n\nexport interface CopyAssetsOptions {\n  /** Absolute path to the workspace root, which `input` is relative to. */\n  workspaceRoot: string\n  /** Absolute path to the build's output directory. */\n  outDir: string\n  assets: readonly AssetDeclaration[]\n}\n\n/** Every file under `root`, as paths relative to it and with forward slashes. */\nfunction filesUnder(root: string): string[] {\n  const found: string[] = []\n  const walk = (dir: string): void => {\n    for (const entry of readdirSync(dir)) {\n      const full = join(dir, entry)\n      if (statSync(full).isDirectory()) walk(full)\n      else found.push(relative(root, full).split(sep).join('/'))\n    }\n  }\n  walk(root)\n  return found\n}\n\n/** What each declaration copies, or the reason it cannot. */\nexport function resolveAssets(options: CopyAssetsOptions): { from: string; to: string }[] {\n  const copies: { from: string; to: string }[] = []\n  for (const asset of options.assets) {\n    const input = join(options.workspaceRoot, asset.input)\n    if (!existsSync(input)) {\n      throw new Error(\n        `sentinel build(nest): the build target declares an asset from \\`${asset.input}\\`, which ` +\n          `does not exist. webpack copied it into the output, so the built service would be ` +\n          `missing files it reads at runtime.`,\n      )\n    }\n    const matcher = globToRegExp(asset.glob)\n    const matched = filesUnder(input).filter((file) => matcher.test(file))\n    if (matched.length === 0) {\n      throw new Error(\n        `sentinel build(nest): the asset glob \\`${asset.glob}\\` under \\`${asset.input}\\` matches ` +\n          `no file. An entry that matches nothing is the same silent loss as no entry at all.`,\n      )\n    }\n    for (const file of matched) {\n      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) })\n    }\n  }\n  return copies\n}\n\nexport const copyAssets = (options: CopyAssetsOptions): Plugin => ({\n  name: 'sentinel:copy-assets',\n  // After the bundle is written and the output directory has stopped being emptied.\n  closeBundle() {\n    for (const { from, to } of resolveAssets(options)) {\n      mkdirSync(dirname(to), { recursive: true })\n      cpSync(from, to)\n    }\n  },\n})\n","/**\n * The pruned `package.json` and lockfile a Node image installs from.\n *\n * This is the half that made the nx executor look load-bearing. `--generatePackageJson` was an\n * option of `@nx/webpack:webpack`, and the backend image is built on its two outputs:\n *\n *   COPY --from=build /app/dist/apps/nest/<service>/package.json   /app/package.json\n *   COPY --from=build /app/dist/apps/nest/<service>/pnpm-lock.yaml /app/pnpm-lock.yaml\n *   RUN pnpm i --prod=true --frozen-lockfile\n *\n * It is not bound to the executor. The executor supplies one thing, the project graph, and\n * every function that does the work is exported by `@nx/js`. So the same two files can be\n * produced from a Vite plugin, and `--frozen-lockfile` accepting them afterwards is the proof\n * that they agree with each other: pnpm refuses the install otherwise.\n *\n * ## Why the graph, and not something simpler\n *\n * A Nest service here declares almost nothing of its own: measured, one dependency in its\n * manifest against 1463 installed in its image. Everything it uses is declared at the\n * workspace root and reaches it through source imports. So the dependency list can only be\n * computed from what the code imports, which is what the graph knows.\n *\n * Deriving it from the bundle's own externals is not equivalent either: measured on the first\n * service, the bundle statically requires 42 packages while the correct manifest holds 65. The\n * 23 missing ones are transitive or required dynamically at runtime (`fastify` behind\n * `@nestjs/platform-fastify`, `jsonwebtoken`, the LaunchDarkly SDK). Shipping the short list\n * fails in production, not in the build.\n */\nimport { existsSync, writeFileSync } from 'node:fs'\nimport { isBuiltin } from 'node:module'\nimport { join } from 'node:path'\n\nimport type { Plugin, Rollup } from 'vite'\n\nexport interface NodeManifestOptions {\n  /** The nx project name, which is how the graph is keyed. */\n  project: string\n  /** Absolute path to the workspace root. */\n  workspaceRoot: string\n  /** Where the bundle is written; the two files land beside it. */\n  outDir: string\n  /** Entry file name, written as `main` so `node .` resolves inside the image. */\n  entry?: string\n  /**\n   * Packages the IMAGE provides, which are therefore allowed to be required without being\n   * declared in the manifest.\n   *\n   * The generated Prisma clients are the case this exists for: the Dockerfile copies\n   * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module\n   * declares them. Everything else that is required and undeclared is a bug, and the check\n   * below refuses the build.\n   */\n  providedByImage?: readonly string[]\n}\n\n/** What the Dockerfile copies in itself, so requiring it without declaring it is legitimate. */\nconst DEFAULT_PROVIDED_BY_IMAGE = ['@prisma'] as const\n\n/**\n * Every real package the emitted output requires, from Rollup's own record rather than a scan\n * of the text.\n *\n * `chunk.imports` mixes three things, and only the third is a dependency:\n *\n *  - other EMITTED chunks. Under `preserveModules` these are relative output paths that do not\n *    begin with `.`, so `apps/…`, `libs/…` and `_virtual/…` read exactly like package names.\n *    They are recognised by being keys of the bundle itself.\n *  - Node BUILTINS, which appear both bare (`crypto`) and prefixed (`node:crypto`).\n *  - genuine external packages, which is what the manifest has to cover.\n */\nconst externalPackages = (bundle: Rollup.OutputBundle): Set<string> => {\n  const emitted = new Set(Object.keys(bundle))\n  const packages = new Set<string>()\n\n  for (const emittedFile of Object.values(bundle)) {\n    // Assets carry no imports, and the bundle holds both. Narrowing on the discriminant is what\n    // replaced a cast through `unknown`, which asserted the same thing without checking it.\n    if (emittedFile.type !== 'chunk') continue\n\n    for (const imported of emittedFile.imports) {\n      if (emitted.has(imported)) continue\n      if (imported.startsWith('.') || imported.startsWith('/')) continue\n      if (isBuiltin(imported)) continue\n\n      const parts = imported.split('/')\n      const name = imported.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]\n      if (name) packages.add(name)\n    }\n  }\n  return packages\n}\n\n/**\n * Writes the manifest and lockfile once the bundle is on disk.\n *\n * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the\n * directory and cannot be cleared by `emptyOutDir`.\n *\n * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left\n * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it\n * became the one Vite printed, hiding the failure that actually stopped the build. It cost two\n * diagnoses before being recognised, so the missing directory is now read as what it is: the\n * bundle was never written, and this plugin has nothing to say about why.\n */\nexport const nodeManifest = (options: NodeManifestOptions): Plugin => {\n  /*\n   * Captured while the bundle still exists in memory, and read back once the manifest is built.\n   *\n   * `undefined` until `generateBundle` runs, deliberately: an empty SET would make the coverage\n   * check below pass by having seen nothing, which is the worst way for a guard to succeed. The\n   * two states have to be told apart.\n   */\n  let required: Set<string> | undefined\n\n  return {\n    name: 'sentinel:node-manifest',\n    apply: 'build',\n\n    generateBundle(_outputOptions, bundle) {\n      required = externalPackages(bundle)\n    },\n\n    async closeBundle() {\n      // `closeBundle` runs after a FAILED build too. The ENTRY is what says a bundle was really\n      // written: `emptyOutDir` leaves the directory in place, so its existence alone would let a\n      // failed build still produce a manifest describing nothing.\n      const entry = options.entry ?? 'main.js'\n      if (!existsSync(join(options.outDir, entry))) return\n\n      // Imported here rather than at module scope: a front config importing this file must not\n      // pay for loading the nx graph machinery it will never call.\n      const { createProjectGraphAsync } = await import('nx/src/devkit-exports.js')\n      const { createPackageJson, createLockFile, getLockFileName } = await import('@nx/js')\n\n      const graph = await createProjectGraphAsync({ exitOnError: false })\n      const manifest = createPackageJson(options.project, graph, {\n        root: options.workspaceRoot,\n        isProduction: true,\n      })\n      manifest.main = entry\n\n      if (required === undefined) {\n        throw new Error(\n          `sentinel build(nest): the bundle was written but never inspected, so the manifest ` +\n            `could not be checked against what it requires. Refusing to write one that might ` +\n            `not install.`,\n        )\n      }\n      assertManifestCovers(required, manifest, options)\n\n      writeFileSync(join(options.outDir, 'package.json'), `${JSON.stringify(manifest, null, 2)}\\n`)\n      writeFileSync(\n        join(options.outDir, getLockFileName('pnpm')),\n        createLockFile(manifest, graph, 'pnpm'),\n      )\n    },\n  }\n}\n\n/**\n * Refuse a bundle that requires something the image will not install.\n *\n * The manifest is derived from the project GRAPH, so it lists what modules declare. The bundle\n * requires what the bundler left external. Those two sets agreeing is an assumption, and it was\n * wrong: `tslib` arrives through `importHelpers` in the workspace tsconfig without any module\n * declaring it, so the manifest omitted it and the service died on its first require.\n *\n * It died only in the image. Locally and in CI the workspace root has the package, so the gap is\n * invisible until a container starts, which is the most expensive place to discover it. Checking\n * here turns that into a build failure naming the package.\n */\nconst assertManifestCovers = (\n  required: ReadonlySet<string>,\n  manifest: { dependencies?: Record<string, string> },\n  options: NodeManifestOptions,\n): void => {\n  const declared = new Set(Object.keys(manifest.dependencies ?? {}))\n  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE\n  const missing = [...required]\n    .filter((name) => !declared.has(name))\n    .filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`)))\n    .sort()\n\n  if (missing.length === 0) return\n\n  throw new Error(\n    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated ` +\n      `manifest does not declare, so the image would not install them: ${missing.join(', ')}. ` +\n      `Either declare them in the module's package.json, inline them with ` +\n      `\\`ssr.noExternal\\`, or list them in \\`providedByImage\\` if the Dockerfile copies them in.`,\n  )\n}\n","/**\n * What `@hublo/sentinel/build/nest` gives an adopted service.\n *\n * The sibling `build/react` entry is a re-export surface: the module keeps its own config and\n * only its import lines move. This one carries a shape as well, because 38 Nest services share\n * one config and have nothing of their own to preserve. See `nest-service.ts` for why the two\n * answers differ, and why that is one rule rather than two.\n *\n * Its own entry point, like the React one, so importing it at build time never drags the CLI\n * and its adapters into a Vite config.\n */\nexport { nestService, type NestServiceOptions } from './nest-service.js'\n\n// The pieces the shape is built from, exported individually so a service that needs something\n// the shape does not give it can compose its own without leaving sentinel.\nexport { decoratorMetadata, type DecoratorMetadataOptions } from './decorator-metadata.js'\nexport { nodeManifest, type NodeManifestOptions } from './node-manifest.js'\nexport { tsconfigAliases, type Alias } from './tsconfig-aliases.js'\n\n// Vite's own, so an adopted config imports everything from one place and the module can drop\n// `vite` from its dependencies.\nexport { defineConfig, loadEnv, mergeConfig } from 'vite'\nexport type { Plugin, PluginOption, UserConfig, UserConfigExport } from 'vite'\n"],"mappings":";;;;;;;;;AA0BA,SAAS,QAAAA,aAAY;AAErB,SAAS,mBAAoC;;;ACN7C,SAAS,QAAQ,YAAY,WAAW,aAAa,gBAAgB;AACrE,SAAS,SAAS,MAAM,UAAU,WAAW;AAiB7C,SAAS,WAAW,MAAwB;AAC1C,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,QAAsB;AAClC,eAAW,SAAS,YAAY,GAAG,GAAG;AACpC,YAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,UAAI,SAAS,IAAI,EAAE,YAAY,EAAG,MAAK,IAAI;AAAA,UACtC,OAAM,KAAK,SAAS,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,OAAK,IAAI;AACT,SAAO;AACT;AAGO,SAAS,cAAc,SAA4D;AACxF,QAAM,SAAyC,CAAC;AAChD,aAAW,SAAS,QAAQ,QAAQ;AAClC,UAAM,QAAQ,KAAK,QAAQ,eAAe,MAAM,KAAK;AACrD,QAAI,CAAC,WAAW,KAAK,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,mEAAmE,MAAM,KAAK;AAAA,MAGhF;AAAA,IACF;AACA,UAAM,UAAU,aAAa,MAAM,IAAI;AACvC,UAAM,UAAU,WAAW,KAAK,EAAE,OAAO,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AACrE,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,0CAA0C,MAAM,IAAI,cAAc,MAAM,KAAK;AAAA,MAE/E;AAAA,IACF;AACA,eAAW,QAAQ,SAAS;AAC1B,aAAO,KAAK,EAAE,MAAM,KAAK,OAAO,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,MAAM,QAAQ,IAAI,EAAE,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,aAAa,CAAC,aAAwC;AAAA,EACjE,MAAM;AAAA;AAAA,EAEN,cAAc;AACZ,eAAW,EAAE,MAAM,GAAG,KAAK,cAAc,OAAO,GAAG;AACjD,gBAAU,QAAQ,EAAE,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1C,aAAO,MAAM,EAAE;AAAA,IACjB;AAAA,EACF;AACF;;;AC7DA,SAAS,cAAAC,aAAY,qBAAqB;AAC1C,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AA0BrB,IAAM,4BAA4B,CAAC,SAAS;AAc5C,IAAM,mBAAmB,CAAC,WAA6C;AACrE,QAAM,UAAU,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AAEjC,aAAW,eAAe,OAAO,OAAO,MAAM,GAAG;AAG/C,QAAI,YAAY,SAAS,QAAS;AAElC,eAAW,YAAY,YAAY,SAAS;AAC1C,UAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,UAAI,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,GAAG,EAAG;AAC1D,UAAI,UAAU,QAAQ,EAAG;AAEzB,YAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,YAAM,OAAO,SAAS,WAAW,GAAG,IAAI,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC;AAC7E,UAAI,KAAM,UAAS,IAAI,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAcO,IAAM,eAAe,CAAC,YAAyC;AAQpE,MAAI;AAEJ,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IAEP,eAAe,gBAAgB,QAAQ;AACrC,iBAAW,iBAAiB,MAAM;AAAA,IACpC;AAAA,IAEA,MAAM,cAAc;AAIlB,YAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAI,CAACD,YAAWC,MAAK,QAAQ,QAAQ,KAAK,CAAC,EAAG;AAI9C,YAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,0BAA0B;AAC3E,YAAM,EAAE,mBAAmB,gBAAgB,gBAAgB,IAAI,MAAM,OAAO,QAAQ;AAEpF,YAAM,QAAQ,MAAM,wBAAwB,EAAE,aAAa,MAAM,CAAC;AAClE,YAAM,WAAW,kBAAkB,QAAQ,SAAS,OAAO;AAAA,QACzD,MAAM,QAAQ;AAAA,QACd,cAAc;AAAA,MAChB,CAAC;AACD,eAAS,OAAO;AAEhB,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,2BAAqB,UAAU,UAAU,OAAO;AAEhD,oBAAcA,MAAK,QAAQ,QAAQ,cAAc,GAAG,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5F;AAAA,QACEA,MAAK,QAAQ,QAAQ,gBAAgB,MAAM,CAAC;AAAA,QAC5C,eAAe,UAAU,OAAO,MAAM;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAcA,IAAM,uBAAuB,CAC3B,UACA,UACA,YACS;AACT,QAAM,WAAW,IAAI,IAAI,OAAO,KAAK,SAAS,gBAAgB,CAAC,CAAC,CAAC;AACjE,QAAM,WAAW,QAAQ,mBAAmB;AAC5C,QAAM,UAAU,CAAC,GAAG,QAAQ,EACzB,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,EACpC,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC,EAC7F,KAAK;AAER,MAAI,QAAQ,WAAW,EAAG;AAE1B,QAAM,IAAI;AAAA,IACR,6CAA6C,QAAQ,MAAM,6FACU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAGzF;AACF;;;AF/GA,IAAM,aAAa,CAAC,YAA4C;AAC9D,QAAM,SAASC,MAAK,QAAQ,eAAe,QAAQ,UAAU,QAAQ,QAAQ,OAAO,EAAE;AACtF,QAAM,QAAQA,MAAK,QAAQ,MAAM,QAAQ,SAAS,aAAa;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,MACP,kBAAkB;AAAA,QAChB,MAAM,QAAQ;AAAA,QACd,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,MACxB,CAAC;AAAA,MACD,GAAI,QAAQ,QAAQ,SAChB,CAAC,WAAW,EAAE,eAAe,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,CAAC,CAAC,IACrF,CAAC;AAAA,MACL,aAAa;AAAA,QACX,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,SAAS,EAAE,OAAO,gBAAgB,QAAQ,aAAa,EAAE;AAAA,IACzD,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOH,YAAY,CAAC,OAAO;AAAA,IACtB;AAAA,IACA,OAAO;AAAA;AAAA;AAAA,MAGL,KAAK;AAAA,MACL;AAAA,MACA,aAAa;AAAA,MACb,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA;AAAA,MAGR,QAAQ;AAAA,MACR,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAaR,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,UAKjB,gBAAgB,CAAC,UAAW,MAAM,mBAAmB,QAAQ,YAAY;AAAA,QAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,WAAW,EAAE,mBAAmB,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,cAAc,CAAC,YAC1B,QAAQ,cAAc,SAClB,WAAW,OAAO,IAClB,YAAY,WAAW,OAAO,GAAG,QAAQ,SAAS;;;AGzIxD,SAAS,cAAc,SAAS,eAAAC,oBAAmB;","names":["join","existsSync","join","join","mergeConfig"]}

package/dist/{validate-ONAQPYJB.js → validate-5GABSOYH.js}

@@ -7,7 +7,8 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-GCZKG4B2.js";
+} from "./chunk-ORESQJAU.js";
+import "./chunk-O7REVMOC.js";
 import "./chunk-NW6UHNYX.js";
 
 // src/roles/test/validate.ts

package/docs/test-adoption.md

@@ -10,6 +10,7 @@ that decided a design choice say which choice.
 - [The one line that makes a per-module migration possible](#the-one-line-that-makes-a-per-module-migration-possible)
 - [What `--init --test` rewrites, and what it refuses](#what---init---test-rewrites-and-what-it-refuses)
 - [Nest services](#nest-services)
+- [The two DOM matchers, which a react module gets without asking](#the-two-dom-matchers-which-a-react-module-gets-without-asking)
 - [The check that decides whether you are done](#the-check-that-decides-whether-you-are-done)
 
 ## What the ground actually looks like
@@ -145,6 +146,30 @@ await expect(container).toBeValidHtml()    // html-validate
 
 A **nest** module gets neither, because there is no DOM to assert on.
 
+⚠️ The generated config imports these by their package subpath, so they only resolve once
+`pnpm install` has run. Skip that step and Vitest reports `Cannot find module
+'<module>/@hublo/sentinel/test/setup/a11y'`, which names a path inside your module and reads like
+a missing file rather than a missing install.
+
+### What they found on the first module that ran them
+
+`libs/front/components`, the design system, on the first run after migrating. The `Checkbox` given
+a `label` had no accessible name at all, and both engines said so independently:
+
+| engine          | message                                                     |
+| --------------- | ----------------------------------------------------------- |
+| `axe-core`      | `aria-prohibited-attr`: aria-label cannot be used on a span |
+| `axe-core`      | `label`: form elements must have labels                     |
+| `html-validate` | `aria-label-misuse`                                         |
+| `html-validate` | `input-missing-label`                                       |
+
+One line caused it: `aria-label` was passed to the component, so MUI put it on the root `<span>`
+rather than on the `<input>`. What makes it worth repeating here is why nothing had caught it. The
+component is used across an app of several hundred screens, its tests were green, and
+`getByLabelText` FOUND it: the query returned the wrapper span, so a test could locate the
+checkbox, click it, and never notice it was announced with no name. The name was invisible to
+everything except a screen reader and these two engines.
+
 ### What `toBeAccessible()` does and does not say
 
 It runs axe on what you hand it and fails on any violation, naming the rule, the elements and the
@@ -268,16 +293,36 @@ member NAMES, which `any` gave up too. Applied only when the SAME file mocks tha
 ## The check that decides whether you are done
 
 Not "the suite is green". **The suite runs the same tests as before**. You do not have to arrange
-that comparison; the two commands do it between them:
+that comparison; `--validate` does it, on either side of the migration:
 
 ```console
-$ sentinel --init --test    # runs jest ONCE first, records every test name, then migrates
-$ pnpm install              # the module's dependencies changed
-$ sentinel --run --test     # runs vitest, compares against that recording, then spends it
+$ sentinel --validate --test   # on the JEST state: records every passing test name
+$ sentinel --init --test       # migrates
+$ pnpm install                 # the module's dependencies changed
+$ sentinel --validate --test   # runs vitest, compares against that recording, then spends it
 ```
 
 A codemod touching thousands of files cannot be reviewed by hand. This comparison is the review.
 
+⚠️ **The first command comes first, and the tool enforces it.** Start with `--init` and the jest
+config is already gone, so there is nothing left to record and nothing to compare against:
+
+```console
+✗ recruitment — already migrated, and no reference was recorded before it was, so there is
+  nothing to compare against. A proof has to be started BEFORE the migration:
+  `sentinel --validate --test` on the jest state, then `--init --test`, then this again.
+```
+
+### Why the proof is its own verb
+
+Because of what SURVIVES a run. `--init` and `--migrate` write state that stays, which is their
+whole purpose and why they are strict about what they touch. `--validate` may instrument the module
+it is proving, provided nothing it writes remains. Those are different contracts, so they are
+different verbs, and the proof can grow without touching a migration that is already proven.
+
+It answers every type, too: `sentinel --validate --lint` is a well-formed command, so it says "not
+available yet" rather than calling your sentence wrong.
+
 ### Why it cannot be one command
 
 The reference only exists BEFORE the migration, and the thing that produces it, the jest config, is
@@ -297,7 +342,7 @@ shorter.
 So the gate refuses a run that lost a name or invented one, and says which:
 
 ```console
-$ sentinel --run --test
+$ sentinel --validate --test
   1 test(s) no longer exist: useHublerNetworkProfilesQuery builds the URL with employment
   statuses only. (reference: jest.config.ts, 2026-09-23T21:10:00.000Z) The reference is KEPT
   until a run passes it, so this does not go green by running again. Fix the suite and re-run,
@@ -332,6 +377,7 @@ have read that improvement as a regression.
 ```console
 $ nx run <module>:typecheck            # BEFORE, and write that down too
 $ sentinel --init --test
+$ pnpm install
 $ nx run <module>:typecheck            # after
 ```
 

package/docs/validating-a-change.md

@@ -7,6 +7,7 @@ Everything here was learned the expensive way. None of it is theory.
 - [The rule everything follows](#the-rule-everything-follows)
 - [Phase 0: prove the premise](#phase-0-prove-the-premise)
 - [Phase 1: measure the output](#phase-1-measure-the-output)
+- [Measuring a migration, where both sides must be the same program](#measuring-a-migration-where-both-sides-must-be-the-same-program)
 - [Traps that report success](#traps-that-report-success)
 - [What CI does not cover](#what-ci-does-not-cover)
 
@@ -69,6 +70,34 @@ rm -rf apps/front/<x>/.output && nx run <x>:build     # cache hit: same count re
 `console` once restored **0 of 464** files from a green cache hit. Its image runs `pnpm` rather
 than nx, so the one caller that would have failed never used the cache.
 
+## Measuring a migration, where both sides must be the same program
+
+A migration is proved by comparing a suite BEFORE against the same suite AFTER. That comparison is
+only worth something if the two runs differ in the one variable being changed. Three ways they
+silently differed here, each one costing hours of attributing a real-looking red to the wrong
+cause.
+
+**Run the module's OWN installed binary.** Invoking a local build by path (`node
+/path/to/sentinel/dist/bin/sentinel.js`) resolves the runner through SENTINEL's manifest, so the
+suite runs against the sentinel repo's physical install of vitest rather than the monorepo's. Two
+red modules in one campaign were that and nothing else. A campaign runs `npx
+@hublo/sentinel@<version>` or the module's own script, never a path.
+
+**Run from the workspace ROOT.** The adapter relocates vitest to the root with `--root <module>`,
+because a module's config resolves workspace aliases from there. Running the same command from
+inside the module changes what resolves, and the failure looks like the migration's fault.
+
+**Let the module's environment in, deliberately.** nx loads the repo's dotenv files into a task:
+314 environment names under nx against 49 direct. One of them, set in a module's own `.env.local`,
+made a single test fail, and the reference recorded without it reported a name that "disappeared".
+This is the one place where the usual instinct, isolate, is WRONG: the two sides of a comparison
+have to be the same program, so the proof loads the same files the module's own target loads.
+
+**A name can leave both lists without failing.** Vitest reports the tests of a suite whose hook
+threw as `skipped`, where jest counted them FAILED. The count moves, no test is red, and the
+comparison must say "missing because skipped" rather than "lost", or it accuses the migration of
+something the runner did.
+
 ## Traps that report success
 
 | Trap                        | What it looks like              | What closes it                                                             |
@@ -79,9 +108,13 @@ than nx, so the one caller that would have failed never used the cache.
 | A clock reading vs an mtime | passes locally, fails in CI     | stamp from the same filesystem                                             |
 | A stale cache entry         | a hit that restores nothing     | `nx reset`; entries predating a module's `outputs` restore nothing forever |
 | `"$var:generate-x"` in zsh  | a task name that does not exist | brace it: `"${var}:generate-x"` — `:g` is a zsh modifier                   |
+| `rc=$?` after a pipeline    | the status of `tail`, not yours | capture before piping, or `set -o pipefail`                                |
+| `timeout` on macOS          | an empty run read as green      | it does not exist there; the command never ran                             |
+| A local build by path       | a red that is not the module's  | resolves the runner through SENTINEL's install                             |
 
-The last one is the only one that lies toward FAILURE, which makes it visible but sends you
-hunting for causes elsewhere. It produced several "failures" that were only quoting.
+`rc=$?` after a pipeline caught us three times in one day, and once produced a claim we had
+already announced. The zsh one is the only entry that lies toward FAILURE, which makes it visible
+but sends you hunting for causes elsewhere.
 
 ## What CI does not cover
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.4.0-alpha.30",
+  "version": "1.4.0-alpha.32",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",