@hublo/sentinel 1.4.0-alpha.9 → 1.4.1

package/dist/chunk-H3GSGAX2.js

@@ -0,0 +1,11 @@
+// src/roles/test/setup/file-boundary-state.ts
+var CURRENT_FILE_MOCKS = /* @__PURE__ */ Symbol.for("@hublo/sentinel/test/current-file-mocks");
+var PHASE = /* @__PURE__ */ Symbol.for("@hublo/sentinel/test/boundary-phase");
+var SHARED_WORKER = /* @__PURE__ */ Symbol.for("@hublo/sentinel/test/shared-worker");
+
+export {
+  CURRENT_FILE_MOCKS,
+  PHASE,
+  SHARED_WORKER
+};
+//# sourceMappingURL=chunk-H3GSGAX2.js.map

package/dist/chunk-H3GSGAX2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/roles/test/setup/file-boundary-state.ts"],"sourcesContent":["/**\n * The three keys `./file-boundary.js` and `./file-boundary-close.js` share.\n *\n * They live on `globalThis` rather than in this module's scope for one reason: with isolation off\n * a module is evaluated once per worker, but with isolation ON it is re-evaluated per file, and\n * the two halves of the boundary must find the same state in both cases. `Symbol.for` keeps that\n * true even if pnpm's layout hands the two halves different copies of this file.\n */\n\n/**\n * Mocks the test file currently running built, and the only thing the global reset APIs act on.\n *\n * Mocks a SETUP file built are not recorded at all rather than recorded separately: nothing needs\n * to iterate them, and a setup file runs per test file, so keeping them grew without bound.\n */\nexport const CURRENT_FILE_MOCKS = Symbol.for('@hublo/sentinel/test/current-file-mocks')\n\n/** `'infrastructure'` while the setup files run, `'file'` from the test file onwards. */\nexport const PHASE = Symbol.for('@hublo/sentinel/test/boundary-phase')\n\n/**\n * Set by `./file-boundary.js`, which the preset installs only when a suite shares a worker.\n *\n * Read by anything whose lifecycle differs between the two, msw's `close()` being the first: its\n * boundary is the worker, and only per-file isolation ever made the worker and the file the same\n * thing.\n */\nexport const SHARED_WORKER = Symbol.for('@hublo/sentinel/test/shared-worker')\n"],"mappings":";AAeO,IAAM,qBAAqB,uBAAO,IAAI,yCAAyC;AAG/E,IAAM,QAAQ,uBAAO,IAAI,qCAAqC;AAS9D,IAAM,gBAAgB,uBAAO,IAAI,oCAAoC;","names":[]}

package/dist/{chunk-WLFE5RUU.js → chunk-KMKQDGI6.js}

@@ -1,7 +1,7 @@
 // src/shared/package-json.ts
-import { existsSync, readFileSync } from "fs";
-import { basename, dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { existsSync, readFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 function readOwnPackage() {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (; ; ) {
@@ -50,15 +50,13 @@ function moduleName(dir) {
   return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
 }
 
-// src/core/workspace-prep.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname as dirname2, join as join2, relative } from "path";
-
 // src/core/settings.ts
 var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, join as join2, relative } from "node:path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -261,4 +259,4 @@ export {
   ensureWorkspacePrep,
   inspectWorkspacePrep
 };
-//# sourceMappingURL=chunk-WLFE5RUU.js.map
+//# sourceMappingURL=chunk-KMKQDGI6.js.map

package/dist/chunk-KMKQDGI6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/package-json.ts","../src/core/settings.ts","../src/core/workspace-prep.ts"],"sourcesContent":["/**\n * package.json helpers, shared by the CLI and the engine.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\n/**\n * sentinel's OWN version, for `--version`. We must NOT use\n * `process.env.npm_package_version`, that is the version of whatever script\n * invoked us (an app's package.json, or nothing). Instead walk up from this\n * module to the nearest package.json, which is always sentinel's own, whether\n * running from source or the bundled dist.\n */\n/**\n * sentinel's OWN name + version, read by walking up from this module to the nearest\n * package.json. Used both for `--version` and to pin the exact dependency `--init`\n * writes into an adopted module, so a module always references the version that adopted it.\n */\nexport function readOwnPackage(): { name: string; version: string; bin?: string } {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    const pkgPath = join(dir, 'package.json')\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {\n          name?: string\n          version?: string\n          bin?: string | Record<string, string>\n        }\n        if (typeof pkg.version === 'string') {\n          // The bin PATH, not the command name: a package that adopts itself has to invoke\n          // its own build output, because the `.bin` shim does not exist yet (see below).\n          const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin ?? {})[0]\n          return { name: pkg.name ?? '@hublo/sentinel', version: pkg.version, bin }\n        }\n      } catch {\n        // Malformed package.json; keep walking up.\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) return { name: '@hublo/sentinel', version: '0.0.0' } // filesystem root\n    dir = parent\n  }\n}\n\nexport function readOwnVersion(): string {\n  return readOwnPackage().version\n}\n\n/**\n * Read a module's package.json for framework detection; tolerant of a missing or\n * malformed file (returns `{}`, so detection falls through to the `node` default).\n */\nexport function readProjectPackageJson(dir: string): {\n  /** The package name, which is also what nx calls the project when there is no `project.json`. */\n  name?: string\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  /**\n   * How the module's `.js`/`.ts` files are loaded. It decides whether a Vite config can import\n   * an ESM-only package at all, which is why the build role reads it before rewriting one.\n   */\n  type?: string\n  /**\n   * What nx alone needs per target, which every role writes here and none could read back.\n   *\n   * Typed loosely on purpose: this reader is shared by every role and each one knows the shape of\n   * its own target. Declared at all because a role that WRITES a block and then has to cast to\n   * read it is one refactor away from reading a key it never wrote.\n   */\n  nx?: { targets?: Record<string, Record<string, unknown>> }\n} {\n  const path = join(dir, 'package.json')\n  if (!existsSync(path)) return {}\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as Record<string, never>\n  } catch {\n    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.\\n`)\n    return {}\n  }\n}\n\n/**\n * The nx project name for a module, read from its `project.json`, or undefined if\n * there is none/unreadable. Used when `--init` has to scaffold a `package.json`\n * for a module that only has a `project.json` (common for nx apps/services): the\n * scaffolded file borrows this name so it is a valid, uniquely-named workspace\n * package. Reusable by any tool that scaffolds, not just TypeScript.\n */\nexport function readNxProjectName(dir: string): string | undefined {\n  const path = join(dir, 'project.json')\n  if (!existsSync(path)) return undefined\n  try {\n    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { name?: unknown }\n    return typeof parsed.name === 'string' ? parsed.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * What nx calls this module, resolved the way nx itself resolves it.\n *\n * The precedence is `project.json`, then `package.json`, then the directory, and only the\n * first and last of those were being consulted. A module with no `project.json` therefore\n * answered with its DIRECTORY while nx answered with its package name, and the two disagree\n * in the real repo: `apps/front/hr-management` is `front-hr-management` to nx, as is\n * `apps/front/storybook-app`.\n *\n * That gap is not cosmetic, because this name is what `--module` is matched against. The\n * `serve` script `--init` writes carries `--module <name>`, so a module in that shape was\n * adopted with a script naming a project the workspace does not contain, and `pnpm run serve`\n * failed the day it was adopted with nothing having reported it.\n *\n * One function so the two ends cannot drift again: whoever WRITES the name and whoever\n * RESOLVES it now read the same source.\n */\nexport function moduleName(dir: string): string {\n  const declared = readProjectPackageJson(dir).name\n  return readNxProjectName(dir) ?? (declared === undefined ? basename(dir) : declared)\n}\n","/**\n * Tunable settings: the knobs you would actually change. The fixed vocabulary and\n * its types live in `domain.ts`.\n *\n * Note: the preset is DETECTED from a module's dependencies (see\n * `detect-framework.ts`), deterministically, `node` when no framework dep is present.\n * `--preset` overrides the detection (recommended for `--init`, since hoisted deps\n * can make detection return `node`). The detection table lives in `detect-framework.ts`.\n */\n\n/** A file that marks a workspace root; sentinel refuses to operate there. */\nexport const WORKSPACE_ROOT_MARKER = 'nx.json'\n\n/**\n * How many structured diagnostics a report embeds per module, when the caller does not say.\n *\n * A cap, not a limit on what is counted: the totals stay exact and `diagnosticsTruncated`\n * says when rows were dropped, so a bounded envelope never reads as a clean module. Shared\n * by every role, because a consumer reading `--json` across roles should not have to learn\n * a different cap for each one. `--max-diagnostics 0` means no cap.\n */\nexport const DEFAULT_MAX_DIAGNOSTICS = 100\n","/**\n * Workspace-level preparation that `--init` applies once, at the workspace root, so an\n * adopted module actually installs and resolves cleanly. `--init` writes a module's own\n * files; this is the small, deliberate exception where it also touches the root, because\n * \"set this module up\" is not honest if the workspace it lives in cannot then install or\n * resolve it.\n *\n * Kept intentionally narrow (YAGNI): it applies the specific fixes a workspace's OWN\n * config shows it needs, and is a no-op everywhere else. It is NOT a speculative dedupe\n * engine, when a second, different case appears we generalize from real cases instead of\n * predicting them. The two fixes today:\n *\n *  - i18next singleton override. If the root declares a second TypeScript via the\n *    `@typescript/native` alias (a repo mid-migration running two TypeScripts), adopting a\n *    module re-resolves pnpm and i18next, which carries an optional type-only `typescript`\n *    peer, forks into two peer-keyed variants. That forks react-i18next into two React\n *    contexts and breaks translation-singleton tests. Pinning i18next's `typescript` peer\n *    to the declared TS collapses it to one. Read from the root's own declaration, so it\n *    tracks the version and disappears (no-op) once the migration removes the second TS.\n *    Written to `pnpm-workspace.yaml`, the only place current pnpm reads overrides from.\n *\n *  - release-age allow-list. If the root uses pnpm's `minimumReleaseAgeExclude` gate, a\n *    freshly published sentinel is younger than the gate and will not install; allow-list\n *    it. Only touched when the gate is actually configured.\n *\n *  - root formatter exclusion. A module that has adopted the FORMAT role is formatted by\n *    oxfmt, from its own config. The root Prettier does not know that and still owns every\n *    file in the repo, so `nx format:write` or `prettier --write .` from the root reformats\n *    the module back to the ROOT's style, and the next `pnpm run format` in the module\n *    reverses it. Two formatters fighting over the same files, with whichever ran last\n *    winning, is the exact state adoption removes INSIDE a module, and it has to be removed\n *    at the root too. So the module is excluded in the root `.prettierignore` as it adopts,\n *    and the root's own config is otherwise untouched: it still serves every module that has\n *    not migrated.\n *\n * All three edits are idempotent and defensive: absent the trigger (no second TypeScript, no\n * release-age gate, no root Prettier) each is skipped, so the step is safe on any workspace.\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, relative } from 'node:path'\n\nimport { readOwnPackage } from '../shared/package-json.js'\n\nimport { WORKSPACE_ROOT_MARKER } from './settings.js'\n\nconst OVERRIDE_KEY = 'i18next>typescript'\nconst NATIVE_TS_ALIAS = '@typescript/native' // `npm:typescript@^7.x`: a workspace's second, real TS\nconst WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst RELEASE_AGE_KEY = 'minimumReleaseAgeExclude'\nconst LIST_ITEM = /^(\\s*)-\\s+(.*?)\\s*$/\nconst MAP_ENTRY = /^(\\s+)(.*?):\\s+(.*?)\\s*$/\n\ninterface RootPackageJson {\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  pnpm?: { overrides?: Record<string, string> }\n}\n\n/** Walk up from a module directory to the workspace root (the dir holding the marker). */\nexport function findWorkspaceRoot(startDir: string): string | undefined {\n  let dir = startDir\n  for (;;) {\n    if (existsSync(join(dir, WORKSPACE_ROOT_MARKER))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return undefined\n    dir = parent\n  }\n}\n\n/**\n * The TypeScript version to pin i18next's peer to, read from the root's own\n * `@typescript/native` alias (`npm:typescript@^7.0.2` -> `7.0.2`). Returns undefined when\n * the alias is absent (no second TypeScript, so no fork to fix).\n */\nfunction declaredNativeTs(pkg: RootPackageJson): string | undefined {\n  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS]\n  if (!spec) return undefined\n  const version = spec.slice(spec.lastIndexOf('@') + 1).replace(/^[\\^~>=<\\s]+/, '')\n  return version || undefined\n}\n\n/**\n * Ensure the i18next singleton override matches the declared second TypeScript. No-op when\n * the workspace runs a single TypeScript (no `@typescript/native`). Returns a message when\n * it changed (or would change, under dryRun), else undefined.\n *\n * The override is written to `pnpm-workspace.yaml`, never to `package.json#pnpm`: pnpm 11\n * stopped reading the `pnpm` field and does so SILENTLY, with no warning and no deprecation\n * (pnpm/pnpm#11536), so an override left in `package.json` is simply not applied. The yaml is\n * read by pnpm 10 and 11 alike (https://pnpm.io/settings), which is why there is one target\n * here rather than a version-dependent fallback.\n */\nfunction ensureI18nextSingleton(root: string, dryRun: boolean): string | undefined {\n  const pkgPath = join(root, 'package.json')\n  if (!existsSync(pkgPath)) return undefined\n  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n  const want = declaredNativeTs(pkg)\n  if (!want) return undefined // single TypeScript: nothing forks\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined // no workspace file: nowhere pnpm would read it\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const entry = findOverrideEntry(lines)\n  if (entry.valueIdx !== undefined && entry.value === want) return undefined // already pinned\n  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n\n  applyOverride(lines, entry, want)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n}\n\n/** Where the override sits in the yaml, if at all, plus where a new one would be inserted. */\ninterface OverrideEntry {\n  /** Index of the `OVERRIDE_KEY` line, when the key is already declared. */\n  valueIdx?: number\n  /** Its current value, unquoted. */\n  value?: string\n  /** Index of the `overrides:` key line, when the block exists. */\n  blockIdx?: number\n  /** Index of the block's last entry, so an insertion keeps the block contiguous. */\n  lastEntryIdx?: number\n  /** Indentation the block's entries use. */\n  indent: string\n}\n\n/**\n * Locate the `overrides:` block and the i18next key inside it. A targeted text read rather\n * than a yaml parse, for the same reason `ensureReleaseAgeAllowList` does it: this file is\n * hand-maintained and round-tripping it through a parser would drop its comments and ordering.\n */\nfunction findOverrideEntry(lines: string[]): OverrideEntry {\n  const blockIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === 'overrides:')\n  if (blockIdx === -1) return { indent: '  ' }\n\n  let lastEntryIdx = blockIdx\n  let indent = '  '\n  for (let i = blockIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(MAP_ENTRY)\n    if (!match) break // dedent or blank line: the block ended\n    indent = match[1] ?? indent\n    lastEntryIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === OVERRIDE_KEY) {\n      return {\n        valueIdx: i,\n        value: (match[3] ?? '').replace(/^['\"]|['\"]$/g, ''),\n        blockIdx,\n        lastEntryIdx,\n        indent,\n      }\n    }\n  }\n  return { blockIdx, lastEntryIdx, indent }\n}\n\n/** Update the key in place, append it to an existing block, or open a block at the end. */\nfunction applyOverride(lines: string[], entry: OverrideEntry, want: string): void {\n  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`\n  if (entry.valueIdx !== undefined) {\n    lines[entry.valueIdx] = line\n    return\n  }\n  if (entry.lastEntryIdx !== undefined) {\n    lines.splice(entry.lastEntryIdx + 1, 0, line)\n    return\n  }\n  // No `overrides:` block at all: open one, keeping a single trailing newline.\n  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()\n  lines.push('overrides:', line, '')\n}\n\n/**\n * Ensure sentinel is allow-listed under `minimumReleaseAgeExclude` so a fresh publish\n * installs. No-op when the workspace has no such gate. Targeted text edit so comments and\n * formatting are preserved. Returns a message when it changed (or would), else undefined.\n */\nfunction ensureReleaseAgeAllowList(root: string, dryRun: boolean): string | undefined {\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined\n  const own = readOwnPackage().name\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const keyIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === `${RELEASE_AGE_KEY}:`)\n  if (keyIdx === -1) return undefined // no release-age gate in use\n\n  let lastItemIdx = keyIdx\n  let indent = '  '\n  for (let i = keyIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(LIST_ITEM)\n    if (!match) break\n    indent = match[1] ?? indent\n    lastItemIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === own) return undefined // already listed\n  }\n  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`\n\n  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`\n}\n\n/** The root ignore file Prettier reads, and the section sentinel owns inside it. */\nconst PRETTIER_IGNORE = '.prettierignore'\nconst EXCLUSION_HEADER = '# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier'\n\n/** Root Prettier configs. Their presence is what makes an exclusion meaningful. */\nconst ROOT_PRETTIER_CONFIGS = [\n  '.prettierrc',\n  '.prettierrc.json',\n  '.prettierrc.json5',\n  '.prettierrc.yml',\n  '.prettierrc.yaml',\n  '.prettierrc.js',\n  '.prettierrc.cjs',\n  '.prettierrc.mjs',\n  'prettier.config.js',\n  'prettier.config.cjs',\n  'prettier.config.mjs',\n]\n\n/**\n * Exclude a module that now formats itself from the ROOT Prettier.\n *\n * Written as a directory pattern anchored at the root (`/apps/front/x/`), which is what\n * gitignore syntax means by \"this exact directory\", so a module cannot accidentally exclude a\n * same-named directory somewhere else.\n *\n * Skipped entirely when the root has no Prettier at all: there is then nothing to conflict\n * with, and creating an ignore file for a tool the workspace does not use would be noise.\n */\nfunction ensureFormatterExclusion(\n  root: string,\n  moduleDir: string,\n  dryRun: boolean,\n): string | undefined {\n  const rel = relative(root, moduleDir).replaceAll('\\\\', '/')\n  if (rel === '' || rel.startsWith('..')) return undefined // the root itself, or outside it\n\n  const ignorePath = join(root, PRETTIER_IGNORE)\n  const hasPrettier =\n    existsSync(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync(join(root, name)))\n  if (!hasPrettier) return undefined\n\n  const pattern = `/${rel}/`\n  const existing = existsSync(ignorePath) ? readFileSync(ignorePath, 'utf8') : ''\n  const lines = existing.split('\\n')\n  // Already excluded, in whichever spelling a human may have used.\n  if (lines.some((line) => line.trim().replace(/\\/$/, '') === pattern.replace(/\\/$/, ''))) {\n    return undefined\n  }\n  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`\n\n  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER)\n  if (headerIdx === -1) {\n    const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}\\n${pattern}\\n`)\n  } else {\n    // Keep the managed section together and sorted, so the list stays readable as it grows\n    // to 150 entries and a diff shows one added line rather than a reshuffle.\n    let end = headerIdx + 1\n    while (end < lines.length && lines[end]?.trim().startsWith('/')) end += 1\n    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort()\n    writeFileSync(\n      ignorePath,\n      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join('\\n'),\n    )\n  }\n  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`\n}\n\n/**\n * Apply every workspace-level fix the given root needs. Returns the human-readable\n * messages for what changed (empty when nothing did). Under dryRun nothing is written and\n * the messages describe what would change.\n *\n * `formattedModule` is the module that just adopted the FORMAT role, when one did. Absent\n * for a lint-only or TypeScript-only `--init`, because a module that has not adopted the\n * formatter must keep being formatted by the root.\n */\nexport function ensureWorkspacePrep(opts: {\n  root: string\n  dryRun?: boolean\n  formattedModule?: string\n}): string[] {\n  const dryRun = Boolean(opts.dryRun)\n  return [\n    ensureI18nextSingleton(opts.root, dryRun),\n    ensureReleaseAgeAllowList(opts.root, dryRun),\n    opts.formattedModule === undefined\n      ? undefined\n      : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),\n  ].filter((message): message is string => message !== undefined)\n}\n\n/**\n * One standing change sentinel has made to the workspace ROOT, and whether it is still earned.\n *\n * This exists because the three root writes are the only thing sentinel does that nobody can\n * see afterwards. `--init` announces each one on the run that makes it, and then it is a line\n * in someone else's file forever. Two consequences already bit us.\n *\n * The `i18next>typescript` override re-resolved `apps/front/console` from a PR that touched no\n * file under it, so CODEOWNERS pulled nobody and its owners learned about it afterwards.\n *\n * And every one of them is TEMPORARY with its removal condition written in prose. That failed\n * three times in one week: `SENTINEL_TAG=alpha` in the migration-page workflow kept building\n * with a pre-release long after 1.1.0 went stable and reported `Format 0/439` for 15 adopted\n * modules; ADR 0042 and its RFC both sat mid-flight past their deadline; and this release-age\n * exclusion is still waiting on \"once sentinel's release cadence settles\". Nothing failed when\n * any of them expired, because a comment cannot fail.\n *\n * So each entry carries the condition that JUSTIFIES it, evaluated now rather than described.\n * A trigger that has gone away makes the entry dead config, and dead config is something a\n * command can say out loud instead of something a reader has to notice.\n *\n * Read-only, and offline: it inspects the same files `--init` writes and nothing else. What it\n * deliberately does NOT claim is anything needing the npm registry — whether a published\n * version is old enough to clear the release-age gate is not knowable from the repo, so it is\n * stated as the standing exemption it is rather than guessed at.\n */\nexport interface WorkspacePrepEntry {\n  /** `rule` to match the shape the shared renderer already prints as a labelled block. */\n  rule: string\n  /** What it does, whether its trigger still holds, and what would retire it. */\n  reason: string\n}\n\n/** The root-level changes sentinel maintains here, each with its justification checked now. */\nexport function inspectWorkspacePrep(root: string): WorkspacePrepEntry[] {\n  const entries: WorkspacePrepEntry[] = []\n  // Tolerant, unlike the write path above, and the difference is deliberate. `--init` should\n  // fail loudly on a root it cannot parse, because it is about to edit it. `--inspect` is a\n  // read verb that sweeps 441 modules, and one malformed root file must not take the whole\n  // sweep down: the modules still have honest answers to give. Caught by its own test.\n  let pkg: RootPackageJson = {}\n  const pkgPath = join(root, 'package.json')\n  if (existsSync(pkgPath)) {\n    try {\n      pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n    } catch {\n      pkg = {}\n    }\n  }\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  const yaml = existsSync(yamlPath) ? readFileSync(yamlPath, 'utf8') : undefined\n\n  const pinned = yaml === undefined ? undefined : findOverrideEntry(yaml.split('\\n')).value\n  if (pinned !== undefined) {\n    const stillForks = declaredNativeTs(pkg)\n    entries.push({\n      rule: `${WORKSPACE_YAML} → overrides.${OVERRIDE_KEY}`,\n      reason:\n        stillForks === undefined\n          ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing ` +\n            `forks any more. This override is now dead config and can be removed.`\n          : `pinned to ${pinned}, matching the second TypeScript the root declares ` +\n            `(${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, ` +\n            `not only adopted ones. It retires with the second TypeScript.`,\n    })\n  }\n\n  // A copy left in `package.json#pnpm` by an older sentinel, or by hand. Reported because it\n  // is INERT rather than redundant: pnpm 11 dropped the `pnpm` field with no warning\n  // (pnpm/pnpm#11536), so it reads as protection that is not applied.\n  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY]\n  if (legacy !== undefined) {\n    entries.push({\n      rule: `package.json → pnpm.overrides.${OVERRIDE_KEY}`,\n      reason:\n        `pinned to ${legacy}, but pnpm 11 no longer reads the \\`pnpm\\` field of package.json ` +\n        `and says nothing about it, so this override is not applied. Move it to ` +\n        `${WORKSPACE_YAML} under \\`overrides:\\`, which pnpm 10 and 11 both read.`,\n    })\n  }\n\n  const own = readOwnPackage().name\n  if (yaml !== undefined) {\n    const listed = new RegExp(`^\\\\s*-\\\\s*['\"]?${own.replace('/', '\\\\/')}['\"]?\\\\s*$`, 'm').test(yaml)\n    if (listed) {\n      const gated = new RegExp(`^\\\\s*minimumReleaseAge\\\\s*:`, 'm').test(yaml)\n      entries.push({\n        rule: `${WORKSPACE_YAML} → ${RELEASE_AGE_KEY}: ${own}`,\n        reason: gated\n          ? `${own} is exempt from this workspace's release-age gate, so a freshly published ` +\n            `version installs instead of being held. That is a standing exemption from a ` +\n            `supply-chain control: the exposure is one bump wide, since the version is pinned ` +\n            `and the lockfile carries its integrity, so a re-publish of the same version does ` +\n            `not pass. Retire it once a bump can simply wait out the window.`\n          : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so ` +\n            `there is no gate to be exempt from. This entry is now dead config and can be removed.`,\n      })\n    }\n  }\n\n  return entries\n}\n"],"mappings":";AAGA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,qBAAqB;AAcvB,SAAS,iBAAkE;AAChF,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,YAAI,OAAO,IAAI,YAAY,UAAU;AAGnC,gBAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;AAClF,iBAAO,EAAE,MAAM,IAAI,QAAQ,mBAAmB,SAAS,IAAI,SAAS,IAAI;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AACvE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,iBAAyB;AACvC,SAAO,eAAe,EAAE;AAC1B;AAMO,SAAS,uBAAuB,KAkBrC;AACA,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,YAAQ,OAAO,MAAM,6BAA6B,IAAI;AAAA,CAA6B;AACnF,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,kBAAkB,KAAiC;AACjE,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,WAAW,KAAqB;AAC9C,QAAM,WAAW,uBAAuB,GAAG,EAAE;AAC7C,SAAO,kBAAkB,GAAG,MAAM,aAAa,SAAY,SAAS,GAAG,IAAI;AAC7E;;;AC9GO,IAAM,wBAAwB;AAU9B,IAAM,0BAA0B;;;ACiBvC,SAAS,cAAAA,aAAY,gBAAAC,eAAc,qBAAqB;AACxD,SAAS,WAAAC,UAAS,QAAAC,OAAM,gBAAgB;AAMxC,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAClB,IAAM,YAAY;AASX,SAAS,kBAAkB,UAAsC;AACtE,MAAI,MAAM;AACV,aAAS;AACP,QAAIC,YAAWC,MAAK,KAAK,qBAAqB,CAAC,EAAG,QAAO;AACzD,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOA,SAAS,iBAAiB,KAA0C;AAClE,QAAM,OAAO,IAAI,eAAe,eAAe,KAAK,IAAI,kBAAkB,eAAe;AACzF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAChF,SAAO,WAAW;AACpB;AAaA,SAAS,uBAAuB,MAAc,QAAqC;AACjF,QAAM,UAAUD,MAAK,MAAM,cAAc;AACzC,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO;AACjC,QAAM,MAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AACpD,QAAM,OAAO,iBAAiB,GAAG;AACjC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,QAAQ,kBAAkB,KAAK;AACrC,MAAI,MAAM,aAAa,UAAa,MAAM,UAAU,KAAM,QAAO;AACjE,MAAI,OAAQ,QAAO,aAAa,YAAY,OAAO,IAAI,OAAO,cAAc;AAE5E,gBAAc,OAAO,OAAO,IAAI;AAChC,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,UAAU,YAAY,OAAO,IAAI,OAAO,cAAc;AAC/D;AAqBA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,WAAW,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,YAAY;AACpF,MAAI,aAAa,GAAI,QAAO,EAAE,QAAQ,KAAK;AAE3C,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,WAAS,IAAI,WAAW,GAAG,IAAI,MAAM,QAAQ,KAAK;AAChD,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,mBAAe;AACf,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,cAAc;AACjE,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,cAAc,OAAO;AAC1C;AAGA,SAAS,cAAc,OAAiB,OAAsB,MAAoB;AAChF,QAAM,OAAO,GAAG,MAAM,MAAM,IAAI,YAAY,MAAM,IAAI;AACtD,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,MAAM,QAAQ,IAAI;AACxB;AAAA,EACF;AACA,MAAI,MAAM,iBAAiB,QAAW;AACpC,UAAM,OAAO,MAAM,eAAe,GAAG,GAAG,IAAI;AAC5C;AAAA,EACF;AAEA,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,GAAI,OAAM,IAAI;AACrE,QAAM,KAAK,cAAc,MAAM,EAAE;AACnC;AAOA,SAAS,0BAA0B,MAAc,QAAqC;AACpF,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,MAAM,eAAe,EAAE;AAC7B,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,SAAS,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG;AAC3F,MAAI,WAAW,GAAI,QAAO;AAE1B,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,WAAS,IAAI,SAAS,GAAG,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,kBAAc;AACd,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,IAAK,QAAO;AAAA,EACnE;AACA,MAAI,OAAQ,QAAO,oBAAoB,GAAG,UAAU,eAAe;AAEnE,QAAM,OAAO,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,GAAG;AACtD,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,gBAAgB,GAAG,UAAU,eAAe,OAAO,cAAc;AAC1E;AAGA,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGzB,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYA,SAAS,yBACP,MACA,WACA,QACoB;AACpB,QAAM,MAAM,SAAS,MAAM,SAAS,EAAE,WAAW,MAAM,GAAG;AAC1D,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,EAAG,QAAO;AAE/C,QAAM,aAAaF,MAAK,MAAM,eAAe;AAC7C,QAAM,cACJD,YAAW,UAAU,KAAK,sBAAsB,KAAK,CAAC,SAASA,YAAWC,MAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,IAAI,GAAG;AACvB,QAAM,WAAWD,YAAW,UAAU,IAAIG,cAAa,YAAY,MAAM,IAAI;AAC7E,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,MAAI,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI,OAAQ,QAAO,iBAAiB,GAAG,4BAA4B,eAAe;AAElF,QAAM,YAAY,MAAM,UAAU,CAAC,SAAS,KAAK,KAAK,MAAM,gBAAgB;AAC5E,MAAI,cAAc,IAAI;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,kBAAc,YAAY,GAAG,MAAM,GAAG,gBAAgB;AAAA,EAAK,OAAO;AAAA,CAAI;AAAA,EACxE,OAAO;AAGL,QAAI,MAAM,YAAY;AACtB,WAAO,MAAM,MAAM,UAAU,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AACxE,UAAM,UAAU,CAAC,GAAG,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,OAAO,EAAE,KAAK;AACnE;AAAA,MACE;AAAA,MACA,CAAC,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,YAAY,GAAG,4BAA4B,eAAe;AACnE;AAWO,SAAS,oBAAoB,MAIvB;AACX,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,SAAO;AAAA,IACL,uBAAuB,KAAK,MAAM,MAAM;AAAA,IACxC,0BAA0B,KAAK,MAAM,MAAM;AAAA,IAC3C,KAAK,oBAAoB,SACrB,SACA,yBAAyB,KAAK,MAAM,KAAK,iBAAiB,MAAM;AAAA,EACtE,EAAE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAChE;AAoCO,SAAS,qBAAqB,MAAoC;AACvE,QAAM,UAAgC,CAAC;AAKvC,MAAI,MAAuB,CAAC;AAC5B,QAAM,UAAUF,MAAK,MAAM,cAAc;AACzC,MAAID,YAAW,OAAO,GAAG;AACvB,QAAI;AACF,YAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,YAAM,CAAC;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,QAAM,OAAOD,YAAW,QAAQ,IAAIG,cAAa,UAAU,MAAM,IAAI;AAErE,QAAM,SAAS,SAAS,SAAY,SAAY,kBAAkB,KAAK,MAAM,IAAI,CAAC,EAAE;AACpF,MAAI,WAAW,QAAW;AACxB,UAAM,aAAa,iBAAiB,GAAG;AACvC,YAAQ,KAAK;AAAA,MACX,MAAM,GAAG,cAAc,qBAAgB,YAAY;AAAA,MACnD,QACE,eAAe,SACX,aAAa,MAAM,qCAAqC,eAAe,sFAEvE,aAAa,MAAM,uDACf,eAAe;AAAA,IAE3B,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,IAAI,MAAM,YAAY,YAAY;AACjD,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK;AAAA,MACX,MAAM,sCAAiC,YAAY;AAAA,MACnD,QACE,aAAa,MAAM,2IAEhB,cAAc;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,eAAe,EAAE;AAC7B,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,IAAI,OAAO,kBAAkB,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,KAAK,IAAI;AAC/F,QAAI,QAAQ;AACV,YAAM,QAAQ,IAAI,OAAO,+BAA+B,GAAG,EAAE,KAAK,IAAI;AACtE,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,cAAc,WAAM,eAAe,KAAK,GAAG;AAAA,QACpD,QAAQ,QACJ,GAAG,GAAG,4XAKN,GAAG,GAAG;AAAA,MAEZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["existsSync","readFileSync","dirname","join","existsSync","join","dirname","readFileSync"]}

package/dist/{chunk-PWV3BMDA.js → chunk-MMKBDO5V.js}

@@ -1,3 +1,7 @@
+import {
+  SHARED_WORKER
+} from "./chunk-H3GSGAX2.js";
+
 // src/roles/test/setup/msw.ts
 import { setupServer } from "msw/node";
 var server = setupServer();
@@ -5,11 +9,16 @@ var LISTEN_OPTIONS = { onUnhandledRequest: "error" };
 function installMswLifecycle(hooks) {
   server.listen(LISTEN_OPTIONS);
   hooks.beforeAll(() => server.listen(LISTEN_OPTIONS));
-  hooks.afterAll(() => server.close());
+  hooks.afterAll(() => {
+    if (!sharesAWorker()) server.close();
+  });
+}
+function sharesAWorker() {
+  return globalThis[SHARED_WORKER] === true;
 }
 
 export {
   server,
   installMswLifecycle
 };
-//# sourceMappingURL=chunk-PWV3BMDA.js.map
+//# sourceMappingURL=chunk-MMKBDO5V.js.map

package/dist/chunk-MMKBDO5V.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/roles/test/setup/msw.ts"],"sourcesContent":["/**\n * The HTTP interception a test suite runs against, owned here rather than by each module.\n *\n * ## Why sentinel ships msw at all\n *\n * The goal is that a future migration is ONE version bump of sentinel. Today's migration is\n * painful for the opposite reason: the runner and everything around it are declared in 133 places,\n * so moving them means moving 133 modules. A tool that sits between the runner and the tests, as\n * msw does, has to travel with the runner or it becomes the next thing nobody can move.\n *\n * It also puts the compatibility question where someone can answer it. When Vitest moves, msw\n * either still works with it or does not, and that is a question for the tooling team with one\n * test suite, not for thirty teams discovering it separately.\n *\n * ## Why version 1.3.3, which is not the newest\n *\n * Measured across the repo: 523 test files use the msw 1 API (`rest.get`), and NOT ONE uses the\n * msw 2 API (`http.get`). Shipping msw 2 would break all 523 on the day they migrate, turning one\n * migration into two. Shipping 1.3.3 keeps them working, and the eventual 1 to 2 move becomes\n * OURS: studied once, then automated or documented, which is the whole point of owning it.\n *\n * The one module on msw 2 is `apps/front/hr-management`, which is Svelte, and the test role defers\n * Svelte for its own reasons.\n */\nimport { setupServer } from 'msw/node'\n\nimport { SHARED_WORKER } from './file-boundary-state.js'\n\n/**\n * No default handlers, deliberately.\n *\n * The repo's own server had `defaultHandlers = []` too, so nothing is lost. A handler here would\n * be a Hublo endpoint inside a package meant to be usable by anyone, which is the line between\n * what sentinel owns (the config) and what an app owns (what it mocks).\n *\n * A suite adds its own with `server.use(...)`, which is how all 600 files that touch this already\n * work.\n */\nexport const server = setupServer()\n\n/** The options the repo's own setup passed, kept in one place since two calls now use them. */\nconst LISTEN_OPTIONS = { onUnhandledRequest: 'error' } as const\n\n/**\n * The lifecycle, as the root jest setup had it, plus ONE deviation the runners forced.\n *\n * `onUnhandledRequest: 'error'` is carried over rather than softened: a test that reaches a real\n * network is a test whose result depends on something outside the repo, and it should say so\n * loudly. The repo already ran this way, so nothing changes for a migrating suite.\n *\n * Registered through the globals Vitest exposes, because the preset sets `globals: true` and a\n * setup file that imported them would need them resolvable from wherever it is loaded.\n *\n * ## Why `listen()` also runs here, at module scope\n *\n * msw intercepts by REPLACING `request` and `get` on the `http` and `https` modules. Under jest,\n * `import * as https from 'https'` compiled to `require('https')`, so the module object was read\n * at call time and a patch applied later was seen. Under Vitest the same line is a real ESM\n * namespace import of a CJS builtin, and Node builds that namespace ONCE, from the exports as they\n * stand at first import. A patch applied afterwards never reaches it.\n *\n * `beforeAll` runs after the test file and everything it imports have been evaluated, so the\n * namespace is already frozen by then: the provider keeps calling the ORIGINAL `https.request` and\n * the request leaves the machine. Measured on `libs/cloud/hermes`: `send-push` reached the REAL\n * OneSignal API, which answered `400 Failed to parse app_id from request`, a message that exists\n * nowhere in this repo. msw never saw the call, so `onUnhandledRequest: 'error'` never fired\n * either, and the only visible symptom was `expected \"vi.fn()\" to be called 50 times, but got 0`.\n *\n * A setup file is evaluated BEFORE the test module graph, so patching here happens before the\n * namespace is built. Same file, same suite, 0 of 7 to 7 of 7.\n *\n * The `beforeAll` call is kept as well: it is what restores interception for a suite that closed\n * the server itself, and msw's own `listen()` is safe to call twice.\n */\nexport function installMswLifecycle(hooks: {\n  beforeAll: (fn: () => void) => void\n  afterEach: (fn: () => void) => void\n  afterAll: (fn: () => void) => void\n}): void {\n  server.listen(LISTEN_OPTIONS)\n  hooks.beforeAll(() => server.listen(LISTEN_OPTIONS))\n\n  /*\n   * ⚠️ `close()` is per WORKER, not per file, and only isolation ever made those the same thing.\n   *\n   * Closing disposes the interceptors msw installed on `http`, `https`, `fetch` and `XMLHttpRequest`\n   * and drops the registry it keeps on a global symbol. With a file-per-registry that was free: the\n   * next file rebuilt everything from nothing. Sharing a worker, the next `listen()` finds a\n   * disposed registry that is still THERE, so interception silently stops and the suite reads\n   * whatever the previous file's handlers last said.\n   *\n   * Measured on `front-components` with `isolate: false`: one test, `useFeatureFlags`, and it took\n   * a while to name because a global sweep was hiding it by deleting msw's four symbols 210 times\n   * a run. Removing the per-file close instead: 230 files, 1418 tests, green, and green again\n   * across four shuffled file orders.\n   *\n   * Not closing at all is safe: the worker exits when its files are done, and the process takes the\n   * patched builtins with it. A module that wrote its own `afterAll(() => server.close())` before\n   * adopting this needs the same line removed, which `--validate` surfaces as the suite failing.\n   */\n  hooks.afterAll(() => {\n    if (!sharesAWorker()) server.close()\n  })\n\n  /*\n   * `server.resetHandlers()` is NOT called here, and that is a transcription and not a judgement.\n   *\n   * The root jest setup has the line commented out. Enabling it would be an improvement in the\n   * abstract — a handler one test adds leaks into the next, and the failure then appears in\n   * whichever test happens to run after, which is the hardest kind to trace. But some suite may\n   * depend on that persistence today, and a migration is the wrong moment to find out.\n   *\n   * So the behaviour is carried across exactly, and the question is reported rather than settled\n   * here: it belongs to whoever owns those suites, as its own reviewed change.\n   */\n}\n\n/** Whether the files of this suite share a worker, which `./file-boundary.js` is what declares. */\nfunction sharesAWorker(): boolean {\n  return (globalThis as Record<symbol, unknown>)[SHARED_WORKER] === true\n}\n"],"mappings":";;;;;AAwBA,SAAS,mBAAmB;AAcrB,IAAM,SAAS,YAAY;AAGlC,IAAM,iBAAiB,EAAE,oBAAoB,QAAQ;AAiC9C,SAAS,oBAAoB,OAI3B;AACP,SAAO,OAAO,cAAc;AAC5B,QAAM,UAAU,MAAM,OAAO,OAAO,cAAc,CAAC;AAoBnD,QAAM,SAAS,MAAM;AACnB,QAAI,CAAC,cAAc,EAAG,QAAO,MAAM;AAAA,EACrC,CAAC;AAaH;AAGA,SAAS,gBAAyB;AAChC,SAAQ,WAAuC,aAAa,MAAM;AACpE;","names":[]}

package/dist/chunk-NUOQXAYR.js

@@ -0,0 +1,14 @@
+// src/roles/test/setup/install-once.ts
+var INSTALLED = /* @__PURE__ */ Symbol.for("@hublo/sentinel/test/setup/installed");
+function alreadyInstalled(target, name) {
+  const marked = target;
+  const installed = marked[INSTALLED] ??= /* @__PURE__ */ new Set();
+  if (installed.has(name)) return true;
+  installed.add(name);
+  return false;
+}
+
+export {
+  alreadyInstalled
+};
+//# sourceMappingURL=chunk-NUOQXAYR.js.map

package/dist/chunk-NUOQXAYR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/roles/test/setup/install-once.ts"],"sourcesContent":["/**\n * The guard every setup installer needs, because a setup file runs ONCE PER TEST FILE.\n *\n * ## The defect this exists to close\n *\n * Vitest re-executes each entry of `setupFiles` for every test file. Under the isolation Vitest\n * gives by default that is harmless: the file also gets a fresh module registry, so the `vi` a\n * setup wraps is a fresh `vi`, and last file's wrapper went away with last file's registry.\n *\n * Without isolation the registry is the worker's, so `vi` is ONE object for every file, and an\n * installer that wraps `vi.fn` wraps last file's wrapper. Measured on `front-components`, 230 test\n * files: the chain reaches 230 deep and the suite dies with\n * `RangeError: Maximum call stack size exceeded`. What makes it worth a named guard rather than a\n * fix at each call site is how it fails. 26 files never ran, and the reporter said\n * `204 passed (204)` with no red: the loss was only visible by comparing the test COUNT against\n * the run before it.\n *\n * `installJestErrorEquality` fails the same way more quietly, adding one more equality tester to\n * `expect` per file rather than overflowing anything.\n *\n * ## Why the mark goes on the target and not on `globalThis`\n *\n * The mark has to answer \"is the object I am about to wrap already wrapped\", and only the object\n * itself can answer that. On `globalThis` the answer would be wrong in the isolated case: Vitest\n * builds a new environment per file, but a `node`-environment worker keeps one global object, so a\n * flag set there would survive into a file whose `vi` is brand new and unwrapped, and the\n * installer would skip the work it still had to do.\n */\n\n/** Stable across copies of this module, which pnpm's layout makes possible. */\nconst INSTALLED = Symbol.for('@hublo/sentinel/test/setup/installed')\n\ntype Marked = Record<symbol, Set<string> | undefined>\n\n/**\n * Records `name` against `target` and says whether it was already there.\n *\n * Written as a question an installer asks on its first line, `if (alreadyInstalled(vi, '...'))\n * return`, so the guarantee travels with the installer instead of depending on every caller\n * remembering it.\n */\nexport function alreadyInstalled(target: object, name: string): boolean {\n  const marked = target as Marked\n  const installed = (marked[INSTALLED] ??= new Set<string>())\n\n  if (installed.has(name)) return true\n\n  installed.add(name)\n  return false\n}\n"],"mappings":";AA8BA,IAAM,YAAY,uBAAO,IAAI,sCAAsC;AAW5D,SAAS,iBAAiB,QAAgB,MAAuB;AACtE,QAAM,SAAS;AACf,QAAM,YAAa,OAAO,SAAS,MAAM,oBAAI,IAAY;AAEzD,MAAI,UAAU,IAAI,IAAI,EAAG,QAAO;AAEhC,YAAU,IAAI,IAAI;AAClB,SAAO;AACT;","names":[]}

package/dist/chunk-O7REVMOC.js

@@ -0,0 +1,38 @@
+// src/shared/glob.ts
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let index = 0; index < glob.length; index++) {
+    const char = glob[index] ?? "";
+    if (char === "*") {
+      if (glob[index + 1] === "*") {
+        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
+        index += glob[index + 2] === "/" ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "{") {
+      const close = glob.indexOf("}", index);
+      if (close === -1) throw new Error(`sentinel: unbalanced \`{\` in glob ${glob}`);
+      const alternatives = glob.slice(index + 1, close).split(",");
+      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+      index = close;
+      continue;
+    }
+    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function matchesTsconfigPattern(pattern, relative) {
+  const cleaned = pattern.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (globToRegExp(cleaned).test(relative)) return true;
+  const asDirectory = cleaned.endsWith("/**") ? cleaned.slice(0, -3) : cleaned;
+  return globToRegExp(`${asDirectory}/**/*`).test(relative);
+}
+
+export {
+  globToRegExp,
+  matchesTsconfigPattern
+};
+//# sourceMappingURL=chunk-O7REVMOC.js.map

package/dist/chunk-O7REVMOC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/glob.ts"],"sourcesContent":["/**\n * The glob dialect a config file uses for a FILE NAME, reduced to what that needs.\n *\n * Shared because two roles read globs out of configuration and neither needs a glob library: the\n * build role reads `@nx/webpack`'s asset declarations, and the test role reads a tsconfig's\n * `include` and `exclude`. A second copy of this would drift from the first, which is a mistake\n * this package has already made once with the binary resolver.\n *\n * Three forms, and anything else is taken literally: `**` for any depth, `*` within a segment, and\n * a `{a,b}` alternation. A pattern that uses something else matches nothing rather than matching\n * by accident, which is the behaviour a caller can check.\n */\nexport function globToRegExp(glob: string): RegExp {\n  let pattern = ''\n  for (let index = 0; index < glob.length; index++) {\n    const char = glob[index] ?? ''\n    if (char === '*') {\n      if (glob[index + 1] === '*') {\n        // `**/` matches any number of directories, including none.\n        pattern += glob[index + 2] === '/' ? '(?:.*/)?' : '.*'\n        index += glob[index + 2] === '/' ? 2 : 1\n      } else {\n        pattern += '[^/]*'\n      }\n      continue\n    }\n    if (char === '{') {\n      const close = glob.indexOf('}', index)\n      if (close === -1) throw new Error(`sentinel: unbalanced \\`{\\` in glob ${glob}`)\n      const alternatives = glob.slice(index + 1, close).split(',')\n      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')).join('|')})`\n      index = close\n      continue\n    }\n    pattern += char.replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n  }\n  return new RegExp(`^${pattern}$`)\n}\n\n/**\n * A tsconfig's `include` / `exclude`, applied to a path relative to that config.\n *\n * ⚠️ A tsconfig pattern ending in a DIRECTORY matches everything under it, and one naming no\n * extension matches the TypeScript ones. `src/tests/functional/**` and `src/tests` both have to\n * claim `src/tests/functional/a.spec.ts`, which a plain file-name match does not do.\n */\nexport function matchesTsconfigPattern(pattern: string, relative: string): boolean {\n  const cleaned = pattern.replace(/^\\.\\//, '').replace(/\\/+$/, '')\n  if (globToRegExp(cleaned).test(relative)) return true\n  // A directory, named with or without a trailing `/**`, claims everything beneath it.\n  const asDirectory = cleaned.endsWith('/**') ? cleaned.slice(0, -3) : cleaned\n  return globToRegExp(`${asDirectory}/**/*`).test(relative)\n}\n"],"mappings":";AAYO,SAAS,aAAa,MAAsB;AACjD,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,QAAI,SAAS,KAAK;AAChB,UAAI,KAAK,QAAQ,CAAC,MAAM,KAAK;AAE3B,mBAAW,KAAK,QAAQ,CAAC,MAAM,MAAM,aAAa;AAClD,iBAAS,KAAK,QAAQ,CAAC,MAAM,MAAM,IAAI;AAAA,MACzC,OAAO;AACL,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB,YAAM,QAAQ,KAAK,QAAQ,KAAK,KAAK;AACrC,UAAI,UAAU,GAAI,OAAM,IAAI,MAAM,sCAAsC,IAAI,EAAE;AAC9E,YAAM,eAAe,KAAK,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3D,iBAAW,MAAM,aAAa,IAAI,CAAC,QAAQ,IAAI,QAAQ,uBAAuB,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC;AAChG,cAAQ;AACR;AAAA,IACF;AACA,eAAW,KAAK,QAAQ,sBAAsB,MAAM;AAAA,EACtD;AACA,SAAO,IAAI,OAAO,IAAI,OAAO,GAAG;AAClC;AASO,SAAS,uBAAuB,SAAiB,UAA2B;AACjF,QAAM,UAAU,QAAQ,QAAQ,SAAS,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAC/D,MAAI,aAAa,OAAO,EAAE,KAAK,QAAQ,EAAG,QAAO;AAEjD,QAAM,cAAc,QAAQ,SAAS,KAAK,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACrE,SAAO,aAAa,GAAG,WAAW,OAAO,EAAE,KAAK,QAAQ;AAC1D;","names":[]}

package/dist/chunk-QXFCZON7.js

@@ -0,0 +1,16 @@
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+export {
+  parseJsonc
+};
+//# sourceMappingURL=chunk-QXFCZON7.js.map

package/dist/chunk-QXFCZON7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/jsonc.ts"],"sourcesContent":["/**\n * JSONC (JSON with comments + trailing commas) helpers. tsconfig files are JSONC,\n * so reading them with plain `JSON.parse` throws on real projects (e.g.\n * host-admin's tsconfig.app.json has comments). Backed by jsonc-parser (the VS\n * Code library), which also underpins content-preserving edits (added with the\n * `--init` merge).\n */\nimport { parse, printParseErrorCode, type ParseError } from 'jsonc-parser'\n\n/**\n * Parse JSONC text into a value. Throws with a clear message listing the parse\n * errors, so a malformed config fails loudly rather than silently mis-reading.\n */\nexport function parseJsonc<T = unknown>(text: string, source = 'config'): T {\n  const errors: ParseError[] = []\n  const value = parse(text, errors, { allowTrailingComma: true }) as T\n  if (errors.length > 0) {\n    const details = errors.map((error) => printParseErrorCode(error.error)).join(', ')\n    throw new Error(`${source}: malformed JSONC (${details}).`)\n  }\n  return value\n}\n"],"mappings":";AAOA,SAAS,OAAO,2BAA4C;AAMrD,SAAS,WAAwB,MAAc,SAAS,UAAa;AAC1E,QAAM,SAAuB,CAAC;AAC9B,QAAM,QAAQ,MAAM,MAAM,QAAQ,EAAE,oBAAoB,KAAK,CAAC;AAC9D,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,UAAU,OAAO,IAAI,CAAC,UAAU,oBAAoB,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AACjF,UAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,OAAO,IAAI;AAAA,EAC5D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-3TDUIKVQ.js → chunk-SWWQ7X7B.js}

@@ -1,7 +1,11 @@
+import {
+  parseJsonc
+} from "./chunk-QXFCZON7.js";
+
 // src/roles/build/nest/decorator-metadata.ts
-import { existsSync } from "fs";
-import { createRequire } from "module";
-import path from "path";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
 var TYPESCRIPT_SOURCE = /\.ts$/;
 var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
 function loadCompiler(root) {
@@ -152,9 +156,8 @@ var decoratorMetadata = (options) => {
 };
 
 // src/roles/build/nest/tsconfig-aliases.ts
-import { readFileSync } from "fs";
-import { join } from "path";
-var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 var toAlias = (workspaceRoot, pattern, target) => {
   const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
   return {
@@ -164,7 +167,7 @@ var toAlias = (workspaceRoot, pattern, target) => {
 };
 var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
   const raw = readFileSync(join(workspaceRoot, file), "utf8");
-  const { compilerOptions } = JSON.parse(stripLineComments(raw));
+  const { compilerOptions } = parseJsonc(raw, file);
   return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
     const [target] = targets;
     return target === void 0 ? [] : [toAlias(workspaceRoot, pattern, target)];
@@ -175,4 +178,4 @@ export {
   decoratorMetadata,
   tsconfigAliases
 };
-//# sourceMappingURL=chunk-3TDUIKVQ.js.map
+//# sourceMappingURL=chunk-SWWQ7X7B.js.map

package/dist/{chunk-3TDUIKVQ.js.map → chunk-SWWQ7X7B.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/roles/build/nest/decorator-metadata.ts","../src/roles/build/nest/tsconfig-aliases.ts"],"sourcesContent":["/**\n * Decorator metadata, which esbuild cannot emit and Nest cannot live without, plus the TypeScript\n * transformers a service declared on its webpack target.\n *\n * Vite's default transformer is esbuild, and esbuild does not implement `emitDecoratorMetadata`.\n * Nest resolves a constructor's parameters from exactly that metadata, so without it the DI\n * container comes up empty and the application fails on its first module. Measured in the\n * monorepo this ships to: `emitDecoratorMetadata: true` in `tsconfig.base.json`, and 7365 files\n * carrying `@Injectable`, `@Module` or `@Controller`.\n *\n * ## TWO modes, chosen exactly as nx chooses them\n *\n * This is the one decision in this file that is not ours, and trying to make it ours cost a day.\n *\n * `@nx/webpack` configures ts-loader with one line:\n *\n *     transpileOnly: !hasPlugin        // hasPlugin = this target declares `transformers`\n *\n * So webpack already had two behaviours. A service with no transformers compiled with\n * `transpileOnly`, which is `ts.transpileModule` semantics: no type checker, one file at a time.\n * A service WITH transformers compiled through a full `ts.Program`, because that is the only way\n * a TypeScript transformer can run at all.\n *\n * The difference is visible, and measured. On a property typed by an imported string enum:\n *\n *     Program         : __metadata(\"design:type\", String)\n *     transpileModule : __metadata(\"design:type\", typeof (_a = ...) === \"function\" ? _a : Object)\n *\n * and on a `@Body()` whose DTO arrives through `import type`, a Program emits `Function` where\n * transpileOnly emits `Object`, which `@nestjs/swagger` turns into four `$ref: Function` request\n * bodies that the published contract does not have.\n *\n * This plugin used only the first mode and this file claimed it was \"the serializer ts-loader was\n * already using\". Half true, and the wrong half: it is what ts-loader uses for the 29 services\n * with no transformers, and those came back byte-identical. Then a Program was used for ALL of\n * them, which fixed the eight and moved the contract of `network`, which had been correct.\n *\n * Both were the same mistake: choosing one mode for everyone, when the tool being replaced chose\n * per service. So the condition is copied rather than invented, and there is no third case to\n * discover: nx has two, and both are reproduced here.\n *\n * The Program costs about six seconds more on the largest service (1419 files: ~1.9s to build it,\n * ~3.3ms per file against ~0.9ms). Only the services that declare a transformer pay it, which is\n * also what webpack did.\n *\n * ## The transformers, which are configuration and are read, never invented\n *\n * Eight services and BFFs declare `@nestjs/swagger/plugin` on their webpack target, with\n * `introspectComments` and `classValidatorShim`. It writes the `@ApiProperty` decorators a\n * developer would otherwise write by hand, turns JSDoc into descriptions, and projects\n * class-validator rules into the schema.\n *\n * Dropping it does not fail a build. Measured on `institution` by regenerating its committed\n * contract after a sentinel build: 385 insertions and 1378 deletions. Response schemas and every\n * `minItems`, `minimum`, `maximum`, `minLength` and `format` disappeared, silently.\n *\n * So `--init` reads the declaration off the webpack target and writes it into the generated Vite\n * config, and this plugin loads it. Nothing here decides which transformers a service runs.\n *\n * ## Why the MODULE's compiler now, and not sentinel's own\n *\n * This plugin used to pin sentinel's TypeScript, on the grounds that `typescript` in the consumer\n * could resolve to the 7.x native port, which exports a version and no compiler API. Measured\n * from a service today it resolves to `@typescript/typescript6` 6.0.2, with the full API.\n *\n * The pin cannot survive the transformers anyway: a plugin loaded from the module's\n * `node_modules` imports the module's TypeScript, and a transformer built against one compiler\n * cannot be handed a Program built by another. One compiler, the module's, is also what ts-loader\n * used, so it is the faithful answer rather than merely the workable one. The API is asserted at\n * `buildStart`, where a failure is reported.\n *\n * ## Why the module's own tsconfig, and not options chosen here\n *\n * Emit follows compiler options, so options invented here would be a second, silent source of\n * divergence from what ts-loader produced. `target` alone decides how classes and fields are\n * downlevelled: this workspace is on `es2021`, where `useDefineForClassFields` defaults to false\n * and a declared-but-unassigned DTO field is therefore NOT emitted. Defaulting to `es2022` here\n * would flip that, `Object.defineProperty` would write `undefined` over every field, and\n * `class-transformer` payloads would arrive empty at runtime with nothing in the build to explain\n * it.\n *\n * So the config is read, `extends` resolved by the compiler itself, and only what this plugin\n * genuinely owns is overridden.\n *\n * ## Still no type CHECKING, which is a different thing from having types\n *\n * The Program gives this plugin a type checker; it does not use it to report errors. Every Nest\n * project already runs `tsc -b` in its own `typecheck` target, and the build never was the thing\n * that type-checked. Emitting with type information and refusing to type-check are independent,\n * and only the first is needed to reproduce what ts-loader wrote.\n */\nimport { existsSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport path from 'node:path'\n\nimport type TS from 'typescript'\nimport type { Plugin } from 'vite'\n\n/** Files this transform owns: TypeScript sources, never a dependency's compiled output. */\nconst TYPESCRIPT_SOURCE = /\\.ts$/\n\n/**\n * Where a Nest service keeps the config it builds with, most specific first.\n *\n * `tsconfig.app.json` is the one Nx generates for the application's own sources and the one\n * ts-loader was pointed at; `tsconfig.json` is the fallback for a service that never split them.\n * Measured on `main`: all 37 services still on webpack name `tsconfig.app.json`.\n */\nconst TSCONFIG_CANDIDATES = ['tsconfig.app.json', 'tsconfig.json']\n\n/** A TypeScript transformer a service runs at build time, as its build target declares it. */\nexport interface TransformerDeclaration {\n  /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */\n  name: string\n  /** Passed to the transformer's own factory, unread here. */\n  options?: Record<string, unknown>\n}\n\nexport interface DecoratorMetadataOptions {\n  /** The module being built. Its tsconfig is the one whose emit must be preserved. */\n  root: string\n  /**\n   * An explicit tsconfig, when the service does not use either conventional name.\n   *\n   * Relative paths resolve against `root`.\n   */\n  tsconfig?: string\n  /** The transformers this service declared, translated from its webpack target. */\n  transformers?: readonly TransformerDeclaration[]\n}\n\n/**\n * The module's own TypeScript, with its emit API asserted.\n *\n * Resolved from `root` rather than from here, because a transformer loaded from the module binds\n * to the compiler the module resolves, and Programs are not interchangeable between compilers.\n */\nfunction loadCompiler(root: string): typeof TS {\n  const require = createRequire(path.join(root, 'noop.js'))\n  let compiler: typeof TS\n  try {\n    compiler = require('typescript') as typeof TS\n  } catch {\n    throw new Error(\n      `sentinel build(nest): no \\`typescript\\` resolvable from ${root}. The build emits decorator ` +\n        `metadata with the module's own compiler, so one has to be installed there.`,\n    )\n  }\n  if (typeof compiler.createProgram !== 'function') {\n    throw new Error(\n      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? 'unknown'}) ` +\n        `has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API ` +\n        `lives under @typescript/typescript6. Point this module's \\`typescript\\` at a compiler ` +\n        `with an emit API, which is the one its \\`typecheck\\` target already uses.`,\n    )\n  }\n  return compiler\n}\n\nfunction resolveTsconfig(options: DecoratorMetadataOptions): string {\n  if (options.tsconfig) {\n    const explicit = path.resolve(options.root, options.tsconfig)\n    if (!existsSync(explicit)) {\n      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`)\n    }\n    return explicit\n  }\n  for (const candidate of TSCONFIG_CANDIDATES) {\n    const found = path.join(options.root, candidate)\n    if (existsSync(found)) return found\n  }\n  throw new Error(\n    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(' or ')} in ${options.root}. ` +\n      `Pass \\`tsconfig\\` if this service keeps it elsewhere.`,\n  )\n}\n\n/** The module's compiler options, with `extends` already resolved, plus what this plugin owns. */\nfunction readConfig(\n  ts: typeof TS,\n  options: DecoratorMetadataOptions,\n): { fileNames: string[]; compilerOptions: TS.CompilerOptions } {\n  const configPath = resolveTsconfig(options)\n  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {\n    ...ts.sys,\n    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {\n      throw new Error(\n        `sentinel build(nest): could not read ${configPath}: ` +\n          ts.flattenDiagnosticMessageText(diagnostic.messageText, ' '),\n      )\n    },\n  } as TS.ParseConfigFileHost)\n\n  return {\n    fileNames: parsed?.fileNames ?? [],\n    compilerOptions: {\n      ...parsed?.options,\n      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot\n      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.\n      module: ts.ModuleKind.ESNext,\n      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.\n      sourceMap: true,\n      inlineSourceMap: false,\n      inlineSources: false,\n      // Types are another target's job, and emitting them here would write into the source tree.\n      declaration: false,\n      declarationMap: false,\n      emitDeclarationOnly: false,\n      noEmit: false,\n      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no\n      // incremental build here to inform.\n      composite: false,\n      incremental: false,\n    },\n  }\n}\n\n/**\n * The declared transformers, loaded from the MODULE so each binds to the compiler it expects.\n *\n * A name that cannot be loaded, or a package that exports no `before`, fails the build here\n * rather than producing a bundle quietly missing what the transformer contributes. That failure\n * mode is the reason this exists: dropping `@nestjs/swagger/plugin` costs a service most of its\n * published contract and nothing in the build says so.\n */\nfunction loadTransformers(\n  root: string,\n  program: TS.Program,\n  declared: readonly TransformerDeclaration[],\n): TS.TransformerFactory<TS.SourceFile>[] {\n  const require = createRequire(path.join(root, 'noop.js'))\n  return declared.map(({ name, options }) => {\n    let loaded: { before?: unknown }\n    try {\n      loaded = require(name) as { before?: unknown }\n    } catch (error) {\n      throw new Error(\n        `sentinel build(nest): the build target declares the transformer \\`${name}\\`, which ` +\n          `cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,\n        { cause: error },\n      )\n    }\n    if (typeof loaded.before !== 'function') {\n      throw new Error(\n        `sentinel build(nest): \\`${name}\\` exports no \\`before\\` factory, so it cannot run as a ` +\n          `TypeScript transformer. Building without it would drop whatever it contributes.`,\n      )\n    }\n    const factory = loaded.before as (\n      options: Record<string, unknown> | undefined,\n      program: TS.Program,\n    ) => TS.TransformerFactory<TS.SourceFile>\n    return factory(options, program)\n  })\n}\n\nexport const decoratorMetadata = (options: DecoratorMetadataOptions): Plugin => {\n  /*\n   * Everything is prepared in `buildStart`, and that placement is the whole point.\n   *\n   * It used to be resolved lazily inside `transform`, on the reasoning that an error belongs to\n   * the build rather than to importing the preset. Half right: it belongs to the build, but\n   * Rollup SWALLOWS a throwing `transform` hook. The wrong compiler, an unreadable tsconfig and a\n   * missing one all produced the same symptom instead of their own message: \"1 modules\n   * transformed\", nothing written, then an unrelated error from whichever later hook tripped over\n   * the empty output directory. It cost two diagnoses to recognise.\n   *\n   * `buildStart` is reported. So the compiler is loaded, the config read, the Program built and\n   * the transformers resolved exactly once, before a single file is transformed, where failing\n   * says what failed.\n   */\n  /** `hasPlugin` in nx's own words: this service declares transformers, so it needs a Program. */\n  const typeAware = (options.transformers ?? []).length > 0\n\n  let ts: typeof TS | undefined\n  let program: TS.Program | undefined\n  let compilerOptions: TS.CompilerOptions | undefined\n  let before: TS.TransformerFactory<TS.SourceFile>[] = []\n  /** Files emitted without the Program, which is a fidelity gap and is reported, never silent. */\n  const withoutTypes: string[] = []\n\n  return {\n    name: 'sentinel:decorator-metadata',\n    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so\n    // the source this plugin reads from the Program is still the source on disk.\n    enforce: 'pre',\n    buildStart() {\n      ts = loadCompiler(options.root)\n      const config = readConfig(ts, options)\n      compilerOptions = config.compilerOptions\n      // Built only in the type-aware mode. It costs ~1.9s on the largest service here and buys\n      // nothing a service without transformers can use, which is why nx does not build one either.\n      if (!typeAware) return\n      program = ts.createProgram(config.fileNames, config.compilerOptions)\n      before = loadTransformers(options.root, program, options.transformers ?? [])\n    },\n    transform(code, id) {\n      if (!TYPESCRIPT_SOURCE.test(id) || id.includes('node_modules')) return null\n      // Only reachable if `buildStart` did not run, which no Rollup build does. Named rather than\n      // defaulted, so it cannot silently emit with TypeScript's defaults instead of the module's.\n      if (ts === undefined || compilerOptions === undefined) {\n        throw new Error(\n          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with ` +\n            `defaults rather than this module's tsconfig.`,\n        )\n      }\n\n      /*\n       * The Program's own SourceFile, which is what carries the type information.\n       *\n       * Three cases emit without it. The service declares no transformer, which is `transpileOnly`\n       * and is what ts-loader did for it. A file the Program never reached, because nothing\n       * imports it from the entry. And a file another plugin has already rewritten, where the\n       * Program's copy is no longer the truth: emitting that stale copy over someone else's\n       * transform would be the worse failure.\n       *\n       * The last two are counted and reported at the end. The first is not a gap, it is the mode.\n       *\n       * Measured on the largest service here: neither of the last two fires, on any of its 5594\n       * files. That is the point of reporting them rather than tolerating them quietly — a warning\n       * from this build means something genuinely new, not a known rough edge.\n       */\n      const sourceFile = program?.getSourceFile(id)\n      if (program === undefined || sourceFile === undefined || sourceFile.text !== code) {\n        if (typeAware) withoutTypes.push(id)\n        const output = ts.transpileModule(code, { fileName: id, compilerOptions })\n        return { code: output.outputText, map: output.sourceMapText ?? null }\n      }\n\n      let emitted: string | undefined\n      let map: string | undefined\n      program.emit(\n        sourceFile,\n        (fileName, text) => {\n          if (fileName.endsWith('.map')) map = text\n          else emitted = text\n        },\n        undefined,\n        false,\n        { before },\n      )\n      if (emitted === undefined) {\n        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`)\n      }\n      return { code: emitted, map: map ?? null }\n    },\n    closeBundle() {\n      if (withoutTypes.length === 0) return\n      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file))\n      this.warn(\n        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type ` +\n          `information, so their decorator metadata may differ from what ts-loader produced ` +\n          `(${shown.join(', ')}${withoutTypes.length > shown.length ? ', …' : ''}). They are ` +\n          `outside this module's tsconfig, or another plugin rewrote them first.`,\n      )\n    },\n  }\n}\n","/**\n * The workspace's `paths` mappings, as Vite resolve aliases.\n *\n * They matter more than they look. The mappings point at SOURCE files, and that is what makes\n * a workspace library get BUNDLED rather than externalised: Vite treats anything outside\n * `node_modules` as source. Drop them and every `@hublo/nest/*` import becomes an external the\n * runtime cannot resolve, because those packages are never published.\n *\n * This reproduces what webpack did through `tsconfig-paths-webpack-plugin`, alongside\n * `webpack-node-externals` which only ever externalised real packages. Measured on the first\n * migrated service: 45 externals under Vite against 47 under webpack, and nothing externalised\n * by Vite that webpack did not.\n */\nimport { readFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nexport interface Alias {\n  find: RegExp\n  replacement: string\n}\n\n/** `tsconfig.base.json` carries `//` comments, which `JSON.parse` refuses. */\nconst stripLineComments = (json: string): string => json.replace(/^\\s*\\/\\/.*$/gm, '')\n\nconst toAlias = (workspaceRoot: string, pattern: string, target: string): Alias => {\n  const escaped = pattern.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&').replace(/\\\\\\*/g, '(.*)')\n  return {\n    find: new RegExp(`^${escaped}$`),\n    replacement: join(workspaceRoot, target.replace(/\\*/g, '$1')),\n  }\n}\n\n/**\n * Read the mappings from the workspace's base tsconfig.\n *\n * Longest pattern first, because Vite takes the first alias that matches and the mappings\n * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.\n */\nexport const tsconfigAliases = (workspaceRoot: string, file = 'tsconfig.base.json'): Alias[] => {\n  const raw = readFileSync(join(workspaceRoot, file), 'utf8')\n  const { compilerOptions } = JSON.parse(stripLineComments(raw)) as {\n    compilerOptions?: { paths?: Record<string, string[]> }\n  }\n  return Object.entries(compilerOptions?.paths ?? {})\n    .flatMap(([pattern, targets]) => {\n      const [target] = targets\n      return target === undefined ? [] : [toAlias(workspaceRoot, pattern, target)]\n    })\n    .sort((a, b) => b.find.source.length - a.find.source.length)\n}\n"],"mappings":";AA2FA,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AAMjB,IAAM,oBAAoB;AAS1B,IAAM,sBAAsB,CAAC,qBAAqB,eAAe;AA6BjE,SAAS,aAAa,MAAyB;AAC7C,QAAMA,WAAU,cAAc,KAAK,KAAK,MAAM,SAAS,CAAC;AACxD,MAAI;AACJ,MAAI;AACF,eAAWA,SAAQ,YAAY;AAAA,EACjC,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,2DAA2D,IAAI;AAAA,IAEjE;AAAA,EACF;AACA,MAAI,OAAO,SAAS,kBAAkB,YAAY;AAChD,UAAM,IAAI;AAAA,MACR,sDAAsD,IAAI,KAAK,SAAS,WAAW,SAAS;AAAA,IAI9F;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA2C;AAClE,MAAI,QAAQ,UAAU;AACpB,UAAM,WAAW,KAAK,QAAQ,QAAQ,MAAM,QAAQ,QAAQ;AAC5D,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,+CAA+C,QAAQ,EAAE;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AACA,aAAW,aAAa,qBAAqB;AAC3C,UAAM,QAAQ,KAAK,KAAK,QAAQ,MAAM,SAAS;AAC/C,QAAI,WAAW,KAAK,EAAG,QAAO;AAAA,EAChC;AACA,QAAM,IAAI;AAAA,IACR,4BAA4B,oBAAoB,KAAK,MAAM,CAAC,OAAO,QAAQ,IAAI;AAAA,EAEjF;AACF;AAGA,SAAS,WACP,IACA,SAC8D;AAC9D,QAAM,aAAa,gBAAgB,OAAO;AAC1C,QAAM,SAAS,GAAG,iCAAiC,YAAY,CAAC,GAAG;AAAA,IACjE,GAAG,GAAG;AAAA,IACN,qCAAqC,CAAC,eAAe;AACnD,YAAM,IAAI;AAAA,QACR,wCAAwC,UAAU,OAChD,GAAG,6BAA6B,WAAW,aAAa,GAAG;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,CAA2B;AAE3B,SAAO;AAAA,IACL,WAAW,QAAQ,aAAa,CAAC;AAAA,IACjC,iBAAiB;AAAA,MACf,GAAG,QAAQ;AAAA;AAAA;AAAA,MAGX,QAAQ,GAAG,WAAW;AAAA;AAAA,MAEtB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,eAAe;AAAA;AAAA,MAEf,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,QAAQ;AAAA;AAAA;AAAA,MAGR,WAAW;AAAA,MACX,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAUA,SAAS,iBACP,MACA,SACA,UACwC;AACxC,QAAMA,WAAU,cAAc,KAAK,KAAK,MAAM,SAAS,CAAC;AACxD,SAAO,SAAS,IAAI,CAAC,EAAE,MAAM,QAAQ,MAAM;AACzC,QAAI;AACJ,QAAI;AACF,eAASA,SAAQ,IAAI;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,qEAAqE,IAAI,mCAC9C,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC1F,EAAE,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,WAAW,YAAY;AACvC,YAAM,IAAI;AAAA,QACR,2BAA2B,IAAI;AAAA,MAEjC;AAAA,IACF;AACA,UAAM,UAAU,OAAO;AAIvB,WAAO,QAAQ,SAAS,OAAO;AAAA,EACjC,CAAC;AACH;AAEO,IAAM,oBAAoB,CAAC,YAA8C;AAgB9E,QAAM,aAAa,QAAQ,gBAAgB,CAAC,GAAG,SAAS;AAExD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,SAAiD,CAAC;AAEtD,QAAM,eAAyB,CAAC;AAEhC,SAAO;AAAA,IACL,MAAM;AAAA;AAAA;AAAA,IAGN,SAAS;AAAA,IACT,aAAa;AACX,WAAK,aAAa,QAAQ,IAAI;AAC9B,YAAM,SAAS,WAAW,IAAI,OAAO;AACrC,wBAAkB,OAAO;AAGzB,UAAI,CAAC,UAAW;AAChB,gBAAU,GAAG,cAAc,OAAO,WAAW,OAAO,eAAe;AACnE,eAAS,iBAAiB,QAAQ,MAAM,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AAAA,IAC7E;AAAA,IACA,UAAU,MAAM,IAAI;AAClB,UAAI,CAAC,kBAAkB,KAAK,EAAE,KAAK,GAAG,SAAS,cAAc,EAAG,QAAO;AAGvE,UAAI,OAAO,UAAa,oBAAoB,QAAW;AACrD,cAAM,IAAI;AAAA,UACR,6DAA6D,EAAE;AAAA,QAEjE;AAAA,MACF;AAiBA,YAAM,aAAa,SAAS,cAAc,EAAE;AAC5C,UAAI,YAAY,UAAa,eAAe,UAAa,WAAW,SAAS,MAAM;AACjF,YAAI,UAAW,cAAa,KAAK,EAAE;AACnC,cAAM,SAAS,GAAG,gBAAgB,MAAM,EAAE,UAAU,IAAI,gBAAgB,CAAC;AACzE,eAAO,EAAE,MAAM,OAAO,YAAY,KAAK,OAAO,iBAAiB,KAAK;AAAA,MACtE;AAEA,UAAI;AACJ,UAAI;AACJ,cAAQ;AAAA,QACN;AAAA,QACA,CAAC,UAAU,SAAS;AAClB,cAAI,SAAS,SAAS,MAAM,EAAG,OAAM;AAAA,cAChC,WAAU;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,OAAO;AAAA,MACX;AACA,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,wDAAwD,EAAE,GAAG;AAAA,MAC/E;AACA,aAAO,EAAE,MAAM,SAAS,KAAK,OAAO,KAAK;AAAA,IAC3C;AAAA,IACA,cAAc;AACZ,UAAI,aAAa,WAAW,EAAG;AAC/B,YAAM,QAAQ,aAAa,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,QAAQ,MAAM,IAAI,CAAC;AACtF,WAAK;AAAA,QACH,yBAAyB,aAAa,MAAM,wHAEtC,MAAM,KAAK,IAAI,CAAC,GAAG,aAAa,SAAS,MAAM,SAAS,aAAQ,EAAE;AAAA,MAE1E;AAAA,IACF;AAAA,EACF;AACF;;;ACxVA,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AAQrB,IAAM,oBAAoB,CAAC,SAAyB,KAAK,QAAQ,iBAAiB,EAAE;AAEpF,IAAM,UAAU,CAAC,eAAuB,SAAiB,WAA0B;AACjF,QAAM,UAAU,QAAQ,QAAQ,uBAAuB,MAAM,EAAE,QAAQ,SAAS,MAAM;AACtF,SAAO;AAAA,IACL,MAAM,IAAI,OAAO,IAAI,OAAO,GAAG;AAAA,IAC/B,aAAa,KAAK,eAAe,OAAO,QAAQ,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAQO,IAAM,kBAAkB,CAAC,eAAuB,OAAO,yBAAkC;AAC9F,QAAM,MAAM,aAAa,KAAK,eAAe,IAAI,GAAG,MAAM;AAC1D,QAAM,EAAE,gBAAgB,IAAI,KAAK,MAAM,kBAAkB,GAAG,CAAC;AAG7D,SAAO,OAAO,QAAQ,iBAAiB,SAAS,CAAC,CAAC,EAC/C,QAAQ,CAAC,CAAC,SAAS,OAAO,MAAM;AAC/B,UAAM,CAAC,MAAM,IAAI;AACjB,WAAO,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,eAAe,SAAS,MAAM,CAAC;AAAA,EAC7E,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,OAAO,SAAS,EAAE,KAAK,OAAO,MAAM;AAC/D;","names":["require"]}
+{"version":3,"sources":["../src/roles/build/nest/decorator-metadata.ts","../src/roles/build/nest/tsconfig-aliases.ts"],"sourcesContent":["/**\n * Decorator metadata, which esbuild cannot emit and Nest cannot live without, plus the TypeScript\n * transformers a service declared on its webpack target.\n *\n * Vite's default transformer is esbuild, and esbuild does not implement `emitDecoratorMetadata`.\n * Nest resolves a constructor's parameters from exactly that metadata, so without it the DI\n * container comes up empty and the application fails on its first module. Measured in the\n * monorepo this ships to: `emitDecoratorMetadata: true` in `tsconfig.base.json`, and 7365 files\n * carrying `@Injectable`, `@Module` or `@Controller`.\n *\n * ## TWO modes, chosen exactly as nx chooses them\n *\n * This is the one decision in this file that is not ours, and trying to make it ours cost a day.\n *\n * `@nx/webpack` configures ts-loader with one line:\n *\n *     transpileOnly: !hasPlugin        // hasPlugin = this target declares `transformers`\n *\n * So webpack already had two behaviours. A service with no transformers compiled with\n * `transpileOnly`, which is `ts.transpileModule` semantics: no type checker, one file at a time.\n * A service WITH transformers compiled through a full `ts.Program`, because that is the only way\n * a TypeScript transformer can run at all.\n *\n * The difference is visible, and measured. On a property typed by an imported string enum:\n *\n *     Program         : __metadata(\"design:type\", String)\n *     transpileModule : __metadata(\"design:type\", typeof (_a = ...) === \"function\" ? _a : Object)\n *\n * and on a `@Body()` whose DTO arrives through `import type`, a Program emits `Function` where\n * transpileOnly emits `Object`, which `@nestjs/swagger` turns into four `$ref: Function` request\n * bodies that the published contract does not have.\n *\n * This plugin used only the first mode and this file claimed it was \"the serializer ts-loader was\n * already using\". Half true, and the wrong half: it is what ts-loader uses for the 29 services\n * with no transformers, and those came back byte-identical. Then a Program was used for ALL of\n * them, which fixed the eight and moved the contract of `network`, which had been correct.\n *\n * Both were the same mistake: choosing one mode for everyone, when the tool being replaced chose\n * per service. So the condition is copied rather than invented, and there is no third case to\n * discover: nx has two, and both are reproduced here.\n *\n * The Program costs about six seconds more on the largest service (1419 files: ~1.9s to build it,\n * ~3.3ms per file against ~0.9ms). Only the services that declare a transformer pay it, which is\n * also what webpack did.\n *\n * ## The transformers, which are configuration and are read, never invented\n *\n * Eight services and BFFs declare `@nestjs/swagger/plugin` on their webpack target, with\n * `introspectComments` and `classValidatorShim`. It writes the `@ApiProperty` decorators a\n * developer would otherwise write by hand, turns JSDoc into descriptions, and projects\n * class-validator rules into the schema.\n *\n * Dropping it does not fail a build. Measured on `institution` by regenerating its committed\n * contract after a sentinel build: 385 insertions and 1378 deletions. Response schemas and every\n * `minItems`, `minimum`, `maximum`, `minLength` and `format` disappeared, silently.\n *\n * So `--init` reads the declaration off the webpack target and writes it into the generated Vite\n * config, and this plugin loads it. Nothing here decides which transformers a service runs.\n *\n * ## Why the MODULE's compiler now, and not sentinel's own\n *\n * This plugin used to pin sentinel's TypeScript, on the grounds that `typescript` in the consumer\n * could resolve to the 7.x native port, which exports a version and no compiler API. Measured\n * from a service today it resolves to `@typescript/typescript6` 6.0.2, with the full API.\n *\n * The pin cannot survive the transformers anyway: a plugin loaded from the module's\n * `node_modules` imports the module's TypeScript, and a transformer built against one compiler\n * cannot be handed a Program built by another. One compiler, the module's, is also what ts-loader\n * used, so it is the faithful answer rather than merely the workable one. The API is asserted at\n * `buildStart`, where a failure is reported.\n *\n * ## Why the module's own tsconfig, and not options chosen here\n *\n * Emit follows compiler options, so options invented here would be a second, silent source of\n * divergence from what ts-loader produced. `target` alone decides how classes and fields are\n * downlevelled: this workspace is on `es2021`, where `useDefineForClassFields` defaults to false\n * and a declared-but-unassigned DTO field is therefore NOT emitted. Defaulting to `es2022` here\n * would flip that, `Object.defineProperty` would write `undefined` over every field, and\n * `class-transformer` payloads would arrive empty at runtime with nothing in the build to explain\n * it.\n *\n * So the config is read, `extends` resolved by the compiler itself, and only what this plugin\n * genuinely owns is overridden.\n *\n * ## Still no type CHECKING, which is a different thing from having types\n *\n * The Program gives this plugin a type checker; it does not use it to report errors. Every Nest\n * project already runs `tsc -b` in its own `typecheck` target, and the build never was the thing\n * that type-checked. Emitting with type information and refusing to type-check are independent,\n * and only the first is needed to reproduce what ts-loader wrote.\n */\nimport { existsSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport path from 'node:path'\n\nimport type TS from 'typescript'\nimport type { Plugin } from 'vite'\n\n/** Files this transform owns: TypeScript sources, never a dependency's compiled output. */\nconst TYPESCRIPT_SOURCE = /\\.ts$/\n\n/**\n * Where a Nest service keeps the config it builds with, most specific first.\n *\n * `tsconfig.app.json` is the one Nx generates for the application's own sources and the one\n * ts-loader was pointed at; `tsconfig.json` is the fallback for a service that never split them.\n * Measured on `main`: all 37 services still on webpack name `tsconfig.app.json`.\n */\nconst TSCONFIG_CANDIDATES = ['tsconfig.app.json', 'tsconfig.json']\n\n/** A TypeScript transformer a service runs at build time, as its build target declares it. */\nexport interface TransformerDeclaration {\n  /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */\n  name: string\n  /** Passed to the transformer's own factory, unread here. */\n  options?: Record<string, unknown>\n}\n\nexport interface DecoratorMetadataOptions {\n  /** The module being built. Its tsconfig is the one whose emit must be preserved. */\n  root: string\n  /**\n   * An explicit tsconfig, when the service does not use either conventional name.\n   *\n   * Relative paths resolve against `root`.\n   */\n  tsconfig?: string\n  /** The transformers this service declared, translated from its webpack target. */\n  transformers?: readonly TransformerDeclaration[]\n}\n\n/**\n * The module's own TypeScript, with its emit API asserted.\n *\n * Resolved from `root` rather than from here, because a transformer loaded from the module binds\n * to the compiler the module resolves, and Programs are not interchangeable between compilers.\n */\nfunction loadCompiler(root: string): typeof TS {\n  const require = createRequire(path.join(root, 'noop.js'))\n  let compiler: typeof TS\n  try {\n    compiler = require('typescript') as typeof TS\n  } catch {\n    throw new Error(\n      `sentinel build(nest): no \\`typescript\\` resolvable from ${root}. The build emits decorator ` +\n        `metadata with the module's own compiler, so one has to be installed there.`,\n    )\n  }\n  if (typeof compiler.createProgram !== 'function') {\n    throw new Error(\n      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? 'unknown'}) ` +\n        `has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API ` +\n        `lives under @typescript/typescript6. Point this module's \\`typescript\\` at a compiler ` +\n        `with an emit API, which is the one its \\`typecheck\\` target already uses.`,\n    )\n  }\n  return compiler\n}\n\nfunction resolveTsconfig(options: DecoratorMetadataOptions): string {\n  if (options.tsconfig) {\n    const explicit = path.resolve(options.root, options.tsconfig)\n    if (!existsSync(explicit)) {\n      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`)\n    }\n    return explicit\n  }\n  for (const candidate of TSCONFIG_CANDIDATES) {\n    const found = path.join(options.root, candidate)\n    if (existsSync(found)) return found\n  }\n  throw new Error(\n    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(' or ')} in ${options.root}. ` +\n      `Pass \\`tsconfig\\` if this service keeps it elsewhere.`,\n  )\n}\n\n/** The module's compiler options, with `extends` already resolved, plus what this plugin owns. */\nfunction readConfig(\n  ts: typeof TS,\n  options: DecoratorMetadataOptions,\n): { fileNames: string[]; compilerOptions: TS.CompilerOptions } {\n  const configPath = resolveTsconfig(options)\n  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {\n    ...ts.sys,\n    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {\n      throw new Error(\n        `sentinel build(nest): could not read ${configPath}: ` +\n          ts.flattenDiagnosticMessageText(diagnostic.messageText, ' '),\n      )\n    },\n  } as TS.ParseConfigFileHost)\n\n  return {\n    fileNames: parsed?.fileNames ?? [],\n    compilerOptions: {\n      ...parsed?.options,\n      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot\n      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.\n      module: ts.ModuleKind.ESNext,\n      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.\n      sourceMap: true,\n      inlineSourceMap: false,\n      inlineSources: false,\n      // Types are another target's job, and emitting them here would write into the source tree.\n      declaration: false,\n      declarationMap: false,\n      emitDeclarationOnly: false,\n      noEmit: false,\n      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no\n      // incremental build here to inform.\n      composite: false,\n      incremental: false,\n    },\n  }\n}\n\n/**\n * The declared transformers, loaded from the MODULE so each binds to the compiler it expects.\n *\n * A name that cannot be loaded, or a package that exports no `before`, fails the build here\n * rather than producing a bundle quietly missing what the transformer contributes. That failure\n * mode is the reason this exists: dropping `@nestjs/swagger/plugin` costs a service most of its\n * published contract and nothing in the build says so.\n */\nfunction loadTransformers(\n  root: string,\n  program: TS.Program,\n  declared: readonly TransformerDeclaration[],\n): TS.TransformerFactory<TS.SourceFile>[] {\n  const require = createRequire(path.join(root, 'noop.js'))\n  return declared.map(({ name, options }) => {\n    let loaded: { before?: unknown }\n    try {\n      loaded = require(name) as { before?: unknown }\n    } catch (error) {\n      throw new Error(\n        `sentinel build(nest): the build target declares the transformer \\`${name}\\`, which ` +\n          `cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,\n        { cause: error },\n      )\n    }\n    if (typeof loaded.before !== 'function') {\n      throw new Error(\n        `sentinel build(nest): \\`${name}\\` exports no \\`before\\` factory, so it cannot run as a ` +\n          `TypeScript transformer. Building without it would drop whatever it contributes.`,\n      )\n    }\n    const factory = loaded.before as (\n      options: Record<string, unknown> | undefined,\n      program: TS.Program,\n    ) => TS.TransformerFactory<TS.SourceFile>\n    return factory(options, program)\n  })\n}\n\nexport const decoratorMetadata = (options: DecoratorMetadataOptions): Plugin => {\n  /*\n   * Everything is prepared in `buildStart`, and that placement is the whole point.\n   *\n   * It used to be resolved lazily inside `transform`, on the reasoning that an error belongs to\n   * the build rather than to importing the preset. Half right: it belongs to the build, but\n   * Rollup SWALLOWS a throwing `transform` hook. The wrong compiler, an unreadable tsconfig and a\n   * missing one all produced the same symptom instead of their own message: \"1 modules\n   * transformed\", nothing written, then an unrelated error from whichever later hook tripped over\n   * the empty output directory. It cost two diagnoses to recognise.\n   *\n   * `buildStart` is reported. So the compiler is loaded, the config read, the Program built and\n   * the transformers resolved exactly once, before a single file is transformed, where failing\n   * says what failed.\n   */\n  /** `hasPlugin` in nx's own words: this service declares transformers, so it needs a Program. */\n  const typeAware = (options.transformers ?? []).length > 0\n\n  let ts: typeof TS | undefined\n  let program: TS.Program | undefined\n  let compilerOptions: TS.CompilerOptions | undefined\n  let before: TS.TransformerFactory<TS.SourceFile>[] = []\n  /** Files emitted without the Program, which is a fidelity gap and is reported, never silent. */\n  const withoutTypes: string[] = []\n\n  return {\n    name: 'sentinel:decorator-metadata',\n    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so\n    // the source this plugin reads from the Program is still the source on disk.\n    enforce: 'pre',\n    buildStart() {\n      ts = loadCompiler(options.root)\n      const config = readConfig(ts, options)\n      compilerOptions = config.compilerOptions\n      // Built only in the type-aware mode. It costs ~1.9s on the largest service here and buys\n      // nothing a service without transformers can use, which is why nx does not build one either.\n      if (!typeAware) return\n      program = ts.createProgram(config.fileNames, config.compilerOptions)\n      before = loadTransformers(options.root, program, options.transformers ?? [])\n    },\n    transform(code, id) {\n      if (!TYPESCRIPT_SOURCE.test(id) || id.includes('node_modules')) return null\n      // Only reachable if `buildStart` did not run, which no Rollup build does. Named rather than\n      // defaulted, so it cannot silently emit with TypeScript's defaults instead of the module's.\n      if (ts === undefined || compilerOptions === undefined) {\n        throw new Error(\n          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with ` +\n            `defaults rather than this module's tsconfig.`,\n        )\n      }\n\n      /*\n       * The Program's own SourceFile, which is what carries the type information.\n       *\n       * Three cases emit without it. The service declares no transformer, which is `transpileOnly`\n       * and is what ts-loader did for it. A file the Program never reached, because nothing\n       * imports it from the entry. And a file another plugin has already rewritten, where the\n       * Program's copy is no longer the truth: emitting that stale copy over someone else's\n       * transform would be the worse failure.\n       *\n       * The last two are counted and reported at the end. The first is not a gap, it is the mode.\n       *\n       * Measured on the largest service here: neither of the last two fires, on any of its 5594\n       * files. That is the point of reporting them rather than tolerating them quietly — a warning\n       * from this build means something genuinely new, not a known rough edge.\n       */\n      const sourceFile = program?.getSourceFile(id)\n      if (program === undefined || sourceFile === undefined || sourceFile.text !== code) {\n        if (typeAware) withoutTypes.push(id)\n        const output = ts.transpileModule(code, { fileName: id, compilerOptions })\n        return { code: output.outputText, map: output.sourceMapText ?? null }\n      }\n\n      let emitted: string | undefined\n      let map: string | undefined\n      program.emit(\n        sourceFile,\n        (fileName, text) => {\n          if (fileName.endsWith('.map')) map = text\n          else emitted = text\n        },\n        undefined,\n        false,\n        { before },\n      )\n      if (emitted === undefined) {\n        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`)\n      }\n      return { code: emitted, map: map ?? null }\n    },\n    closeBundle() {\n      if (withoutTypes.length === 0) return\n      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file))\n      this.warn(\n        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type ` +\n          `information, so their decorator metadata may differ from what ts-loader produced ` +\n          `(${shown.join(', ')}${withoutTypes.length > shown.length ? ', …' : ''}). They are ` +\n          `outside this module's tsconfig, or another plugin rewrote them first.`,\n      )\n    },\n  }\n}\n","/**\n * The workspace's `paths` mappings, as Vite resolve aliases.\n *\n * They matter more than they look. The mappings point at SOURCE files, and that is what makes\n * a workspace library get BUNDLED rather than externalised: Vite treats anything outside\n * `node_modules` as source. Drop them and every `@hublo/nest/*` import becomes an external the\n * runtime cannot resolve, because those packages are never published.\n *\n * This reproduces what webpack did through `tsconfig-paths-webpack-plugin`, alongside\n * `webpack-node-externals` which only ever externalised real packages. Measured on the first\n * migrated service: 45 externals under Vite against 47 under webpack, and nothing externalised\n * by Vite that webpack did not.\n */\nimport { readFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { parseJsonc } from '../../../shared/jsonc.js'\n\nexport interface Alias {\n  find: RegExp\n  replacement: string\n}\n\nconst toAlias = (workspaceRoot: string, pattern: string, target: string): Alias => {\n  const escaped = pattern.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&').replace(/\\\\\\*/g, '(.*)')\n  return {\n    find: new RegExp(`^${escaped}$`),\n    replacement: join(workspaceRoot, target.replace(/\\*/g, '$1')),\n  }\n}\n\n/**\n * Read the mappings from the workspace's base tsconfig.\n *\n * Longest pattern first, because Vite takes the first alias that matches and the mappings\n * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.\n */\nexport const tsconfigAliases = (workspaceRoot: string, file = 'tsconfig.base.json'): Alias[] => {\n  /*\n   * ⚠️ JSONC, through the shared reader. This stripped `//` comments by hand and then called\n   * `JSON.parse`, which handled a comment on its OWN line and nothing else: a trailing comment\n   * after a value, a block comment, or a trailing comma, all legal in a tsconfig, would throw a\n   * raw SyntaxError naming a character offset. Latent on this repo's base config today, and\n   * `shared/jsonc.ts` already existed for exactly this.\n   */\n  const raw = readFileSync(join(workspaceRoot, file), 'utf8')\n  const { compilerOptions } = parseJsonc<{\n    compilerOptions?: { paths?: Record<string, string[]> }\n  }>(raw, file)\n  return Object.entries(compilerOptions?.paths ?? {})\n    .flatMap(([pattern, targets]) => {\n      const [target] = targets\n      return target === undefined ? [] : [toAlias(workspaceRoot, pattern, target)]\n    })\n    .sort((a, b) => b.find.source.length - a.find.source.length)\n}\n"],"mappings":";;;;;AA2FA,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AAMjB,IAAM,oBAAoB;AAS1B,IAAM,sBAAsB,CAAC,qBAAqB,eAAe;AA6BjE,SAAS,aAAa,MAAyB;AAC7C,QAAMA,WAAU,cAAc,KAAK,KAAK,MAAM,SAAS,CAAC;AACxD,MAAI;AACJ,MAAI;AACF,eAAWA,SAAQ,YAAY;AAAA,EACjC,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,2DAA2D,IAAI;AAAA,IAEjE;AAAA,EACF;AACA,MAAI,OAAO,SAAS,kBAAkB,YAAY;AAChD,UAAM,IAAI;AAAA,MACR,sDAAsD,IAAI,KAAK,SAAS,WAAW,SAAS;AAAA,IAI9F;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA2C;AAClE,MAAI,QAAQ,UAAU;AACpB,UAAM,WAAW,KAAK,QAAQ,QAAQ,MAAM,QAAQ,QAAQ;AAC5D,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,+CAA+C,QAAQ,EAAE;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AACA,aAAW,aAAa,qBAAqB;AAC3C,UAAM,QAAQ,KAAK,KAAK,QAAQ,MAAM,SAAS;AAC/C,QAAI,WAAW,KAAK,EAAG,QAAO;AAAA,EAChC;AACA,QAAM,IAAI;AAAA,IACR,4BAA4B,oBAAoB,KAAK,MAAM,CAAC,OAAO,QAAQ,IAAI;AAAA,EAEjF;AACF;AAGA,SAAS,WACP,IACA,SAC8D;AAC9D,QAAM,aAAa,gBAAgB,OAAO;AAC1C,QAAM,SAAS,GAAG,iCAAiC,YAAY,CAAC,GAAG;AAAA,IACjE,GAAG,GAAG;AAAA,IACN,qCAAqC,CAAC,eAAe;AACnD,YAAM,IAAI;AAAA,QACR,wCAAwC,UAAU,OAChD,GAAG,6BAA6B,WAAW,aAAa,GAAG;AAAA,MAC/D;AAAA,IACF;AAAA,EACF,CAA2B;AAE3B,SAAO;AAAA,IACL,WAAW,QAAQ,aAAa,CAAC;AAAA,IACjC,iBAAiB;AAAA,MACf,GAAG,QAAQ;AAAA;AAAA;AAAA,MAGX,QAAQ,GAAG,WAAW;AAAA;AAAA,MAEtB,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,eAAe;AAAA;AAAA,MAEf,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,QAAQ;AAAA;AAAA;AAAA,MAGR,WAAW;AAAA,MACX,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAUA,SAAS,iBACP,MACA,SACA,UACwC;AACxC,QAAMA,WAAU,cAAc,KAAK,KAAK,MAAM,SAAS,CAAC;AACxD,SAAO,SAAS,IAAI,CAAC,EAAE,MAAM,QAAQ,MAAM;AACzC,QAAI;AACJ,QAAI;AACF,eAASA,SAAQ,IAAI;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,qEAAqE,IAAI,mCAC9C,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC1F,EAAE,OAAO,MAAM;AAAA,MACjB;AAAA,IACF;AACA,QAAI,OAAO,OAAO,WAAW,YAAY;AACvC,YAAM,IAAI;AAAA,QACR,2BAA2B,IAAI;AAAA,MAEjC;AAAA,IACF;AACA,UAAM,UAAU,OAAO;AAIvB,WAAO,QAAQ,SAAS,OAAO;AAAA,EACjC,CAAC;AACH;AAEO,IAAM,oBAAoB,CAAC,YAA8C;AAgB9E,QAAM,aAAa,QAAQ,gBAAgB,CAAC,GAAG,SAAS;AAExD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,SAAiD,CAAC;AAEtD,QAAM,eAAyB,CAAC;AAEhC,SAAO;AAAA,IACL,MAAM;AAAA;AAAA;AAAA,IAGN,SAAS;AAAA,IACT,aAAa;AACX,WAAK,aAAa,QAAQ,IAAI;AAC9B,YAAM,SAAS,WAAW,IAAI,OAAO;AACrC,wBAAkB,OAAO;AAGzB,UAAI,CAAC,UAAW;AAChB,gBAAU,GAAG,cAAc,OAAO,WAAW,OAAO,eAAe;AACnE,eAAS,iBAAiB,QAAQ,MAAM,SAAS,QAAQ,gBAAgB,CAAC,CAAC;AAAA,IAC7E;AAAA,IACA,UAAU,MAAM,IAAI;AAClB,UAAI,CAAC,kBAAkB,KAAK,EAAE,KAAK,GAAG,SAAS,cAAc,EAAG,QAAO;AAGvE,UAAI,OAAO,UAAa,oBAAoB,QAAW;AACrD,cAAM,IAAI;AAAA,UACR,6DAA6D,EAAE;AAAA,QAEjE;AAAA,MACF;AAiBA,YAAM,aAAa,SAAS,cAAc,EAAE;AAC5C,UAAI,YAAY,UAAa,eAAe,UAAa,WAAW,SAAS,MAAM;AACjF,YAAI,UAAW,cAAa,KAAK,EAAE;AACnC,cAAM,SAAS,GAAG,gBAAgB,MAAM,EAAE,UAAU,IAAI,gBAAgB,CAAC;AACzE,eAAO,EAAE,MAAM,OAAO,YAAY,KAAK,OAAO,iBAAiB,KAAK;AAAA,MACtE;AAEA,UAAI;AACJ,UAAI;AACJ,cAAQ;AAAA,QACN;AAAA,QACA,CAAC,UAAU,SAAS;AAClB,cAAI,SAAS,SAAS,MAAM,EAAG,OAAM;AAAA,cAChC,WAAU;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,OAAO;AAAA,MACX;AACA,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,wDAAwD,EAAE,GAAG;AAAA,MAC/E;AACA,aAAO,EAAE,MAAM,SAAS,KAAK,OAAO,KAAK;AAAA,IAC3C;AAAA,IACA,cAAc;AACZ,UAAI,aAAa,WAAW,EAAG;AAC/B,YAAM,QAAQ,aAAa,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,QAAQ,MAAM,IAAI,CAAC;AACtF,WAAK;AAAA,QACH,yBAAyB,aAAa,MAAM,wHAEtC,MAAM,KAAK,IAAI,CAAC,GAAG,aAAa,SAAS,MAAM,SAAS,aAAQ,EAAE;AAAA,MAE1E;AAAA,IACF;AAAA,EACF;AACF;;;ACxVA,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AASrB,IAAM,UAAU,CAAC,eAAuB,SAAiB,WAA0B;AACjF,QAAM,UAAU,QAAQ,QAAQ,uBAAuB,MAAM,EAAE,QAAQ,SAAS,MAAM;AACtF,SAAO;AAAA,IACL,MAAM,IAAI,OAAO,IAAI,OAAO,GAAG;AAAA,IAC/B,aAAa,KAAK,eAAe,OAAO,QAAQ,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAQO,IAAM,kBAAkB,CAAC,eAAuB,OAAO,yBAAkC;AAQ9F,QAAM,MAAM,aAAa,KAAK,eAAe,IAAI,GAAG,MAAM;AAC1D,QAAM,EAAE,gBAAgB,IAAI,WAEzB,KAAK,IAAI;AACZ,SAAO,OAAO,QAAQ,iBAAiB,SAAS,CAAC,CAAC,EAC/C,QAAQ,CAAC,CAAC,SAAS,OAAO,MAAM;AAC/B,UAAM,CAAC,MAAM,IAAI;AACjB,WAAO,WAAW,SAAY,CAAC,IAAI,CAAC,QAAQ,eAAe,SAAS,MAAM,CAAC;AAAA,EAC7E,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,OAAO,SAAS,EAAE,KAAK,OAAO,MAAM;AAC/D;","names":["require"]}

package/dist/{chunk-CPCUPK4J.js → chunk-Z7L4FGKP.js}

@@ -1,10 +1,11 @@
+import {
+  fromModule
+} from "./chunk-ELZHIN6E.js";
 import {
   findWorkspaceRoot
-} from "./chunk-WLFE5RUU.js";
+} from "./chunk-KMKQDGI6.js";
 
 // src/roles/test/setup/workspace.ts
-import { createRequire } from "module";
-import { join } from "path";
 function isMissingModule(error) {
   return error?.code === "ERR_MODULE_NOT_FOUND";
 }
@@ -18,14 +19,6 @@ async function optional(specifier, use) {
     if (!isMissingModule(error)) throw error;
   }
 }
-function fromModule(specifier) {
-  try {
-    const require2 = createRequire(join(process.cwd(), "noop.cjs"));
-    return require2(specifier);
-  } catch {
-    return void 0;
-  }
-}
 async function loadEnvironment() {
   await optional("dotenv-flow", (module) => {
     const flow = module;
@@ -67,4 +60,4 @@ export {
   installWorkspaceSetup,
   pinWorkspaceTimezone
 };
-//# sourceMappingURL=chunk-CPCUPK4J.js.map
+//# sourceMappingURL=chunk-Z7L4FGKP.js.map

package/dist/chunk-Z7L4FGKP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/roles/test/setup/workspace.ts"],"sourcesContent":["/**\n * The rest of what a migrated suite needs before its tests, loaded DEFENSIVELY.\n *\n * ## Why this is in sentinel and not in the repo\n *\n * Because it is config, and an app must depend on its own config and nothing outside it. The first\n * version of the generated config referenced `'../../../../vitest.setup.mts'`, a relative path\n * climbing four levels to the workspace root — which is exactly the external link this whole\n * migration exists to remove. A module that reaches outside itself cannot move on its own.\n *\n * ## Why loading is conditional, and why that is the point rather than a precaution\n *\n * Unlike the msw lifecycle beside it, nothing here reacts to the RUNNER. `dotenv-flow` and luxon's\n * zone would behave identically under jest, Vitest or `node:test`; what they react to is the REPO,\n * which chose those two packages. So the conditional load is the statement of ownership: sentinel\n * offers the behaviour, and the repo that installed the package decides whether it happens.\n *\n * That is also what keeps sentinel installable elsewhere. Neither package can be a hard dependency,\n * so each is loaded only if present and skipped in silence if not. Elsewhere this file does nothing;\n * here both are present and the behaviour is the one the jest setup had.\n *\n * Silence is the right answer for an absent package and the wrong one for a broken package, so a\n * load that fails for any other reason is re-thrown rather than swallowed.\n */\n\nimport { findWorkspaceRoot } from '../../../core/workspace-prep.js'\n\nimport { fromModule } from './module-copy.js'\n\n/** Was this module absent, as opposed to present and broken? */\nfunction isMissingModule(error: unknown): boolean {\n  return (error as { code?: string } | null)?.code === 'ERR_MODULE_NOT_FOUND'\n}\n\n/**\n * Optional by construction: `import()` inside a try, so a missing package is a no-op rather than a\n * failure at load time. A static import would make every one of them a hard dependency.\n */\nasync function optional(specifier: string, use: (module: unknown) => void): Promise<void> {\n  try {\n    use(await import(/* @vite-ignore */ specifier))\n  } catch (error) {\n    if (!isMissingModule(error)) throw error\n  }\n}\n\n/**\n * `dotenv-flow`, which the root jest setup loaded first.\n *\n * Vite's own `.env` handling does NOT replace it, which was checked before writing this. Measured on\n * Vitest 4 against a fixture holding `.env` and `.env.test`: the cascade is read and `MODE` is\n * `test`, but only `VITE_`-prefixed values are exposed, and only on `import.meta.env`. `process.env`\n * comes back untouched, and the code under test reads unprefixed `process.env`.\n *\n * `purge_dotenv` is carried across: it clears variables a previous load left behind, and without it\n * a value from one run leaks into the next. Not a detail in a suite that asserts on URLs.\n */\nasync function loadEnvironment(): Promise<void> {\n  // A plain dependency of sentinel now: it mutates `process.env`, which is global, so WHICH copy\n  // runs does not matter. It is the other half of replacing the root setup, and the root is going\n  // away (Héla, 2026-09-21: \"mon but est de supprimer la config root\").\n  await optional('dotenv-flow', (module) => {\n    const flow = module as {\n      config?: (options: Record<string, unknown>) => void\n      default?: unknown\n    }\n    const config =\n      flow.config ?? (flow.default as { config?: (o: Record<string, unknown>) => void })?.config\n    /*\n     * From the WORKSPACE ROOT, not from the module.\n     *\n     * dotenv-flow reads its cascade from the current directory, and the two runners do not share\n     * one: jest ran from the repo root, where `.env`, `.env.test` and `.env.token` live, while\n     * `sentinel --run --test` runs from the module, where there is nothing to read. Measured on\n     * `libs/cloud/events-notifications`: from the module, a service call waits for an endpoint its\n     * env never named and the test dies on a 5 s timeout; from the root, it answers in 200 ms.\n     *\n     * The root is found rather than configured: the setup cannot be handed a value, since a module\n     * that overrides `test.env` would replace whatever the preset injected there.\n     */\n    const workspaceRoot = findWorkspaceRoot(process.cwd())\n    config?.({\n      silent: true,\n      purge_dotenv: true,\n      ...(workspaceRoot === undefined ? {} : { path: workspaceRoot }),\n    })\n  })\n}\n\n/**\n * Luxon's default zone, carried as luxon's own setting and NOT translated to `process.env.TZ`.\n *\n * They are different instructions: one configures luxon, the other the whole process, `Date` and\n * `Intl` included. Swapping them would change what a suite does while claiming to migrate it, and\n * timezone is not a detail here — a machine's zone accounted for a large part of 345 local failures\n * on `host-admin` that did not exist in CI.\n */\nasync function pinLuxonZone(): Promise<void> {\n  // The module's copy, deliberately: `Settings` is per-copy state, so sentinel's own luxon is the\n  // one package this setup must NOT configure.\n  /*\n   * Through the RUNNER's resolver first, which is what the tests use. `fromModule` goes through\n   * `require`, and a package shipping both builds hands it the CJS one while Vite hands the tests\n   * the ESM one. Two copies, two `Settings`, and the pin lands on the one nobody reads: measured on\n   * `libs/cloud/events-notifications`, whose suite ran in `Europe/Paris` and compared timestamps\n   * two hours apart. The preset aliases luxon to one path so both routes agree.\n   */\n  let pinned = false\n  await optional('luxon', (module) => {\n    const settings = (module as { Settings?: { defaultZone: string } }).Settings\n    if (settings === undefined) return\n    settings.defaultZone = 'utc'\n    pinned = true\n  })\n  if (pinned) return\n\n  const own = fromModule('luxon') as { Settings?: { defaultZone: string } } | undefined\n  if (own?.Settings !== undefined) {\n    own.Settings.defaultZone = 'utc'\n    return\n  }\n\n  // Said out loud rather than skipped: a suite whose dates silently run in the machine's zone is\n  // the kind of failure that gets blamed on the migration months later.\n  process.stderr.write(\n    'sentinel (test): luxon was not found in this module, so the UTC default zone is NOT pinned. ' +\n      'Dates will follow the machine zone, as they did not under jest.\\n',\n  )\n}\n\n/**\n * Everything the workspace needs beyond the msw lifecycle.\n *\n * NOT included: the `jest.mock('dynamoose')` and `jest.mock('@opentelemetry/exporter-metrics-otlp-grpc')`\n * calls the jest setup made. A module mock is a per-suite decision that `vi.mock` must make in the\n * file that needs it, and hoisting it into a shared setup is what makes a test pass for a reason\n * nobody can see. The migration reports them instead, so the module that relies on one declares it.\n */\nexport async function installWorkspaceSetup(): Promise<void> {\n  await loadEnvironment()\n}\n\n/**\n * Luxon's default zone, split out because it is not in the same class as the rest.\n *\n * ⚠️ These two were one function until 23/09 and moving them together broke three modules.\n *\n * The `.env` cascade is needed by any suite whose code reads `process.env`, whatever setup its\n * jest config named: under jest those modules got it from a `globalSetup` running in the main\n * process, and Vitest's workers do not inherit it the same way. Removing it cost\n * `libs/front/logic` 23 tests and `libs/front/api` 44, all with `missing env var\n * NEXT_PUBLIC_MONOREPO_BASE_URL`.\n *\n * The UTC pin is a decision ONE file at the workspace root made, and only the modules naming that\n * file ever had it. So it is conditional and the cascade is not.\n */\nexport async function pinWorkspaceTimezone(): Promise<void> {\n  await pinLuxonZone()\n}\n"],"mappings":";;;;;;;;AA8BA,SAAS,gBAAgB,OAAyB;AAChD,SAAQ,OAAoC,SAAS;AACvD;AAMA,eAAe,SAAS,WAAmB,KAA+C;AACxF,MAAI;AACF,QAAI,MAAM;AAAA;AAAA,MAA0B;AAAA,KAAU;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,CAAC,gBAAgB,KAAK,EAAG,OAAM;AAAA,EACrC;AACF;AAaA,eAAe,kBAAiC;AAI9C,QAAM,SAAS,eAAe,CAAC,WAAW;AACxC,UAAM,OAAO;AAIb,UAAM,SACJ,KAAK,UAAW,KAAK,SAA+D;AAatF,UAAM,gBAAgB,kBAAkB,QAAQ,IAAI,CAAC;AACrD,aAAS;AAAA,MACP,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACH;AAUA,eAAe,eAA8B;AAU3C,MAAI,SAAS;AACb,QAAM,SAAS,SAAS,CAAC,WAAW;AAClC,UAAM,WAAY,OAAkD;AACpE,QAAI,aAAa,OAAW;AAC5B,aAAS,cAAc;AACvB,aAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAQ;AAEZ,QAAM,MAAM,WAAW,OAAO;AAC9B,MAAI,KAAK,aAAa,QAAW;AAC/B,QAAI,SAAS,cAAc;AAC3B;AAAA,EACF;AAIA,UAAQ,OAAO;AAAA,IACb;AAAA,EAEF;AACF;AAUA,eAAsB,wBAAuC;AAC3D,QAAM,gBAAgB;AACxB;AAgBA,eAAsB,uBAAsC;AAC1D,QAAM,aAAa;AACrB;","names":[]}

package/dist/index.d.ts

@@ -11,12 +11,25 @@ declare function registerAdapters(): void;
  * `settings.ts`, not here.
  */
 /**
- * Verbs: what to do. `init` writes a module's config + the workspace prep it needs (the
- * one-time setup); the read verbs (run/inspect/report/status) execute or introspect.
- * `migrate` is reserved for changing an already-initialized setup and is not wired yet
- * (the CLI lists it as planned and refuses it).
+ * Verbs: what to do.
+ *
+ * The axis is not "who runs it" but **what survives the run**, which is the distinction that
+ * outlives any sharing of the work:
+ *
+ * | verb | writes | what remains |
+ * | --- | --- | --- |
+ * | `init` | a module's config + the workspace prep it needs | the module's new state, that IS the deliverable |
+ * | `migrate` | changes an already-initialized setup | same; reserved, not wired yet |
+ * | `validate` | instrumentation, if it needs any | **nothing**, the project returns to what it was |
+ * | `run` / `inspect` / `report` / `status` | nothing | they execute or introspect |
+ *
+ * `validate` is the one that judges. Héla, 2026-09-25: it does not carry the migration's
+ * strictness, so it MAY write into the project under validation, a `data-testid` to make something
+ * addressable for instance, provided it takes it back out. That freedom is what makes its
+ * dependability the thing to design: idempotent, reversible on error, recoverable after a kill,
+ * and never silent about instrumentation it failed to remove.
  */
-declare const VERBS: readonly ["run", "inspect", "init", "migrate", "report", "status"];
+declare const VERBS: readonly ["run", "inspect", "init", "migrate", "validate", "report", "status"];
 type Verb = (typeof VERBS)[number];
 /** Targets: the kind of check. The CLI `--<target>` flags map 1:1 to these. */
 declare const TARGETS: readonly ["lint", "format", "typescript", "build", "dev", "test", "static-analysis", "runtime-analysis", "arch"];
@@ -66,6 +79,16 @@ interface RunContext {
     ci: boolean;
     /** Apply auto-fixes where the tool supports it. */
     fix: boolean;
+    /**
+     * The files `--init` just wrote, relative to `cwd`, for an `afterInit` that tidies up after
+     * itself.
+     *
+     * ⚠️ It exists because the alternative is a whole-directory pass, and that is not a tidy-up.
+     * Measured on `apps/nest/microservices/institution`: an `afterInit` running its formatter over
+     * `.` reformatted 1813 files, 47333 insertions and 55506 deletions, in a module whose migration
+     * touched 268. Only set by the `--init` path, so an adapter must treat it as optional.
+     */
+    written?: string[];
     /**
      * Cap on the number of structured diagnostics a `--report` embeds per module (the
      * full count still lives in `errors`, so nothing is hidden silently). `0` means no

package/dist/index.js

@@ -1,5 +1,4 @@
 import {
-  BaseAdapter,
   all,
   detectFramework,
   dispatch,
@@ -7,8 +6,13 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-L7WS36XV.js";
-import "./chunk-WLFE5RUU.js";
+} from "./chunk-GRK2KRFI.js";
+import {
+  BaseAdapter
+} from "./chunk-DYJ6J43A.js";
+import "./chunk-O7REVMOC.js";
+import "./chunk-QXFCZON7.js";
+import "./chunk-KMKQDGI6.js";
 export {
   BaseAdapter,
   all,