@hublo/sentinel 1.1.0-alpha.2 → 1.1.0-alpha.4

package/dist/chunk-FLLX5MN3.js

@@ -0,0 +1,3155 @@
+// src/core/registry.ts
+var adapters = [];
+var defaultRunner = {
+  // Filled in by tool branches, e.g. lint: 'eslint', typescript: 'tsc'.
+};
+function register(adapter) {
+  adapters.push(adapter);
+}
+function setDefaultRunner(target, runner) {
+  defaultRunner[target] = runner;
+}
+function all() {
+  return adapters;
+}
+function availableTargets() {
+  return [...new Set(adapters.map((a) => a.target))];
+}
+function resolve(target, preset, runner) {
+  const forTarget = adapters.filter((a) => a.target === target);
+  if (forTarget.length === 0) {
+    throw new Error(
+      `No adapter registered for target "${target}" yet (it ships in a later ticket).`
+    );
+  }
+  const candidates = preset ? forTarget.filter((a) => a.appliesTo(preset)) : forTarget;
+  if (candidates.length === 0) {
+    throw new Error(`No adapter for target "${target}" handles preset "${preset}".`);
+  }
+  const wanted = runner ?? defaultRunner[target];
+  const available = candidates.map((a) => a.runner).join(", ");
+  if (!wanted) {
+    const [first, ...rest] = candidates;
+    if (first && rest.length === 0) return first;
+    throw new Error(
+      `Multiple runners for target "${target}" (${available}); pass --runner or set a default.`
+    );
+  }
+  const matching = candidates.filter((a) => a.runner === wanted);
+  if (matching.length === 0) {
+    throw new Error(
+      `No runner "${wanted}" for target "${target}" (preset "${preset}"). Available: ${available}.`
+    );
+  }
+  if (matching.length > 1) {
+    throw new Error(
+      `Ambiguous: ${matching.length} adapters claim target "${target}", runner "${wanted}", preset "${preset}".`
+    );
+  }
+  return matching[0];
+}
+
+// src/core/base-adapter.ts
+var BaseAdapter = class {
+  inspect(_ctx) {
+    throw new Error(`${this.runner}: --inspect not implemented yet`);
+  }
+  report(_ctx) {
+    throw new Error(`${this.runner}: --report not implemented yet`);
+  }
+  status(_ctx) {
+    throw new Error(`${this.runner}: --status not implemented yet`);
+  }
+};
+
+// src/shared/color.ts
+import { styleText } from "util";
+function palette(stream) {
+  const paint = (format, text) => styleText(format, text, { stream });
+  return {
+    ok: (text) => paint(["green", "bold"], text),
+    fail: (text) => paint(["red", "bold"], text),
+    warn: (text) => paint("yellow", text),
+    strong: (text) => paint("bold", text),
+    dim: (text) => paint("dim", text),
+    accent: (text) => paint("cyan", text)
+  };
+}
+
+// src/shared/package-json.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function readOwnPackage() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (typeof pkg.version === "string") {
+          return { name: pkg.name ?? "@hublo/sentinel", version: pkg.version };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return { name: "@hublo/sentinel", version: "0.0.0" };
+    dir = parent;
+  }
+}
+function readOwnVersion() {
+  return readOwnPackage().version;
+}
+function readProjectPackageJson(dir) {
+  const path = join(dir, "package.json");
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.
+`);
+    return {};
+  }
+}
+function readNxProjectName(dir) {
+  const path = join(dir, "project.json");
+  if (!existsSync(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/core/domain.ts
+var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
+var TARGETS = [
+  "lint",
+  "format",
+  "typescript",
+  "build",
+  "test",
+  "static-analysis",
+  "runtime-analysis",
+  "arch"
+];
+var PRESET_NAMES = ["react", "nest", "svelte", "node"];
+
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { basename, join as join8 } from "path";
+import { spawnSync } from "child_process";
+
+// src/core/config/deferred-rules.ts
+function deferredRuleNames(rules) {
+  return rules.map((entry) => entry.rule);
+}
+
+// src/roles/lint/config-policy.ts
+var LINT_CONFIG_FILE = ".oxlintrc.json";
+var LINT_SCRIPT_NAME = "lint";
+var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
+function presetPath(preset) {
+  return `${PRESET_DIR}/${preset}.json`;
+}
+var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/oxlint\/([a-z-]+)\.json$/;
+function presetNameFromPath(preset) {
+  return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
+}
+var PERMITTED_LOCAL_KEYS = ["extends"];
+var ESLINT_CONFIG_FILES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts"
+];
+function lintTarget() {
+  return {
+    executor: "nx:run-commands",
+    cache: true,
+    // The config is an input so a preset bump invalidates the cache. Without it, nx would
+    // replay a stale result after the rules changed underneath it.
+    inputs: ["default", `{projectRoot}/${LINT_CONFIG_FILE}`],
+    options: { cwd: "{projectRoot}", command: `pnpm run ${LINT_SCRIPT_NAME}` }
+  };
+}
+
+// src/roles/lint/presets/base.json
+var base_default = {
+  rules: {
+    "no-var": "error",
+    "prefer-const": [
+      "error",
+      {
+        destructuring: "any",
+        ignoreReadBeforeAssign: false
+      }
+    ],
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-constructor": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": [
+      "error",
+      {
+        allowShortCircuit: false,
+        allowTaggedTemplates: false,
+        allowTernary: false
+      }
+    ],
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/triple-slash-reference": "error"
+  }
+};
+
+// src/roles/lint/presets/nest.json
+var nest_default = {
+  plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    {
+      name: "nx",
+      specifier: "@nx/eslint-plugin"
+    },
+    {
+      name: "import-js",
+      specifier: "eslint-plugin-import"
+    }
+  ],
+  settings: {
+    "import/extensions": [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],
+    "import/external-module-folders": ["node_modules", "node_modules/@types"],
+    "import/parsers": {
+      "@typescript-eslint/parser": [".ts", ".cts", ".mts", ".tsx"]
+    },
+    "import/resolver": {
+      node: {
+        extensions: [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]
+      }
+    }
+  },
+  rules: {
+    "array-callback-return": [
+      "error",
+      {
+        allowImplicit: false,
+        checkForEach: false,
+        allowVoid: false
+      }
+    ],
+    complexity: ["error", 30],
+    curly: ["error", "all"],
+    "dot-notation": [
+      "error",
+      {
+        allowKeywords: true,
+        allowPattern: ""
+      }
+    ],
+    eqeqeq: "error",
+    "for-direction": "error",
+    "func-style": [
+      "error",
+      "expression",
+      {
+        allowArrowFunctions: false,
+        allowTypeAnnotation: false,
+        overrides: {}
+      }
+    ],
+    "import-js/no-duplicates": [
+      "error",
+      {
+        considerQueryString: true,
+        "prefer-inline": true
+      }
+    ],
+    "import-js/order": {
+      severity: "warn",
+      reason: "was error in the module config, but the lint target only ever checked 2 files of 2888, so the 23 violations were never reported; held at warn so adoption does not turn a green module red, and restored once they are fixed",
+      options: [
+        {
+          "newlines-between": "always",
+          groups: ["builtin", "external", "internal", ["parent", "index"], "sibling"],
+          alphabetize: {
+            order: "asc",
+            caseInsensitive: false,
+            orderImportKind: "ignore"
+          },
+          pathGroups: [
+            {
+              pattern: "@nestjs/**",
+              group: "external"
+            },
+            {
+              pattern: "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+              group: "internal",
+              position: "before"
+            }
+          ],
+          pathGroupsExcludedImportTypes: ["builtin"],
+          distinctGroup: true,
+          sortTypesGroup: false,
+          named: false,
+          warnOnUnassignedImports: false
+        }
+      ]
+    },
+    "jest/expect-expect": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
+    },
+    "jest/no-alias-methods": "error",
+    "jest/no-commented-out-tests": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
+    },
+    "jest/no-deprecated-functions": "error",
+    "jest/no-disabled-tests": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); a skipped test is a deliberate act often paired with a ticket, so it reports rather than blocks"
+    },
+    "jest/no-done-callback": "error",
+    "jest/no-export": "error",
+    "jest/no-focused-tests": "error",
+    "jest/no-identical-title": "error",
+    "jest/no-interpolation-in-snapshots": "error",
+    "jest/no-jasmine-globals": "error",
+    "jest/no-mocks-import": "error",
+    "jest/no-standalone-expect": "error",
+    "jest/no-test-prefixes": "error",
+    "jest/prefer-to-be": "error",
+    "jest/prefer-to-contain": "error",
+    "jest/prefer-to-have-length": "error",
+    "jest/valid-describe-callback": "error",
+    "jest/valid-expect": "error",
+    "jest/valid-expect-in-promise": "error",
+    "jest/valid-title": "error",
+    "no-async-promise-executor": "error",
+    "no-barrel-files/no-barrel-files": {
+      severity: "off",
+      reason: "nest modules use barrel index.ts files as a deliberate structural pattern; the rule fired 127 times and every one was the architecture working as intended"
+    },
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-console": [
+      "error",
+      {
+        allow: ["warn", "error"]
+      }
+    ],
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": {
+      severity: "off",
+      reason: "the single occurrence is a regex whose whole purpose is stripping ASCII control characters before XML output, which the rule cannot distinguish from an accident"
+    },
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-else-return": [
+      "error",
+      {
+        allowElseIf: true
+      }
+    ],
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-implicit-coercion": [
+      "error",
+      {
+        allow: [],
+        boolean: true,
+        disallowTemplateShorthand: false,
+        number: true,
+        string: true
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-lonely-if": "error",
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        paths: [
+          {
+            name: "@front/theme",
+            importNames: [
+              "hubloTheme",
+              "legacyHubloTheme",
+              "customCommonColors",
+              "customPalette",
+              "breakpointsOptions",
+              "breakpointsValues",
+              "spacingConstants"
+            ],
+            message: "Use the MUI theme context or the public providers exposed by @front/theme."
+          }
+        ],
+        patterns: [
+          {
+            group: ["@front/theme/*", "!@front/theme/testing"],
+            message: "Deep imports from @front/theme are forbidden outside the theme lib."
+          }
+        ]
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unneeded-ternary": [
+      "error",
+      {
+        defaultAssignment: true
+      }
+    ],
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": [
+      "error",
+      {
+        disallowArithmeticOperators: false
+      }
+    ],
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "no-useless-return": "error",
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        enforceBuildableLibDependency: true,
+        allow: [],
+        depConstraints: [
+          {
+            sourceTag: "*",
+            onlyDependOnLibsWithTags: ["*"]
+          }
+        ]
+      }
+    ],
+    "prefer-arrow-callback": [
+      "error",
+      {
+        allowNamedFunctions: false,
+        allowUnboundThis: true
+      }
+    ],
+    "require-yield": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-confusing-non-null-assertion": "error",
+    "typescript/no-empty-function": [
+      "error",
+      {
+        allow: []
+      }
+    ],
+    "typescript/no-explicit-any": "error",
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        ignoreVoid: true
+      }
+    ],
+    "typescript/no-import-type-side-effects": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-non-null-assertion": "error",
+    "typescript/no-unused-vars": [
+      "error",
+      {
+        argsIgnorePattern: "^_",
+        caughtErrors: "none"
+      }
+    ],
+    "typescript/return-await": {
+      severity: "warn",
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
+      options: ["never"]
+    },
+    "typescript/switch-exhaustiveness-check": [
+      "error",
+      {
+        considerDefaultExhaustiveForUnions: true
+      }
+    ],
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ]
+  },
+  uncovered: {
+    "array-bracket-newline": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "array-bracket-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "block-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "computed-property-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "dot-location": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "eol-last": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "func-call-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "key-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "keyword-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "lines-between-class-members": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
+    "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "no-octal": "no oxlint equivalent",
+    "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "typescript/member-ordering": "oxlint has no native rule for it, and the preset deliberately does NOT host @typescript-eslint/eslint-plugin: hosting a whole plugin for one rule costs a dependency, a load step and a pass over every file. Accepted as a loss rather than paid for, the same call as no-octal."
+  }
+};
+
+// src/roles/lint/presets/node.json
+var node_default = {
+  plugins: ["typescript", "oxc"],
+  jsPlugins: [],
+  settings: null,
+  rules: {}
+};
+
+// src/roles/lint/presets/react.json
+var react_default = {
+  plugins: ["typescript", "react", "jsx-a11y", "jest", "import", "unicorn", "oxc"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    {
+      name: "nx",
+      specifier: "@nx/eslint-plugin"
+    },
+    {
+      name: "import-js",
+      specifier: "eslint-plugin-import"
+    },
+    {
+      name: "@tanstack/query",
+      specifier: "@tanstack/eslint-plugin-query"
+    },
+    {
+      name: "styled-components-a11y",
+      specifier: "eslint-plugin-styled-components-a11y"
+    },
+    {
+      name: "react-refresh",
+      specifier: "eslint-plugin-react-refresh"
+    },
+    "../plugins/hublo.js"
+  ],
+  settings: {
+    "import/extensions": [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],
+    "import/external-module-folders": ["node_modules", "node_modules/@types"],
+    "import/parsers": {
+      "@typescript-eslint/parser": [".ts", ".cts", ".mts", ".tsx"]
+    },
+    "import/resolver": {
+      node: {
+        extensions: [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]
+      }
+    }
+  },
+  rules: {
+    "@tanstack/query/exhaustive-deps": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/infinite-query-property-order": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/mutation-property-order": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/no-rest-destructuring": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/no-unstable-deps": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/no-void-query-fn": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    "@tanstack/query/stable-query-client": {
+      severity: "off",
+      reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+    },
+    curly: ["error", "all"],
+    "for-direction": "error",
+    "hublo/no-palette-common": {
+      severity: "off",
+      reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
+    },
+    "import-js/order": [
+      "error",
+      {
+        "newlines-between": "always",
+        groups: ["builtin", "external", "internal", ["parent", "index"], "sibling"],
+        alphabetize: {
+          order: "asc"
+        },
+        pathGroups: [
+          {
+            pattern: "@nestjs/**",
+            group: "external"
+          },
+          {
+            pattern: "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+            group: "internal",
+            position: "before"
+          }
+        ],
+        pathGroupsExcludedImportTypes: ["builtin"]
+      }
+    ],
+    "jest/expect-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-alias-methods": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-commented-out-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-conditional-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-deprecated-functions": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-disabled-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-done-callback": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-export": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-focused-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-identical-title": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-interpolation-in-snapshots": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-jasmine-globals": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-mocks-import": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-standalone-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-test-prefixes": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-be": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-contain": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-have-length": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-describe-callback": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-expect-in-promise": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-title": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jsx-a11y/alt-text": "error",
+    "jsx-a11y/anchor-has-content": "error",
+    "jsx-a11y/anchor-is-valid": "error",
+    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+    "jsx-a11y/aria-props": "error",
+    "jsx-a11y/aria-proptypes": "error",
+    "jsx-a11y/aria-role": "error",
+    "jsx-a11y/aria-unsupported-elements": "error",
+    "jsx-a11y/autocomplete-valid": "error",
+    "jsx-a11y/click-events-have-key-events": "error",
+    "jsx-a11y/heading-has-content": "error",
+    "jsx-a11y/html-has-lang": "error",
+    "jsx-a11y/iframe-has-title": "error",
+    "jsx-a11y/img-redundant-alt": {
+      severity: "off",
+      reason: 'one real finding, a decorative image whose title is already rendered as a heading beside it, so the fix is alt="". A genuine accessibility issue rather than a false positive: parked only so swapping linters stays a lateral move, and worth switching back on as soon as it is fixed'
+    },
+    "jsx-a11y/interactive-supports-focus": [
+      "error",
+      {
+        tabbable: [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "jsx-a11y/label-has-associated-control": "error",
+    "jsx-a11y/media-has-caption": "error",
+    "jsx-a11y/mouse-events-have-key-events": "error",
+    "jsx-a11y/no-access-key": "error",
+    "jsx-a11y/no-autofocus": "error",
+    "jsx-a11y/no-distracting-elements": "error",
+    "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "jsx-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        body: ["onError", "onLoad"],
+        iframe: ["onError", "onLoad"],
+        img: ["onError", "onLoad"]
+      }
+    ],
+    "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "jsx-a11y/no-noninteractive-tabindex": "error",
+    "jsx-a11y/no-redundant-roles": "error",
+    "jsx-a11y/no-static-element-interactions": "error",
+    "jsx-a11y/role-has-required-aria-props": "error",
+    "jsx-a11y/role-supports-aria-props": "error",
+    "jsx-a11y/scope": "error",
+    "jsx-a11y/tabindex-no-positive": "error",
+    "no-async-promise-executor": "error",
+    "no-barrel-files/no-barrel-files": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); nest disables it outright as deliberate architecture, react keeps it visible"
+    },
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-console": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        patterns: [
+          {
+            group: ["next/*"],
+            message: "Importing from next/* is not allowed in the admin project."
+          },
+          {
+            group: ["storybook/*"],
+            message: "Importing from storybook/* is not allowed in the admin project."
+          },
+          {
+            group: ["@nestjs/*"],
+            message: "Importing from @nestjs/* is not allowed in the admin project."
+          },
+          {
+            group: ["next-i18next"],
+            message: "Importing from next-i18next is not allowed in the admin project."
+          },
+          {
+            group: ["@hublo/style/colors", "@hublo/style/colors/*"],
+            message: "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
+          }
+        ]
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unexpected-multiline": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        enforceBuildableLibDependency: true,
+        allow: [],
+        depConstraints: [
+          {
+            sourceTag: "*",
+            onlyDependOnLibsWithTags: ["*"]
+          }
+        ]
+      }
+    ],
+    "react-hooks/exhaustive-deps": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); its suggested fix can change behaviour, so it reports and a human decides"
+    },
+    "react-hooks/rules-of-hooks": "error",
+    "react-refresh/only-export-components": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); it guards fast-refresh ergonomics, not correctness",
+      options: [
+        {
+          allowConstantExport: true
+        }
+      ]
+    },
+    "react/jsx-curly-brace-presence": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "require-yield": "error",
+    "styled-components-a11y/alt-text": "error",
+    "styled-components-a11y/anchor-has-content": "error",
+    "styled-components-a11y/anchor-is-valid": "error",
+    "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
+    "styled-components-a11y/aria-props": "error",
+    "styled-components-a11y/aria-proptypes": "error",
+    "styled-components-a11y/aria-role": "error",
+    "styled-components-a11y/aria-unsupported-elements": "error",
+    "styled-components-a11y/autocomplete-valid": "error",
+    "styled-components-a11y/click-events-have-key-events": "error",
+    "styled-components-a11y/control-has-associated-label": {
+      severity: "off",
+      reason: "off in the host-admin proof-of-concept config, with its element and role ignore lists; it fires on composed styled components where the label lives in a wrapper the rule cannot see",
+      options: [
+        {
+          ignoreElements: ["audio", "canvas", "embed", "input", "textarea", "tr", "video"],
+          ignoreRoles: [
+            "grid",
+            "listbox",
+            "menu",
+            "menubar",
+            "radiogroup",
+            "row",
+            "tablist",
+            "toolbar",
+            "tree",
+            "treegrid"
+          ],
+          includeRoles: ["alert", "dialog"]
+        }
+      ]
+    },
+    "styled-components-a11y/heading-has-content": "error",
+    "styled-components-a11y/html-has-lang": "error",
+    "styled-components-a11y/iframe-has-title": "error",
+    "styled-components-a11y/img-redundant-alt": "error",
+    "styled-components-a11y/interactive-supports-focus": [
+      "error",
+      {
+        tabbable: [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "styled-components-a11y/label-has-associated-control": "error",
+    "styled-components-a11y/label-has-for": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "styled-components-a11y/media-has-caption": "error",
+    "styled-components-a11y/mouse-events-have-key-events": "error",
+    "styled-components-a11y/no-access-key": "error",
+    "styled-components-a11y/no-autofocus": "error",
+    "styled-components-a11y/no-distracting-elements": "error",
+    "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "styled-components-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        body: ["onError", "onLoad"],
+        iframe: ["onError", "onLoad"],
+        img: ["onError", "onLoad"]
+      }
+    ],
+    "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "styled-components-a11y/no-noninteractive-tabindex": "error",
+    "styled-components-a11y/no-redundant-roles": "error",
+    "styled-components-a11y/no-static-element-interactions": "error",
+    "styled-components-a11y/role-has-required-aria-props": "error",
+    "styled-components-a11y/role-supports-aria-props": "error",
+    "styled-components-a11y/scope": "error",
+    "styled-components-a11y/tabindex-no-positive": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-array-delete": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-duplicate-type-constituents": "error",
+    "typescript/no-empty-function": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-explicit-any": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        ignoreVoid: true
+      }
+    ],
+    "typescript/no-for-in-array": "error",
+    "typescript/no-implied-eval": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-misused-promises": [
+      "error",
+      {
+        checksVoidReturn: {
+          attributes: false
+        }
+      }
+    ],
+    "typescript/no-non-null-assertion": {
+      severity: "warn",
+      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
+    },
+    "typescript/no-redundant-type-constituents": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-unnecessary-type-assertion": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-argument": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-assignment": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-call": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-enum-comparison": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-member-access": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-return": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-unary-minus": "error",
+    "typescript/no-unused-vars": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/only-throw-error": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/prefer-promise-reject-errors": "error",
+    "typescript/require-await": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/restrict-plus-operands": "error",
+    "typescript/restrict-template-expressions": "error",
+    "typescript/return-await": {
+      severity: "warn",
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
+      options: ["never"]
+    },
+    "typescript/switch-exhaustiveness-check": {
+      severity: "warn",
+      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
+    },
+    "typescript/unbound-method": "error",
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ]
+  },
+  uncovered: {
+    "no-octal": "no oxlint equivalent",
+    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
+  }
+};
+
+// src/roles/lint/presets/svelte.json
+var svelte_default = {
+  plugins: ["typescript", "oxc"],
+  jsPlugins: [],
+  settings: null,
+  rules: {
+    "constructor-super": "error",
+    "for-direction": "error",
+    "getter-return": [
+      "error",
+      {
+        allowImplicit: false
+      }
+    ],
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-class-assign": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-const-assign": "error",
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-class-members": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-func-assign": "error",
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-import-assign": "error",
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-new-native-nonconstructor": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-obj-calls": "error",
+    "no-prototype-builtins": "error",
+    "no-redeclare": [
+      "error",
+      {
+        builtinGlobals: true
+      }
+    ],
+    "no-regex-spaces": "error",
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-setter-return": "error",
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-this-before-super": "error",
+    "no-undef": {
+      severity: "off",
+      reason: "unusable under oxlint for Svelte, and not for want of configuration. Svelte 5's runes ($state, $props, $derived, $effect) are compiler globals, and `$store` auto-subscription invents an identifier per store ($_, $page, $currentAdmin, \u2026), so the names cannot be enumerated. eslint-plugin-svelte's PARSER supplies both; oxlint has no Svelte parser, so it reported 1641 undefined identifiers on hr-management, none of them real. TypeScript and svelte-check already report genuinely undefined identifiers, which is why react and nest never enabled this rule either."
+    },
+    "no-unreachable": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-negation": [
+      "error",
+      {
+        enforceForOrderingRelations: false
+      }
+    ],
+    "no-unsafe-optional-chaining": [
+      "error",
+      {
+        disallowArithmeticOperators: false
+      }
+    ],
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "no-with": "error",
+    "prefer-rest-params": {
+      severity: "warn",
+      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
+    },
+    "prefer-spread": {
+      severity: "warn",
+      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
+    },
+    "require-yield": "error",
+    "typescript/no-explicit-any": {
+      severity: "warn",
+      reason: "libs/front/ui enforces it and apps/front/hr-management turns it off; enforcing it would newly fail hr-management, so it reports for both instead of breaking one"
+    },
+    "typescript/no-require-imports": "error",
+    "typescript/no-unused-vars": {
+      severity: "warn",
+      reason: "the two modules disagree: libs/front/ui runs it at error with no ignore patterns, apps/front/hr-management at warn with the ^_ patterns kept here (both read from eslint --print-config). Holding it at error would newly fail hr-management, so it reports for both and keeps the patterns hr-management already relies on",
+      options: [
+        {
+          varsIgnorePattern: "^_",
+          argsIgnorePattern: "^_",
+          destructuredArrayIgnorePattern: "^_"
+        }
+      ]
+    },
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ]
+  },
+  uncovered: {
+    "svelte/comment-directive": "oxlint cannot parse Svelte templates, so the eslint-disable comments inside markup are neither read nor honoured",
+    "svelte/system": "the plugin internal rule that reports Svelte parse errors; it needs the Svelte parser",
+    "svelte/no-at-debug-tags": "reads {@debug} in the template",
+    "svelte/no-at-html-tags": "reads {@html} in the template, the XSS guard; the highest-value loss in this list",
+    "svelte/no-dupe-else-if-blocks": "reads {#if}/{:else if} chains in the template",
+    "svelte/no-dupe-style-properties": "reads the style block",
+    "svelte/no-dynamic-slot-name": "reads <slot> in the template",
+    "svelte/no-inner-declarations": "the Svelte-aware variant; the core rule it shadows is not a substitute inside markup",
+    "svelte/no-not-function-handler": "reads on:event handlers in the template",
+    "svelte/no-object-in-text-mustaches": "reads {expression} interpolation in the template",
+    "svelte/no-shorthand-style-property-overrides": "reads the style block",
+    "svelte/no-unknown-style-directive-property": "reads style: directives in the template",
+    "svelte/no-unused-svelte-ignore": "reads svelte-ignore comments in the template",
+    "svelte/valid-compile": "runs the Svelte compiler and reports its warnings",
+    "no-dupe-args": "no oxlint equivalent (TypeScript rejects duplicate parameter names anyway)",
+    "no-octal": "no oxlint equivalent"
+  }
+};
+
+// src/roles/lint/preset-data.ts
+var BASE_RULES = base_default.rules;
+var PRESET_FILES = {
+  nest: nest_default,
+  node: node_default,
+  react: react_default,
+  svelte: svelte_default
+};
+var LINT_PRESETS = Object.keys(PRESET_FILES);
+function hasLintPreset(preset) {
+  return preset in PRESET_FILES;
+}
+function presetFile(preset) {
+  return PRESET_FILES[preset] ?? node_default;
+}
+function baseRules() {
+  return BASE_RULES;
+}
+function presetRules(preset) {
+  return presetFile(preset).rules;
+}
+
+// src/roles/lint/rule-data.ts
+var baseRules2 = baseRules();
+function isDecision(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function severityOf(value) {
+  if (isDecision(value)) return value.severity;
+  if (Array.isArray(value)) return String(value[0]);
+  return value;
+}
+function validate(preset, rules) {
+  for (const [rule, value] of Object.entries(rules)) {
+    const severity = severityOf(value);
+    if (!["off", "warn", "error"].includes(severity)) {
+      throw new Error(
+        `${preset}: rule "${rule}" has severity "${severity}"; expected off, warn or error`
+      );
+    }
+    if (severity === "error") continue;
+    const reason = isDecision(value) ? value.reason.trim() : "";
+    if (reason === "") {
+      throw new Error(
+        `${preset}: rule "${rule}" is set to "${severity}" without a reason. Every rule that is not enforced must say why, so --inspect can tell a developer what is not running. Use { "severity": "${severity}", "reason": "..." }.`
+      );
+    }
+  }
+}
+function layered(preset) {
+  const base = baseRules();
+  const layer = presetRules(preset);
+  validate("base", base);
+  validate(preset, layer);
+  return { ...base, ...layer };
+}
+function rulesFor(preset) {
+  const entries = Object.entries(layered(preset)).map(([rule, value]) => {
+    if (!isDecision(value)) return [rule, value];
+    const options = value.options ?? [];
+    return [rule, options.length > 0 ? [value.severity, ...options] : value.severity];
+  });
+  return Object.fromEntries(entries);
+}
+function disabledFor(preset) {
+  return decisionsAt(preset, "off");
+}
+function downgradedFor(preset) {
+  return decisionsAt(preset, "warn");
+}
+function decisionsAt(preset, severity) {
+  return Object.entries(layered(preset)).filter(([, value]) => isDecision(value) && value.severity === severity).map(([rule, value]) => ({ rule, reason: value.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
+
+// src/roles/lint/disabled-rules.ts
+function disabledRulesFor(preset) {
+  return disabledFor(preset);
+}
+
+// src/roles/lint/downgraded-rules.ts
+function downgradedRulesFor(preset) {
+  return downgradedFor(preset);
+}
+
+// src/roles/lint/presets.ts
+function lintPresetFor(preset) {
+  const file = presetFile(preset);
+  const resolved = LINT_PRESETS.includes(preset) ? preset : "node";
+  return {
+    plugins: file.plugins,
+    jsPlugins: file.jsPlugins,
+    ...file.settings === null ? {} : { settings: file.settings },
+    rules: rulesFor(resolved)
+  };
+}
+
+// src/roles/lint/rename-suppressions.ts
+import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join2, relative } from "path";
+var SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".svelte",
+  ".vue"
+];
+var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", ".git", ".nx"]);
+var SUPPRESSION = /(eslint-disable(?:-next-line|-line)?)\s+([^\n*]+?)(?:\s*--.*)?(?:\s*\*\/)?\s*$/;
+function renamedPrefixes(jsPlugins, declared = {}) {
+  const renames = /* @__PURE__ */ new Map();
+  for (const plugin of jsPlugins) {
+    if (typeof plugin === "string") continue;
+    const original = plugin.specifier.replace(/^eslint-plugin-/, "").replace(/\/eslint-plugin$/, "");
+    if (original !== plugin.name) renames.set(`${original}/`, `${plugin.name}/`);
+  }
+  const slash = (value) => value.endsWith("/") ? value : `${value}/`;
+  for (const [from, to] of Object.entries(declared)) renames.set(slash(from), slash(to));
+  return collapseChains(renames);
+}
+function collapseChains(renames) {
+  const collapsed = /* @__PURE__ */ new Map();
+  for (const [from, to] of renames) {
+    let target = to;
+    for (let hop = 0; hop < renames.size; hop += 1) {
+      const next = renames.get(target);
+      if (next === void 0 || next === target) break;
+      target = next;
+    }
+    collapsed.set(from, target);
+  }
+  return collapsed;
+}
+function* sourceFiles(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = join2(dir, entry);
+    let isDirectory;
+    try {
+      isDirectory = statSync(full).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDirectory) {
+      if (!SKIP_DIRECTORIES.has(entry)) yield* sourceFiles(full);
+    } else if (SOURCE_EXTENSIONS.some((extension) => entry.endsWith(extension))) {
+      yield full;
+    }
+  }
+}
+function findSuppressionRenames(cwd, renames) {
+  if (renames.size === 0) return [];
+  const found = [];
+  for (const file of sourceFiles(cwd)) {
+    let content;
+    try {
+      content = readFileSync2(file, "utf8");
+    } catch {
+      continue;
+    }
+    if (!content.includes("eslint-disable")) continue;
+    content.split("\n").forEach((line, index) => {
+      const match = SUPPRESSION.exec(line);
+      const rules = match?.[2];
+      if (!rules) return;
+      const names = rules.split(",").map((entry) => entry.trim());
+      const renamed = [];
+      const hits = [];
+      for (const name of names) {
+        const match2 = [...renames].find(([oldPrefix2]) => name.startsWith(oldPrefix2));
+        if (!match2) {
+          renamed.push(name);
+          continue;
+        }
+        const [oldPrefix, newPrefix] = match2;
+        hits.push(name);
+        renamed.push(newPrefix + name.slice(oldPrefix.length));
+      }
+      if (hits.length === 0) return;
+      found.push({
+        file: relative(cwd, file),
+        line: index + 1,
+        from: line,
+        to: line.replace(rules, renamed.join(", ")),
+        rule: hits.join(", ")
+      });
+    });
+  }
+  return found;
+}
+
+// src/roles/lint/lint-script.ts
+var SENTINEL_LINT_COMMAND = "sentinel --run --lint";
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function isEslintSegment(segment) {
+  return /(^|[\s/])eslint(\s|$)/.test(segment.trim());
+}
+function composeLintScript(existing) {
+  if (!existing || existing.trim() === "") return SENTINEL_LINT_COMMAND;
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isEslintSegment)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isEslintSegment(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return SENTINEL_LINT_COMMAND;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
+    }
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== SENTINEL_LINT_COMMAND);
+}
+
+// src/roles/lint/eslint-ignores.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
+var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
+var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
+function toOxlintPattern(pattern) {
+  return pattern.replace(/^\.\//, "");
+}
+function readEslintIgnores(cwd) {
+  const config = ESLINT_CONFIG_FILES.map((name) => join3(cwd, name)).find((path) => existsSync2(path));
+  if (!config) return { patterns: [], unresolved: [] };
+  let source;
+  try {
+    source = readFileSync3(config, "utf8");
+  } catch {
+    return { patterns: [], unresolved: [] };
+  }
+  const patterns = /* @__PURE__ */ new Set();
+  for (const block of IGNORE_BLOCKS) {
+    for (const [, body] of source.matchAll(block)) {
+      for (const [, literal] of (body ?? "").matchAll(STRING_LITERAL)) {
+        if (literal) patterns.add(toOxlintPattern(literal));
+      }
+    }
+  }
+  const unresolved = [...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]);
+  return { patterns: [...patterns], unresolved: [...new Set(unresolved)] };
+}
+
+// src/core/config/read-adoption.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+// src/core/config/owned-keys.ts
+function presetOwnedKeys(config, permitted) {
+  if (!config) return [];
+  return Object.keys(config).filter((key) => !permitted.includes(key));
+}
+
+// src/core/config/resolve-config-target.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+function readExtends(absolutePath) {
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync4(absolutePath, "utf8"), absolutePath);
+  } catch {
+    return [];
+  }
+  if (typeof parsed.extends === "string") return [parsed.extends];
+  if (Array.isArray(parsed.extends)) {
+    return parsed.extends.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
+  let existing;
+  let existingExtendsSomething = false;
+  for (const candidate of candidates) {
+    const absolutePath = join4(moduleDir, candidate);
+    if (!existsSync3(absolutePath)) continue;
+    const chain = readExtends(absolutePath);
+    if (existing === void 0) {
+      existing = candidate;
+      existingExtendsSomething = chain.length > 0;
+    }
+    const extendsBase = chain.some((value) => markers.some((marker) => value.includes(marker)));
+    if (extendsBase) return { path: candidate, reason: "extends-base" };
+  }
+  if (existing) {
+    return { path: existing, reason: existingExtendsSomething ? "other-chain" : "no-extends" };
+  }
+  return { path: fallback, reason: "none" };
+}
+
+// src/core/config/read-adoption.ts
+function normaliseExtends(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+var NOT_ADOPTED = (configFile) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: []
+});
+function readAdoption(cwd, options) {
+  const target = resolveConfigTarget(cwd, options);
+  if (target.reason === "none" || !existsSync4(join5(cwd, target.path))) {
+    return NOT_ADOPTED(target.reason === "none" ? null : target.path);
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync5(join5(cwd, target.path), "utf8"), target.path);
+  } catch {
+    return NOT_ADOPTED(target.path);
+  }
+  const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
+  if (preset === null) return NOT_ADOPTED(target.path);
+  const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
+  const drift = presetOwnedKeys(settings, options.permitted);
+  return { configFile: target.path, preset, adopted: true, conformant: drift.length === 0, drift };
+}
+
+// src/roles/lint/read-adoption.ts
+function readLintAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: [LINT_CONFIG_FILE],
+    markers: ["@hublo/sentinel/oxlint/"],
+    fallback: LINT_CONFIG_FILE,
+    presetPattern: SENTINEL_LINT_PRESET,
+    // Drift for lint is any TOP-LEVEL key beyond `extends`, so the settings the shared
+    // reader inspects are the config's own root rather than a nested options object.
+    settingsKey: null,
+    permitted: PERMITTED_LOCAL_KEYS
+  });
+}
+
+// src/roles/lint/render-config.ts
+var DEFAULT_IGNORE_PATTERNS = [
+  "**/dist/**",
+  "**/node_modules/**",
+  "**/coverage/**",
+  "**/*.mock.ts"
+];
+
+// src/roles/lint/resolve-oxlint.ts
+import { createRequire } from "module";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { existsSync as existsSync6 } from "fs";
+import { delimiter, dirname as dirname3, join as join7 } from "path";
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname2, join as join6 } from "path";
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join6(dir, "node_modules", ".bin", name);
+    if (existsSync5(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+
+// src/roles/lint/resolve-oxlint.ts
+var PACKAGE_OF = {
+  oxlint: "oxlint",
+  tsgolint: "oxlint-tsgolint"
+};
+var require2 = createRequire(import.meta.url);
+function fromOwnInstall(name) {
+  try {
+    const packageName = PACKAGE_OF[name];
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative2 = typeof bin === "string" ? bin : bin?.[name];
+    if (!relative2) return void 0;
+    const executable = join7(dirname3(manifest), relative2);
+    return existsSync6(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveOxlint(cwd, name = "oxlint") {
+  return resolveBin(cwd, name) ?? fromOwnInstall(name);
+}
+function canRunTypeAware(cwd) {
+  return tsgolintShim(cwd) !== void 0;
+}
+function oxlintPath(cwd, env) {
+  const shim = tsgolintShim(cwd);
+  if (!shim) return env.PATH;
+  return [dirname3(shim), env.PATH].filter(Boolean).join(delimiter);
+}
+function tsgolintShim(cwd) {
+  const fromModule = resolveBin(cwd, "tsgolint");
+  if (fromModule) return fromModule;
+  const candidates = [];
+  for (const owner of ["oxlint-tsgolint", "oxlint"]) {
+    try {
+      const packageDir = dirname3(require2.resolve(`${owner}/package.json`));
+      candidates.push(join7(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join7(packageDir, "..", ".bin", "tsgolint"));
+    } catch {
+    }
+  }
+  try {
+    const ownRoot = dirname3(require2.resolve("@hublo/sentinel/package.json"));
+    candidates.push(join7(ownRoot, "node_modules", ".bin", "tsgolint"));
+  } catch {
+    candidates.push(resolveBin(dirname3(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
+  }
+  return candidates.find((candidate) => candidate !== "" && existsSync6(candidate));
+}
+function oxlintSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+var MAX_FIX_PASSES = 3;
+function summariseByPlugin(rules) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const name of deferredRuleNames(rules)) {
+    const plugin = name.includes("/") ? name.split("/")[0] ?? name : "core";
+    counts.set(plugin, (counts.get(plugin) ?? 0) + 1);
+  }
+  return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
+}
+var OxlintAdapter = class extends BaseAdapter {
+  target = "lint";
+  runner = "oxlint";
+  /**
+   * Handles every preset, deliberately. Adapter selection happens BEFORE the engine can
+   * ask `declaredPreset`, so filtering here would make an adopted module unreachable:
+   * detection answers `node` for a hoisted-deps monorepo, no adapter would match, and the
+   * module would report `unsupported` while its committed config says otherwise. Whether a
+   * preset actually ships a preset is gated inside `plan`, where it can say so clearly.
+   */
+  appliesTo(_flavour) {
+    return true;
+  }
+  /**
+   * The preset this module committed to, read from the config sentinel wrote. Preferred
+   * over detection because a monorepo hoists dependencies: a module declares no `react`,
+   * so detection honestly answers `node` while the committed config says otherwise.
+   */
+  declaredPreset(cwd) {
+    return presetNameFromPath(readLintAdoption(cwd).preset);
+  }
+  plan(context) {
+    if (!hasLintPreset(context.preset)) {
+      return {
+        operations: [],
+        blocked: `sentinel does not ship a lint preset named "${context.preset}" yet (shipped: ${LINT_PRESETS.join(", ")}). Nothing was written; this module cannot adopt the lint preset until that preset ships.`
+      };
+    }
+    const current = presetNameFromPath(readLintAdoption(context.cwd).preset);
+    if (current !== void 0 && current !== context.preset) {
+      return {
+        operations: [],
+        blocked: `this module is already adopted as "${current}", and --preset says "${context.preset}". Nothing was written. If the change is deliberate, delete ${LINT_CONFIG_FILE} and re-run; otherwise re-run with --preset ${current}.`
+      };
+    }
+    const disabled = disabledRulesFor(context.preset);
+    const own = readOwnPackage();
+    const ignores = readEslintIgnores(context.cwd);
+    const stub = {
+      extends: [presetPath(context.preset)],
+      ...ignores.patterns.length > 0 ? { ignorePatterns: ignores.patterns } : {}
+    };
+    const operations = [
+      { kind: "write", path: LINT_CONFIG_FILE, contents: JSON.stringify(stub, null, 2) + "\n" },
+      this.packageJsonOperation(context.cwd)
+    ];
+    const removableDeps = this.moduleEslintDependencies(context.cwd);
+    if (removableDeps.length > 0) {
+      operations.push({
+        kind: "remove-json-keys",
+        path: "package.json",
+        keys: removableDeps
+      });
+    }
+    const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync7(join8(context.cwd, name)));
+    for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
+    if (existsSync7(join8(context.cwd, "project.json")) && !this.hasLintTarget(context.cwd)) {
+      operations.push({
+        kind: "remove-json-keys",
+        path: "project.json",
+        keys: [["targets", "lint"]]
+      });
+      operations.push({
+        kind: "merge-json",
+        path: "project.json",
+        value: { targets: { lint: lintTarget() } }
+      });
+    }
+    const renames = findSuppressionRenames(
+      context.cwd,
+      renamedPrefixes(
+        lintPresetFor(context.preset).jsPlugins,
+        lintPresetFor(context.preset).renames
+      )
+    );
+    const deleting = new Set(eslintConfigs);
+    const rewritten = renames.filter((entry) => !deleting.has(entry.file));
+    const byFile = /* @__PURE__ */ new Map();
+    for (const entry of rewritten) {
+      const list = byFile.get(entry.file) ?? [];
+      list.push({ from: entry.from, to: entry.to });
+      byFile.set(entry.file, list);
+    }
+    for (const [file, replacements] of byFile) {
+      operations.push({ kind: "replace-lines", path: file, replacements });
+    }
+    const notes = [
+      `wrote ${LINT_CONFIG_FILE} extending ${presetPath(context.preset)} (${own.name}@${own.version})`
+    ];
+    if (disabled.length > 0) {
+      notes.push(
+        `${disabled.length} rule(s) not enforced by this preset (${summariseByPlugin(disabled)}). Run --inspect --lint for each rule and why.`
+      );
+    }
+    if (eslintConfigs.length > 0) {
+      notes.push(`removed ${eslintConfigs.join(", ")} and pointed the nx lint target at oxlint`);
+    }
+    if (ignores.patterns.length > 0) {
+      notes.push(
+        `carried ${ignores.patterns.length} ignore pattern(s) over from the eslint config (${ignores.patterns.join(", ")}): they are this module's, not the preset's`
+      );
+    }
+    if (ignores.unresolved.length > 0) {
+      notes.push(
+        `COULD NOT read ${ignores.unresolved.join(", ")} from the eslint config, so any ignores it contributed are NOT carried over. Check them and add what you need to \`ignorePatterns\` in ${LINT_CONFIG_FILE}`
+      );
+    }
+    if (removableDeps.length > 0) {
+      notes.push(
+        `removed ${removableDeps.length} eslint dependenc(ies) this module declared (${removableDeps.map(([, name]) => name).join(", ")}); the ROOT is untouched, it serves every module that has not migrated yet`
+      );
+    }
+    if (rewritten.length > 0) {
+      notes.push(
+        `renamed ${rewritten.length} suppression comment(s) whose plugin oxlint registers under a different name (${[...new Set(rewritten.map((entry) => entry.rule))].join(", ")}); left alone they would stop suppressing anything, silently`
+      );
+    }
+    const script = composeLintScript(this.existingLintScript(context.cwd));
+    if (keepsOtherCommands(script)) {
+      notes.push(
+        `kept the rest of the lint script (\`${script}\`): only the eslint part is sentinel's. Formatting stays with prettier until the formatter moves, as its own decision.`
+      );
+    }
+    notes.push("run `pnpm install`, then `pnpm run lint`");
+    return { operations, notes };
+  }
+  /**
+   * Write the `lint` script and the pinned `@hublo/sentinel` devDependency, creating a
+   * `package.json` when the module has none. Real case: a BFF in the monorepo had no
+   * `package.json` at all, so `pnpm exec` failed outright and there was nowhere to put a
+   * script. `merge-json` preserves everything else and makes a re-run idempotent.
+   */
+  packageJsonOperation(cwd) {
+    const own = readOwnPackage();
+    const value = {
+      scripts: { [LINT_SCRIPT_NAME]: composeLintScript(this.existingLintScript(cwd)) },
+      devDependencies: { [own.name]: own.version }
+    };
+    if (existsSync7(join8(cwd, "package.json"))) {
+      return { kind: "merge-json", path: "package.json", value };
+    }
+    return {
+      kind: "merge-json",
+      path: "package.json",
+      value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+    };
+  }
+  /**
+   * True when the nx lint target already says exactly what sentinel would write.
+   *
+   * Worth checking rather than rewriting: the remove-then-merge cycle moves the key's
+   * position in the file, so an unchanged target still produces a diff, and `--init` would
+   * report a change on every run forever.
+   */
+  hasLintTarget(cwd) {
+    try {
+      const project = JSON.parse(readFileSync6(join8(cwd, "project.json"), "utf8"));
+      return JSON.stringify(project.targets?.[LINT_SCRIPT_NAME]) === JSON.stringify(lintTarget());
+    } catch {
+      return false;
+    }
+  }
+  /** The module's current `lint` script, so adoption replaces only the eslint part of it. */
+  existingLintScript(cwd) {
+    try {
+      const pkg = JSON.parse(readFileSync6(join8(cwd, "package.json"), "utf8"));
+      return pkg.scripts?.[LINT_SCRIPT_NAME];
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Lint the module. Announces the rules that are deliberately not enforced, so the
+   * reduced coverage is never a silent gap, and refuses to report a pass when the linter
+   * or its type-aware sidecar is missing.
+   */
+  async run(ctx) {
+    if (!existsSync7(join8(ctx.cwd, LINT_CONFIG_FILE))) {
+      process.stderr.write(
+        `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const oxlint = resolveOxlint(ctx.cwd);
+    if (!oxlint) {
+      process.stderr.write(
+        `sentinel lint(oxlint): could not find the oxlint binary (looked in ${oxlintSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const missingPreset = this.unresolvedPreset(ctx.cwd);
+    if (missingPreset) {
+      process.stderr.write(
+        `sentinel lint(oxlint): ${LINT_CONFIG_FILE} extends ${missingPreset}, which does not exist. That path assumes pnpm's isolated node_modules layout; if the workspace now uses a hoisted linker, or @hublo/sentinel is not installed in this module, run \`pnpm install\` here.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    this.announceDisabled(ctx.preset);
+    const typeAware = canRunTypeAware(ctx.cwd);
+    if (!typeAware) {
+      process.stderr.write(
+        `${palette(process.stderr).warn("sentinel lint(oxlint): oxlint-tsgolint is not installed, so type-aware rules will NOT run")}
+`
+      );
+    }
+    const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
+    const ignores = DEFAULT_IGNORE_PATTERNS.flatMap((pattern) => ["--ignore-pattern", pattern]);
+    const lint = (extra) => {
+      const passed = [...extra, ...ctx.toolArgs ?? []];
+      const result = spawnSync(oxlint, ["-c", LINT_CONFIG_FILE, ...ignores, ...passed, "."], {
+        cwd: ctx.cwd,
+        stdio: "inherit",
+        env
+      });
+      if (result.error) {
+        process.stderr.write(
+          `sentinel lint(oxlint): could not run oxlint (${result.error.message})
+`
+        );
+        return 1;
+      }
+      return result.status ?? 1;
+    };
+    if (ctx.fix) {
+      for (let pass = 0; pass < MAX_FIX_PASSES; pass += 1) {
+        if (lint(["--fix"]) === 0) break;
+      }
+    }
+    const code = lint(typeAware ? ["--type-aware"] : []);
+    return { ok: code === 0, code };
+  }
+  /** The module's resolved lint configuration, and what it deliberately does not enforce. */
+  async inspect(ctx) {
+    const adoption = readLintAdoption(ctx.cwd);
+    const disabled = disabledRulesFor(ctx.preset);
+    const rules = this.presetRuleCount(ctx.cwd);
+    return {
+      target: "lint",
+      runner: "oxlint",
+      adopted: adoption.adopted,
+      preset: adoption.preset,
+      configFile: adoption.configFile,
+      rules,
+      typeAware: canRunTypeAware(ctx.cwd),
+      disabled: disabled.map((entry) => ({ rule: entry.rule, reason: entry.reason })),
+      // Reported separately from `disabled`: these still run and still report, they just
+      // cannot fail a build. Collapsing the two would hide the difference between "we do
+      // not enforce this" and "we enforce this but will not block on it yet".
+      downgraded: downgradedRulesFor(ctx.preset).map((entry) => ({
+        rule: entry.rule,
+        reason: entry.reason
+      }))
+    };
+  }
+  /**
+   * The module's own eslint dependencies, as `package.json` key paths to remove.
+   *
+   * Deliberately narrow. Only packages that exist to serve eslint are listed, so nothing a
+   * module might use for another purpose is taken away: `globals`, for instance, is a plain
+   * data package that outlives its eslint config, and removing it on a guess would break a
+   * build for a cleanup nobody asked for. Prettier is untouched too, since formatting stays
+   * with prettier until the formatter migrates as its own decision.
+   */
+  moduleEslintDependencies(cwd) {
+    const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync6(join8(cwd, "package.json"), "utf8"));
+    } catch {
+      return [];
+    }
+    return ["dependencies", "devDependencies"].flatMap(
+      (section) => Object.keys(manifest[section] ?? {}).filter(isEslintPackage).map((name) => [section, name])
+    );
+  }
+  /** How many rules the extended preset enforces, read from the preset on disk. */
+  presetRuleCount(cwd) {
+    const target = this.unresolvedPreset(cwd);
+    if (target) return 0;
+    let total = 0;
+    try {
+      const stub = JSON.parse(readFileSync6(join8(cwd, LINT_CONFIG_FILE), "utf8"));
+      for (const entry of stub.extends ?? []) {
+        const preset = JSON.parse(readFileSync6(join8(cwd, entry), "utf8"));
+        total += Object.keys(preset.rules ?? {}).length;
+      }
+    } catch {
+      return 0;
+    }
+    return total;
+  }
+  /** Lint health for `--report`. Deepened in a later step; today it is the run outcome. */
+  async report(ctx) {
+    const result = await this.run(ctx);
+    return { ...result, metrics: { adopted: readLintAdoption(ctx.cwd).adopted } };
+  }
+  /** Adoption + conformity, read from the committed config with no tool run. */
+  async status(ctx) {
+    const adoption = readLintAdoption(ctx.cwd);
+    return {
+      adopted: adoption.adopted,
+      preset: adoption.preset,
+      conformant: adoption.conformant,
+      drift: adoption.drift
+    };
+  }
+  /**
+   * The `extends` target this module points at, when it cannot be found on disk. Returns
+   * undefined when everything resolves. Read from the committed config rather than
+   * recomputed, so it checks what the module actually says.
+   */
+  unresolvedPreset(cwd) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync6(join8(cwd, LINT_CONFIG_FILE), "utf8"));
+    } catch {
+      return void 0;
+    }
+    const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
+    return targets.find((target) => !existsSync7(join8(cwd, target)));
+  }
+  /** Announce what is not enforced, so reduced coverage is never silent. */
+  announceDisabled(preset) {
+    const softened = downgradedRulesFor(preset);
+    if (softened.length > 0) {
+      process.stderr.write(
+        `${palette(process.stderr).warn(
+          `sentinel lint(oxlint): ${softened.length} rule(s) report but will not fail the build (${summariseByPlugin(softened)}); run --inspect --lint for each rule and why`
+        )}
+`
+      );
+    }
+    const disabled = disabledRulesFor(preset);
+    if (disabled.length === 0) return;
+    process.stderr.write(
+      `${palette(process.stderr).warn(
+        `sentinel lint(oxlint): ${disabled.length} rule(s) not enforced by default (${summariseByPlugin(disabled)}); run --inspect --lint for each rule and why`
+      )}
+`
+    );
+  }
+};
+
+// src/roles/lint/register.ts
+function registerLint() {
+  register(new OxlintAdapter());
+  setDefaultRunner("lint", "oxlint");
+}
+
+// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createRequire as createRequire2 } from "module";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { basename as basename2, join as join10 } from "path";
+
+// src/core/config/preset-evidence.ts
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+var PATH_SIGNALS = [
+  {
+    preset: "nest",
+    pattern: /(^|\/)apps\/nest\//,
+    evidence: "it lives under apps/nest"
+  }
+];
+var DEPENDENCY_SIGNALS = [
+  { preset: "react", pattern: /^(react|react-dom|@types\/react)$|^eslint-plugin-react/ },
+  { preset: "svelte", pattern: /^svelte$|^@sveltejs\// },
+  { preset: "nest", pattern: /^@nestjs\// }
+];
+function dependencyNames(cwd) {
+  const path = join9(cwd, "package.json");
+  if (!existsSync8(path)) return [];
+  try {
+    const manifest = parseJsonc(
+      readFileSync7(path, "utf8"),
+      path
+    );
+    return [
+      ...Object.keys(manifest.dependencies ?? {}),
+      ...Object.keys(manifest.devDependencies ?? {})
+    ];
+  } catch {
+    return [];
+  }
+}
+function declaresJsx(cwd) {
+  let entries;
+  try {
+    entries = readdirSync2(cwd).filter(
+      (name) => name.startsWith("tsconfig") && name.endsWith(".json")
+    );
+  } catch {
+    return false;
+  }
+  for (const name of entries) {
+    try {
+      const config = parseJsonc(
+        readFileSync7(join9(cwd, name), "utf8"),
+        name
+      );
+      if (config.compilerOptions?.jsx !== void 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function presetSignals(cwd) {
+  const signals = [];
+  const dependencies = dependencyNames(cwd);
+  for (const { preset, pattern } of DEPENDENCY_SIGNALS) {
+    const hit = dependencies.find((name) => pattern.test(name));
+    if (hit) signals.push({ preset, evidence: `it depends on "${hit}"` });
+  }
+  if (declaresJsx(cwd) && !signals.some((signal) => signal.preset === "react")) {
+    signals.push({ preset: "react", evidence: 'its tsconfig sets "jsx"' });
+  }
+  const location = cwd.replaceAll("\\", "/");
+  for (const { preset, pattern, evidence } of PATH_SIGNALS) {
+    if (pattern.test(location) && !signals.some((signal) => signal.preset === preset)) {
+      signals.push({ preset, evidence });
+    }
+  }
+  return signals;
+}
+function presetContradiction(declared, cwd) {
+  const signals = presetSignals(cwd);
+  if (signals.length === 0) return void 0;
+  if (signals.some((signal) => signal.preset === declared)) return void 0;
+  const [first] = signals;
+  if (!first) return void 0;
+  const evidence = signals.map((signal) => signal.evidence).join(", and ");
+  return `--preset ${declared} does not match this module: ${evidence}, which makes it "${first.preset}". Nothing was written. Re-run with --preset ${first.preset}, or adopt from the module you actually meant.`;
+}
+
+// src/roles/typescript/config-policy.ts
+var PERMITTED_COMPILER_OPTIONS = [
+  "paths",
+  "baseUrl",
+  "rootDir",
+  "outDir",
+  "tsBuildInfoFile"
+];
+function presetOwnedKeys2(compilerOptions) {
+  return presetOwnedKeys(compilerOptions, PERMITTED_COMPILER_OPTIONS);
+}
+
+// src/roles/typescript/presets/base.json
+var base_default2 = {
+  $schema: "https://json.schemastore.org/tsconfig",
+  compilerOptions: {
+    strict: true,
+    noFallthroughCasesInSwitch: true,
+    forceConsistentCasingInFileNames: true,
+    esModuleInterop: true,
+    skipLibCheck: true
+  },
+  deferred: {
+    noImplicitAny: {
+      phase: 2,
+      reason: "the implicit-any migration (TS70xx)"
+    },
+    noUnusedLocals: {
+      phase: 2,
+      reason: "unused-local cleanup (TS6133)"
+    },
+    noUnusedParameters: {
+      phase: 2,
+      reason: "unused-parameter cleanup (TS6133)"
+    }
+  }
+};
+
+// src/roles/typescript/presets/nest.json
+var nest_default2 = {
+  compilerOptions: {
+    module: "esnext",
+    moduleResolution: "bundler",
+    types: ["node"],
+    experimentalDecorators: true,
+    emitDecoratorMetadata: true,
+    declaration: true,
+    sourceMap: true
+  },
+  notes: {
+    module: "the backends are webpack-bundled and tsc only typechecks, so the module format is the bundler's concern; `bundler` resolution is what the repo already uses, and the only Node-friendly option TS7 still accepts since it removed classic `node`",
+    target: "deliberately NOT set, here or in lib: those are environment the repo base owns. Overriding target flips useDefineForClassFields (TS2612) and narrowing lib drops DOM (GLfloat); both REPLACE the base rather than merge"
+  }
+};
+
+// src/roles/typescript/presets/node.json
+var node_default2 = {
+  compilerOptions: {
+    module: "esnext",
+    moduleResolution: "bundler",
+    types: ["node"],
+    declaration: true
+  },
+  notes: {
+    module: "esnext/bundler like the react and nest presets, matching a monorepo whose libs are bundler-resolved in practice. NOT NodeNext: that would force its stricter ESM rules onto libs the repo resolves through a bundler"
+  }
+};
+
+// src/roles/typescript/presets/react.json
+var react_default2 = {
+  compilerOptions: {
+    target: "ES2023",
+    lib: ["ES2023", "DOM", "DOM.Iterable"],
+    module: "ESNext",
+    moduleResolution: "bundler",
+    jsx: "react-jsx",
+    useDefineForClassFields: true,
+    isolatedModules: true,
+    moduleDetection: "force",
+    noEmit: true,
+    noUncheckedSideEffectImports: true
+  },
+  notes: {
+    noEmit: "vite owns the build; tsc only typechecks here"
+  }
+};
+
+// src/roles/typescript/preset-data.ts
+var BASE = base_default2;
+var LAYERS = {
+  nest: nest_default2,
+  node: node_default2,
+  react: react_default2
+};
+var SHIPPED_PRESETS = Object.keys(LAYERS).sort();
+var DEFERRED_RULES = Object.entries(BASE.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+function validate2() {
+  for (const { rule, phase, reason } of DEFERRED_RULES) {
+    if (!Number.isInteger(phase) || phase < 2) {
+      throw new Error(
+        `deferred rule "${rule}" has phase ${phase}; a deferred rule is scheduled for phase 2 or later`
+      );
+    }
+    if (reason.trim() === "") {
+      throw new Error(
+        `deferred rule "${rule}" has no reason; --inspect reports it and would say nothing`
+      );
+    }
+    if (rule in BASE.compilerOptions) {
+      throw new Error(
+        `"${rule}" is deferred and also set by the base preset; it would be announced as not enforced while being enforced`
+      );
+    }
+    for (const [preset, layer] of Object.entries(LAYERS)) {
+      if (layer && rule in layer.compilerOptions) {
+        throw new Error(
+          `"${rule}" is deferred and also set by the ${preset} preset; it would be announced as not enforced while being enforced`
+        );
+      }
+    }
+  }
+}
+validate2();
+function hasShippedPreset(preset) {
+  return preset in LAYERS;
+}
+
+// src/roles/typescript/phased-rules.ts
+function deferredRuleNames2() {
+  return deferredRuleNames(DEFERRED_RULES);
+}
+
+// src/roles/typescript/resolve-tsconfig-target.ts
+var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
+var TSCONFIG_MARKERS = ["tsconfig.base.json", "@hublo/sentinel/tsconfig/"];
+var TSCONFIG_FALLBACK = "tsconfig.json";
+function resolveTsconfigTarget(moduleDir) {
+  return resolveConfigTarget(moduleDir, {
+    candidates: TSCONFIG_CANDIDATES,
+    markers: TSCONFIG_MARKERS,
+    fallback: TSCONFIG_FALLBACK
+  });
+}
+
+// src/roles/typescript/read-adoption.ts
+var SENTINEL_PRESET = /^@hublo\/sentinel\/tsconfig\/[a-z-]+$/;
+function readTsconfigAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: TSCONFIG_CANDIDATES,
+    markers: TSCONFIG_MARKERS,
+    fallback: TSCONFIG_FALLBACK,
+    presetPattern: SENTINEL_PRESET,
+    settingsKey: "compilerOptions",
+    permitted: PERMITTED_COMPILER_OPTIONS
+  });
+}
+
+// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+var SENTINEL_PACKAGE = "@hublo/sentinel";
+var SENTINEL_PRESET_SCOPE = `${SENTINEL_PACKAGE}/tsconfig/`;
+var TYPECHECK_SCRIPT = { typecheck: "sentinel --run --typescript" };
+var INSTALL_NOTE = "run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+var DIAGNOSTIC_RE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.+)$/;
+function parseDiagnostics(output) {
+  const diagnostics = [];
+  for (const raw of output.split("\n")) {
+    const m = DIAGNOSTIC_RE.exec(raw.trim());
+    if (m) {
+      diagnostics.push({
+        file: m[1],
+        line: Number(m[2]),
+        col: Number(m[3]),
+        code: m[4],
+        message: m[5]
+      });
+    }
+  }
+  return diagnostics;
+}
+var PHASED_STRICTNESS_WARNING = `sentinel typescript: phase 1 (non-breaking) \u2014 deferred: ${deferredRuleNames2().join(", ")}. Enabled centrally in a later wave; run \`sentinel --inspect --typescript\` for the list, or \`sentinel --run --typescript -- --noImplicitAny\` to measure what one would cost today.`;
+function composeExtends(current, preset) {
+  const chain = typeof current === "string" ? [current] : Array.isArray(current) ? current.filter((entry) => typeof entry === "string") : [];
+  return chain.includes(preset) ? chain : [...chain, preset];
+}
+var TscAdapter = class extends BaseAdapter {
+  target = "typescript";
+  runner = "tsc";
+  /**
+   * The tsc adapter drives type-checking for any preset: `--run`/`--report`/
+   * `--inspect` just execute tsc against the module's existing config, which is
+   * meaningful regardless of preset. `--init` is the exception, it only WRITES a
+   * preset for the names that ship one (gated inside `plan`), so svelte is not
+   * clobbered with a non-existent preset.
+   */
+  appliesTo(_flavour) {
+    return true;
+  }
+  /**
+   * The preset read from the committed `extends` chain
+   * (`@hublo/sentinel/tsconfig/nest` -> `nest`), or undefined when the module has not
+   * adopted a preset, so the engine falls back to dependency detection.
+   *
+   * This is the same detection-free read `--status` uses, and it is why an adopted React app
+   * reports `react` even in a monorepo that hoists `react` to the root.
+   */
+  declaredPreset(cwd) {
+    const { preset } = readTsconfigAdoption(cwd);
+    if (!preset) return void 0;
+    const name = preset.slice(preset.lastIndexOf("/") + 1);
+    return PRESET_NAMES.includes(name) ? name : void 0;
+  }
+  /**
+   * Plan `--init`: make the module extend the sentinel preset with a THIN,
+   * conformant stub, route type-checking through the CLI, and pin the
+   * `@hublo/sentinel` devDependency into the module. The engine applies the ops, so
+   * adoption is `--init` then `pnpm install`, with nothing to add by hand.
+   *
+   * Per resolved case:
+   *   - extends-base: append the preset to the `extends` chain (keep the base for
+   *     the monorepo's paths/structure) + strip preset-owned `compilerOptions`
+   *     (drift), keeping the project's own paths/include (the allowlist).
+   *   - none: create a fresh thin `tsconfig.json`.
+   *   - other-chain (svelte): skip, its config extends a different base.
+   */
+  plan(context) {
+    if (!hasShippedPreset(context.preset)) {
+      return {
+        operations: [],
+        blocked: `sentinel does not ship a TypeScript preset named "${context.preset}" yet (shipped: ${SHIPPED_PRESETS.join(", ")}). Nothing was written; this module cannot adopt the TypeScript preset until that preset ships.`
+      };
+    }
+    const current = this.declaredPreset(context.cwd);
+    if (current !== void 0 && current !== context.preset) {
+      return {
+        operations: [],
+        blocked: `this module is already adopted as "${current}", and --preset says "${context.preset}". Nothing was written. If the change is deliberate, remove the sentinel preset from the tsconfig \`extends\` chain and re-run; otherwise re-run with --preset ${current}.`
+      };
+    }
+    const contradiction = presetContradiction(context.preset, context.cwd);
+    if (contradiction !== void 0) {
+      return { operations: [], blocked: contradiction };
+    }
+    const target = resolveTsconfigTarget(context.cwd);
+    const preset = `@hublo/sentinel/tsconfig/${context.preset}`;
+    const addScript = this.packageJsonOperation(context.cwd);
+    if (target.reason === "other-chain") {
+      return {
+        operations: [],
+        blocked: `${target.path} extends a config chain sentinel does not handle, so nothing was written. Point it at the workspace base (or a plain config) and re-run.`
+      };
+    }
+    if (target.reason === "no-extends") {
+      return {
+        operations: [],
+        blocked: `${target.path} extends nothing, so it defines its own complete set of compilerOptions and sentinel will not silently take ownership of them. Nothing was written. Make it extend the workspace base and re-run, and --init will then move the shared options into the preset.`
+      };
+    }
+    if (target.reason === "none") {
+      const contents = JSON.stringify({ extends: preset, include: ["src"] }, null, 2) + "\n";
+      return {
+        operations: [{ kind: "write", path: target.path, contents }, addScript],
+        notes: [`created ${target.path} (no tsconfig found)`, INSTALL_NOTE]
+      };
+    }
+    const existing = parseJsonc(
+      readFileSync8(join10(context.cwd, target.path), "utf8"),
+      target.path
+    );
+    const extendsChain = composeExtends(existing.extends, preset);
+    const drift = presetOwnedKeys2(existing.compilerOptions);
+    const operations = [
+      { kind: "merge-json", path: target.path, value: { extends: extendsChain } }
+    ];
+    const notes = [];
+    if (drift.length > 0) {
+      const localKeys = Object.keys(existing.compilerOptions ?? {});
+      const stripsAll = localKeys.length > 0 && localKeys.every((key) => drift.includes(key));
+      operations.push({
+        kind: "remove-json-keys",
+        path: target.path,
+        keys: stripsAll ? [["compilerOptions"]] : drift.map((key) => ["compilerOptions", key])
+      });
+      notes.push(`stripped preset-owned compilerOptions: ${drift.join(", ")}`);
+    }
+    operations.push(addScript);
+    notes.push(INSTALL_NOTE);
+    return { operations, notes };
+  }
+  /**
+   * The op that routes type-checking through the CLI. If the module already has a
+   * `package.json`, merge the script in and leave the rest untouched. If it does
+   * NOT (common for nx apps/services that carry only a `project.json`), scaffold a
+   * minimal, workspace-valid one, its nx name + `private: true`, so pnpm accepts it
+   * and it can carry the pinned `@hublo/sentinel` devDep this op also writes. The
+   * exact version is written (never a range), so `pnpm install` resolves the same
+   * build the stub's `extends` points at.
+   */
+  packageJsonOperation(cwd) {
+    const own = readOwnPackage();
+    const devDependencies = { [own.name]: own.version };
+    if (existsSync9(join10(cwd, "package.json"))) {
+      return {
+        kind: "merge-json",
+        path: "package.json",
+        value: { scripts: TYPECHECK_SCRIPT, devDependencies }
+      };
+    }
+    const name = readNxProjectName(cwd) ?? basename2(cwd);
+    return {
+      kind: "merge-json",
+      path: "package.json",
+      value: { name, private: true, scripts: TYPECHECK_SCRIPT, devDependencies }
+    };
+  }
+  /**
+   * Type-check the module with `tsc -b` (build mode) on its solution config, the
+   * way the monorepo itself does. Build mode walks the config's `references`, so a
+   * references-only solution (Pattern A: app + spec) is actually checked instead of
+   * passing vacuously; it also only caches SUCCESSFUL builds, so errors are always
+   * re-reported. Uses the module's own tsc. Nothing to check is a pass.
+   */
+  /**
+   * Translate "the preset file is not there" into the one thing that fixes it.
+   *
+   * tsc reports a missing `extends` target as a bare TS6053, once per referenced project,
+   * which reads as a broken preset rather than a missing install:
+   *
+   *   tsconfig.json(2,46): error TS6053: File '@hublo/sentinel/tsconfig/node' not found.
+   *
+   * The usual cause is mundane and recurring: the module's `tsconfig` extends the package
+   * from `node_modules`, and switching branches changes the lockfile without reinstalling,
+   * so the package is simply absent. Twice while developing this, a green module looked like
+   * a regression for exactly that reason.
+   *
+   * The lint role already says this; saying it here too means a developer gets the same
+   * answer whichever tool they happen to run first.
+   */
+  explainMissingPreset(output) {
+    const missing = /error TS6053: File '(@hublo\/sentinel\/[^']+)' not found/.exec(output);
+    if (!missing) return;
+    process.stderr.write(
+      `sentinel typescript(tsc): the tsconfig extends ${missing[1]}, which is not installed in this module. That usually means the lockfile changed without a reinstall (a branch switch is the common one). Run \`pnpm install\` and try again.
+`
+    );
+  }
+  /**
+   * The sentinel preset a tsconfig extends, when the package is not installed here.
+   *
+   * Checked BEFORE running, because `run` inherits tsc's stdio and never sees its output.
+   * Without this the developer gets a bare TS6053 repeated once per referenced project:
+   *
+   *   tsconfig.json(2,46): error TS6053: File '@hublo/sentinel/tsconfig/node' not found.
+   *
+   * which reads as a broken preset rather than the mundane and recurring cause: the module
+   * extends the package from `node_modules`, and a branch switch changes the lockfile
+   * without reinstalling. Twice while building this, a green module looked like a
+   * regression for exactly that reason. The lint role already says it; both roles should.
+   */
+  missingPresetPackage(cwd) {
+    const target = resolveTsconfigTarget(cwd);
+    if (target.reason === "none") return void 0;
+    let chain;
+    try {
+      const parsed = parseJsonc(
+        readFileSync8(join10(cwd, target.path), "utf8"),
+        target.path
+      );
+      chain = parsed.extends;
+    } catch {
+      return void 0;
+    }
+    const entries = typeof chain === "string" ? [chain] : Array.isArray(chain) ? chain : [];
+    const preset = entries.find(
+      (entry) => typeof entry === "string" && entry.startsWith(SENTINEL_PRESET_SCOPE)
+    );
+    if (preset === void 0) return void 0;
+    try {
+      createRequire2(join10(cwd, "noop.js")).resolve(preset);
+      return void 0;
+    } catch {
+      return preset;
+    }
+  }
+  async run(ctx) {
+    const config = this.typecheckTarget(ctx.cwd);
+    if (!config) {
+      process.stderr.write("sentinel typescript(tsc): no tsconfig to check\n");
+      return { ok: true, code: 0 };
+    }
+    const missing = this.missingPresetPackage(ctx.cwd);
+    if (missing) {
+      process.stderr.write(
+        `sentinel typescript(tsc): the tsconfig extends ${missing}, which is not installed in this module. That usually means the lockfile changed without a reinstall (a branch switch is the common one). Run \`pnpm install\` and try again.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    process.stderr.write(`${palette(process.stderr).warn(PHASED_STRICTNESS_WARNING)}
+`);
+    const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
+    if (ctx.toolArgs && ctx.toolArgs.length > 0) return this.runWithOptions(ctx, tsc, config);
+    const result = spawnSync2(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? 1;
+    return { ok: code === 0, code };
+  }
+  /**
+   * The same check, with the caller's own compiler options applied.
+   *
+   * It cannot reuse the `tsc -b` path above, and that is not a preference. Build mode
+   * REFUSES most compiler options outright:
+   *
+   *   $ tsc -b tsconfig.json --noImplicitAny
+   *   error TS5094: Compiler option '--noImplicitAny' may not be used with '--build'.
+   *
+   * So honouring them means project mode, which carries a trap of its own here: on this
+   * repo's layout a module's `tsconfig.json` is a SOLUTION (`files: []`, `include: []`,
+   * `references`), so `tsc -p` on it compiles NOTHING and exits 0. That would report a clean
+   * answer for a check that never ran, and it is exactly why the normal path uses build
+   * mode. So walk the references and check each project that actually holds files.
+   *
+   * `--noEmit` is forced: this asks a question about the code, it does not build. Letting a
+   * run with non-standard options write output would poison the artifacts and the build info
+   * the normal path depends on. `--composite false` rides with it, because a composite
+   * project refuses `--noEmit`.
+   */
+  runWithOptions(ctx, tsc, config) {
+    let worst = 0;
+    for (const project of this.referencedProjects(ctx.cwd, config)) {
+      const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
+      const result = spawnSync2(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      if (result.error) {
+        process.stderr.write(
+          `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
+`
+        );
+        return { ok: false, code: 1 };
+      }
+      worst = Math.max(worst, result.status ?? 1);
+    }
+    return { ok: worst === 0, code: worst };
+  }
+  /**
+   * The projects that actually hold files: a solution's `references`, else the config
+   * itself. Returning the solution when it has references would check nothing, so the
+   * fallback is only for a module whose config really is the compilation unit.
+   */
+  referencedProjects(cwd, config) {
+    try {
+      const parsed = parseJsonc(
+        readFileSync8(join10(cwd, config), "utf8"),
+        config
+      );
+      const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
+      return referenced.length > 0 ? referenced : [config];
+    } catch {
+      return [config];
+    }
+  }
+  /**
+   * The config to type-check with `tsc -b`. Prefer the module's root `tsconfig.json`
+   * (the solution the monorepo builds; `tsc -b` follows its `references` to cover
+   * app + spec), else the base-extending file, else null when there is nothing to
+   * check.
+   */
+  typecheckTarget(cwd) {
+    if (existsSync9(join10(cwd, "tsconfig.json"))) return "tsconfig.json";
+    const target = resolveTsconfigTarget(cwd);
+    return target.reason === "none" ? null : target.path;
+  }
+  /**
+   * The module's resolved TypeScript config: which preset, which file, how, and the
+   * phased-strictness state (`deferred` rules that are off in phase 1). This is the
+   * "list what's deferred" query, `sentinel --inspect --typescript`.
+   */
+  async inspect(ctx) {
+    const target = resolveTsconfigTarget(ctx.cwd);
+    const { preset, adopted } = readTsconfigAdoption(ctx.cwd);
+    return {
+      module: ctx.module,
+      target: "typescript",
+      // The machine-output key stays `flavour` for now. In this shape `preset` already
+      // means the preset PATH, and the output is consumed (the migration status page reads
+      // it), so it is renamed with the rest of the output when --report/--status change.
+      flavour: ctx.preset,
+      configFile: target.path,
+      configState: target.reason,
+      preset,
+      adopted,
+      phase: 1,
+      deferred: DEFERRED_RULES
+    };
+  }
+  /**
+   * Adoption + conformity from the committed tsconfig, for `--status`. No tsc run and
+   * no preset guessing: reads the actual `extends` chain, so a workspace-wide scan is
+   * a cheap coverage + drift dashboard (adopted? which preset? drifted?).
+   */
+  async status(ctx) {
+    const { adopted, preset, conformant, drift } = readTsconfigAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift };
+  }
+  /**
+   * Report conformance for the module: `tsc -b` (build mode, so app + spec are
+   * covered) and count total type errors plus the implicit-`any` family (TS70xx:
+   * 7006/7031/7053/… ), the signal that drives the noImplicitAny migration. No
+   * tsconfig is a clean, empty report.
+   */
+  async report(ctx) {
+    const config = this.typecheckTarget(ctx.cwd);
+    if (!config) {
+      return { ok: true, code: 0, metrics: { errors: 0, implicitAny: "deferred", diagnostics: [] } };
+    }
+    const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
+    const result = spawnSync2(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
+`
+      );
+      return { ok: false, code: 1, metrics: { error: "tsc not available" } };
+    }
+    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+    this.explainMissingPreset(output);
+    const errors = (output.match(/error TS\d+/g) ?? []).length;
+    const parsed = parseDiagnostics(output);
+    const cap = ctx.maxDiagnostics === 0 ? Infinity : ctx.maxDiagnostics ?? DEFAULT_MAX_DIAGNOSTICS;
+    const diagnostics = Number.isFinite(cap) ? parsed.slice(0, cap) : parsed;
+    return {
+      ok: errors === 0,
+      code: result.status ?? 0,
+      metrics: {
+        errors,
+        implicitAny: this.implicitAnyMetric(ctx.cwd, tsc, config, output),
+        diagnostics,
+        diagnosticsTruncated: diagnostics.length < parsed.length
+      }
+    };
+  }
+  /**
+   * The `implicitAny` report metric, honestly. Implicit-`any` violations (TS70xx) are
+   * only *visible* to tsc when `noImplicitAny` is ON. In phase 1 the rule is DEFERRED
+   * (off), so counting TS70xx from the committed-config run is structurally always 0 —
+   * a misleading "no implicit-any" when the rule simply was not applied. So: report the
+   * real count only when the rule is on, otherwise `'deferred'` (never a fake `0`). The
+   * remaining debt while deferred is a separate, opt-in probe (a later `--migration`).
+   */
+  implicitAnyMetric(cwd, tsc, config, mainOutput) {
+    return this.noImplicitAnyEnabled(cwd, tsc, config, mainOutput) ? (mainOutput.match(/error TS70\d\d/g) ?? []).length : "deferred";
+  }
+  /**
+   * Whether `noImplicitAny` is effectively ON in the module's resolved config. Read from
+   * `tsc --showConfig` (an explicit value wins; otherwise `strict` implies it). If
+   * `--showConfig` is unavailable, fall back to the run's own evidence: implicit-`any`
+   * errors in the output mean the rule must be on.
+   */
+  noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
+    const shown = spawnSync2(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    if (shown.status === 0 && shown.stdout) {
+      try {
+        const co = parseJsonc(
+          shown.stdout,
+          "tsconfig(--showConfig)"
+        ).compilerOptions;
+        if (co) return co.noImplicitAny ?? co.strict === true;
+      } catch {
+      }
+    }
+    return /error TS70\d\d/.test(mainOutput);
+  }
+};
+
+// src/roles/typescript/register.ts
+function registerTypescript() {
+  register(new TscAdapter());
+  setDefaultRunner("typescript", "tsc");
+}
+
+// src/adapters.ts
+function registerAdapters() {
+  registerTypescript();
+  registerLint();
+}
+
+// src/core/detect-framework.ts
+var FRAMEWORK_SIGNALS = [
+  { preset: "nest", dependency: "@nestjs/core" },
+  { preset: "react", dependency: "react" },
+  { preset: "svelte", dependency: "svelte" }
+];
+var BACKEND_HINTS = ["sails", "express", "koa", "fastify", "@hapi/hapi"];
+function describeFramework(packageJson) {
+  const dependencies = { ...packageJson.dependencies, ...packageJson.devDependencies };
+  const matched = FRAMEWORK_SIGNALS.filter((s) => s.dependency in dependencies);
+  const chosen = matched[0];
+  const preset = chosen?.preset ?? "node";
+  const source = chosen?.dependency ?? "(no framework dependency)";
+  const otherFlavourSignals = matched.slice(1).map((s) => s.dependency);
+  const backendHints = preset === "react" || preset === "svelte" ? BACKEND_HINTS.filter((hint) => hint in dependencies) : [];
+  const conflicts = [...otherFlavourSignals, ...backendHints];
+  return { preset, source, ambiguous: conflicts.length > 0, conflicts };
+}
+function detectFramework(packageJson) {
+  return describeFramework(packageJson).preset;
+}
+
+// src/shared/text.ts
+function ensureLines(current, lines) {
+  const present = new Set(current.split("\n").map((line) => line.trim()));
+  const missing = lines.filter((line) => !present.has(line.trim()));
+  if (missing.length === 0) return current;
+  const prefix = current.length === 0 || current.endsWith("\n") ? current : current + "\n";
+  return prefix + missing.join("\n") + "\n";
+}
+function toLines(text) {
+  if (text.length === 0) return [];
+  return text.replace(/\n$/, "").split("\n");
+}
+function diffLines(before, after) {
+  const from = toLines(before);
+  const to = toLines(after);
+  const lcs = Array.from(
+    { length: from.length + 1 },
+    () => new Array(to.length + 1).fill(0)
+  );
+  const cell = (i2, j2) => lcs[i2]?.[j2] ?? 0;
+  for (let i2 = from.length - 1; i2 >= 0; i2--) {
+    const row = lcs[i2];
+    if (!row) continue;
+    for (let j2 = to.length - 1; j2 >= 0; j2--) {
+      row[j2] = from[i2] === to[j2] ? cell(i2 + 1, j2 + 1) + 1 : Math.max(cell(i2 + 1, j2), cell(i2, j2 + 1));
+    }
+  }
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < from.length && j < to.length) {
+    if (from[i] === to[j]) {
+      out.push(`  ${from[i] ?? ""}`);
+      i++;
+      j++;
+    } else if (cell(i + 1, j) >= cell(i, j + 1)) {
+      out.push(`- ${from[i] ?? ""}`);
+      i++;
+    } else {
+      out.push(`+ ${to[j] ?? ""}`);
+      j++;
+    }
+  }
+  while (i < from.length) out.push(`- ${from[i++] ?? ""}`);
+  while (j < to.length) out.push(`+ ${to[j++] ?? ""}`);
+  return out;
+}
+function replaceLines(current, replacements) {
+  if (replacements.length === 0) return current;
+  const byLine = new Map(replacements.map((entry) => [entry.from, entry.to]));
+  return current.split("\n").map((line) => byLine.get(line) ?? line).join("\n");
+}
+
+// src/core/apply-plan.ts
+import { existsSync as existsSync10, readFileSync as readFileSync9, renameSync, rmSync, writeFileSync } from "fs";
+import { resolve as resolve2, sep } from "path";
+import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
+
+// src/shared/deep-merge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/apply-plan.ts
+function resolveWithinRoot(cwd, relativePath) {
+  const root = resolve2(cwd);
+  const absolutePath = resolve2(root, relativePath);
+  if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+    throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
+  }
+  return absolutePath;
+}
+function readIfExists(absolutePath) {
+  return existsSync10(absolutePath) ? readFileSync9(absolutePath, "utf8") : void 0;
+}
+function* leaves(value, prefix = []) {
+  for (const [key, keyValue] of Object.entries(value)) {
+    const path = [...prefix, key];
+    if (isPlainObject(keyValue)) yield* leaves(keyValue, path);
+    else yield [path, keyValue];
+  }
+}
+function mergeJsonc(current, value) {
+  let text = current.trim().length > 0 ? current : "{}\n";
+  for (const [path, leaf] of leaves(value)) {
+    const edits = modify(text, path, leaf, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 }
+    });
+    text = applyEdits(text, edits);
+  }
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function removeJsoncKeys(current, keys) {
+  let text = current.trim().length > 0 ? current : "{}\n";
+  for (const path of keys) {
+    const root = parseTree(text);
+    if (!root || !findNodeAtLocation(root, path)) continue;
+    const edits = modify(text, path, void 0, {
+      formattingOptions: { insertSpaces: true, tabSize: 2 }
+    });
+    text = applyEdits(text, edits);
+  }
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function sameJson(left, right) {
+  try {
+    return JSON.stringify(parseJsonc(left, "a")) === JSON.stringify(parseJsonc(right, "b"));
+  } catch {
+    return false;
+  }
+}
+function applyOperationTo(current, operation) {
+  switch (operation.kind) {
+    case "write":
+      return sameJson(current, operation.contents) ? current : operation.contents;
+    case "merge-json":
+      return mergeJsonc(current, operation.value);
+    case "ensure-lines":
+      return ensureLines(current, operation.lines);
+    case "remove-json-keys":
+      return removeJsoncKeys(current, operation.keys);
+    case "replace-lines":
+      return replaceLines(current, operation.replacements);
+    case "delete":
+      return "";
+    default: {
+      const unreachable = operation;
+      throw new Error(`Unknown file operation: ${JSON.stringify(unreachable)}`);
+    }
+  }
+}
+function preparePlan(cwd, plan) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const operation of plan.operations) {
+    const absolutePath = resolveWithinRoot(cwd, operation.path);
+    const existing = prepared.get(operation.path);
+    const before = existing?.before ?? readIfExists(absolutePath) ?? "";
+    const current = existing?.after ?? before;
+    prepared.set(operation.path, {
+      path: operation.path,
+      absolutePath,
+      before,
+      after: applyOperationTo(current, operation),
+      // A later operation on the same path un-deletes it: the last word wins, the same
+      // way content operations chain.
+      deleted: operation.kind === "delete"
+    });
+  }
+  return [...prepared.values()];
+}
+function writeFileAtomic(absolutePath, contents) {
+  const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
+  writeFileSync(tempPath, contents);
+  renameSync(tempPath, absolutePath);
+}
+function applyPlan(cwd, plan) {
+  const changed = preparePlan(cwd, plan).filter((file) => file.before !== file.after);
+  for (const file of changed) {
+    if (file.deleted) {
+      rmSync(file.absolutePath, { force: true });
+      continue;
+    }
+    writeFileAtomic(file.absolutePath, file.after);
+  }
+  return changed.map((file) => file.path);
+}
+
+// src/core/dispatch.ts
+function resolveFlavour(opts) {
+  if (opts.preset) return opts.preset;
+  const detection = describeFramework(readProjectPackageJson(opts.cwd));
+  if (detection.ambiguous) {
+    const warn = palette(process.stderr);
+    process.stderr.write(
+      warn.warn(
+        `sentinel: preset is ambiguous, detected "${detection.preset}" (from ${detection.source}), also found ${detection.conflicts.join(", ")}. Pass --preset to write the intended preset.`
+      ) + "\n"
+    );
+  }
+  return detection.preset;
+}
+function previewPlan(opts, plan) {
+  const changed = preparePlan(opts.cwd, plan).filter((file) => file.before !== file.after);
+  if (opts.json) {
+    process.stdout.write(
+      JSON.stringify(
+        {
+          dryRun: true,
+          notes: plan.notes ?? [],
+          files: changed.map(({ path, before, after, deleted }) => ({
+            path,
+            action: deleted ? "delete" : before.length === 0 ? "create" : "update",
+            before,
+            after
+          }))
+        },
+        null,
+        2
+      ) + "\n"
+    );
+    return 0;
+  }
+  process.stderr.write("  dry run: no files written\n");
+  for (const note of plan.notes ?? []) process.stderr.write(`  ${note}
+`);
+  if (changed.length === 0) {
+    process.stderr.write("  nothing to change\n");
+    return 0;
+  }
+  for (const { path, before, after, deleted } of changed) {
+    const action = deleted ? "delete" : before.length === 0 ? "create" : "update";
+    process.stdout.write(`
+  ${action} ${path}
+`);
+    for (const line of diffLines(before, after)) process.stdout.write(`    ${line}
+`);
+  }
+  return 0;
+}
+async function dispatch(opts) {
+  if (opts.verb !== "init") {
+    throw new Error(`dispatch handles --init only; --${opts.verb} routes through analyse()`);
+  }
+  const detected = resolveFlavour(opts);
+  const adapter = resolve(opts.target, detected, opts.runner);
+  const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
+  const context = { cwd: opts.cwd, preset };
+  const plan = await adapter.plan(context);
+  if (plan.blocked) {
+    process.stderr.write(`sentinel (${opts.target}): ${plan.blocked}
+`);
+    return 1;
+  }
+  if (opts.dryRun) {
+    return previewPlan(opts, plan);
+  }
+  const written = applyPlan(opts.cwd, plan);
+  for (const path of written) process.stderr.write(`  wrote ${path}
+`);
+  for (const note of plan.notes ?? []) process.stderr.write(`  ${note}
+`);
+  return 0;
+}
+
+export {
+  register,
+  setDefaultRunner,
+  all,
+  availableTargets,
+  resolve,
+  BaseAdapter,
+  palette,
+  readOwnPackage,
+  readOwnVersion,
+  readProjectPackageJson,
+  readNxProjectName,
+  resolveBin,
+  VERBS,
+  TARGETS,
+  PRESET_NAMES,
+  registerAdapters,
+  describeFramework,
+  detectFramework,
+  dispatch
+};
+//# sourceMappingURL=chunk-FLLX5MN3.js.map