@hublo/sentinel 1.1.5 → 1.1.7

package/dist/bin/sentinel.js

@@ -9,6 +9,7 @@ import {
   dispatch,
   ensureWorkspacePrep,
   findWorkspaceRoot,
+  inspectWorkspacePrep,
   palette,
   readNxProjectName,
   readOwnVersion,
@@ -16,7 +17,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-RLVLDC5H.js";
+} from "../chunk-W73ISYMG.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
@@ -438,6 +439,10 @@ function renderStatusSummary(items, p) {
 }
 
 // src/cli/run-verb.ts
+function workspacePrep(cwd2) {
+  const root = findWorkspaceRoot(cwd2);
+  return root ? inspectWorkspacePrep(root) : [];
+}
 async function runVerb(ctx) {
   const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: ctx.ci });
   const out = palette(process.stdout);
@@ -482,7 +487,15 @@ async function runVerb(ctx) {
   });
   const summary = generateSummaries(results, ctx.targets);
   if (ctx.json) {
-    const base = ctx.verb === "status" || ctx.verb === "inspect" ? { ...summary, coverage: statusCoverage(summary.results) } : summary;
+    const base = ctx.verb === "status" || ctx.verb === "inspect" ? {
+      ...summary,
+      coverage: statusCoverage(summary.results),
+      // The root-level changes sentinel maintains, each with its justification checked
+      // NOW rather than described in a comment. They are the only thing sentinel does
+      // that nobody can see afterwards, and every one of them is temporary. See
+      // `inspectWorkspacePrep`.
+      ...ctx.verb === "inspect" ? { workspace: workspacePrep(ctx.cwd) } : {}
+    } : summary;
     const payload = ctx.toolArgs.length > 0 ? { ...base, toolArgs: ctx.toolArgs } : base;
     process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
   } else if (ctx.verb === "status" || ctx.verb === "inspect" && modules.length > 1) {
@@ -493,6 +506,19 @@ async function runVerb(ctx) {
       process.stdout.write(renderSummary(item, out) + "\n");
     }
   }
+  if (!ctx.json && ctx.verb === "inspect") {
+    const prep = workspacePrep(ctx.cwd);
+    if (prep.length > 0) {
+      process.stdout.write(`
+  sentinel maintains these at the workspace root:
+`);
+      for (const entry of prep) {
+        process.stdout.write(`    ${out.strong(entry.rule)}
+      ${entry.reason}
+`);
+      }
+    }
+  }
   process.stderr.write(
     err.dim(`  ${modules.length} module(s) [${scope}] in ${Date.now() - started}ms
 `)

package/dist/{chunk-RLVLDC5H.js → chunk-W73ISYMG.js}

@@ -110,20 +110,6 @@ function readNxProjectName(dir) {
   }
 }
 
-// src/shared/color.ts
-import { styleText } from "util";
-function palette(stream) {
-  const paint = (format, text) => styleText(format, text, { stream });
-  return {
-    ok: (text) => paint(["green", "bold"], text),
-    fail: (text) => paint(["red", "bold"], text),
-    warn: (text) => paint("yellow", text),
-    strong: (text) => paint("bold", text),
-    dim: (text) => paint("dim", text),
-    accent: (text) => paint("cyan", text)
-  };
-}
-
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
 var TARGETS = [
@@ -138,6 +124,20 @@ var TARGETS = [
 ];
 var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
+// src/shared/color.ts
+import { styleText } from "util";
+function palette(stream) {
+  const paint = (format, text) => styleText(format, text, { stream });
+  return {
+    ok: (text) => paint(["green", "bold"], text),
+    fail: (text) => paint(["red", "bold"], text),
+    warn: (text) => paint("yellow", text),
+    strong: (text) => paint("bold", text),
+    dim: (text) => paint("dim", text),
+    accent: (text) => paint("cyan", text)
+  };
+}
+
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
@@ -458,6 +458,40 @@ function ensureWorkspacePrep(opts) {
     opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
   ].filter((message) => message !== void 0);
 }
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join6(root, "package.json");
+  if (existsSync5(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
+  }
+  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
+  }
+  const own = readOwnPackage().name;
+  const yamlPath = join6(root, WORKSPACE_YAML);
+  if (existsSync5(yamlPath)) {
+    const yaml = readFileSync4(yamlPath, "utf8");
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
+}
 
 // src/shared/resolve-bin.ts
 import { existsSync as existsSync6 } from "fs";
@@ -514,6 +548,7 @@ var PERMITTED_LOCAL_KEYS = [
   "experimentalOperatorPosition"
 ];
 var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
+var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
 var PRETTIER_CONFIG_FILES = [
   ".prettierrc",
   ".prettierrc.json",
@@ -906,6 +941,22 @@ var OxfmtAdapter = class extends BaseAdapter {
   appliesTo(_preset) {
     return true;
   }
+  /**
+   * The preset this module COMMITTED to, read from the `$sentinel` block it writes.
+   *
+   * Every other role implements this and format did not, so it was the only one answering from
+   * dependency detection alone. On an adopted Nest module whose own `.oxfmtrc.json` records
+   * `"preset": "nest"`, `--inspect` reported `flavour=node` — the module knew, and the role did
+   * not pass it on. Same command, four rows, two different answers about what the module is.
+   *
+   * It reads the RECORD rather than re-deriving: the block is what `--init` wrote, so it is the
+   * module's declaration, and a re-derivation from hoisted dependencies is exactly the wrong
+   * answer this exists to avoid.
+   */
+  declaredPreset(cwd) {
+    const declared = readFormatAdoption(cwd).preset;
+    return declared !== null && PRESET_NAMES.includes(declared) ? declared : void 0;
+  }
   plan(context) {
     if (!hasSourceFiles(context.cwd, FORMATTABLE_EXTENSIONS)) {
       return {
@@ -926,7 +977,9 @@ var OxfmtAdapter = class extends BaseAdapter {
     const localKeys = Object.keys(local).filter((key) => !ALWAYS_LOCAL_KEYS.includes(key)).sort();
     const inherited = inheritedIgnorePatterns(findWorkspaceRoot(context.cwd));
     const declaredIgnores = Array.isArray(local.ignorePatterns) ? local.ignorePatterns.filter((v) => typeof v === "string") : [];
-    const ignorePatterns = [.../* @__PURE__ */ new Set([...declaredIgnores, ...inherited])].sort();
+    const ignorePatterns = [
+      .../* @__PURE__ */ new Set([...declaredIgnores, ...inherited, ...FORMAT_DEFAULT_IGNORES])
+    ].sort();
     if (ignorePatterns.length > 0) local.ignorePatterns = ignorePatterns;
     const unchanged = existing.adopted && existing.conformant;
     const version = unchanged && existing.presetVersion ? existing.presetVersion : own.version;
@@ -1264,8 +1317,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync15, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync16, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join20 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -1279,6 +1332,14 @@ var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
 function presetPath(preset) {
   return `${PRESET_DIR}/${preset}.json`;
 }
+function isSentinelPreset(entry) {
+  return entry.includes("@hublo/sentinel/oxlint/");
+}
+function extendsWithPreset(current, variant) {
+  const own = presetPath(variant);
+  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
+  return [own, ...new Set(others)];
+}
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
   return preset === "react" && /(^|\/)libs\//.test(normalised) ? "react-lib" : preset;
@@ -1298,7 +1359,7 @@ var ESLINT_CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function lintTarget() {
-  return { cache: true, inputs: ["default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
+  return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
 // src/roles/lint/presets/base.json
@@ -1642,8 +1703,8 @@ var nest_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": [
       "error",
@@ -2034,8 +2095,8 @@ var react_lib_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`. The `never` option is what makes it mean the same thing. Held at warn to match the app tier, where running it over every file found real violations the old rule never reported.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "use-isnan": [
       "error",
@@ -2608,8 +2669,8 @@ var react_default = {
     "typescript/restrict-template-expressions": "error",
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": {
       severity: "warn",
@@ -3070,6 +3131,10 @@ function downgradedRulesFor(preset) {
   return downgradedFor(preset);
 }
 
+// src/roles/lint/extra-layers.ts
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { isAbsolute as isAbsolute2, join as join13, resolve as resolve3 } from "path";
+
 // src/roles/lint/module-baseline.ts
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
@@ -3078,10 +3143,7 @@ function holdsFrom(errorCounts) {
   return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
 }
 function renderBaseline(holds, version) {
-  const entries = holds.map(
-    ({ rule, count }) => `    // ${count} violation${count === 1 ? "" : "s"} when this module adopted
-    ${JSON.stringify(rule)}: "warn"`
-  ).join(",\n");
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
   return [
     "{",
     `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
@@ -3089,9 +3151,15 @@ function renderBaseline(holds, version) {
     "  // and returns to `error` on its own.",
     "  //",
     "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report; they just cannot fail the build for code",
-    "  // that was there before the migration. Fix them and re-run `--init --lint` to get the",
-    "  // preset severity back.",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
+    "  // to get the preset severity back.",
     '  "rules": {',
     entries,
     "  }",
@@ -3111,6 +3179,44 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 
+// src/roles/lint/extra-layers.ts
+function isSentinelPreset2(entry) {
+  return entry.includes("@hublo/sentinel/oxlint/");
+}
+function ruleCount(cwd, specifier) {
+  const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
+  if (!existsSync11(path)) return void 0;
+  try {
+    const parsed = parseJsonc(
+      readFileSync10(path, "utf8"),
+      specifier
+    );
+    return Object.keys(parsed.rules ?? {}).length;
+  } catch {
+    return void 0;
+  }
+}
+function extraLayers(cwd, extendsList) {
+  return extendsList.filter((entry) => !isSentinelPreset2(entry) && entry !== LINT_BASELINE_SPECIFIER).map((entry) => {
+    const count = ruleCount(cwd, entry);
+    return {
+      rule: entry,
+      reason: count === void 0 ? "this module extends it, but it could not be read from here" : `${count} rule(s) on top of the preset, applied after it`
+    };
+  });
+}
+function committedExtendsList(cwd, configFile) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync10(join13(cwd, configFile), "utf8"),
+      configFile
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
@@ -3161,8 +3267,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3177,12 +3283,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync11(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3196,8 +3302,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join13(moduleDir, candidate);
-    if (!existsSync11(absolutePath)) continue;
+    const absolutePath = join14(moduleDir, candidate);
+    if (!existsSync12(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3230,12 +3336,12 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync12(join14(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync13(join15(cwd, target.path))) {
     return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync11(join14(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync12(join15(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
@@ -3269,9 +3375,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join15 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3296,30 +3402,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join15(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join15(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join16(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join16(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join15(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join16(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync13(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync14(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -3332,11 +3438,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join16(cwd, name)).find((path) => existsSync14(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join17(cwd, name)).find((path) => existsSync15(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync12(config, "utf8");
+    source = readFileSync13(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -3390,8 +3496,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync13, statSync } from "fs";
-import { join as join17, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync14, statSync } from "fs";
+import { join as join18, relative as relative2 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -3438,7 +3544,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join17(dir, entry);
+    const full = join18(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync(full).isDirectory();
@@ -3458,7 +3564,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync13(file, "utf8");
+      content = readFileSync14(file, "utf8");
     } catch {
       continue;
     }
@@ -3498,7 +3604,17 @@ var DEFAULT_IGNORE_PATTERNS = [
   "**/dist/**",
   "**/node_modules/**",
   "**/coverage/**",
-  "**/*.mock.ts",
+  // `**/*.mock.ts` used to sit here and has been removed. It was the only entry in this list
+  // with no reason written next to it, and it does not meet the bar the paragraph above sets:
+  // a mock is not build output, not vendored and not generated. It is hand-written TypeScript
+  // that ships with the tests, and lint rules have as much to say about it as about any other
+  // source file. Ignoring it quietly narrowed what an adopted module checks — career lost
+  // `src/test/router.mock.ts`, which its previous ESLint config did lint.
+  //
+  // Measured before removing, because this is the one change that can turn a green module red:
+  // career has 1 such file and it reports nothing; the 15 planning modules have none. 222 exist
+  // repo-wide, and modules adopting later meet them through the baseline, which is exactly what
+  // the baseline is for.
   // Tool configuration is not source. A repo's shared ESLint config ignores these, and every
   // module inherits that; adoption replaces the config chain, so without them the first thing
   // an adopted module lints is its own jest setup file. Found on libs/front/components, where
@@ -3561,7 +3677,7 @@ function plan(context) {
   ].filter((pattern) => !defaults.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
-    extends: [presetPath(variant)],
+    extends: extendsWithPreset(committedExtends(context.cwd), variant),
     ...carried.length > 0 ? { ignorePatterns: carried } : {}
   };
   const operations = [
@@ -3576,7 +3692,7 @@ function plan(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join18(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync16(join19(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -3671,10 +3787,21 @@ function lintScripts(cwd) {
   }
   return rewritten;
 }
+function committedExtends(cwd) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      LINT_CONFIG_FILE
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -3686,7 +3813,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync14(join18(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync15(join19(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -3805,20 +3932,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join19(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join19(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync16(configPath)) return;
+    const configPath = join20(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join20(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync17(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync15(configPath, "utf8"),
+        readFileSync16(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join19(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join20(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -3866,7 +3993,7 @@ var OxlintAdapter = class extends BaseAdapter {
     }
   }
   async run(ctx) {
-    if (!existsSync16(join19(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync17(join20(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -3950,7 +4077,12 @@ var OxlintAdapter = class extends BaseAdapter {
       downgraded: downgradedRulesFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
         rule: entry.rule,
         reason: entry.reason
-      }))
+      })),
+      // What this module enforces BEYOND the preset. Not drift, and not covered by anything
+      // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
+      // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
+      // the extra rules it runs. See `extra-layers` for why that state is legitimate.
+      layers: extraLayers(ctx.cwd, committedExtendsList(ctx.cwd, LINT_CONFIG_FILE))
     };
   }
   /** How many rules the extended preset enforces, read from the preset on disk. */
@@ -3981,7 +4113,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -3991,7 +4123,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync15(join19(cwd, entry), "utf8"),
+          readFileSync16(join20(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4061,14 +4193,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync16(join19(cwd, target)));
+    return targets.find((target) => !existsSync17(join20(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4100,9 +4232,9 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // src/roles/typescript/presets/base.json
 var base_default3 = {
@@ -4283,8 +4415,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync16 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { join as join21 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -4306,7 +4438,10 @@ function keepsForeignChecker(existing) {
 
 // src/roles/typescript/adapters/tsc/plan.ts
 var INSTALL_NOTE = "run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve";
-var TYPECHECK_TARGET = { cache: true, inputs: ["default", "{projectRoot}/tsconfig.json"] };
+var TYPECHECK_TARGET = {
+  cache: true,
+  inputs: ["default", "^default", "{projectRoot}/tsconfig.json"]
+};
 function typecheckScripts(cwd) {
   return {
     // Reads the nx target too, not only the npm script: five modules in this repo keep a
@@ -4372,7 +4507,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync16(join20(context.cwd, target.path), "utf8"),
+    readFileSync17(join21(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -4510,7 +4645,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync17(join21(cwd, target.path), "utf8"),
+        readFileSync18(join22(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -4523,7 +4658,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join21(cwd, "noop.js")).resolve(preset);
+      createRequire4(join22(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -4619,7 +4754,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync17(join21(cwd, config), "utf8"),
+        readFileSync18(join22(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -4635,7 +4770,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync17(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync18(join22(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -4838,8 +4973,8 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3, sep } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
 // src/shared/deep-merge.ts
@@ -4849,15 +4984,15 @@ function isPlainObject(value) {
 
 // src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
-  const root = resolve3(cwd);
-  const absolutePath = resolve3(root, relativePath);
+  const root = resolve4(cwd);
+  const absolutePath = resolve4(root, relativePath);
   if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
     throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
   }
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync18(absolutePath) ? readFileSync18(absolutePath, "utf8") : void 0;
+  return existsSync19(absolutePath) ? readFileSync19(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -4975,8 +5110,8 @@ function applyPlan(cwd, plan2) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync19 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync20 } from "fs";
+import { join as join23 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -4990,11 +5125,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join22(cwd, "package.json");
-  if (!existsSync19(path)) return [];
+  const path = join23(cwd, "package.json");
+  if (!existsSync20(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync19(path, "utf8"),
+      readFileSync20(path, "utf8"),
       path
     );
     return [
@@ -5017,7 +5152,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync19(join22(cwd, name), "utf8"),
+        readFileSync20(join23(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5113,13 +5248,26 @@ async function dispatch(opts) {
   const detected = resolveFlavour(opts);
   const adapter = resolve(opts.target, detected, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
-  const contradiction = presetContradiction(preset, opts.cwd);
-  if (contradiction !== void 0) {
-    process.stderr.write(`sentinel (${opts.target}): ${contradiction}
+  if (opts.preset !== void 0) {
+    const contradiction = presetContradiction(opts.preset, opts.cwd);
+    if (contradiction !== void 0) {
+      process.stderr.write(`sentinel (${opts.target}): ${contradiction}
 `);
-    return 1;
+      return 1;
+    }
+  }
+  let effective = preset;
+  if (opts.preset === void 0 && adapter.declaredPreset?.(opts.cwd) === void 0) {
+    const [signal] = presetSignals(opts.cwd);
+    if (signal !== void 0 && signal.preset !== preset) {
+      effective = signal.preset;
+      process.stderr.write(
+        `  detected "${preset}" from dependencies, but ${signal.evidence}, so adopting as "${signal.preset}". Pass --preset to override.
+`
+      );
+    }
   }
-  const context = { cwd: opts.cwd, preset };
+  const context = { cwd: opts.cwd, preset: effective };
   const plan2 = await adapter.plan(context);
   if (plan2.blocked) {
     process.stderr.write(`sentinel (${opts.target}): ${plan2.blocked}
@@ -5164,17 +5312,18 @@ export {
   readOwnVersion,
   readProjectPackageJson,
   readNxProjectName,
+  VERBS,
+  TARGETS,
+  PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
+  inspectWorkspacePrep,
   palette,
   resolveBin,
-  VERBS,
-  TARGETS,
-  PRESET_NAMES,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-RLVLDC5H.js.map
+//# sourceMappingURL=chunk-W73ISYMG.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-RLVLDC5H.js";
+} from "./chunk-W73ISYMG.js";
 export {
   BaseAdapter,
   all,

package/oxlint/nest.json

@@ -327,7 +327,7 @@
     ],
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "typescript/switch-exhaustiveness-check": [
       "error",

package/oxlint/react-lib.json

@@ -319,7 +319,7 @@
     "typescript/no-useless-constructor": "warn",
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "use-isnan": [
       "error",

package/oxlint/react.json

@@ -438,7 +438,7 @@
     "typescript/restrict-template-expressions": "error",
     "typescript/return-await": [
       "warn",
-      "never"
+      "in-try-catch"
     ],
     "typescript/switch-exhaustiveness-check": "warn",
     "typescript/unbound-method": "error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",