@hublo/sentinel 1.1.4 → 1.1.6

package/dist/bin/sentinel.js

@@ -9,6 +9,7 @@ import {
   dispatch,
   ensureWorkspacePrep,
   findWorkspaceRoot,
+  inspectWorkspacePrep,
   palette,
   readNxProjectName,
   readOwnVersion,
@@ -16,7 +17,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-HNE774F7.js";
+} from "../chunk-RGIEWANO.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -438,6 +439,10 @@ function renderStatusSummary(items, p) {
 }
 
 // src/cli/run-verb.ts
+function workspacePrep(cwd2) {
+  const root = findWorkspaceRoot(cwd2);
+  return root ? inspectWorkspacePrep(root) : [];
+}
 async function runVerb(ctx) {
   const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: ctx.ci });
   const out = palette(process.stdout);
@@ -482,7 +487,15 @@ async function runVerb(ctx) {
   });
   const summary = generateSummaries(results, ctx.targets);
   if (ctx.json) {
-    const base = ctx.verb === "status" || ctx.verb === "inspect" ? { ...summary, coverage: statusCoverage(summary.results) } : summary;
+    const base = ctx.verb === "status" || ctx.verb === "inspect" ? {
+      ...summary,
+      coverage: statusCoverage(summary.results),
+      // The root-level changes sentinel maintains, each with its justification checked
+      // NOW rather than described in a comment. They are the only thing sentinel does
+      // that nobody can see afterwards, and every one of them is temporary. See
+      // `inspectWorkspacePrep`.
+      ...ctx.verb === "inspect" ? { workspace: workspacePrep(ctx.cwd) } : {}
+    } : summary;
     const payload = ctx.toolArgs.length > 0 ? { ...base, toolArgs: ctx.toolArgs } : base;
     process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
   } else if (ctx.verb === "status" || ctx.verb === "inspect" && modules.length > 1) {
@@ -493,6 +506,19 @@ async function runVerb(ctx) {
       process.stdout.write(renderSummary(item, out) + "\n");
     }
   }
+  if (!ctx.json && ctx.verb === "inspect") {
+    const prep = workspacePrep(ctx.cwd);
+    if (prep.length > 0) {
+      process.stdout.write(`
+  sentinel maintains these at the workspace root:
+`);
+      for (const entry of prep) {
+        process.stdout.write(`    ${out.strong(entry.rule)}
+      ${entry.reason}
+`);
+      }
+    }
+  }
   process.stderr.write(
     err.dim(`  ${modules.length} module(s) [${scope}] in ${Date.now() - started}ms
 `)

package/dist/{chunk-HNE774F7.js → chunk-RGIEWANO.js}

@@ -140,12 +140,106 @@ var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
+
+// src/core/config/existing-command.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+// src/core/config/manifest.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { basename, join as join2 } from "path";
+function moduleScripts(cwd) {
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    return pkg.scripts ?? {};
+  } catch {
+    return {};
+  }
+}
+function moduleName(cwd) {
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    return pkg.name;
+  } catch {
+    return void 0;
+  }
+}
+function isSelfAdoption(cwd) {
+  return moduleName(cwd) === readOwnPackage().name;
+}
+function selfCommand(cwd, flags) {
+  const own = readOwnPackage();
+  if (!isSelfAdoption(cwd) || !own.bin) return void 0;
+  return `node ${own.bin.replace(/^\.\//, "")} ${flags}`;
+}
+function manifestOperation(cwd, scripts) {
+  const own = readOwnPackage();
+  const value = {
+    scripts,
+    devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
+  };
+  if (existsSync2(join2(cwd, "package.json"))) {
+    return { kind: "merge-json", path: "package.json", value };
+  }
+  return {
+    kind: "merge-json",
+    path: "package.json",
+    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+  };
+}
+
+// src/core/config/existing-command.ts
+function nxTargetCommand(cwd, target) {
+  let project;
+  try {
+    project = parseJsonc(
+      readFileSync3(join3(cwd, "project.json"), "utf8"),
+      "project.json"
+    );
+  } catch {
+    return void 0;
+  }
+  const entry = project.targets?.[target];
+  if (!entry || entry.executor !== "nx:run-commands") return void 0;
+  const { command, commands, cwd: targetCwd } = entry.options ?? {};
+  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
+  if (typeof command === "string" && command.trim() !== "") {
+    return { command: command.trim(), ranInModule };
+  }
+  if (Array.isArray(commands)) {
+    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
+    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
+  }
+  return void 0;
+}
+function rootedForScript(command) {
+  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
+}
+function existingCommand(cwd, target) {
+  const script = moduleScripts(cwd)[target];
+  if (script !== void 0 && script.trim() !== "") return script;
+  const fromTarget = nxTargetCommand(cwd, target);
+  if (fromTarget === void 0) return void 0;
+  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+}
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join2 } from "path";
+import { extname, join as join4 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -196,7 +290,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join2(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join4(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -205,58 +299,15 @@ function hasSourceFiles(cwd, extensions) {
   return false;
 }
 
-// src/core/config/manifest.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { basename, join as join3 } from "path";
-function moduleScripts(cwd) {
-  try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
-    return pkg.scripts ?? {};
-  } catch {
-    return {};
-  }
-}
-function moduleName(cwd) {
-  try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
-    return pkg.name;
-  } catch {
-    return void 0;
-  }
-}
-function isSelfAdoption(cwd) {
-  return moduleName(cwd) === readOwnPackage().name;
-}
-function selfCommand(cwd, flags) {
-  const own = readOwnPackage();
-  if (!isSelfAdoption(cwd) || !own.bin) return void 0;
-  return `node ${own.bin.replace(/^\.\//, "")} ${flags}`;
-}
-function manifestOperation(cwd, scripts) {
-  const own = readOwnPackage();
-  const value = {
-    scripts,
-    devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
-  };
-  if (existsSync2(join3(cwd, "package.json"))) {
-    return { kind: "merge-json", path: "package.json", value };
-  }
-  return {
-    kind: "merge-json",
-    path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
-  };
-}
-
 // src/core/config/nx-target.ts
 import { existsSync as existsSync3 } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function nxTargetOperations(options) {
   const { cwd, targets } = options;
   const names = Object.keys(targets);
   if (names.length === 0) return [];
   const operations = [];
-  if (existsSync3(join4(cwd, "project.json"))) {
+  if (existsSync3(join5(cwd, "project.json"))) {
     operations.push({
       kind: "remove-json-keys",
       path: "project.json",
@@ -294,8 +345,8 @@ var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { dirname as dirname2, join as join5, relative } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { dirname as dirname2, join as join6, relative } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -304,7 +355,7 @@ var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
 function findWorkspaceRoot(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync5(join5(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    if (existsSync5(join6(dir, WORKSPACE_ROOT_MARKER))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -317,9 +368,9 @@ function declaredNativeTs(pkg) {
   return version || void 0;
 }
 function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join5(root, "package.json");
+  const pkgPath = join6(root, "package.json");
   if (!existsSync5(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
   const want = declaredNativeTs(pkg);
   if (!want) return void 0;
   const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
@@ -332,10 +383,10 @@ function ensureI18nextSingleton(root, dryRun) {
   return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
 }
 function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join5(root, WORKSPACE_YAML);
+  const yamlPath = join6(root, WORKSPACE_YAML);
   if (!existsSync5(yamlPath)) return void 0;
   const own = readOwnPackage().name;
-  const lines = readFileSync3(yamlPath, "utf8").split("\n");
+  const lines = readFileSync4(yamlPath, "utf8").split("\n");
   const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
   if (keyIdx === -1) return void 0;
   let lastItemIdx = keyIdx;
@@ -370,11 +421,11 @@ var ROOT_PRETTIER_CONFIGS = [
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
   const rel = relative(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join5(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync5(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync5(join5(root, name)));
+  const ignorePath = join6(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync5(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync5(join6(root, name)));
   if (!hasPrettier) return void 0;
   const pattern = `/${rel}/`;
-  const existing = existsSync5(ignorePath) ? readFileSync3(ignorePath, "utf8") : "";
+  const existing = existsSync5(ignorePath) ? readFileSync4(ignorePath, "utf8") : "";
   const lines = existing.split("\n");
   if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
     return void 0;
@@ -407,16 +458,50 @@ function ensureWorkspacePrep(opts) {
     opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
   ].filter((message) => message !== void 0);
 }
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join6(root, "package.json");
+  if (existsSync5(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
+  }
+  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
+  }
+  const own = readOwnPackage().name;
+  const yamlPath = join6(root, WORKSPACE_YAML);
+  if (existsSync5(yamlPath)) {
+    const yaml = readFileSync4(yamlPath, "utf8");
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
+}
 
 // src/shared/resolve-bin.ts
 import { existsSync as existsSync6 } from "fs";
 import { createRequire } from "module";
-import { delimiter, dirname as dirname3, join as join6 } from "path";
+import { delimiter, dirname as dirname3, join as join7 } from "path";
 var require2 = createRequire(import.meta.url);
 function resolveBin(fromDir, name) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join6(dir, "node_modules", ".bin", name);
+    const candidate = join7(dir, "node_modules", ".bin", name);
     if (existsSync6(candidate)) return candidate;
     const parent = dirname3(dir);
     if (parent === dir) return void 0;
@@ -429,7 +514,7 @@ function binFromOwnInstall(packageName, binName) {
     const bin = require2(manifest).bin;
     const relative3 = typeof bin === "string" ? bin : bin?.[binName];
     if (!relative3) return void 0;
-    const executable = join6(dirname3(manifest), relative3);
+    const executable = join7(dirname3(manifest), relative3);
     return existsSync6(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -463,6 +548,7 @@ var PERMITTED_LOCAL_KEYS = [
   "experimentalOperatorPosition"
 ];
 var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
+var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
 var PRETTIER_CONFIG_FILES = [
   ".prettierrc",
   ".prettierrc.json",
@@ -556,8 +642,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -572,11 +658,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join7(workspaceRoot, ROOT_IGNORE_FILE);
+  const path = join8(workspaceRoot, ROOT_IGNORE_FILE);
   if (!existsSync7(path)) return [];
   let contents;
   try {
-    contents = readFileSync4(path, "utf8");
+    contents = readFileSync5(path, "utf8");
   } catch {
     return [];
   }
@@ -663,25 +749,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { join as join9 } from "path";
-
-// src/shared/jsonc.ts
-import { parse, printParseErrorCode } from "jsonc-parser";
-function parseJsonc(text, source = "config") {
-  const errors = [];
-  const value = parse(text, errors, { allowTrailingComma: true });
-  if (errors.length > 0) {
-    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
-    throw new Error(`${source}: malformed JSONC (${details}).`);
-  }
-  return value;
-}
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join8 } from "path";
+import { dirname as dirname4, join as join9 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -710,8 +784,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join8(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync5(schemaPath, "utf8"));
+    const schemaPath = join9(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync6(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -742,14 +816,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join9(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join10(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync6(join9(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync7(join10(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -779,8 +853,8 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -796,11 +870,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join10(cwd, FORMAT_CONFIG_FILE);
+  const path = join11(cwd, FORMAT_CONFIG_FILE);
   if (!existsSync9(path)) return NOT_ADOPTED(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync7(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync8(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -887,7 +961,9 @@ var OxfmtAdapter = class extends BaseAdapter {
     const localKeys = Object.keys(local).filter((key) => !ALWAYS_LOCAL_KEYS.includes(key)).sort();
     const inherited = inheritedIgnorePatterns(findWorkspaceRoot(context.cwd));
     const declaredIgnores = Array.isArray(local.ignorePatterns) ? local.ignorePatterns.filter((v) => typeof v === "string") : [];
-    const ignorePatterns = [.../* @__PURE__ */ new Set([...declaredIgnores, ...inherited])].sort();
+    const ignorePatterns = [
+      .../* @__PURE__ */ new Set([...declaredIgnores, ...inherited, ...FORMAT_DEFAULT_IGNORES])
+    ].sort();
     if (ignorePatterns.length > 0) local.ignorePatterns = ignorePatterns;
     const unchanged = existing.adopted && existing.conformant;
     const version = unchanged && existing.presetVersion ? existing.presetVersion : own.version;
@@ -907,7 +983,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync10(join11(context.cwd, name))
+      (name) => existsSync10(join12(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1143,7 +1219,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync8(join11(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync9(join12(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -1166,7 +1242,9 @@ var OxfmtAdapter = class extends BaseAdapter {
     const ownCommand = selfCommand(cwd, "--run --format");
     const compose = (existing, keepFix) => composeFormatScript(existing, { keepFix, command: ownCommand });
     const rewritten = {
-      [FORMAT_SCRIPT_NAME]: compose(scripts[FORMAT_SCRIPT_NAME], false),
+      // `existingCommand` for the role's own script: the command can live in an
+      // `nx:run-commands` target that adoption deletes, taking anything else it ran with it.
+      [FORMAT_SCRIPT_NAME]: compose(existingCommand(cwd, FORMAT_SCRIPT_NAME), false),
       [`${FORMAT_SCRIPT_NAME}:fix`]: compose(scripts[`${FORMAT_SCRIPT_NAME}:fix`], true)
     };
     for (const [name, command] of Object.entries(scripts)) {
@@ -1223,8 +1301,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync16, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join20 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -1238,6 +1316,14 @@ var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
 function presetPath(preset) {
   return `${PRESET_DIR}/${preset}.json`;
 }
+function isSentinelPreset(entry) {
+  return entry.includes("@hublo/sentinel/oxlint/");
+}
+function extendsWithPreset(current, variant) {
+  const own = presetPath(variant);
+  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
+  return [own, ...new Set(others)];
+}
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
   return preset === "react" && /(^|\/)libs\//.test(normalised) ? "react-lib" : preset;
@@ -1257,7 +1343,7 @@ var ESLINT_CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function lintTarget() {
-  return { cache: true, inputs: ["default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
+  return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
 // src/roles/lint/presets/base.json
@@ -1601,8 +1687,8 @@ var nest_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": [
       "error",
@@ -1993,8 +2079,8 @@ var react_lib_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`. The `never` option is what makes it mean the same thing. Held at warn to match the app tier, where running it over every file found real violations the old rule never reported.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "use-isnan": [
       "error",
@@ -2567,8 +2653,8 @@ var react_default = {
     "typescript/restrict-template-expressions": "error",
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": {
       severity: "warn",
@@ -3029,6 +3115,10 @@ function downgradedRulesFor(preset) {
   return downgradedFor(preset);
 }
 
+// src/roles/lint/extra-layers.ts
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { isAbsolute as isAbsolute2, join as join13, resolve as resolve3 } from "path";
+
 // src/roles/lint/module-baseline.ts
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
@@ -3037,10 +3127,7 @@ function holdsFrom(errorCounts) {
   return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
 }
 function renderBaseline(holds, version) {
-  const entries = holds.map(
-    ({ rule, count }) => `    // ${count} violation${count === 1 ? "" : "s"} when this module adopted
-    ${JSON.stringify(rule)}: "warn"`
-  ).join(",\n");
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
   return [
     "{",
     `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
@@ -3048,9 +3135,15 @@ function renderBaseline(holds, version) {
     "  // and returns to `error` on its own.",
     "  //",
     "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report; they just cannot fail the build for code",
-    "  // that was there before the migration. Fix them and re-run `--init --lint` to get the",
-    "  // preset severity back.",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
+    "  // to get the preset severity back.",
     '  "rules": {',
     entries,
     "  }",
@@ -3070,6 +3163,44 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 
+// src/roles/lint/extra-layers.ts
+function isSentinelPreset2(entry) {
+  return entry.includes("@hublo/sentinel/oxlint/");
+}
+function ruleCount(cwd, specifier) {
+  const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
+  if (!existsSync11(path)) return void 0;
+  try {
+    const parsed = parseJsonc(
+      readFileSync10(path, "utf8"),
+      specifier
+    );
+    return Object.keys(parsed.rules ?? {}).length;
+  } catch {
+    return void 0;
+  }
+}
+function extraLayers(cwd, extendsList) {
+  return extendsList.filter((entry) => !isSentinelPreset2(entry) && entry !== LINT_BASELINE_SPECIFIER).map((entry) => {
+    const count = ruleCount(cwd, entry);
+    return {
+      rule: entry,
+      reason: count === void 0 ? "this module extends it, but it could not be read from here" : `${count} rule(s) on top of the preset, applied after it`
+    };
+  });
+}
+function committedExtendsList(cwd, configFile) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync10(join13(cwd, configFile), "utf8"),
+      configFile
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
@@ -3120,8 +3251,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3136,12 +3267,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync9(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync11(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3155,8 +3286,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join12(moduleDir, candidate);
-    if (!existsSync11(absolutePath)) continue;
+    const absolutePath = join14(moduleDir, candidate);
+    if (!existsSync12(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3189,12 +3320,12 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync12(join13(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync13(join15(cwd, target.path))) {
     return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(join13(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync12(join15(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
@@ -3228,9 +3359,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join14 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3255,30 +3386,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join14(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join14(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join16(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join16(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join14(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join16(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync13(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync14(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -3291,11 +3422,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join15(cwd, name)).find((path) => existsSync14(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join17(cwd, name)).find((path) => existsSync15(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync11(config, "utf8");
+    source = readFileSync13(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -3349,8 +3480,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync } from "fs";
-import { join as join16, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync14, statSync } from "fs";
+import { join as join18, relative as relative2 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -3397,7 +3528,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join16(dir, entry);
+    const full = join18(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync(full).isDirectory();
@@ -3417,7 +3548,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync12(file, "utf8");
+      content = readFileSync14(file, "utf8");
     } catch {
       continue;
     }
@@ -3457,7 +3588,17 @@ var DEFAULT_IGNORE_PATTERNS = [
   "**/dist/**",
   "**/node_modules/**",
   "**/coverage/**",
-  "**/*.mock.ts",
+  // `**/*.mock.ts` used to sit here and has been removed. It was the only entry in this list
+  // with no reason written next to it, and it does not meet the bar the paragraph above sets:
+  // a mock is not build output, not vendored and not generated. It is hand-written TypeScript
+  // that ships with the tests, and lint rules have as much to say about it as about any other
+  // source file. Ignoring it quietly narrowed what an adopted module checks — career lost
+  // `src/test/router.mock.ts`, which its previous ESLint config did lint.
+  //
+  // Measured before removing, because this is the one change that can turn a green module red:
+  // career has 1 such file and it reports nothing; the 15 planning modules have none. 222 exist
+  // repo-wide, and modules adopting later meet them through the baseline, which is exactly what
+  // the baseline is for.
   // Tool configuration is not source. A repo's shared ESLint config ignores these, and every
   // module inherits that; adoption replaces the config chain, so without them the first thing
   // an adopted module lints is its own jest setup file. Found on libs/front/components, where
@@ -3520,7 +3661,7 @@ function plan(context) {
   ].filter((pattern) => !defaults.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
-    extends: [presetPath(variant)],
+    extends: extendsWithPreset(committedExtends(context.cwd), variant),
     ...carried.length > 0 ? { ignorePatterns: carried } : {}
   };
   const operations = [
@@ -3535,7 +3676,7 @@ function plan(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join17(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync16(join19(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -3611,7 +3752,10 @@ function plan(context) {
 function lintScripts(cwd) {
   const scripts = moduleScripts(cwd);
   const rewritten = {
-    [LINT_SCRIPT_NAME]: composeLintScript(scripts[LINT_SCRIPT_NAME], {
+    // `existingCommand`, not `scripts[...]`: the command can live in an `nx:run-commands`
+    // target instead of a script, and adoption deletes that target. Composing against only
+    // the script threw away whatever else the target ran.
+    [LINT_SCRIPT_NAME]: composeLintScript(existingCommand(cwd, LINT_SCRIPT_NAME), {
       command: selfCommand(cwd, "--run --lint")
     })
   };
@@ -3627,10 +3771,21 @@ function lintScripts(cwd) {
   }
   return rewritten;
 }
+function committedExtends(cwd) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      LINT_CONFIG_FILE
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join17(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -3642,7 +3797,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync13(join17(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync15(join19(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -3761,20 +3916,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join18(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join18(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync16(configPath)) return;
+    const configPath = join20(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join20(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync17(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync14(configPath, "utf8"),
+        readFileSync16(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join18(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join20(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -3822,7 +3977,7 @@ var OxlintAdapter = class extends BaseAdapter {
     }
   }
   async run(ctx) {
-    if (!existsSync16(join18(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync17(join20(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -3906,7 +4061,12 @@ var OxlintAdapter = class extends BaseAdapter {
       downgraded: downgradedRulesFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
         rule: entry.rule,
         reason: entry.reason
-      }))
+      })),
+      // What this module enforces BEYOND the preset. Not drift, and not covered by anything
+      // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
+      // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
+      // the extra rules it runs. See `extra-layers` for why that state is legitimate.
+      layers: extraLayers(ctx.cwd, committedExtendsList(ctx.cwd, LINT_CONFIG_FILE))
     };
   }
   /** How many rules the extended preset enforces, read from the preset on disk. */
@@ -3937,7 +4097,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -3947,7 +4107,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync14(join18(cwd, entry), "utf8"),
+          readFileSync16(join20(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4017,14 +4177,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync16(join18(cwd, target)));
+    return targets.find((target) => !existsSync17(join20(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4056,9 +4216,9 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 
 // src/roles/typescript/presets/base.json
 var base_default3 = {
@@ -4239,8 +4399,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join21 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -4262,10 +4422,16 @@ function keepsForeignChecker(existing) {
 
 // src/roles/typescript/adapters/tsc/plan.ts
 var INSTALL_NOTE = "run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve";
-var TYPECHECK_TARGET = { cache: true, inputs: ["default", "{projectRoot}/tsconfig.json"] };
+var TYPECHECK_TARGET = {
+  cache: true,
+  inputs: ["default", "^default", "{projectRoot}/tsconfig.json"]
+};
 function typecheckScripts(cwd) {
   return {
-    [TYPECHECK_SCRIPT_NAME]: composeTypecheckScript(moduleScripts(cwd)[TYPECHECK_SCRIPT_NAME])
+    // Reads the nx target too, not only the npm script: five modules in this repo keep a
+    // real prerequisite (the brand-token generator) in an `nx:run-commands` typecheck
+    // target, and adoption used to delete it along with the target.
+    [TYPECHECK_SCRIPT_NAME]: composeTypecheckScript(existingCommand(cwd, TYPECHECK_SCRIPT_NAME))
   };
 }
 function composeExtends(current, preset) {
@@ -4325,7 +4491,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync15(join19(context.cwd, target.path), "utf8"),
+    readFileSync17(join21(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -4463,7 +4629,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync16(join20(cwd, target.path), "utf8"),
+        readFileSync18(join22(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -4476,7 +4642,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join20(cwd, "noop.js")).resolve(preset);
+      createRequire4(join22(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -4572,7 +4738,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync16(join20(cwd, config), "utf8"),
+        readFileSync18(join22(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -4588,7 +4754,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync17(join20(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync18(join22(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -4791,8 +4957,8 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3, sep } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
 // src/shared/deep-merge.ts
@@ -4802,15 +4968,15 @@ function isPlainObject(value) {
 
 // src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
-  const root = resolve3(cwd);
-  const absolutePath = resolve3(root, relativePath);
+  const root = resolve4(cwd);
+  const absolutePath = resolve4(root, relativePath);
   if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
     throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
   }
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync18(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
+  return existsSync19(absolutePath) ? readFileSync19(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -4928,8 +5094,8 @@ function applyPlan(cwd, plan2) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync20 } from "fs";
+import { join as join23 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -4943,11 +5109,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join21(cwd, "package.json");
-  if (!existsSync19(path)) return [];
+  const path = join23(cwd, "package.json");
+  if (!existsSync20(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync18(path, "utf8"),
+      readFileSync20(path, "utf8"),
       path
     );
     return [
@@ -4970,7 +5136,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync18(join21(cwd, name), "utf8"),
+        readFileSync20(join23(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5120,6 +5286,7 @@ export {
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
+  inspectWorkspacePrep,
   palette,
   resolveBin,
   VERBS,
@@ -5130,4 +5297,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-HNE774F7.js.map
+//# sourceMappingURL=chunk-RGIEWANO.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-HNE774F7.js";
+} from "./chunk-RGIEWANO.js";
 export {
   BaseAdapter,
   all,

package/oxlint/nest.json

@@ -327,7 +327,7 @@
     ],
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "typescript/switch-exhaustiveness-check": [
       "error",

package/oxlint/react-lib.json

@@ -319,7 +319,7 @@
     "typescript/no-useless-constructor": "warn",
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "use-isnan": [
       "error",

package/oxlint/react.json

@@ -438,7 +438,7 @@
     "typescript/restrict-template-expressions": "error",
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "typescript/switch-exhaustiveness-check": "warn",
     "typescript/unbound-method": "error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",