@hublo/sentinel 1.1.0-alpha.5 → 1.1.0-alpha.7

package/README.md

@@ -158,11 +158,11 @@ pnpm dlx @hublo/sentinel@<exact-version> --inspect --typescript --module <name>
 
 Every check is described by three layers:
 
-| Layer                | Flag                        | What it is                                  | Examples                                                                               |
-| -------------------- | --------------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------- |
-| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                 | `lint` `format` `typescript` `build` `test` `static-analysis` `runtime-analysis`       |
-| **runner** (adapter) | `--runner=<tool>`           | the _tool_ behind the target, swappable     | lint: `eslint`/`biome`/`oxlint` · types: `tsc`/`tsgo` · build: `vite` · test: `vitest` |
-| **preset** (preset)  | detected / `--preset`       | the _variant_ per stack (strict by default) | `react` `nest` `node` `svelte` (svelte: lint only, no tsconfig preset yet)             |
+| Layer                | Flag                        | What it is                                  | Examples                                                                                                                                                     |
+| -------------------- | --------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                 | `lint` `format` `typescript` `build` `test` `static-analysis` `runtime-analysis`                                                                             |
+| **runner** (adapter) | `--runner=<tool>`           | the _tool_ behind the target, swappable     | lint: `eslint`/`biome`/`oxlint` · types: `tsc`/`tsgo` · build: `vite` · test: `vitest`                                                                       |
+| **preset** (preset)  | detected / `--preset`       | the _variant_ per stack (strict by default) | `react` `nest` `node` `svelte` (svelte: lint + format; no tsconfig preset yet, so the TypeScript role stands aside on those modules and the other two adopt) |
 
 A run is `target × runner × preset`, e.g. `sentinel --run --lint --runner=eslint` from the `host-admin` dir.
 

package/dist/bin/sentinel.js

@@ -16,7 +16,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-NAUACDXT.js";
+} from "../chunk-FA6N4XCP.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -223,6 +223,14 @@ async function analyse(params) {
         toolArgs: params.toolArgs
       };
       try {
+        let adoption;
+        if (params.verb === "run" || params.verb === "report") {
+          try {
+            adoption = await adapter.status(ctx);
+          } catch {
+          }
+        }
+        const adoptionFields = adoption ? { adopted: adoption.adopted, preset: adoption.preset, conformant: adoption.conformant } : {};
         if (params.verb === "run") {
           if (params.modules.length > 1) {
             const err = palette(process.stderr);
@@ -239,7 +247,7 @@ async function analyse(params) {
             flavour: effectiveFlavour,
             ok: result.ok,
             status: result.ok ? "ok" : "failed",
-            data: {}
+            data: { ...adoptionFields }
           });
           worstCode = Math.max(worstCode, result.code);
         } else if (params.verb === "report") {
@@ -250,12 +258,15 @@ async function analyse(params) {
             flavour: effectiveFlavour,
             ok: result.ok,
             status: result.ok ? "ok" : "failed",
-            data: result.metrics ?? {}
+            // Engine fields LAST, so they WIN. Spreading them first let a role's own metrics
+            // override them, which is the disagreement this was written to remove: the point
+            // is that adoption has exactly one source, not that it has a default.
+            data: { ...result.metrics ?? {}, ...adoptionFields }
           });
           worstCode = Math.max(worstCode, result.code);
         } else if (params.verb === "inspect") {
-          const [config, adoption] = await Promise.all([adapter.inspect(ctx), adapter.status(ctx)]);
-          const ok = !adoption.unreadable && (!adoption.adopted || adoption.conformant);
+          const [config, adoption2] = await Promise.all([adapter.inspect(ctx), adapter.status(ctx)]);
+          const ok = !adoption2.unreadable && (!adoption2.adopted || adoption2.conformant);
           results.push({
             project: module.name,
             target,
@@ -265,7 +276,7 @@ async function analyse(params) {
             // `inspect` is typed as `unknown` (each role shapes its own detail), so the
             // merge is guarded rather than assumed: a role returning a non-object still
             // gets its adoption fields instead of throwing here.
-            data: config && typeof config === "object" ? { ...config, ...adoption } : { ...adoption }
+            data: config && typeof config === "object" ? { ...config, ...adoption2 } : { ...adoption2 }
           });
           if (!ok) worstCode = Math.max(worstCode, 1);
         } else {

package/dist/{chunk-NAUACDXT.js → chunk-FA6N4XCP.js}

@@ -140,8 +140,8 @@ var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
@@ -548,6 +548,12 @@ function invokesFormat(script) {
 function keepsOtherCommands2(script, command) {
   return keepsOtherCommands(script, command ?? SENTINEL_FORMAT_COMMAND);
 }
+function writesWhenRewritten(name, command) {
+  if (/[:-](fix|write)$/.test(name)) return true;
+  if (CHECK_SCRIPT_NAMES.has(name) || /[:-]check$/.test(name)) return false;
+  return /--write\b/.test(command);
+}
+var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
 import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
@@ -578,6 +584,42 @@ function inheritedIgnorePatterns(workspaceRoot) {
   return [...new Set(carried)].sort();
 }
 
+// src/roles/format/oxfmt-diagnostics.ts
+var MESSAGE = /^\s*[x\u00d7]\s+(.+?)\s*$/;
+var LOCATION = /[,\u256d][-\u2500]\[([^\]]+?):(\d+):\d+\]/;
+var ANSI = /\u001b\[[0-9;]*m/g;
+function plain(output) {
+  return output.replace(ANSI, "");
+}
+function unparseableFiles(output) {
+  const diagnostics = [];
+  let pending;
+  for (const raw of plain(output).split("\n")) {
+    const location = LOCATION.exec(raw);
+    if (location && pending) {
+      diagnostics.push({
+        file: location[1] ?? "",
+        line: Number(location[2] ?? 0),
+        message: pending
+      });
+      pending = void 0;
+      continue;
+    }
+    const message = MESSAGE.exec(raw);
+    if (message) pending = message[1];
+  }
+  return diagnostics;
+}
+function oxfmtSaid(output) {
+  const lines = plain(output).split("\n");
+  const diagnostic = lines.find((line) => MESSAGE.test(line));
+  if (diagnostic) return MESSAGE.exec(diagnostic)?.[1] ?? diagnostic.trim();
+  return [...lines].reverse().find((line) => line.trim().length > 0)?.trim() ?? "no output";
+}
+function needsSvelteCompiler(output) {
+  return /svelte\/compiler/.test(output);
+}
+
 // src/roles/format/presets/base.json
 var base_default = {
   printWidth: 80,
@@ -594,17 +636,21 @@ var base_default = {
 };
 
 // src/roles/format/preset-data.ts
-var FORMAT_PRESETS = ["base"];
+var FORMAT_PRESETS = ["base", "svelte"];
 function hasFormatPreset(name) {
   return FORMAT_PRESETS.includes(name);
 }
-function formatPresetFor(_preset) {
-  return base_default;
+function formatPresetName(declared) {
+  return declared === "svelte" ? "svelte" : "base";
+}
+function formatPresetFor(preset) {
+  const base = base_default;
+  return formatPresetName(preset) === "svelte" ? { ...base, svelte: true } : base;
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join9 } from "path";
 
 // src/shared/jsonc.ts
 import { parse, printParseErrorCode } from "jsonc-parser";
@@ -618,17 +664,78 @@ function parseJsonc(text, source = "config") {
   return value;
 }
 
+// src/roles/format/resolve-oxfmt.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname4, join as join8 } from "path";
+function resolveOxfmt(cwd) {
+  return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
+}
+function oxfmtRejects(key, value) {
+  const schema = configSchema();
+  const property = schema?.properties?.[key];
+  if (!property) return false;
+  const definition = resolveRef(schema, property);
+  if (Array.isArray(definition.enum)) return !definition.enum.includes(value);
+  if (definition.type === "boolean") return typeof value !== "boolean";
+  if (definition.type === "integer" || definition.type === "number")
+    return typeof value !== "number";
+  return false;
+}
+function resolveRef(schema, node) {
+  const ref = node.$ref ?? node.allOf?.[0]?.$ref;
+  const name = ref?.startsWith("#/definitions/") ? ref.slice("#/definitions/".length) : void 0;
+  return (name ? schema.definitions?.[name] : void 0) ?? node;
+}
+var cachedSchema;
+function configSchema() {
+  if (cachedSchema !== void 0) return cachedSchema ?? void 0;
+  cachedSchema = readConfigSchema() ?? null;
+  return cachedSchema ?? void 0;
+}
+function readConfigSchema() {
+  try {
+    const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
+    const schemaPath = join8(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync5(schemaPath, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/roles/format/prettier-config.ts
 var UNSUPPORTED = /* @__PURE__ */ new Set(["plugins", "parser", "filepath", "rangeStart", "rangeEnd"]);
+function toOxfmtOverrides(value) {
+  if (!Array.isArray(value)) return { overrides: [], unresolved: [] };
+  const overrides = [];
+  const unresolved = [];
+  for (const entry of value) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const { files, options } = entry;
+    const patterns = typeof files === "string" ? [files] : Array.isArray(files) ? files : [];
+    if (patterns.length === 0) continue;
+    const kept = {};
+    for (const [key, option] of Object.entries(options ?? {})) {
+      const where = `overrides[${patterns.join(", ")}].${key}`;
+      if (UNSUPPORTED.has(key)) unresolved.push(where);
+      else if (!PERMITTED_LOCAL_KEYS.includes(key)) continue;
+      else if (oxfmtRejects(key, option)) {
+        unresolved.push(`${where}: ${JSON.stringify(option)} (oxfmt does not accept that value)`);
+      } else kept[key] = option;
+    }
+    if (Object.keys(kept).length > 0) overrides.push({ files: patterns, options: kept });
+  }
+  return { overrides, unresolved };
+}
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join8(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join9(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync5(join8(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync6(join9(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -636,10 +743,21 @@ function readPrettierSettings(cwd) {
   const unresolved = [];
   for (const [key, value] of Object.entries(parsed)) {
     if (UNSUPPORTED.has(key)) {
-      unresolved.push(`${key} (oxfmt has no equivalent)`);
+      const named = key === "plugins" && Array.isArray(value) ? value.map((plugin) => `plugins: ${String(plugin)}`) : [key];
+      unresolved.push(...named.map((entry) => `${entry} (oxfmt has no equivalent)`));
+      continue;
+    }
+    if (key === "overrides") {
+      const translated = toOxfmtOverrides(value);
+      if (translated.overrides.length > 0) options.overrides = translated.overrides;
+      unresolved.push(...translated.unresolved.map((entry) => `${entry} (oxfmt has no equivalent)`));
       continue;
     }
     if (PERMITTED_LOCAL_KEYS.includes(key) || ALWAYS_LOCAL_KEYS.includes(key)) {
+      if (oxfmtRejects(key, value)) {
+        unresolved.push(`${key}: ${JSON.stringify(value)} (oxfmt does not accept that value)`);
+        continue;
+      }
       options[key] = value;
     }
   }
@@ -647,8 +765,8 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -663,11 +781,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join9(cwd, FORMAT_CONFIG_FILE);
+  const path = join10(cwd, FORMAT_CONFIG_FILE);
   if (!existsSync9(path)) return NOT_ADOPTED(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync6(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync7(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -709,13 +827,8 @@ function readFormatAdoption(cwd) {
   };
 }
 
-// src/roles/format/resolve-oxfmt.ts
-function resolveOxfmt(cwd) {
-  return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
-}
-
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
-var PRESET = "base";
+var DEFAULT_PRESET = "base";
 var OXFMT_VALUE_FLAGS = ["-c", "--config", "--ignore-path", "--threads", "--stdin-filepath"];
 var OxfmtAdapter = class extends BaseAdapter {
   target = "format";
@@ -732,7 +845,8 @@ var OxfmtAdapter = class extends BaseAdapter {
       };
     }
     const own = readOwnPackage();
-    const preset = formatPresetFor(PRESET);
+    const presetName = formatPresetName(context.preset);
+    const preset = formatPresetFor(presetName);
     const existing = readFormatAdoption(context.cwd);
     const prettier = readPrettierSettings(context.cwd);
     const local = existing.adopted ? { ...existing.local } : { ...prettier.options };
@@ -748,7 +862,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     const unchanged = existing.adopted && existing.conformant;
     const version = unchanged && existing.presetVersion ? existing.presetVersion : own.version;
     const config = {
-      [PROVENANCE_KEY]: { preset: PRESET, version, local: localKeys },
+      [PROVENANCE_KEY]: { preset: presetName, version, local: localKeys },
       ...preset,
       ...Object.fromEntries(
         [...localKeys, ...ALWAYS_LOCAL_KEYS].flatMap(
@@ -763,7 +877,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync10(join10(context.cwd, name))
+      (name) => existsSync10(join11(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -772,7 +886,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     }
     operations.push(...nxTargetOperations({ cwd: context.cwd, targets: formatTargets() }));
     const notes = [
-      `materialized the ${PRESET} format preset into ${FORMAT_CONFIG_FILE} (${own.name}@${own.version}). oxfmt has no \`extends\`, so the values live here; \`sentinel --status --format\` reports modules left behind by a preset change`
+      `materialized the ${presetName} format preset into ${FORMAT_CONFIG_FILE} (${own.name}@${own.version}). oxfmt has no \`extends\`, so the values live here; \`sentinel --status --format\` reports modules left behind by a preset change`
     ];
     if (localKeys.length > 0) {
       notes.push(
@@ -784,9 +898,12 @@ var OxfmtAdapter = class extends BaseAdapter {
         `carried ${inherited.length} ignore pattern(s) from the workspace .prettierignore (${inherited.join(", ")}). oxfmt reads that file from the CURRENT directory and sentinel runs it in this module, so without them adoption would start formatting files the repo has always excluded`
       );
     }
-    if (prettier.unresolved.length > 0) {
+    const lost = prettier.unresolved.filter(
+      (entry) => !(presetName === "svelte" && /svelte/i.test(entry))
+    );
+    if (lost.length > 0) {
       notes.push(
-        `COULD NOT carry ${prettier.unresolved.join("; ")}. Check it and add what you need to ${FORMAT_CONFIG_FILE}, declaring the key in \`${PROVENANCE_KEY}.local\` so a re-init keeps it`
+        `COULD NOT carry ${lost.join("; ")}. Check it and add what you need to ${FORMAT_CONFIG_FILE}, declaring the key in \`${PROVENANCE_KEY}.local\` so a re-init keeps it`
       );
     }
     if (prettierConfigs.length > 0) {
@@ -819,7 +936,45 @@ var OxfmtAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
-    spawnSync(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const pass = spawnSync(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    if (pass.status === 0) return;
+    const output = `${pass.stdout ?? ""}${pass.stderr ?? ""}`;
+    const unparseable = unparseableFiles(output);
+    const warn = palette(process.stderr).warn;
+    if (unparseable.length > 0) {
+      process.stderr.write(
+        warn(
+          `  ${unparseable.length} file(s) oxfmt cannot parse, so they were NOT formatted and \`pnpm run ${FORMAT_SCRIPT_NAME}\` fails until they are fixed:
+`
+        )
+      );
+      for (const { file, line, message } of unparseable) {
+        process.stderr.write(warn(`    ${file}:${line}  ${message}
+`));
+      }
+      process.stderr.write(
+        palette(process.stderr).dim(
+          `  These are syntax errors Prettier recovered from and oxfmt refuses. They are the module's, not the migration's: fix them (usually one line), or exclude them in \`ignorePatterns\`.
+`
+        )
+      );
+      return;
+    }
+    if (needsSvelteCompiler(output)) {
+      process.stderr.write(
+        warn(
+          `  .svelte files are not formatted yet: oxfmt loads the Svelte compiler from this module, and it is not installed here. Run \`pnpm install\`, then \`pnpm run ${FORMAT_SCRIPT_NAME}:fix\`.
+`
+        )
+      );
+      return;
+    }
+    process.stderr.write(
+      warn(
+        `  the format pass did not finish, so this module is not formatted yet: ${oxfmtSaid(output)}
+`
+      )
+    );
   }
   /** Check formatting; `--fix` writes. */
   async run(ctx) {
@@ -870,7 +1025,7 @@ var OxfmtAdapter = class extends BaseAdapter {
    */
   async inspect(ctx) {
     const adoption = readFormatAdoption(ctx.cwd);
-    const preset = formatPresetFor(adoption.preset ?? PRESET);
+    const preset = formatPresetFor(adoption.preset ?? DEFAULT_PRESET);
     const options = { ...preset, ...adoption.local };
     const describe = (value) => typeof value === "string" ? value : JSON.stringify(value);
     return {
@@ -881,7 +1036,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       options,
       overrides: Object.entries(adoption.local).filter(([key]) => !ALWAYS_LOCAL_KEYS.includes(key)).map(([key, value]) => ({
         rule: key,
-        reason: key in preset ? `${describe(value)}, where the ${adoption.preset ?? PRESET} preset says ${describe(preset[key])}` : `${describe(value)}, which the preset does not set`
+        reason: key in preset ? `${describe(value)}, where the ${adoption.preset ?? DEFAULT_PRESET} preset says ${describe(preset[key])}` : `${describe(value)}, which the preset does not set`
       })),
       // Which files this module does not format at all. A long list here is worth a look:
       // it is the quiet way a module stops being covered.
@@ -902,7 +1057,7 @@ var OxfmtAdapter = class extends BaseAdapter {
    */
   async report(ctx) {
     const adoption = readFormatAdoption(ctx.cwd);
-    const base = { adopted: adoption.adopted, preset: adoption.preset };
+    const base = {};
     if (!adoption.adopted) return { ok: true, code: 0, metrics: { ...base, unformatted: 0 } };
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) {
@@ -948,7 +1103,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync7(join10(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync8(join11(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -981,7 +1136,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       // script too and rewrote it into a second format run.
       ownCommand !== void 0 && /\bsentinel\b/.test(command) && /--format\b/.test(command);
       if (!needsRewrite) continue;
-      rewritten[name] = compose(command, /--write\b/.test(command) || /:(fix|write)$/.test(name));
+      rewritten[name] = compose(command, writesWhenRewritten(name, command));
     }
     return this.joinFormatIntoLint(scripts, rewritten, ownCommand);
   }
@@ -1028,8 +1183,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2864,22 +3019,28 @@ function parseOxlintDiagnostics(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
 
 // src/core/config/owned-keys.ts
-function presetOwnedKeys(config, permitted) {
+function presetOwnedKeys(config, permitted, presetSets) {
+  if (!config) return [];
+  return Object.keys(config).filter(
+    (key) => !permitted.includes(key) && (presetSets === void 0 || presetSets.includes(key))
+  );
+}
+function localOnlyKeys(config, permitted, presetSets) {
   if (!config) return [];
-  return Object.keys(config).filter((key) => !permitted.includes(key));
+  return Object.keys(config).filter((key) => !permitted.includes(key) && !presetSets.includes(key));
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync8(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync9(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -2893,7 +3054,7 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join11(moduleDir, candidate);
+    const absolutePath = join12(moduleDir, candidate);
     if (!existsSync11(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
@@ -2927,12 +3088,12 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync12(join12(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync12(join13(cwd, target.path))) {
     return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync9(join12(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync10(join13(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
@@ -2940,7 +3101,7 @@ function readAdoption(cwd, options) {
   const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
   if (preset === null) return NOT_ADOPTED2(target.path);
   const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
-  const drift = presetOwnedKeys(settings, options.permitted);
+  const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
   return {
     configFile: target.path,
     preset,
@@ -2967,14 +3128,14 @@ function readLintAdoption(cwd) {
 
 // src/roles/lint/resolve-oxlint.ts
 import { existsSync as existsSync13 } from "fs";
-import { createRequire as createRequire2 } from "module";
-import { delimiter as delimiter2, dirname as dirname4, join as join13 } from "path";
+import { createRequire as createRequire3 } from "module";
+import { delimiter as delimiter2, dirname as dirname5, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
   tsgolint: "oxlint-tsgolint"
 };
-var require3 = createRequire2(import.meta.url);
+var require3 = createRequire3(import.meta.url);
 function resolveOxlint(cwd, name = "oxlint") {
   return resolveBin(cwd, name) ?? binFromOwnInstall(PACKAGE_OF[name], name);
 }
@@ -2984,7 +3145,7 @@ function canRunTypeAware(cwd) {
 function oxlintPath(cwd, env) {
   const shim = tsgolintShim(cwd);
   if (!shim) return env.PATH;
-  return [dirname4(shim), env.PATH].filter(Boolean).join(delimiter2);
+  return [dirname5(shim), env.PATH].filter(Boolean).join(delimiter2);
 }
 function tsgolintShim(cwd) {
   const fromModule = resolveBin(cwd, "tsgolint");
@@ -2992,17 +3153,17 @@ function tsgolintShim(cwd) {
   const candidates = [];
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
-      const packageDir = dirname4(require3.resolve(`${owner}/package.json`));
-      candidates.push(join13(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join13(packageDir, "..", ".bin", "tsgolint"));
+      const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
+      candidates.push(join14(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join14(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
-    const ownRoot = dirname4(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join13(ownRoot, "node_modules", ".bin", "tsgolint"));
+    const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
+    candidates.push(join14(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
-    candidates.push(resolveBin(dirname4(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
+    candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
   return candidates.find((candidate) => candidate !== "" && existsSync13(candidate));
 }
@@ -3011,12 +3172,12 @@ function oxlintSearchPath(cwd) {
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -3029,11 +3190,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join14(cwd, name)).find((path) => existsSync14(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join15(cwd, name)).find((path) => existsSync14(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync10(config, "utf8");
+    source = readFileSync11(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -3087,8 +3248,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync11, statSync } from "fs";
-import { join as join15, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync } from "fs";
+import { join as join16, relative as relative2 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -3135,7 +3296,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join15(dir, entry);
+    const full = join16(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync(full).isDirectory();
@@ -3155,7 +3316,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync11(file, "utf8");
+      content = readFileSync12(file, "utf8");
     } catch {
       continue;
     }
@@ -3228,7 +3389,7 @@ function plan(context) {
   if (!hasLintPreset(context.preset)) {
     return {
       operations: [],
-      blocked: `sentinel does not ship a lint preset named "${context.preset}" yet (shipped: ${LINT_PRESETS.join(", ")}). Nothing was written; this module cannot adopt the lint preset until that preset ships.`
+      skipped: `sentinel does not ship a lint preset named "${context.preset}" yet (shipped: ${LINT_PRESETS.join(", ")}). Nothing was written; the module keeps its current linter and the other roles adopt normally.`
     };
   }
   const current = presetOfVariant(presetNameFromPath(readLintAdoption(context.cwd).preset));
@@ -3273,7 +3434,7 @@ function plan(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join16(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join17(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -3368,7 +3529,7 @@ function lintScripts(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync13(join17(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -3380,7 +3541,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync12(join16(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync13(join17(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -3479,7 +3640,7 @@ var OxlintAdapter = class extends BaseAdapter {
     this.fixPass(ctx, oxlint, env);
   }
   async run(ctx) {
-    if (!existsSync16(join17(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync16(join18(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -3572,9 +3733,9 @@ var OxlintAdapter = class extends BaseAdapter {
     if (target) return 0;
     let total = 0;
     try {
-      const stub = JSON.parse(readFileSync13(join17(cwd, LINT_CONFIG_FILE), "utf8"));
+      const stub = JSON.parse(readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"));
       for (const entry of stub.extends ?? []) {
-        const preset = JSON.parse(readFileSync13(join17(cwd, entry), "utf8"));
+        const preset = JSON.parse(readFileSync14(join18(cwd, entry), "utf8"));
         total += Object.keys(preset.rules ?? {}).length;
       }
     } catch {
@@ -3585,10 +3746,9 @@ var OxlintAdapter = class extends BaseAdapter {
   /** Lint health for `--report`. Deepened in a later step; today it is the run outcome. */
   async report(ctx) {
     const adoption = readLintAdoption(ctx.cwd);
-    if (!adoption.adopted) return { ok: true, code: 0, metrics: { adopted: false } };
+    if (!adoption.adopted) return { ok: true, code: 0, metrics: {} };
     const oxlint = resolveOxlint(ctx.cwd);
-    if (!oxlint)
-      return { ok: false, code: 1, metrics: { adopted: true, error: "oxlint not found" } };
+    if (!oxlint) return { ok: false, code: 1, metrics: { error: "oxlint not found" } };
     const typeAware = canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [];
     const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
@@ -3596,7 +3756,7 @@ var OxlintAdapter = class extends BaseAdapter {
       env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) }
     });
     if (result.error) {
-      return { ok: false, code: 1, metrics: { adopted: true, error: result.error.message } };
+      return { ok: false, code: 1, metrics: { error: result.error.message } };
     }
     const diagnostics = parseOxlintDiagnostics(result.stdout ?? "");
     const errors = diagnostics.filter((entry) => entry.severity === "error").length;
@@ -3614,7 +3774,6 @@ var OxlintAdapter = class extends BaseAdapter {
       ok: errors === 0,
       code: errors === 0 ? 0 : 1,
       metrics: {
-        adopted: true,
         errors,
         warnings,
         rules,
@@ -3642,12 +3801,12 @@ var OxlintAdapter = class extends BaseAdapter {
   unresolvedPreset(cwd) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync13(join17(cwd, LINT_CONFIG_FILE), "utf8"));
+      parsed = JSON.parse(readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"));
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync16(join17(cwd, target)));
+    return targets.find((target) => !existsSync16(join18(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -3679,8 +3838,8 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { createRequire as createRequire3 } from "module";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { createRequire as createRequire4 } from "module";
 import { join as join20 } from "path";
 
 // src/roles/typescript/presets/base.json
@@ -3797,6 +3956,14 @@ validate2();
 function hasShippedPreset(preset) {
   return preset in LAYERS;
 }
+function tsPresetFor(preset) {
+  const layer = LAYERS[preset];
+  if (!layer) throw new Error(`no TypeScript preset ships for preset "${preset}"`);
+  return {
+    ...BASE.$schema === void 0 ? {} : { $schema: BASE.$schema },
+    compilerOptions: { ...BASE.compilerOptions, ...layer.compilerOptions }
+  };
+}
 
 // src/roles/typescript/phased-rules.ts
 function deferredRuleNames2() {
@@ -3811,8 +3978,17 @@ var PERMITTED_COMPILER_OPTIONS = [
   "outDir",
   "tsBuildInfoFile"
 ];
-function presetOwnedKeys2(compilerOptions) {
-  return presetOwnedKeys(compilerOptions, PERMITTED_COMPILER_OPTIONS);
+function presetCompilerOptionKeys(preset) {
+  if (preset === void 0 || !hasShippedPreset(preset)) return void 0;
+  return Object.keys(tsPresetFor(preset).compilerOptions);
+}
+function presetOwnedKeys2(compilerOptions, preset) {
+  return presetOwnedKeys(compilerOptions, PERMITTED_COMPILER_OPTIONS, presetCompilerOptionKeys(preset));
+}
+function localOnlyCompilerOptions(compilerOptions, preset) {
+  const sets = presetCompilerOptionKeys(preset);
+  if (sets === void 0) return [];
+  return localOnlyKeys(compilerOptions, PERMITTED_COMPILER_OPTIONS, sets);
 }
 
 // src/roles/typescript/resolve-tsconfig-target.ts
@@ -3836,7 +4012,11 @@ function readTsconfigAdoption(cwd) {
     fallback: TSCONFIG_FALLBACK,
     presetPattern: SENTINEL_PRESET,
     settingsKey: "compilerOptions",
-    permitted: PERMITTED_COMPILER_OPTIONS
+    permitted: PERMITTED_COMPILER_OPTIONS,
+    // Drift is measured against what the preset SETS, not against the allowlist alone: see
+    // `presetOwnedKeys`. Without this a module overriding the workspace base reads as
+    // non-conformant forever, since re-running `--init` would not (and should not) fix it.
+    presetOwns: (path) => presetCompilerOptionKeys(path.slice(path.lastIndexOf("/") + 1)) ?? []
   });
 }
 
@@ -3844,86 +4024,6 @@ function readTsconfigAdoption(cwd) {
 import { readFileSync as readFileSync15 } from "fs";
 import { join as join19 } from "path";
 
-// src/core/config/preset-evidence.ts
-import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
-var PATH_SIGNALS = [
-  {
-    preset: "nest",
-    pattern: /(^|\/)apps\/nest\//,
-    evidence: "it lives under apps/nest"
-  }
-];
-var DEPENDENCY_SIGNALS = [
-  { preset: "react", pattern: /^(react|react-dom|@types\/react)$|^eslint-plugin-react/ },
-  { preset: "svelte", pattern: /^svelte$|^@sveltejs\// },
-  { preset: "nest", pattern: /^@nestjs\// }
-];
-function dependencyNames(cwd) {
-  const path = join18(cwd, "package.json");
-  if (!existsSync17(path)) return [];
-  try {
-    const manifest = parseJsonc(
-      readFileSync14(path, "utf8"),
-      path
-    );
-    return [
-      ...Object.keys(manifest.dependencies ?? {}),
-      ...Object.keys(manifest.devDependencies ?? {})
-    ];
-  } catch {
-    return [];
-  }
-}
-function declaresJsx(cwd) {
-  let entries;
-  try {
-    entries = readdirSync3(cwd).filter(
-      (name) => name.startsWith("tsconfig") && name.endsWith(".json")
-    );
-  } catch {
-    return false;
-  }
-  for (const name of entries) {
-    try {
-      const config = parseJsonc(
-        readFileSync14(join18(cwd, name), "utf8"),
-        name
-      );
-      if (config.compilerOptions?.jsx !== void 0) return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function presetSignals(cwd) {
-  const signals = [];
-  const dependencies = dependencyNames(cwd);
-  for (const { preset, pattern } of DEPENDENCY_SIGNALS) {
-    const hit = dependencies.find((name) => pattern.test(name));
-    if (hit) signals.push({ preset, evidence: `it depends on "${hit}"` });
-  }
-  if (declaresJsx(cwd) && !signals.some((signal) => signal.preset === "react")) {
-    signals.push({ preset: "react", evidence: 'its tsconfig sets "jsx"' });
-  }
-  const location = cwd.replaceAll("\\", "/");
-  for (const { preset, pattern, evidence } of PATH_SIGNALS) {
-    if (pattern.test(location) && !signals.some((signal) => signal.preset === preset)) {
-      signals.push({ preset, evidence });
-    }
-  }
-  return signals;
-}
-function presetContradiction(declared, cwd) {
-  const signals = presetSignals(cwd);
-  if (signals.length === 0) return void 0;
-  if (signals.some((signal) => signal.preset === declared)) return void 0;
-  const [first] = signals;
-  if (!first) return void 0;
-  const evidence = signals.map((signal) => signal.evidence).join(", and ");
-  return `--preset ${declared} does not match this module: ${evidence}, which makes it "${first.preset}". Nothing was written. Re-run with --preset ${first.preset}, or adopt from the module you actually meant.`;
-}
-
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
 var TYPECHECK_SCRIPT_NAME = "typecheck";
@@ -3964,7 +4064,7 @@ function planAdoption(context) {
   if (!hasShippedPreset(context.preset)) {
     return {
       operations: [],
-      blocked: `sentinel does not ship a TypeScript preset named "${context.preset}" yet (shipped: ${SHIPPED_PRESETS.join(", ")}). Nothing was written; this module cannot adopt the TypeScript preset until that preset ships.`
+      skipped: `sentinel does not ship a TypeScript preset named "${context.preset}" yet (shipped: ${SHIPPED_PRESETS.join(", ")}). Nothing was written, and the module keeps its own tsconfig; the other roles adopt normally.`
     };
   }
   const current = declaredPreset(context.cwd);
@@ -3974,10 +4074,6 @@ function planAdoption(context) {
       blocked: `this module is already adopted as "${current}", and --preset says "${context.preset}". Nothing was written. If the change is deliberate, remove the sentinel preset from the tsconfig \`extends\` chain and re-run; otherwise re-run with --preset ${current}.`
     };
   }
-  const contradiction = presetContradiction(context.preset, context.cwd);
-  if (contradiction !== void 0) {
-    return { operations: [], blocked: contradiction };
-  }
   if (!hasSourceFiles(context.cwd, TYPECHECKABLE_EXTENSIONS)) {
     return {
       operations: [],
@@ -4015,7 +4111,8 @@ function planAdoption(context) {
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
-  const drift = presetOwnedKeys2(existing.compilerOptions);
+  const drift = presetOwnedKeys2(existing.compilerOptions, context.preset);
+  const keptLocal = localOnlyCompilerOptions(existing.compilerOptions, context.preset);
   const operations = [
     { kind: "merge-json", path: target.path, value: { extends: extendsChain } }
   ];
@@ -4030,6 +4127,11 @@ function planAdoption(context) {
     });
     notes.push(`stripped preset-owned compilerOptions: ${drift.join(", ")}`);
   }
+  if (keptLocal.length > 0) {
+    notes.push(
+      `KEPT this module's own compilerOptions (${keptLocal.join(", ")}): the preset does not set them, so they are yours rather than drift. Removing them would not hand the decision to the preset, it would hand it to the workspace tsconfig this module extends`
+    );
+  }
   operations.push(addScript, ...nxTargets);
   const existingCheck = moduleScripts(context.cwd)[TYPECHECK_SCRIPT_NAME];
   if (keepsForeignChecker(existingCheck)) {
@@ -4062,7 +4164,7 @@ function parseDiagnostics(output) {
   return diagnostics;
 }
 var PHASED_STRICTNESS_WARNING = `sentinel typescript: phase 1 (non-breaking) \u2014 deferred: ${deferredRuleNames2().join(", ")}. Enabled centrally in a later wave; run \`sentinel --inspect --typescript\` for the list, or \`sentinel --run --typescript -- --noImplicitAny\` to measure what one would cost today.`;
-var TscAdapter = class extends BaseAdapter {
+var TscAdapter = class _TscAdapter extends BaseAdapter {
   target = "typescript";
   runner = "tsc";
   /**
@@ -4156,7 +4258,7 @@ var TscAdapter = class extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire3(join20(cwd, "noop.js")).resolve(preset);
+      createRequire4(join20(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -4170,6 +4272,13 @@ var TscAdapter = class extends BaseAdapter {
       );
       return { ok: true, code: 0 };
     }
+    if (!readTsconfigAdoption(ctx.cwd).adopted) {
+      process.stderr.write(
+        `sentinel typescript(tsc): no sentinel preset in this module's tsconfig; run \`sentinel --init --typescript\` to adopt.
+`
+      );
+      return { ok: true, code: 0 };
+    }
     const missing = this.missingPresetPackage(ctx.cwd);
     if (missing) {
       process.stderr.write(
@@ -4261,7 +4370,7 @@ var TscAdapter = class extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync18(join20(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync17(join20(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -4295,10 +4404,23 @@ var TscAdapter = class extends BaseAdapter {
    * 7006/7031/7053/… ), the signal that drives the noImplicitAny migration. No
    * tsconfig is a clean, empty report.
    */
+  /**
+   * The metrics for a module this role has nothing to say about. Every KEY the full path
+   * emits, so a consumer never sees a row whose shape depends on whether the module adopted.
+   */
+  static NOTHING_TO_REPORT = {
+    errors: 0,
+    implicitAny: "deferred",
+    diagnostics: [],
+    diagnosticsTruncated: false
+  };
   async report(ctx) {
     const config = this.typecheckTarget(ctx.cwd);
     if (!config) {
-      return { ok: true, code: 0, metrics: { errors: 0, implicitAny: "deferred", diagnostics: [] } };
+      return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
+    }
+    if (!readTsconfigAdoption(ctx.cwd).adopted) {
+      return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
     const result = spawnSync3(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
@@ -4451,7 +4573,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve3, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -4470,7 +4592,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync19(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
+  return existsSync18(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -4587,6 +4709,86 @@ function applyPlan(cwd, plan2) {
   return changed.map((file) => ({ path: file.path, deleted: Boolean(file.deleted) }));
 }
 
+// src/core/config/preset-evidence.ts
+import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "fs";
+import { join as join21 } from "path";
+var PATH_SIGNALS = [
+  {
+    preset: "nest",
+    pattern: /(^|\/)apps\/nest\//,
+    evidence: "it lives under apps/nest"
+  }
+];
+var DEPENDENCY_SIGNALS = [
+  { preset: "react", pattern: /^(react|react-dom|@types\/react)$|^eslint-plugin-react/ },
+  { preset: "svelte", pattern: /^svelte$|^@sveltejs\// },
+  { preset: "nest", pattern: /^@nestjs\// }
+];
+function dependencyNames(cwd) {
+  const path = join21(cwd, "package.json");
+  if (!existsSync19(path)) return [];
+  try {
+    const manifest = parseJsonc(
+      readFileSync18(path, "utf8"),
+      path
+    );
+    return [
+      ...Object.keys(manifest.dependencies ?? {}),
+      ...Object.keys(manifest.devDependencies ?? {})
+    ];
+  } catch {
+    return [];
+  }
+}
+function declaresJsx(cwd) {
+  let entries;
+  try {
+    entries = readdirSync3(cwd).filter(
+      (name) => name.startsWith("tsconfig") && name.endsWith(".json")
+    );
+  } catch {
+    return false;
+  }
+  for (const name of entries) {
+    try {
+      const config = parseJsonc(
+        readFileSync18(join21(cwd, name), "utf8"),
+        name
+      );
+      if (config.compilerOptions?.jsx !== void 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function presetSignals(cwd) {
+  const signals = [];
+  const dependencies = dependencyNames(cwd);
+  for (const { preset, pattern } of DEPENDENCY_SIGNALS) {
+    const hit = dependencies.find((name) => pattern.test(name));
+    if (hit) signals.push({ preset, evidence: `it depends on "${hit}"` });
+  }
+  if (declaresJsx(cwd) && !signals.some((signal) => signal.preset === "react")) {
+    signals.push({ preset: "react", evidence: 'its tsconfig sets "jsx"' });
+  }
+  const location = cwd.replaceAll("\\", "/");
+  for (const { preset, pattern, evidence } of PATH_SIGNALS) {
+    if (pattern.test(location) && !signals.some((signal) => signal.preset === preset)) {
+      signals.push({ preset, evidence });
+    }
+  }
+  return signals;
+}
+function presetContradiction(declared, cwd) {
+  const signals = presetSignals(cwd);
+  if (signals.length === 0) return void 0;
+  if (signals.some((signal) => signal.preset === declared)) return void 0;
+  const [first] = signals;
+  if (!first) return void 0;
+  const evidence = signals.map((signal) => signal.evidence).join(", and ");
+  return `--preset ${declared} does not match this module: ${evidence}, which makes it "${first.preset}". Nothing was written. Re-run with --preset ${first.preset}, or adopt from the module you actually meant.`;
+}
+
 // src/core/dispatch.ts
 function resolveFlavour(opts) {
   if (opts.preset) return opts.preset;
@@ -4646,6 +4848,12 @@ async function dispatch(opts) {
   const detected = resolveFlavour(opts);
   const adapter = resolve(opts.target, detected, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
+  const contradiction = presetContradiction(preset, opts.cwd);
+  if (contradiction !== void 0) {
+    process.stderr.write(`sentinel (${opts.target}): ${contradiction}
+`);
+    return 1;
+  }
   const context = { cwd: opts.cwd, preset };
   const plan2 = await adapter.plan(context);
   if (plan2.blocked) {
@@ -4694,8 +4902,8 @@ export {
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
-  resolveBin,
   palette,
+  resolveBin,
   VERBS,
   TARGETS,
   PRESET_NAMES,
@@ -4704,4 +4912,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-NAUACDXT.js.map
+//# sourceMappingURL=chunk-FA6N4XCP.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-NAUACDXT.js";
+} from "./chunk-FA6N4XCP.js";
 export {
   BaseAdapter,
   all,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.1.0-alpha.5",
+  "version": "1.1.0-alpha.7",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",