@hublo/sentinel 1.0.2 → 1.1.0-alpha.2

package/dist/chunk-EZCRU6XE.js

@@ -0,0 +1,2062 @@
+// src/core/registry.ts
+var adapters = [];
+var defaultRunner = {
+  // Filled in by tool branches, e.g. lint: 'eslint', typescript: 'tsc'.
+};
+function register(adapter) {
+  adapters.push(adapter);
+}
+function setDefaultRunner(target, runner) {
+  defaultRunner[target] = runner;
+}
+function all() {
+  return adapters;
+}
+function availableTargets() {
+  return [...new Set(adapters.map((a) => a.target))];
+}
+function resolve(target, flavour, runner) {
+  const forTarget = adapters.filter((a) => a.target === target);
+  if (forTarget.length === 0) {
+    throw new Error(
+      `No adapter registered for target "${target}" yet (it ships in a later ticket).`
+    );
+  }
+  const candidates = flavour ? forTarget.filter((a) => a.appliesTo(flavour)) : forTarget;
+  if (candidates.length === 0) {
+    throw new Error(`No adapter for target "${target}" handles flavour "${flavour}".`);
+  }
+  const wanted = runner ?? defaultRunner[target];
+  const available = candidates.map((a) => a.runner).join(", ");
+  if (!wanted) {
+    const [first, ...rest] = candidates;
+    if (first && rest.length === 0) return first;
+    throw new Error(
+      `Multiple runners for target "${target}" (${available}); pass --runner or set a default.`
+    );
+  }
+  const matching = candidates.filter((a) => a.runner === wanted);
+  if (matching.length === 0) {
+    throw new Error(
+      `No runner "${wanted}" for target "${target}" (flavour "${flavour}"). Available: ${available}.`
+    );
+  }
+  if (matching.length > 1) {
+    throw new Error(
+      `Ambiguous: ${matching.length} adapters claim target "${target}", runner "${wanted}", flavour "${flavour}".`
+    );
+  }
+  return matching[0];
+}
+
+// src/core/base-adapter.ts
+var BaseAdapter = class {
+  inspect(_ctx) {
+    throw new Error(`${this.runner}: --inspect not implemented yet`);
+  }
+  report(_ctx) {
+    throw new Error(`${this.runner}: --report not implemented yet`);
+  }
+  status(_ctx) {
+    throw new Error(`${this.runner}: --status not implemented yet`);
+  }
+};
+
+// src/shared/color.ts
+import { styleText } from "util";
+function palette(stream) {
+  const paint = (format, text) => styleText(format, text, { stream });
+  return {
+    ok: (text) => paint(["green", "bold"], text),
+    fail: (text) => paint(["red", "bold"], text),
+    warn: (text) => paint("yellow", text),
+    strong: (text) => paint("bold", text),
+    dim: (text) => paint("dim", text),
+    accent: (text) => paint("cyan", text)
+  };
+}
+
+// src/shared/package-json.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function readOwnPackage() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (typeof pkg.version === "string") {
+          return { name: pkg.name ?? "@hublo/sentinel", version: pkg.version };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return { name: "@hublo/sentinel", version: "0.0.0" };
+    dir = parent;
+  }
+}
+function readOwnVersion() {
+  return readOwnPackage().version;
+}
+function readProjectPackageJson(dir) {
+  const path = join(dir, "package.json");
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.
+`);
+    return {};
+  }
+}
+function readNxProjectName(dir) {
+  const path = join(dir, "project.json");
+  if (!existsSync(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/core/domain.ts
+var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
+var TARGETS = [
+  "lint",
+  "format",
+  "typescript",
+  "build",
+  "test",
+  "static-analysis",
+  "runtime-analysis",
+  "arch"
+];
+var FLAVOURS = ["react", "nest", "svelte", "node"];
+
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { basename, join as join7 } from "path";
+import { spawnSync } from "child_process";
+
+// src/core/config/deferred-rules.ts
+function deferredRuleNames(rules) {
+  return rules.map((entry) => entry.rule);
+}
+
+// src/roles/lint/config-policy.ts
+var LINT_CONFIG_FILE = ".oxlintrc.json";
+var LINT_SCRIPT_NAME = "lint";
+var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
+function presetPath(flavour) {
+  return `${PRESET_DIR}/${flavour}.json`;
+}
+var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/oxlint\/([a-z-]+)\.json$/;
+function flavourFromPreset(preset) {
+  return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
+}
+var PERMITTED_LOCAL_KEYS = ["extends"];
+var ESLINT_CONFIG_FILES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts"
+];
+function lintTarget() {
+  return {
+    executor: "nx:run-commands",
+    cache: true,
+    // The config is an input so a preset bump invalidates the cache. Without it, nx would
+    // replay a stale result after the rules changed underneath it.
+    inputs: ["default", `{projectRoot}/${LINT_CONFIG_FILE}`],
+    options: { cwd: "{projectRoot}", command: `pnpm run ${LINT_SCRIPT_NAME}` }
+  };
+}
+
+// src/roles/lint/disabled-rules.ts
+var NEST_DISABLED = [
+  {
+    rule: "no-barrel-files/no-barrel-files",
+    reason: "nest modules use barrel index.ts files as a deliberate structural pattern; the rule fired 127 times and every one was the architecture working as intended"
+  },
+  {
+    rule: "no-control-regex",
+    reason: "the single occurrence is a regex whose whole purpose is stripping ASCII control characters before XML output, which the rule cannot distinguish from an accident"
+  }
+];
+var REACT_DISABLED = [
+  // The jest suite is the single largest group: enabling it turned 135 errors into a
+  // wall nobody would read on day one. Adoption has to be a lateral move first.
+  {
+    rule: "jest/expect-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-alias-methods",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-commented-out-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-conditional-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-deprecated-functions",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-disabled-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-done-callback",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-export",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-focused-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-identical-title",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-interpolation-in-snapshots",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-jasmine-globals",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-mocks-import",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-standalone-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-test-prefixes",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-be",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-contain",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-have-length",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-describe-callback",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-expect-in-promise",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-title",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  // TanStack Query rules the codebase has never satisfied.
+  {
+    rule: "@tanstack/query/exhaustive-deps",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/infinite-query-property-order",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/mutation-property-order",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-rest-destructuring",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-unstable-deps",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-void-query-fn",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/stable-query-client",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  // typescript-eslint rules carrying real, pre-existing debt.
+  {
+    rule: "typescript/no-empty-function",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-explicit-any",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unnecessary-type-assertion",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-argument",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-assignment",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-call",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-enum-comparison",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-member-access",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-return",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unused-vars",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/only-throw-error",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/require-await",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  // One-offs, each for its own reason.
+  {
+    rule: "no-console",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "no-unsafe-optional-chaining",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "react/jsx-curly-brace-presence",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "styled-components-a11y/label-has-for",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "jsx-a11y/img-redundant-alt",
+    reason: 'one real finding, a decorative image whose title is already rendered as a heading beside it, so the fix is alt="". A genuine accessibility issue rather than a false positive: parked only so swapping linters stays a lateral move, and worth switching back on as soon as it is fixed'
+  },
+  {
+    rule: "hublo/no-palette-common",
+    reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
+  }
+];
+var BY_FLAVOUR = {
+  nest: NEST_DISABLED,
+  react: REACT_DISABLED
+};
+function disabledRulesFor(flavour) {
+  return BY_FLAVOUR[flavour] ?? [];
+}
+
+// src/roles/lint/flavours/base.ts
+var lintBase = {
+  // typescript-eslint (17)
+  "typescript/ban-ts-comment": "warn",
+  "typescript/no-array-constructor": "warn",
+  "typescript/no-duplicate-enum-values": "warn",
+  "typescript/no-empty-object-type": "warn",
+  "typescript/no-extra-non-null-assertion": "warn",
+  "typescript/no-misused-new": "warn",
+  "typescript/no-namespace": "warn",
+  "typescript/no-non-null-asserted-optional-chain": "warn",
+  "typescript/no-this-alias": "warn",
+  "typescript/no-unnecessary-type-constraint": "warn",
+  "typescript/no-unsafe-declaration-merging": "warn",
+  "typescript/no-unsafe-function-type": "warn",
+  "typescript/no-unused-expressions": [
+    "warn",
+    { allowShortCircuit: false, allowTaggedTemplates: false, allowTernary: false }
+  ],
+  "typescript/no-wrapper-object-types": "warn",
+  "typescript/prefer-as-const": "warn",
+  "typescript/prefer-namespace-keyword": "warn",
+  "typescript/triple-slash-reference": "warn",
+  // ESLint core (4)
+  "no-var": "warn",
+  "prefer-const": ["warn", { destructuring: "any", ignoreReadBeforeAssign: false }],
+  "prefer-rest-params": "warn",
+  "prefer-spread": "warn"
+};
+
+// src/roles/lint/flavours/nest.ts
+var nestLayer = {
+  // ESLint core (55)
+  "array-callback-return": [
+    "warn",
+    { allowImplicit: false, checkForEach: false, allowVoid: false }
+  ],
+  complexity: ["warn", 30],
+  curly: ["warn", "all"],
+  "dot-notation": ["warn", { allowKeywords: true, allowPattern: "" }],
+  eqeqeq: "warn",
+  "for-direction": "warn",
+  "func-style": [
+    "warn",
+    "expression",
+    { allowArrowFunctions: false, allowTypeAnnotation: false, overrides: {} }
+  ],
+  "no-async-promise-executor": "warn",
+  "no-case-declarations": "warn",
+  "no-compare-neg-zero": "warn",
+  "no-cond-assign": ["warn", "except-parens"],
+  "no-console": ["warn", { allow: ["warn", "error"] }],
+  "no-constant-binary-expression": "warn",
+  "no-constant-condition": ["warn", { checkLoops: "allExceptWhileTrue" }],
+  "no-debugger": "warn",
+  "no-delete-var": "warn",
+  "no-dupe-else-if": "warn",
+  "no-dupe-keys": "warn",
+  "no-duplicate-case": "warn",
+  "no-else-return": ["warn", { allowElseIf: true }],
+  "no-empty": ["warn", { allowEmptyCatch: false }],
+  "no-empty-character-class": "warn",
+  "no-empty-pattern": ["warn", { allowObjectPatternsAsParameters: false }],
+  "no-empty-static-block": "warn",
+  "no-ex-assign": "warn",
+  "no-extra-boolean-cast": ["warn", {}],
+  "no-fallthrough": ["warn", { allowEmptyCase: false, reportUnusedFallthroughComment: false }],
+  "no-global-assign": ["warn", { exceptions: [] }],
+  "no-implicit-coercion": [
+    "warn",
+    { allow: [], boolean: true, disallowTemplateShorthand: false, number: true, string: true }
+  ],
+  "no-invalid-regexp": ["warn", {}],
+  "no-irregular-whitespace": [
+    "warn",
+    {
+      skipComments: false,
+      skipJSXText: false,
+      skipRegExps: false,
+      skipStrings: true,
+      skipTemplates: false
+    }
+  ],
+  "no-lonely-if": "warn",
+  "no-loss-of-precision": "warn",
+  "no-misleading-character-class": "warn",
+  "no-nonoctal-decimal-escape": "warn",
+  "no-prototype-builtins": "warn",
+  "no-regex-spaces": "warn",
+  "no-restricted-imports": [
+    "warn",
+    {
+      paths: [
+        {
+          name: "@front/theme",
+          importNames: [
+            "hubloTheme",
+            "legacyHubloTheme",
+            "customCommonColors",
+            "customPalette",
+            "breakpointsOptions",
+            "breakpointsValues",
+            "spacingConstants"
+          ],
+          message: "Use the MUI theme context or the public providers exposed by @front/theme."
+        }
+      ],
+      patterns: [
+        {
+          group: ["@front/theme/*", "!@front/theme/testing"],
+          message: "Deep imports from @front/theme are forbidden outside the theme lib."
+        }
+      ]
+    }
+  ],
+  "no-self-assign": ["warn", { props: true }],
+  "no-shadow-restricted-names": ["warn", { reportGlobalThis: false }],
+  "no-sparse-arrays": "warn",
+  "no-unneeded-ternary": ["warn", { defaultAssignment: true }],
+  "no-unsafe-finally": "warn",
+  "no-unsafe-optional-chaining": ["warn", { disallowArithmeticOperators: false }],
+  "no-unused-labels": "warn",
+  "no-unused-private-class-members": "warn",
+  "no-useless-backreference": "warn",
+  "no-useless-catch": "warn",
+  "no-useless-escape": ["warn", { allowRegexCharacters: [] }],
+  "no-useless-return": "warn",
+  "prefer-arrow-callback": ["warn", { allowNamedFunctions: false, allowUnboundThis: true }],
+  "require-yield": "warn",
+  "use-isnan": ["warn", { enforceForIndexOf: false, enforceForSwitchCase: true }],
+  "valid-typeof": ["warn", { requireStringLiterals: false }],
+  // typescript-eslint (10)
+  "typescript/await-thenable": "warn",
+  "typescript/no-confusing-non-null-assertion": "warn",
+  "typescript/no-empty-function": ["warn", { allow: [] }],
+  "typescript/no-explicit-any": "warn",
+  "typescript/no-floating-promises": ["warn", { ignoreVoid: true }],
+  "typescript/no-import-type-side-effects": "warn",
+  "typescript/no-inferrable-types": "warn",
+  "typescript/no-non-null-assertion": "warn",
+  "typescript/no-unused-vars": ["warn", { argsIgnorePattern: "^_", caughtErrors: "none" }],
+  "typescript/switch-exhaustiveness-check": ["warn", { considerDefaultExhaustiveForUnions: true }],
+  // eslint-plugin-jest (21)
+  "jest/expect-expect": "warn",
+  "jest/no-alias-methods": "warn",
+  "jest/no-commented-out-tests": "warn",
+  "jest/no-deprecated-functions": "warn",
+  "jest/no-disabled-tests": "warn",
+  "jest/no-done-callback": "warn",
+  "jest/no-export": "warn",
+  "jest/no-focused-tests": "warn",
+  "jest/no-identical-title": "warn",
+  "jest/no-interpolation-in-snapshots": "warn",
+  "jest/no-jasmine-globals": "warn",
+  "jest/no-mocks-import": "warn",
+  "jest/no-standalone-expect": "warn",
+  "jest/no-test-prefixes": "warn",
+  "jest/prefer-to-be": "warn",
+  "jest/prefer-to-contain": "warn",
+  "jest/prefer-to-have-length": "warn",
+  "jest/valid-describe-callback": "warn",
+  "jest/valid-expect": "warn",
+  "jest/valid-expect-in-promise": "warn",
+  "jest/valid-title": "warn",
+  // eslint-plugin-import — aliased, oxlint reserves the name `import` (2)
+  "import-js/no-duplicates": ["warn", { considerQueryString: true, "prefer-inline": true }],
+  "import-js/order": [
+    "warn",
+    {
+      "newlines-between": "always",
+      groups: ["builtin", "external", "internal", ["parent", "index"], "sibling"],
+      alphabetize: { order: "asc", caseInsensitive: false, orderImportKind: "ignore" },
+      pathGroups: [
+        { pattern: "@nestjs/**", group: "external" },
+        {
+          pattern: "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+          group: "internal",
+          position: "before"
+        }
+      ],
+      pathGroupsExcludedImportTypes: ["builtin"],
+      distinctGroup: true,
+      sortTypesGroup: false,
+      named: false,
+      warnOnUnassignedImports: false
+    }
+  ],
+  // @nx/eslint-plugin (1)
+  "nx/enforce-module-boundaries": [
+    "warn",
+    {
+      enforceBuildableLibDependency: true,
+      allow: [],
+      depConstraints: [{ sourceTag: "*", onlyDependOnLibsWithTags: ["*"] }]
+    }
+  ]
+};
+var nestRules = { ...lintBase, ...nestLayer };
+
+// src/roles/lint/flavours/react.ts
+var reactLayer = {
+  // ESLint core (42)
+  curly: ["error", "all"],
+  "for-direction": "error",
+  "no-async-promise-executor": "error",
+  "no-case-declarations": "error",
+  "no-compare-neg-zero": "error",
+  "no-cond-assign": ["error", "except-parens"],
+  "no-constant-binary-expression": "error",
+  "no-constant-condition": ["error", { checkLoops: "allExceptWhileTrue" }],
+  "no-control-regex": "error",
+  "no-debugger": "error",
+  "no-delete-var": "error",
+  "no-dupe-else-if": "error",
+  "no-duplicate-case": "error",
+  "no-empty": ["error", { allowEmptyCatch: false }],
+  "no-empty-character-class": "error",
+  "no-empty-pattern": ["error", { allowObjectPatternsAsParameters: false }],
+  "no-empty-static-block": "error",
+  "no-ex-assign": "error",
+  "no-extra-boolean-cast": ["error", {}],
+  "no-fallthrough": ["error", { allowEmptyCase: false, reportUnusedFallthroughComment: false }],
+  "no-global-assign": ["error", { exceptions: [] }],
+  "no-invalid-regexp": ["error", {}],
+  "no-irregular-whitespace": [
+    "error",
+    {
+      skipComments: false,
+      skipJSXText: false,
+      skipRegExps: false,
+      skipStrings: true,
+      skipTemplates: false
+    }
+  ],
+  "no-loss-of-precision": "error",
+  "no-misleading-character-class": "error",
+  "no-nonoctal-decimal-escape": "error",
+  "no-prototype-builtins": "error",
+  "no-regex-spaces": "error",
+  "no-restricted-imports": [
+    "error",
+    {
+      patterns: [
+        {
+          group: ["next/*"],
+          message: "Importing from next/* is not allowed in the admin project."
+        },
+        {
+          group: ["storybook/*"],
+          message: "Importing from storybook/* is not allowed in the admin project."
+        },
+        {
+          group: ["@nestjs/*"],
+          message: "Importing from @nestjs/* is not allowed in the admin project."
+        },
+        {
+          group: ["next-i18next"],
+          message: "Importing from next-i18next is not allowed in the admin project."
+        },
+        {
+          group: ["@hublo/style/colors", "@hublo/style/colors/*"],
+          message: "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
+        }
+      ]
+    }
+  ],
+  "no-self-assign": ["error", { props: true }],
+  "no-shadow-restricted-names": ["error", { reportGlobalThis: false }],
+  "no-sparse-arrays": "error",
+  "no-unexpected-multiline": "error",
+  "no-unsafe-finally": "error",
+  "no-unused-labels": "error",
+  "no-unused-private-class-members": "error",
+  "no-useless-backreference": "error",
+  "no-useless-catch": "error",
+  "no-useless-escape": ["error", { allowRegexCharacters: [] }],
+  "require-yield": "error",
+  "use-isnan": ["error", { enforceForIndexOf: false, enforceForSwitchCase: true }],
+  "valid-typeof": ["error", { requireStringLiterals: false }],
+  // eslint-plugin-styled-components-a11y (hosted) (32)
+  "styled-components-a11y/alt-text": "error",
+  "styled-components-a11y/anchor-has-content": "error",
+  "styled-components-a11y/anchor-is-valid": "error",
+  "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
+  "styled-components-a11y/aria-props": "error",
+  "styled-components-a11y/aria-proptypes": "error",
+  "styled-components-a11y/aria-role": "error",
+  "styled-components-a11y/aria-unsupported-elements": "error",
+  "styled-components-a11y/autocomplete-valid": "error",
+  "styled-components-a11y/click-events-have-key-events": "error",
+  "styled-components-a11y/control-has-associated-label": [
+    "off",
+    {
+      ignoreElements: ["audio", "canvas", "embed", "input", "textarea", "tr", "video"],
+      ignoreRoles: [
+        "grid",
+        "listbox",
+        "menu",
+        "menubar",
+        "radiogroup",
+        "row",
+        "tablist",
+        "toolbar",
+        "tree",
+        "treegrid"
+      ],
+      includeRoles: ["alert", "dialog"]
+    }
+  ],
+  "styled-components-a11y/heading-has-content": "error",
+  "styled-components-a11y/html-has-lang": "error",
+  "styled-components-a11y/iframe-has-title": "error",
+  "styled-components-a11y/img-redundant-alt": "error",
+  "styled-components-a11y/interactive-supports-focus": [
+    "error",
+    {
+      tabbable: [
+        "button",
+        "checkbox",
+        "link",
+        "progressbar",
+        "searchbox",
+        "slider",
+        "spinbutton",
+        "switch",
+        "textbox"
+      ]
+    }
+  ],
+  "styled-components-a11y/label-has-associated-control": "error",
+  "styled-components-a11y/media-has-caption": "error",
+  "styled-components-a11y/mouse-events-have-key-events": "error",
+  "styled-components-a11y/no-access-key": "error",
+  "styled-components-a11y/no-autofocus": "error",
+  "styled-components-a11y/no-distracting-elements": "error",
+  "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
+  "styled-components-a11y/no-noninteractive-element-interactions": [
+    "error",
+    { body: ["onError", "onLoad"], iframe: ["onError", "onLoad"], img: ["onError", "onLoad"] }
+  ],
+  "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
+  "styled-components-a11y/no-noninteractive-tabindex": "error",
+  "styled-components-a11y/no-redundant-roles": "error",
+  "styled-components-a11y/no-static-element-interactions": "error",
+  "styled-components-a11y/role-has-required-aria-props": "error",
+  "styled-components-a11y/role-supports-aria-props": "error",
+  "styled-components-a11y/scope": "error",
+  "styled-components-a11y/tabindex-no-positive": "error",
+  // eslint-plugin-jsx-a11y (31)
+  "jsx-a11y/alt-text": "error",
+  "jsx-a11y/anchor-has-content": "error",
+  "jsx-a11y/anchor-is-valid": "error",
+  "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+  "jsx-a11y/aria-props": "error",
+  "jsx-a11y/aria-proptypes": "error",
+  "jsx-a11y/aria-role": "error",
+  "jsx-a11y/aria-unsupported-elements": "error",
+  "jsx-a11y/autocomplete-valid": "error",
+  "jsx-a11y/click-events-have-key-events": "error",
+  "jsx-a11y/heading-has-content": "error",
+  "jsx-a11y/html-has-lang": "error",
+  "jsx-a11y/iframe-has-title": "error",
+  "jsx-a11y/img-redundant-alt": "error",
+  "jsx-a11y/interactive-supports-focus": [
+    "error",
+    {
+      tabbable: [
+        "button",
+        "checkbox",
+        "link",
+        "progressbar",
+        "searchbox",
+        "slider",
+        "spinbutton",
+        "switch",
+        "textbox"
+      ]
+    }
+  ],
+  "jsx-a11y/label-has-associated-control": "error",
+  "jsx-a11y/media-has-caption": "error",
+  "jsx-a11y/mouse-events-have-key-events": "error",
+  "jsx-a11y/no-access-key": "error",
+  "jsx-a11y/no-autofocus": "error",
+  "jsx-a11y/no-distracting-elements": "error",
+  "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
+  "jsx-a11y/no-noninteractive-element-interactions": [
+    "error",
+    { body: ["onError", "onLoad"], iframe: ["onError", "onLoad"], img: ["onError", "onLoad"] }
+  ],
+  "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
+  "jsx-a11y/no-noninteractive-tabindex": "error",
+  "jsx-a11y/no-redundant-roles": "error",
+  "jsx-a11y/no-static-element-interactions": "error",
+  "jsx-a11y/role-has-required-aria-props": "error",
+  "jsx-a11y/role-supports-aria-props": "error",
+  "jsx-a11y/scope": "error",
+  "jsx-a11y/tabindex-no-positive": "error",
+  // typescript-eslint (18)
+  "typescript/await-thenable": "error",
+  "typescript/no-array-delete": "error",
+  "typescript/no-base-to-string": "error",
+  "typescript/no-duplicate-type-constituents": "error",
+  "typescript/no-floating-promises": ["error", { ignoreVoid: true }],
+  "typescript/no-for-in-array": "error",
+  "typescript/no-implied-eval": "error",
+  "typescript/no-inferrable-types": "error",
+  "typescript/no-misused-promises": ["error", { checksVoidReturn: { attributes: false } }],
+  "typescript/no-non-null-assertion": "warn",
+  "typescript/no-redundant-type-constituents": "error",
+  "typescript/no-require-imports": "error",
+  "typescript/no-unsafe-unary-minus": "error",
+  "typescript/prefer-promise-reject-errors": "error",
+  "typescript/restrict-plus-operands": "error",
+  "typescript/restrict-template-expressions": "error",
+  "typescript/switch-exhaustiveness-check": "warn",
+  "typescript/unbound-method": "error",
+  // eslint-plugin-react-hooks (2)
+  "react-hooks/exhaustive-deps": "warn",
+  "react-hooks/rules-of-hooks": "error",
+  // eslint-plugin-no-barrel-files (hosted) (1)
+  "no-barrel-files/no-barrel-files": "warn",
+  // @nx/eslint-plugin (hosted) (1)
+  "nx/enforce-module-boundaries": [
+    "error",
+    {
+      enforceBuildableLibDependency: true,
+      allow: [],
+      depConstraints: [{ sourceTag: "*", onlyDependOnLibsWithTags: ["*"] }]
+    }
+  ],
+  // eslint-plugin-import — aliased, oxlint reserves `import` (1)
+  "import-js/order": [
+    "error",
+    {
+      "newlines-between": "always",
+      groups: ["builtin", "external", "internal", ["parent", "index"], "sibling"],
+      alphabetize: { order: "asc" },
+      pathGroups: [
+        { pattern: "@nestjs/**", group: "external" },
+        {
+          pattern: "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+          group: "internal",
+          position: "before"
+        }
+      ],
+      pathGroupsExcludedImportTypes: ["builtin"]
+    }
+  ],
+  // eslint-plugin-react-refresh (hosted) (1)
+  "react-refresh/only-export-components": ["warn", { allowConstantExport: true }]
+};
+var reactRules = { ...lintBase, ...reactLayer };
+
+// src/roles/lint/presets.ts
+var TS_EXTENSIONS = [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+var IMPORT_SETTINGS = {
+  "import/extensions": TS_EXTENSIONS,
+  "import/external-module-folders": ["node_modules", "node_modules/@types"],
+  "import/parsers": { "@typescript-eslint/parser": [".ts", ".cts", ".mts", ".tsx"] },
+  "import/resolver": { node: { extensions: TS_EXTENSIONS } }
+};
+var NEST_PRESET = {
+  plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    { name: "nx", specifier: "@nx/eslint-plugin" },
+    { name: "import-js", specifier: "eslint-plugin-import" }
+  ],
+  env: { node: true, es2022: true, jest: true },
+  settings: IMPORT_SETTINGS,
+  rules: nestRules
+};
+var BASE_PRESET = {
+  plugins: ["typescript", "oxc"],
+  jsPlugins: [],
+  env: { es2022: true },
+  rules: lintBase
+};
+var REACT_PRESET = {
+  plugins: ["typescript", "react", "jsx-a11y", "jest", "import", "unicorn", "oxc"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    { name: "nx", specifier: "@nx/eslint-plugin" },
+    { name: "import-js", specifier: "eslint-plugin-import" },
+    { name: "@tanstack/query", specifier: "@tanstack/eslint-plugin-query" },
+    { name: "styled-components-a11y", specifier: "eslint-plugin-styled-components-a11y" },
+    { name: "react-refresh", specifier: "eslint-plugin-react-refresh" },
+    // Ships inside sentinel, resolved relative to THIS preset file. Oxlint has no
+    // `no-restricted-syntax`, so the Hublo house rules are a real rule instead.
+    "../plugins/hublo.js"
+  ],
+  env: { browser: true, es2022: true, node: true, jest: true },
+  settings: IMPORT_SETTINGS,
+  rules: reactRules
+};
+var BY_FLAVOUR2 = {
+  nest: NEST_PRESET,
+  react: REACT_PRESET,
+  // `node` ships the base alone, deliberately. It is the honest answer for a module that
+  // belongs to no stack, and it keeps `--init` with no named target working everywhere
+  // rather than blocking a whole workspace sweep on one unshipped flavour. It is thin (21
+  // rules) and will grow when the tooling flavour is measured properly.
+  node: BASE_PRESET
+};
+var LINT_FLAVOURS = Object.keys(BY_FLAVOUR2);
+function hasLintPreset(flavour) {
+  return flavour in BY_FLAVOUR2;
+}
+function lintPresetFor(flavour) {
+  return BY_FLAVOUR2[flavour] ?? BASE_PRESET;
+}
+
+// src/roles/lint/rename-suppressions.ts
+import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join2, relative } from "path";
+var SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".svelte",
+  ".vue"
+];
+var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", ".git", ".nx"]);
+var SUPPRESSION = /(eslint-disable(?:-next-line|-line)?)\s+([^\n*]+?)(?:\s*--.*)?(?:\s*\*\/)?\s*$/;
+function renamedPrefixes(jsPlugins, declared = {}) {
+  const renames = /* @__PURE__ */ new Map();
+  for (const plugin of jsPlugins) {
+    if (typeof plugin === "string") continue;
+    const original = plugin.specifier.replace(/^eslint-plugin-/, "").replace(/\/eslint-plugin$/, "");
+    if (original !== plugin.name) renames.set(`${original}/`, `${plugin.name}/`);
+  }
+  const slash = (value) => value.endsWith("/") ? value : `${value}/`;
+  for (const [from, to] of Object.entries(declared)) renames.set(slash(from), slash(to));
+  return collapseChains(renames);
+}
+function collapseChains(renames) {
+  const collapsed = /* @__PURE__ */ new Map();
+  for (const [from, to] of renames) {
+    let target = to;
+    for (let hop = 0; hop < renames.size; hop += 1) {
+      const next = renames.get(target);
+      if (next === void 0 || next === target) break;
+      target = next;
+    }
+    collapsed.set(from, target);
+  }
+  return collapsed;
+}
+function* sourceFiles(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = join2(dir, entry);
+    let isDirectory;
+    try {
+      isDirectory = statSync(full).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDirectory) {
+      if (!SKIP_DIRECTORIES.has(entry)) yield* sourceFiles(full);
+    } else if (SOURCE_EXTENSIONS.some((extension) => entry.endsWith(extension))) {
+      yield full;
+    }
+  }
+}
+function findSuppressionRenames(cwd, renames) {
+  if (renames.size === 0) return [];
+  const found = [];
+  for (const file of sourceFiles(cwd)) {
+    let content;
+    try {
+      content = readFileSync2(file, "utf8");
+    } catch {
+      continue;
+    }
+    if (!content.includes("eslint-disable")) continue;
+    content.split("\n").forEach((line, index) => {
+      const match = SUPPRESSION.exec(line);
+      const rules = match?.[2];
+      if (!rules) return;
+      const names = rules.split(",").map((entry) => entry.trim());
+      const renamed = [];
+      const hits = [];
+      for (const name of names) {
+        const match2 = [...renames].find(([oldPrefix2]) => name.startsWith(oldPrefix2));
+        if (!match2) {
+          renamed.push(name);
+          continue;
+        }
+        const [oldPrefix, newPrefix] = match2;
+        hits.push(name);
+        renamed.push(newPrefix + name.slice(oldPrefix.length));
+      }
+      if (hits.length === 0) return;
+      found.push({
+        file: relative(cwd, file),
+        line: index + 1,
+        from: line,
+        to: line.replace(rules, renamed.join(", ")),
+        rule: hits.join(", ")
+      });
+    });
+  }
+  return found;
+}
+
+// src/core/config/read-adoption.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+// src/core/config/owned-keys.ts
+function presetOwnedKeys(config, permitted) {
+  if (!config) return [];
+  return Object.keys(config).filter((key) => !permitted.includes(key));
+}
+
+// src/core/config/resolve-config-target.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+function readExtends(absolutePath) {
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync3(absolutePath, "utf8"), absolutePath);
+  } catch {
+    return [];
+  }
+  if (typeof parsed.extends === "string") return [parsed.extends];
+  if (Array.isArray(parsed.extends)) {
+    return parsed.extends.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
+  let existing;
+  for (const candidate of candidates) {
+    const absolutePath = join3(moduleDir, candidate);
+    if (!existsSync2(absolutePath)) continue;
+    existing ??= candidate;
+    const extendsBase = readExtends(absolutePath).some(
+      (value) => markers.some((marker) => value.includes(marker))
+    );
+    if (extendsBase) return { path: candidate, reason: "extends-base" };
+  }
+  if (existing) return { path: existing, reason: "other-chain" };
+  return { path: fallback, reason: "none" };
+}
+
+// src/core/config/read-adoption.ts
+function normaliseExtends(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+var NOT_ADOPTED = (configFile) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: []
+});
+function readAdoption(cwd, options) {
+  const target = resolveConfigTarget(cwd, options);
+  if (target.reason === "none" || !existsSync3(join4(cwd, target.path))) {
+    return NOT_ADOPTED(target.reason === "none" ? null : target.path);
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync4(join4(cwd, target.path), "utf8"), target.path);
+  } catch {
+    return NOT_ADOPTED(target.path);
+  }
+  const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
+  if (preset === null) return NOT_ADOPTED(target.path);
+  const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
+  const drift = presetOwnedKeys(settings, options.permitted);
+  return { configFile: target.path, preset, adopted: true, conformant: drift.length === 0, drift };
+}
+
+// src/roles/lint/read-adoption.ts
+function readLintAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: [LINT_CONFIG_FILE],
+    markers: ["@hublo/sentinel/oxlint/"],
+    fallback: LINT_CONFIG_FILE,
+    presetPattern: SENTINEL_LINT_PRESET,
+    // Drift for lint is any TOP-LEVEL key beyond `extends`, so the settings the shared
+    // reader inspects are the config's own root rather than a nested options object.
+    settingsKey: null,
+    permitted: PERMITTED_LOCAL_KEYS
+  });
+}
+
+// src/roles/lint/resolve-oxlint.ts
+import { createRequire } from "module";
+import { existsSync as existsSync5 } from "fs";
+import { delimiter, dirname as dirname3, join as join6 } from "path";
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname2, join as join5 } from "path";
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join5(dir, "node_modules", ".bin", name);
+    if (existsSync4(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+
+// src/roles/lint/resolve-oxlint.ts
+var PACKAGE_OF = {
+  oxlint: "oxlint",
+  tsgolint: "oxlint-tsgolint"
+};
+var require2 = createRequire(import.meta.url);
+function fromOwnInstall(name) {
+  try {
+    const packageName = PACKAGE_OF[name];
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative2 = typeof bin === "string" ? bin : bin?.[name];
+    if (!relative2) return void 0;
+    const executable = join6(dirname3(manifest), relative2);
+    return existsSync5(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveOxlint(cwd, name = "oxlint") {
+  return resolveBin(cwd, name) ?? fromOwnInstall(name);
+}
+function canRunTypeAware(cwd) {
+  return tsgolintShim(cwd) !== void 0;
+}
+function oxlintPath(cwd, env) {
+  const shim = tsgolintShim(cwd);
+  if (!shim) return env.PATH;
+  return [dirname3(shim), env.PATH].filter(Boolean).join(delimiter);
+}
+function tsgolintShim(cwd) {
+  const fromModule = resolveBin(cwd, "tsgolint");
+  if (fromModule) return fromModule;
+  try {
+    const manifest = require2.resolve("oxlint-tsgolint/package.json");
+    const packageDir = dirname3(manifest);
+    const candidates = [
+      join6(packageDir, "node_modules", ".bin", "tsgolint"),
+      join6(packageDir, "..", ".bin", "tsgolint")
+    ];
+    return candidates.find((candidate) => existsSync5(candidate));
+  } catch {
+    return void 0;
+  }
+}
+function oxlintSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+var MAX_FIX_PASSES = 3;
+function summariseByPlugin(rules) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const name of deferredRuleNames(rules)) {
+    const plugin = name.includes("/") ? name.split("/")[0] ?? name : "core";
+    counts.set(plugin, (counts.get(plugin) ?? 0) + 1);
+  }
+  return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
+}
+var OxlintAdapter = class extends BaseAdapter {
+  target = "lint";
+  runner = "oxlint";
+  /**
+   * Handles every flavour, deliberately. Adapter selection happens BEFORE the engine can
+   * ask `declaredFlavour`, so filtering here would make an adopted module unreachable:
+   * detection answers `node` for a hoisted-deps monorepo, no adapter would match, and the
+   * module would report `unsupported` while its committed config says otherwise. Whether a
+   * flavour actually ships a preset is gated inside `plan`, where it can say so clearly.
+   */
+  appliesTo(_flavour) {
+    return true;
+  }
+  /**
+   * The flavour this module committed to, read from the config sentinel wrote. Preferred
+   * over detection because a monorepo hoists dependencies: a module declares no `react`,
+   * so detection honestly answers `node` while the committed config says otherwise.
+   */
+  declaredFlavour(cwd) {
+    return flavourFromPreset(readLintAdoption(cwd).preset);
+  }
+  plan(context) {
+    if (!hasLintPreset(context.flavour)) {
+      return {
+        operations: [],
+        blocked: `no lint preset for flavour "${context.flavour}" yet. Nothing was written; this module cannot adopt the lint preset until that flavour ships.`
+      };
+    }
+    const disabled = disabledRulesFor(context.flavour);
+    const own = readOwnPackage();
+    const stub = { extends: [presetPath(context.flavour)] };
+    const operations = [
+      { kind: "write", path: LINT_CONFIG_FILE, contents: JSON.stringify(stub, null, 2) + "\n" },
+      this.packageJsonOperation(context.cwd)
+    ];
+    const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync6(join7(context.cwd, name)));
+    for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
+    if (existsSync6(join7(context.cwd, "project.json"))) {
+      operations.push({
+        kind: "remove-json-keys",
+        path: "project.json",
+        keys: [["targets", "lint"]]
+      });
+      operations.push({
+        kind: "merge-json",
+        path: "project.json",
+        value: { targets: { lint: lintTarget() } }
+      });
+    }
+    const renames = findSuppressionRenames(
+      context.cwd,
+      renamedPrefixes(
+        lintPresetFor(context.flavour).jsPlugins,
+        lintPresetFor(context.flavour).renames
+      )
+    );
+    const deleting = new Set(eslintConfigs);
+    const rewritten = renames.filter((entry) => !deleting.has(entry.file));
+    const byFile = /* @__PURE__ */ new Map();
+    for (const entry of rewritten) {
+      const list = byFile.get(entry.file) ?? [];
+      list.push({ from: entry.from, to: entry.to });
+      byFile.set(entry.file, list);
+    }
+    for (const [file, replacements] of byFile) {
+      operations.push({ kind: "replace-lines", path: file, replacements });
+    }
+    const notes = [
+      `wrote ${LINT_CONFIG_FILE} extending ${presetPath(context.flavour)} (${own.name}@${own.version})`
+    ];
+    if (disabled.length > 0) {
+      notes.push(
+        `${disabled.length} rule(s) not enforced by this preset (${summariseByPlugin(disabled)}). Run --inspect --lint for each rule and why.`
+      );
+    }
+    if (eslintConfigs.length > 0) {
+      notes.push(`removed ${eslintConfigs.join(", ")} and pointed the nx lint target at oxlint`);
+    }
+    if (rewritten.length > 0) {
+      notes.push(
+        `renamed ${rewritten.length} suppression comment(s) whose plugin oxlint registers under a different name (${[...new Set(rewritten.map((entry) => entry.rule))].join(", ")}); left alone they would stop suppressing anything, silently`
+      );
+    }
+    notes.push("run `pnpm install`, then `pnpm run lint`");
+    return { operations, notes };
+  }
+  /**
+   * Write the `lint` script and the pinned `@hublo/sentinel` devDependency, creating a
+   * `package.json` when the module has none. Real case: a BFF in the monorepo had no
+   * `package.json` at all, so `pnpm exec` failed outright and there was nowhere to put a
+   * script. `merge-json` preserves everything else and makes a re-run idempotent.
+   */
+  packageJsonOperation(cwd) {
+    const own = readOwnPackage();
+    const value = {
+      scripts: { [LINT_SCRIPT_NAME]: `sentinel --run --lint` },
+      devDependencies: { [own.name]: own.version }
+    };
+    if (existsSync6(join7(cwd, "package.json"))) {
+      return { kind: "merge-json", path: "package.json", value };
+    }
+    return {
+      kind: "merge-json",
+      path: "package.json",
+      value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+    };
+  }
+  /**
+   * Lint the module. Announces the rules that are deliberately not enforced, so the
+   * reduced coverage is never a silent gap, and refuses to report a pass when the linter
+   * or its type-aware sidecar is missing.
+   */
+  async run(ctx) {
+    if (!existsSync6(join7(ctx.cwd, LINT_CONFIG_FILE))) {
+      process.stderr.write(
+        `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const oxlint = resolveOxlint(ctx.cwd);
+    if (!oxlint) {
+      process.stderr.write(
+        `sentinel lint(oxlint): could not find the oxlint binary (looked in ${oxlintSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const missingPreset = this.unresolvedPreset(ctx.cwd);
+    if (missingPreset) {
+      process.stderr.write(
+        `sentinel lint(oxlint): ${LINT_CONFIG_FILE} extends ${missingPreset}, which does not exist. That path assumes pnpm's isolated node_modules layout; if the workspace now uses a hoisted linker, or @hublo/sentinel is not installed in this module, run \`pnpm install\` here.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    this.announceDisabled(ctx.flavour);
+    const typeAware = canRunTypeAware(ctx.cwd);
+    if (!typeAware) {
+      process.stderr.write(
+        `${palette(process.stderr).warn("sentinel lint(oxlint): oxlint-tsgolint is not installed, so type-aware rules will NOT run")}
+`
+      );
+    }
+    const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
+    const lint = (extra) => {
+      const result = spawnSync(oxlint, ["-c", LINT_CONFIG_FILE, ...extra, "."], {
+        cwd: ctx.cwd,
+        stdio: "inherit",
+        env
+      });
+      if (result.error) {
+        process.stderr.write(
+          `sentinel lint(oxlint): could not run oxlint (${result.error.message})
+`
+        );
+        return 1;
+      }
+      return result.status ?? 1;
+    };
+    if (ctx.fix) {
+      for (let pass = 0; pass < MAX_FIX_PASSES; pass += 1) {
+        if (lint(["--fix"]) === 0) break;
+      }
+    }
+    const code = lint(typeAware ? ["--type-aware"] : []);
+    return { ok: code === 0, code };
+  }
+  /** The module's resolved lint configuration, and what it deliberately does not enforce. */
+  async inspect(ctx) {
+    const adoption = readLintAdoption(ctx.cwd);
+    const disabled = disabledRulesFor(ctx.flavour);
+    const rules = this.presetRuleCount(ctx.cwd);
+    return {
+      target: "lint",
+      runner: "oxlint",
+      adopted: adoption.adopted,
+      preset: adoption.preset,
+      configFile: adoption.configFile,
+      rules,
+      typeAware: canRunTypeAware(ctx.cwd),
+      disabled: disabled.map((entry) => ({ rule: entry.rule, reason: entry.reason }))
+    };
+  }
+  /** How many rules the extended preset enforces, read from the preset on disk. */
+  presetRuleCount(cwd) {
+    const target = this.unresolvedPreset(cwd);
+    if (target) return 0;
+    let total = 0;
+    try {
+      const stub = JSON.parse(readFileSync5(join7(cwd, LINT_CONFIG_FILE), "utf8"));
+      for (const entry of stub.extends ?? []) {
+        const preset = JSON.parse(readFileSync5(join7(cwd, entry), "utf8"));
+        total += Object.keys(preset.rules ?? {}).length;
+      }
+    } catch {
+      return 0;
+    }
+    return total;
+  }
+  /** Lint health for `--report`. Deepened in a later step; today it is the run outcome. */
+  async report(ctx) {
+    const result = await this.run(ctx);
+    return { ...result, metrics: { adopted: readLintAdoption(ctx.cwd).adopted } };
+  }
+  /** Adoption + conformity, read from the committed config with no tool run. */
+  async status(ctx) {
+    const adoption = readLintAdoption(ctx.cwd);
+    return {
+      adopted: adoption.adopted,
+      preset: adoption.preset,
+      conformant: adoption.conformant,
+      drift: adoption.drift
+    };
+  }
+  /**
+   * The `extends` target this module points at, when it cannot be found on disk. Returns
+   * undefined when everything resolves. Read from the committed config rather than
+   * recomputed, so it checks what the module actually says.
+   */
+  unresolvedPreset(cwd) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync5(join7(cwd, LINT_CONFIG_FILE), "utf8"));
+    } catch {
+      return void 0;
+    }
+    const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
+    return targets.find((target) => !existsSync6(join7(cwd, target)));
+  }
+  /** Announce what is not enforced, so reduced coverage is never silent. */
+  announceDisabled(flavour) {
+    const disabled = disabledRulesFor(flavour);
+    if (disabled.length === 0) return;
+    process.stderr.write(
+      `${palette(process.stderr).warn(
+        `sentinel lint(oxlint): ${disabled.length} rule(s) not enforced by default (${summariseByPlugin(disabled)}); run --inspect --lint for each rule and why`
+      )}
+`
+    );
+  }
+};
+
+// src/roles/lint/register.ts
+function registerLint() {
+  register(new OxlintAdapter());
+  setDefaultRunner("lint", "oxlint");
+}
+
+// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { basename as basename2, join as join8 } from "path";
+
+// src/roles/typescript/config-policy.ts
+var PERMITTED_COMPILER_OPTIONS = [
+  "paths",
+  "baseUrl",
+  "rootDir",
+  "outDir",
+  "tsBuildInfoFile"
+];
+function presetOwnedKeys2(compilerOptions) {
+  return presetOwnedKeys(compilerOptions, PERMITTED_COMPILER_OPTIONS);
+}
+
+// src/roles/typescript/phased-rules.ts
+var DEFERRED_RULES = [
+  { rule: "noImplicitAny", phase: 2, reason: "the implicit-any migration (TS70xx)" },
+  { rule: "noUnusedLocals", phase: 2, reason: "unused-local cleanup (TS6133)" },
+  { rule: "noUnusedParameters", phase: 2, reason: "unused-parameter cleanup (TS6133)" }
+];
+function deferredRuleNames2() {
+  return deferredRuleNames(DEFERRED_RULES);
+}
+
+// src/roles/typescript/presets.ts
+var SHIPPED_FLAVOURS = ["react", "nest", "node"];
+function hasShippedPreset(flavour) {
+  return SHIPPED_FLAVOURS.includes(flavour);
+}
+
+// src/roles/typescript/resolve-tsconfig-target.ts
+var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
+var TSCONFIG_MARKERS = ["tsconfig.base.json", "@hublo/sentinel/tsconfig/"];
+var TSCONFIG_FALLBACK = "tsconfig.json";
+function resolveTsconfigTarget(moduleDir) {
+  return resolveConfigTarget(moduleDir, {
+    candidates: TSCONFIG_CANDIDATES,
+    markers: TSCONFIG_MARKERS,
+    fallback: TSCONFIG_FALLBACK
+  });
+}
+
+// src/roles/typescript/read-adoption.ts
+var SENTINEL_PRESET = /^@hublo\/sentinel\/tsconfig\/[a-z-]+$/;
+function readTsconfigAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: TSCONFIG_CANDIDATES,
+    markers: TSCONFIG_MARKERS,
+    fallback: TSCONFIG_FALLBACK,
+    presetPattern: SENTINEL_PRESET,
+    settingsKey: "compilerOptions",
+    permitted: PERMITTED_COMPILER_OPTIONS
+  });
+}
+
+// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+var TYPECHECK_SCRIPT = { typecheck: "sentinel --run --typescript" };
+var INSTALL_NOTE = "run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+var DIAGNOSTIC_RE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.+)$/;
+function parseDiagnostics(output) {
+  const diagnostics = [];
+  for (const raw of output.split("\n")) {
+    const m = DIAGNOSTIC_RE.exec(raw.trim());
+    if (m) {
+      diagnostics.push({
+        file: m[1],
+        line: Number(m[2]),
+        col: Number(m[3]),
+        code: m[4],
+        message: m[5]
+      });
+    }
+  }
+  return diagnostics;
+}
+var PHASED_STRICTNESS_WARNING = `sentinel typescript: phase 1 (non-breaking) \u2014 deferred: ${deferredRuleNames2().join(", ")}. Enabled centrally in a later wave; run \`sentinel --inspect --typescript\` for the list.`;
+function composeExtends(current, preset) {
+  const chain = typeof current === "string" ? [current] : Array.isArray(current) ? current.filter((entry) => typeof entry === "string") : [];
+  return chain.includes(preset) ? chain : [...chain, preset];
+}
+var TscAdapter = class extends BaseAdapter {
+  target = "typescript";
+  runner = "tsc";
+  /**
+   * The tsc adapter drives type-checking for any flavour: `--run`/`--report`/
+   * `--inspect` just execute tsc against the module's existing config, which is
+   * meaningful regardless of flavour. `--init` is the exception, it only WRITES a
+   * preset for flavours that ship one (gated inside `plan`), so svelte is not
+   * clobbered with a non-existent preset.
+   */
+  appliesTo(_flavour) {
+    return true;
+  }
+  /**
+   * The flavour read from the committed `extends` chain
+   * (`@hublo/sentinel/tsconfig/nest` -> `nest`), or undefined when the module has not
+   * adopted a preset, so the engine falls back to dependency detection.
+   *
+   * This is the same detection-free read `--status` uses, and it is why an adopted React app
+   * reports `react` even in a monorepo that hoists `react` to the root.
+   */
+  declaredFlavour(cwd) {
+    const { preset } = readTsconfigAdoption(cwd);
+    if (!preset) return void 0;
+    const name = preset.slice(preset.lastIndexOf("/") + 1);
+    return FLAVOURS.includes(name) ? name : void 0;
+  }
+  /**
+   * Plan `--init`: make the module extend the sentinel preset with a THIN,
+   * conformant stub, route type-checking through the CLI, and pin the
+   * `@hublo/sentinel` devDependency into the module. The engine applies the ops, so
+   * adoption is `--init` then `pnpm install`, with nothing to add by hand.
+   *
+   * Per resolved case:
+   *   - extends-base: append the preset to the `extends` chain (keep the base for
+   *     the monorepo's paths/structure) + strip preset-owned `compilerOptions`
+   *     (drift), keeping the project's own paths/include (the allowlist).
+   *   - none: create a fresh thin `tsconfig.json`.
+   *   - other-chain (svelte): skip, its config extends a different base.
+   */
+  plan(context) {
+    if (!hasShippedPreset(context.flavour)) {
+      return {
+        operations: [],
+        blocked: `no TypeScript preset for flavour "${context.flavour}" yet (shipped: ${SHIPPED_FLAVOURS.join(", ")}). Nothing was written; this module cannot adopt the TypeScript preset until that flavour ships.`
+      };
+    }
+    const target = resolveTsconfigTarget(context.cwd);
+    const preset = `@hublo/sentinel/tsconfig/${context.flavour}`;
+    const addScript = this.packageJsonOperation(context.cwd);
+    if (target.reason === "other-chain") {
+      return {
+        operations: [],
+        blocked: `${target.path} extends a config chain sentinel does not handle, so nothing was written. Point it at the workspace base (or a plain config) and re-run.`
+      };
+    }
+    if (target.reason === "none") {
+      const contents = JSON.stringify({ extends: preset, include: ["src"] }, null, 2) + "\n";
+      return {
+        operations: [{ kind: "write", path: target.path, contents }, addScript],
+        notes: [`created ${target.path} (no tsconfig found)`, INSTALL_NOTE]
+      };
+    }
+    const existing = parseJsonc(
+      readFileSync6(join8(context.cwd, target.path), "utf8"),
+      target.path
+    );
+    const extendsChain = composeExtends(existing.extends, preset);
+    const drift = presetOwnedKeys2(existing.compilerOptions);
+    const operations = [
+      { kind: "merge-json", path: target.path, value: { extends: extendsChain } }
+    ];
+    const notes = [];
+    if (drift.length > 0) {
+      const localKeys = Object.keys(existing.compilerOptions ?? {});
+      const stripsAll = localKeys.length > 0 && localKeys.every((key) => drift.includes(key));
+      operations.push({
+        kind: "remove-json-keys",
+        path: target.path,
+        keys: stripsAll ? [["compilerOptions"]] : drift.map((key) => ["compilerOptions", key])
+      });
+      notes.push(`stripped preset-owned compilerOptions: ${drift.join(", ")}`);
+    }
+    operations.push(addScript);
+    notes.push(INSTALL_NOTE);
+    return { operations, notes };
+  }
+  /**
+   * The op that routes type-checking through the CLI. If the module already has a
+   * `package.json`, merge the script in and leave the rest untouched. If it does
+   * NOT (common for nx apps/services that carry only a `project.json`), scaffold a
+   * minimal, workspace-valid one, its nx name + `private: true`, so pnpm accepts it
+   * and it can carry the pinned `@hublo/sentinel` devDep this op also writes. The
+   * exact version is written (never a range), so `pnpm install` resolves the same
+   * build the stub's `extends` points at.
+   */
+  packageJsonOperation(cwd) {
+    const own = readOwnPackage();
+    const devDependencies = { [own.name]: own.version };
+    if (existsSync7(join8(cwd, "package.json"))) {
+      return {
+        kind: "merge-json",
+        path: "package.json",
+        value: { scripts: TYPECHECK_SCRIPT, devDependencies }
+      };
+    }
+    const name = readNxProjectName(cwd) ?? basename2(cwd);
+    return {
+      kind: "merge-json",
+      path: "package.json",
+      value: { name, private: true, scripts: TYPECHECK_SCRIPT, devDependencies }
+    };
+  }
+  /**
+   * Type-check the module with `tsc -b` (build mode) on its solution config, the
+   * way the monorepo itself does. Build mode walks the config's `references`, so a
+   * references-only solution (Pattern A: app + spec) is actually checked instead of
+   * passing vacuously; it also only caches SUCCESSFUL builds, so errors are always
+   * re-reported. Uses the module's own tsc. Nothing to check is a pass.
+   */
+  async run(ctx) {
+    const config = this.typecheckTarget(ctx.cwd);
+    if (!config) {
+      process.stderr.write("sentinel typescript(tsc): no tsconfig to check\n");
+      return { ok: true, code: 0 };
+    }
+    process.stderr.write(`${palette(process.stderr).warn(PHASED_STRICTNESS_WARNING)}
+`);
+    const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
+    const result = spawnSync2(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? 1;
+    return { ok: code === 0, code };
+  }
+  /**
+   * The config to type-check with `tsc -b`. Prefer the module's root `tsconfig.json`
+   * (the solution the monorepo builds; `tsc -b` follows its `references` to cover
+   * app + spec), else the base-extending file, else null when there is nothing to
+   * check.
+   */
+  typecheckTarget(cwd) {
+    if (existsSync7(join8(cwd, "tsconfig.json"))) return "tsconfig.json";
+    const target = resolveTsconfigTarget(cwd);
+    return target.reason === "none" ? null : target.path;
+  }
+  /**
+   * The module's resolved TypeScript config: which preset, which file, how, and the
+   * phased-strictness state (`deferred` rules that are off in phase 1). This is the
+   * "list what's deferred" query, `sentinel --inspect --typescript`.
+   */
+  async inspect(ctx) {
+    const target = resolveTsconfigTarget(ctx.cwd);
+    const { preset, adopted } = readTsconfigAdoption(ctx.cwd);
+    return {
+      module: ctx.module,
+      target: "typescript",
+      flavour: ctx.flavour,
+      configFile: target.path,
+      configState: target.reason,
+      preset,
+      adopted,
+      phase: 1,
+      deferred: DEFERRED_RULES
+    };
+  }
+  /**
+   * Adoption + conformity from the committed tsconfig, for `--status`. No tsc run and
+   * no flavour guessing: reads the actual `extends` chain, so a workspace-wide scan is
+   * a cheap coverage + drift dashboard (adopted? which preset? drifted?).
+   */
+  async status(ctx) {
+    const { adopted, preset, conformant, drift } = readTsconfigAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift };
+  }
+  /**
+   * Report conformance for the module: `tsc -b` (build mode, so app + spec are
+   * covered) and count total type errors plus the implicit-`any` family (TS70xx:
+   * 7006/7031/7053/… ), the signal that drives the noImplicitAny migration. No
+   * tsconfig is a clean, empty report.
+   */
+  async report(ctx) {
+    const config = this.typecheckTarget(ctx.cwd);
+    if (!config) {
+      return { ok: true, code: 0, metrics: { errors: 0, implicitAny: "deferred", diagnostics: [] } };
+    }
+    const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
+    const result = spawnSync2(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
+`
+      );
+      return { ok: false, code: 1, metrics: { error: "tsc not available" } };
+    }
+    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+    const errors = (output.match(/error TS\d+/g) ?? []).length;
+    const parsed = parseDiagnostics(output);
+    const cap = ctx.maxDiagnostics === 0 ? Infinity : ctx.maxDiagnostics ?? DEFAULT_MAX_DIAGNOSTICS;
+    const diagnostics = Number.isFinite(cap) ? parsed.slice(0, cap) : parsed;
+    return {
+      ok: errors === 0,
+      code: result.status ?? 0,
+      metrics: {
+        errors,
+        implicitAny: this.implicitAnyMetric(ctx.cwd, tsc, config, output),
+        diagnostics,
+        diagnosticsTruncated: diagnostics.length < parsed.length
+      }
+    };
+  }
+  /**
+   * The `implicitAny` report metric, honestly. Implicit-`any` violations (TS70xx) are
+   * only *visible* to tsc when `noImplicitAny` is ON. In phase 1 the rule is DEFERRED
+   * (off), so counting TS70xx from the committed-config run is structurally always 0 —
+   * a misleading "no implicit-any" when the rule simply was not applied. So: report the
+   * real count only when the rule is on, otherwise `'deferred'` (never a fake `0`). The
+   * remaining debt while deferred is a separate, opt-in probe (a later `--migration`).
+   */
+  implicitAnyMetric(cwd, tsc, config, mainOutput) {
+    return this.noImplicitAnyEnabled(cwd, tsc, config, mainOutput) ? (mainOutput.match(/error TS70\d\d/g) ?? []).length : "deferred";
+  }
+  /**
+   * Whether `noImplicitAny` is effectively ON in the module's resolved config. Read from
+   * `tsc --showConfig` (an explicit value wins; otherwise `strict` implies it). If
+   * `--showConfig` is unavailable, fall back to the run's own evidence: implicit-`any`
+   * errors in the output mean the rule must be on.
+   */
+  noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
+    const shown = spawnSync2(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    if (shown.status === 0 && shown.stdout) {
+      try {
+        const co = parseJsonc(
+          shown.stdout,
+          "tsconfig(--showConfig)"
+        ).compilerOptions;
+        if (co) return co.noImplicitAny ?? co.strict === true;
+      } catch {
+      }
+    }
+    return /error TS70\d\d/.test(mainOutput);
+  }
+};
+
+// src/roles/typescript/register.ts
+function registerTypescript() {
+  register(new TscAdapter());
+  setDefaultRunner("typescript", "tsc");
+}
+
+// src/adapters.ts
+function registerAdapters() {
+  registerTypescript();
+  registerLint();
+}
+
+// src/core/detect-framework.ts
+var FRAMEWORK_SIGNALS = [
+  { flavour: "nest", dependency: "@nestjs/core" },
+  { flavour: "react", dependency: "react" },
+  { flavour: "svelte", dependency: "svelte" }
+];
+var BACKEND_HINTS = ["sails", "express", "koa", "fastify", "@hapi/hapi"];
+function describeFramework(packageJson) {
+  const dependencies = { ...packageJson.dependencies, ...packageJson.devDependencies };
+  const matched = FRAMEWORK_SIGNALS.filter((s) => s.dependency in dependencies);
+  const chosen = matched[0];
+  const flavour = chosen?.flavour ?? "node";
+  const source = chosen?.dependency ?? "(no framework dependency)";
+  const otherFlavourSignals = matched.slice(1).map((s) => s.dependency);
+  const backendHints = flavour === "react" || flavour === "svelte" ? BACKEND_HINTS.filter((hint) => hint in dependencies) : [];
+  const conflicts = [...otherFlavourSignals, ...backendHints];
+  return { flavour, source, ambiguous: conflicts.length > 0, conflicts };
+}
+function detectFramework(packageJson) {
+  return describeFramework(packageJson).flavour;
+}
+
+// src/shared/text.ts
+function ensureLines(current, lines) {
+  const present = new Set(current.split("\n").map((line) => line.trim()));
+  const missing = lines.filter((line) => !present.has(line.trim()));
+  if (missing.length === 0) return current;
+  const prefix = current.length === 0 || current.endsWith("\n") ? current : current + "\n";
+  return prefix + missing.join("\n") + "\n";
+}
+function toLines(text) {
+  if (text.length === 0) return [];
+  return text.replace(/\n$/, "").split("\n");
+}
+function diffLines(before, after) {
+  const from = toLines(before);
+  const to = toLines(after);
+  const lcs = Array.from(
+    { length: from.length + 1 },
+    () => new Array(to.length + 1).fill(0)
+  );
+  const cell = (i2, j2) => lcs[i2]?.[j2] ?? 0;
+  for (let i2 = from.length - 1; i2 >= 0; i2--) {
+    const row = lcs[i2];
+    if (!row) continue;
+    for (let j2 = to.length - 1; j2 >= 0; j2--) {
+      row[j2] = from[i2] === to[j2] ? cell(i2 + 1, j2 + 1) + 1 : Math.max(cell(i2 + 1, j2), cell(i2, j2 + 1));
+    }
+  }
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < from.length && j < to.length) {
+    if (from[i] === to[j]) {
+      out.push(`  ${from[i] ?? ""}`);
+      i++;
+      j++;
+    } else if (cell(i + 1, j) >= cell(i, j + 1)) {
+      out.push(`- ${from[i] ?? ""}`);
+      i++;
+    } else {
+      out.push(`+ ${to[j] ?? ""}`);
+      j++;
+    }
+  }
+  while (i < from.length) out.push(`- ${from[i++] ?? ""}`);
+  while (j < to.length) out.push(`+ ${to[j++] ?? ""}`);
+  return out;
+}
+function replaceLines(current, replacements) {
+  if (replacements.length === 0) return current;
+  const byLine = new Map(replacements.map((entry) => [entry.from, entry.to]));
+  return current.split("\n").map((line) => byLine.get(line) ?? line).join("\n");
+}
+
+// src/core/apply-plan.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync } from "fs";
+import { resolve as resolve2, sep } from "path";
+import { applyEdits, modify } from "jsonc-parser";
+
+// src/shared/deep-merge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/apply-plan.ts
+function resolveWithinRoot(cwd, relativePath) {
+  const root = resolve2(cwd);
+  const absolutePath = resolve2(root, relativePath);
+  if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+    throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
+  }
+  return absolutePath;
+}
+function readIfExists(absolutePath) {
+  return existsSync8(absolutePath) ? readFileSync7(absolutePath, "utf8") : void 0;
+}
+function* leaves(value, prefix = []) {
+  for (const [key, keyValue] of Object.entries(value)) {
+    const path = [...prefix, key];
+    if (isPlainObject(keyValue)) yield* leaves(keyValue, path);
+    else yield [path, keyValue];
+  }
+}
+function mergeJsonc(current, value) {
+  let text = current.trim().length > 0 ? current : "{}\n";
+  for (const [path, leaf] of leaves(value)) {
+    const edits = modify(text, path, leaf, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 }
+    });
+    text = applyEdits(text, edits);
+  }
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function removeJsoncKeys(current, keys) {
+  let text = current.trim().length > 0 ? current : "{}\n";
+  for (const path of keys) {
+    const edits = modify(text, path, void 0, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 }
+    });
+    text = applyEdits(text, edits);
+  }
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function applyOperationTo(current, operation) {
+  switch (operation.kind) {
+    case "write":
+      return operation.contents;
+    case "merge-json":
+      return mergeJsonc(current, operation.value);
+    case "ensure-lines":
+      return ensureLines(current, operation.lines);
+    case "remove-json-keys":
+      return removeJsoncKeys(current, operation.keys);
+    case "replace-lines":
+      return replaceLines(current, operation.replacements);
+    case "delete":
+      return "";
+    default: {
+      const unreachable = operation;
+      throw new Error(`Unknown file operation: ${JSON.stringify(unreachable)}`);
+    }
+  }
+}
+function preparePlan(cwd, plan) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const operation of plan.operations) {
+    const absolutePath = resolveWithinRoot(cwd, operation.path);
+    const existing = prepared.get(operation.path);
+    const before = existing?.before ?? readIfExists(absolutePath) ?? "";
+    const current = existing?.after ?? before;
+    prepared.set(operation.path, {
+      path: operation.path,
+      absolutePath,
+      before,
+      after: applyOperationTo(current, operation),
+      // A later operation on the same path un-deletes it: the last word wins, the same
+      // way content operations chain.
+      deleted: operation.kind === "delete"
+    });
+  }
+  return [...prepared.values()];
+}
+function writeFileAtomic(absolutePath, contents) {
+  const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
+  writeFileSync(tempPath, contents);
+  renameSync(tempPath, absolutePath);
+}
+function applyPlan(cwd, plan) {
+  const changed = preparePlan(cwd, plan).filter((file) => file.before !== file.after);
+  for (const file of changed) {
+    if (file.deleted) {
+      rmSync(file.absolutePath, { force: true });
+      continue;
+    }
+    writeFileAtomic(file.absolutePath, file.after);
+  }
+  return changed.map((file) => file.path);
+}
+
+// src/core/dispatch.ts
+function resolveFlavour(opts) {
+  if (opts.flavour) return opts.flavour;
+  const detection = describeFramework(readProjectPackageJson(opts.cwd));
+  if (detection.ambiguous) {
+    const warn = palette(process.stderr);
+    process.stderr.write(
+      warn.warn(
+        `sentinel: flavour is ambiguous, detected "${detection.flavour}" (from ${detection.source}), also found ${detection.conflicts.join(", ")}. Pass --flavour to write the intended preset.`
+      ) + "\n"
+    );
+  }
+  return detection.flavour;
+}
+function previewPlan(opts, plan) {
+  const changed = preparePlan(opts.cwd, plan).filter((file) => file.before !== file.after);
+  if (opts.json) {
+    process.stdout.write(
+      JSON.stringify(
+        {
+          dryRun: true,
+          notes: plan.notes ?? [],
+          files: changed.map(({ path, before, after, deleted }) => ({
+            path,
+            action: deleted ? "delete" : before.length === 0 ? "create" : "update",
+            before,
+            after
+          }))
+        },
+        null,
+        2
+      ) + "\n"
+    );
+    return 0;
+  }
+  process.stderr.write("  dry run: no files written\n");
+  for (const note of plan.notes ?? []) process.stderr.write(`  ${note}
+`);
+  if (changed.length === 0) {
+    process.stderr.write("  nothing to change\n");
+    return 0;
+  }
+  for (const { path, before, after, deleted } of changed) {
+    const action = deleted ? "delete" : before.length === 0 ? "create" : "update";
+    process.stdout.write(`
+  ${action} ${path}
+`);
+    for (const line of diffLines(before, after)) process.stdout.write(`    ${line}
+`);
+  }
+  return 0;
+}
+async function dispatch(opts) {
+  if (opts.verb !== "init") {
+    throw new Error(`dispatch handles --init only; --${opts.verb} routes through analyse()`);
+  }
+  const detected = resolveFlavour(opts);
+  const adapter = resolve(opts.target, detected, opts.runner);
+  const flavour = opts.flavour ?? adapter.declaredFlavour?.(opts.cwd) ?? detected;
+  const context = { cwd: opts.cwd, flavour };
+  const plan = await adapter.plan(context);
+  if (plan.blocked) {
+    process.stderr.write(`sentinel (${opts.target}): ${plan.blocked}
+`);
+    return 1;
+  }
+  if (opts.dryRun) {
+    return previewPlan(opts, plan);
+  }
+  const written = applyPlan(opts.cwd, plan);
+  for (const path of written) process.stderr.write(`  wrote ${path}
+`);
+  for (const note of plan.notes ?? []) process.stderr.write(`  ${note}
+`);
+  return 0;
+}
+
+export {
+  register,
+  setDefaultRunner,
+  all,
+  availableTargets,
+  resolve,
+  BaseAdapter,
+  palette,
+  readOwnPackage,
+  readOwnVersion,
+  readProjectPackageJson,
+  readNxProjectName,
+  resolveBin,
+  VERBS,
+  TARGETS,
+  FLAVOURS,
+  registerAdapters,
+  describeFramework,
+  detectFramework,
+  dispatch
+};
+//# sourceMappingURL=chunk-EZCRU6XE.js.map