@hublo/sentinel 1.1.5 → 1.2.0-alpha.0

package/dist/{chunk-RLVLDC5H.js → chunk-TWL6T237.js}

@@ -1,5 +1,20 @@
+import {
+  REACT_APP_DEFAULTS,
+  isPlainObject
+} from "./chunk-XSCDJZDY.js";
+
 // src/core/registry.ts
 var adapters = [];
+var PresetUnsupportedError = class extends Error {
+  constructor(target, preset) {
+    super(`No adapter for target "${target}" handles preset "${preset}".`);
+    this.target = target;
+    this.preset = preset;
+    this.name = "PresetUnsupportedError";
+  }
+  target;
+  preset;
+};
 var defaultRunner = {
   // Filled in by tool branches, e.g. lint: 'eslint', typescript: 'tsc'.
 };
@@ -12,6 +27,14 @@ function setDefaultRunner(target, runner) {
 function all() {
   return adapters;
 }
+function declaredPresetFor(target, cwd) {
+  for (const adapter of adapters) {
+    if (adapter.target !== target) continue;
+    const declared = adapter.declaredPreset?.(cwd);
+    if (declared !== void 0) return declared;
+  }
+  return void 0;
+}
 function availableTargets() {
   return [...new Set(adapters.map((a) => a.target))];
 }
@@ -24,7 +47,7 @@ function resolve(target, preset, runner) {
   }
   const candidates = preset ? forTarget.filter((a) => a.appliesTo(preset)) : forTarget;
   if (candidates.length === 0) {
-    throw new Error(`No adapter for target "${target}" handles preset "${preset}".`);
+    throw new PresetUnsupportedError(target, preset);
   }
   const wanted = runner ?? defaultRunner[target];
   const available = candidates.map((a) => a.runner).join(", ");
@@ -131,21 +154,79 @@ var TARGETS = [
   "format",
   "typescript",
   "build",
+  "dev",
   "test",
   "static-analysis",
   "runtime-analysis",
   "arch"
 ];
+var LONG_RUNNING_TARGETS = ["dev"];
+var SWEEPABLE_TARGETS = TARGETS.filter(
+  (target) => !LONG_RUNNING_TARGETS.includes(target)
+);
 var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
-// src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+
+// src/core/config/tool-args.ts
+import { existsSync as existsSync2 } from "fs";
+import { isAbsolute, resolve as resolve2 } from "path";
+function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
+  const takesValue = new Set(valueFlags);
+  const options = [];
+  const paths = [];
+  let previousTakesValue = false;
+  for (const arg of toolArgs) {
+    const looksLikeOption = arg.startsWith("-");
+    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
+    if (!previousTakesValue && !looksLikeOption && existsSync2(target)) paths.push(arg);
+    else options.push(arg);
+    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+  }
+  return { options, paths };
+}
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync3 } from "fs";
+import { createRequire } from "module";
+import { delimiter, dirname as dirname2, join as join2 } from "path";
+var require2 = createRequire(import.meta.url);
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join2(dir, "node_modules", ".bin", name);
+    if (existsSync3(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function binFromOwnInstall(packageName, binName) {
+  try {
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative3 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative3) return void 0;
+    const executable = join2(dirname2(manifest), relative3);
+    return existsSync3(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function binSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/build/plan.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // src/shared/jsonc.ts
 import { parse, printParseErrorCode } from "jsonc-parser";
@@ -160,11 +241,11 @@ function parseJsonc(text, source = "config") {
 }
 
 // src/core/config/manifest.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { basename, join as join2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { basename, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -172,7 +253,7 @@ function moduleScripts(cwd) {
 }
 function moduleName(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -192,54 +273,675 @@ function manifestOperation(cwd, scripts) {
     scripts,
     devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
   };
-  if (existsSync2(join2(cwd, "package.json"))) {
+  if (existsSync4(join3(cwd, "package.json"))) {
     return { kind: "merge-json", path: "package.json", value };
   }
-  return {
-    kind: "merge-json",
-    path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
-  };
-}
-
-// src/core/config/existing-command.ts
-function nxTargetCommand(cwd, target) {
-  let project;
-  try {
-    project = parseJsonc(
-      readFileSync3(join3(cwd, "project.json"), "utf8"),
-      "project.json"
-    );
-  } catch {
-    return void 0;
+  return {
+    kind: "merge-json",
+    path: "package.json",
+    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+  };
+}
+
+// src/core/config/existing-command.ts
+function nxTargetCommand(cwd, target) {
+  let project;
+  try {
+    project = parseJsonc(
+      readFileSync3(join4(cwd, "project.json"), "utf8"),
+      "project.json"
+    );
+  } catch {
+    return void 0;
+  }
+  const entry = project.targets?.[target];
+  if (!entry || entry.executor !== "nx:run-commands") return void 0;
+  const { command, commands, cwd: targetCwd } = entry.options ?? {};
+  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
+  if (typeof command === "string" && command.trim() !== "") {
+    return { command: command.trim(), ranInModule };
+  }
+  if (Array.isArray(commands)) {
+    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
+    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
+  }
+  return void 0;
+}
+function rootedForScript(command) {
+  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
+}
+function existingCommand(cwd, target) {
+  const script = moduleScripts(cwd)[target];
+  if (script !== void 0 && script.trim() !== "") return script;
+  const fromTarget = nxTargetCommand(cwd, target);
+  if (fromTarget === void 0) return void 0;
+  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+}
+
+// src/core/config/nx-target.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join5 } from "path";
+function nxTargetOperations(options) {
+  const { cwd, targets } = options;
+  const names = Object.keys(targets);
+  if (names.length === 0) return [];
+  const operations = [];
+  if (existsSync5(join5(cwd, "project.json"))) {
+    operations.push({
+      kind: "remove-json-keys",
+      path: "project.json",
+      keys: names.map((name) => ["targets", name])
+    });
+  }
+  operations.push({
+    kind: "merge-json",
+    path: "package.json",
+    value: { nx: { targets } }
+  });
+  return operations;
+}
+
+// src/core/config/tool-script.ts
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function invokes(segment, binary) {
+  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
+}
+function isSentinelSegment(segment, roleFlag) {
+  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
+  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
+}
+function composeToolScript(existing, options) {
+  const { command } = options;
+  if (!existing || existing.trim() === "") return command;
+  const { roleFlag } = options;
+  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isReplaceable)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
+    }
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script, sentinelCommand) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
+}
+
+// src/roles/build/config-policy.ts
+var BUILD_CONFIG_FILES = [
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs"
+];
+var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_SCRIPT_NAME = "build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var DEV_SCRIPT_NAME = "serve";
+var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
+function buildTarget() {
+  return {
+    [BUILD_SCRIPT_NAME]: {
+      cache: true,
+      inputs: ["default", "^default", `{projectRoot}/${BUILD_CONFIG_FILES[0]}`]
+    }
+  };
+}
+var SENTINEL_OWNED_BUILD_PACKAGES = [
+  "vite",
+  "@vitejs/plugin-react",
+  "@tailwindcss/vite",
+  "vite-plugin-svgr",
+  "nitro"
+];
+
+// src/roles/build/dev-script.ts
+var CHAIN = " -- ";
+var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
+var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
+function appOptions(rest) {
+  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
+  return kept.join(" ");
+}
+function composeDevScript(existing, command) {
+  if (existing === void 0 || existing.trim() === "") return command;
+  const chunks = existing.trim().split(CHAIN);
+  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at === -1) return existing;
+  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const options = appOptions(rest);
+  chunks[at] = options === "" ? command : `${command} -- ${options}`;
+  return chunks.join(CHAIN);
+}
+
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+var NOT_ADOPTED = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  ownDeclarations: [],
+  unreadable
+});
+function buildConfigFile(cwd) {
+  return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
+}
+function importsPreset(source) {
+  const specifier = BUILD_PRESET_SPECIFIER.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${specifier}['"\`]`).test(source);
+}
+var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
+function declaredBuildPreset(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return void 0;
+  try {
+    const source = readFileSync4(join6(cwd, configFile), "utf8");
+    return REACT_PLUGIN_SPECIFIERS.some((specifier) => source.includes(specifier)) ? "react" : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readBuildAdoption(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return NOT_ADOPTED(null);
+  let source;
+  try {
+    source = readFileSync4(join6(cwd, configFile), "utf8");
+  } catch (error) {
+    return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
+  }
+  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
+  const manifest = readProjectPackageJson(cwd);
+  const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+  const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
+    (name) => ({ name, version: declared[name] })
+  );
+  return {
+    configFile,
+    preset: "react",
+    adopted: true,
+    conformant: ownDeclarations.length === 0,
+    drift: ownDeclarations.map(
+      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
+    ),
+    ownDeclarations,
+    unreadable: null
+  };
+}
+
+// src/roles/build/plan.ts
+function scaffold() {
+  return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
+import { tanstackStart } from '@tanstack/react-start/plugin/vite'
+import { tanstackRouter } from '@tanstack/router-plugin/vite'
+import path from 'node:path'
+
+/*
+ * Composition comes from sentinel: how the env is loaded, which plugins run under test and
+ * which under a real build, the order they run in. The values below are this app's own.
+ *
+ * TanStack is passed IN rather than imported by sentinel, because the app codes against it
+ * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
+ * Anything sentinel does not set goes in \`overrides\`, which merges over the preset last.
+ */
+export default defineConfig(({ mode }) =>
+  reactApp({
+    root: __dirname,
+    mode,
+    base: '/',
+    port: 3000,
+    // Explicit, NOT port + 1: the three apps in this repo disagree, one of them goes down.
+    hmrPort: 3001,
+    router: {
+      routesDirectory: path.resolve(__dirname, 'src/routes'),
+      generatedRouteTree: path.resolve(__dirname, 'src/routeTree.gen.ts'),
+    },
+    tanstack: { start: tanstackStart, router: tanstackRouter },
+    alias: [],
+  }),
+)
+`;
+}
+function ownedBuildDependencies(cwd) {
+  const manifest = readProjectPackageJson(cwd);
+  const keys = [];
+  for (const section of ["dependencies", "devDependencies"]) {
+    const declared = manifest[section];
+    if (!declared) continue;
+    for (const name of SENTINEL_OWNED_BUILD_PACKAGES) {
+      if (name in declared) keys.push([section, name]);
+    }
+  }
+  return keys;
+}
+function invokesVite(segment) {
+  return /(^|\s|\/)vite(\s|$)/.test(segment.trim());
+}
+function buildScripts(cwd) {
+  const own = selfCommand(cwd, "--run --build");
+  const scripts = {
+    [BUILD_SCRIPT_NAME]: composeToolScript(existingCommand(cwd, BUILD_SCRIPT_NAME), {
+      command: own ?? SENTINEL_BUILD_COMMAND,
+      replaces: invokesVite,
+      // Only meaningful for the self case: it lets a re-init correct a sentinel invocation
+      // whose FORM is wrong, without matching another role's script.
+      roleFlag: own === void 0 ? void 0 : "--build"
+    })
+  };
+  const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
+  if (existingDev !== void 0) {
+    scripts[DEV_SCRIPT_NAME] = composeDevScript(
+      existingDev,
+      selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND
+    );
+  }
+  return scripts;
+}
+function plan(context) {
+  if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
+    return {
+      operations: [],
+      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only; the two SvelteKit configs in this repo share nothing with it.`
+    };
+  }
+  const notes = [];
+  const operations = [];
+  const configFile = buildConfigFile(context.cwd);
+  if (configFile === void 0) {
+    operations.push({ kind: "write", path: BUILD_CONFIG_FILES[0], contents: scaffold() });
+    notes.push(
+      `wrote ${BUILD_CONFIG_FILES[0]} as a starting point. Fill in this app's own values (base, ports, routes); sentinel owns the composition, not the data.`
+    );
+  } else if (!readsPreset(context.cwd, configFile)) {
+    notes.push(
+      `${configFile} is this app's own, so it was left alone. To adopt: import \`reactApp\` from \`${BUILD_PRESET_SPECIFIER}\` and pass it this app's values, keeping \`alias\` and your own plugins verbatim. \`sentinel --inspect --build\` reports what the resolved config departs from and what it adds, before and after.`
+    );
+  }
+  operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
+  operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
+  const owned = ownedBuildDependencies(context.cwd);
+  if (owned.length > 0) {
+    operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
+    notes.push(
+      `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
+    );
+  }
+  return { operations, notes };
+}
+function readsPreset(cwd, configFile) {
+  if (!existsSync7(join7(cwd, configFile))) return false;
+  try {
+    return readFileSync5(join7(cwd, configFile), "utf8").includes(BUILD_PRESET_SPECIFIER);
+  } catch {
+    return false;
+  }
+}
+
+// src/roles/build/resolve-vite.ts
+function resolveVite(cwd) {
+  return binFromOwnInstall("vite", "vite") ?? resolveBin(cwd, "vite");
+}
+function viteOrigin(cwd) {
+  if (binFromOwnInstall("vite", "vite")) return "sentinel";
+  return resolveBin(cwd, "vite") ? "module" : "none";
+}
+
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
+var ViteDevAdapter = class extends BaseAdapter {
+  target = "dev";
+  runner = "vite";
+  appliesTo(preset) {
+    return preset === "react";
+  }
+  declaredPreset(cwd) {
+    return declaredBuildPreset(cwd);
+  }
+  /**
+   * The same plan as `--build`, deliberately.
+   *
+   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without
+   * the other leaves the module half-migrated in a way nothing reports. The operations are
+   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than
+   * additive.
+   */
+  plan(context) {
+    return plan(context);
+  }
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
+   *
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
+   */
+  async run(ctx) {
+    if (!readBuildAdoption(ctx.cwd).adopted) {
+      process.stderr.write(
+        `sentinel dev(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const vite = resolveVite(ctx.cwd);
+    if (!vite) {
+      process.stderr.write(
+        `sentinel dev(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    if (viteOrigin(ctx.cwd) === "module") {
+      process.stderr.write(
+        `sentinel dev(vite): serving with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one process fail in ways that never mention a version. Remove vite from this module's package.json.
+`
+      );
+    }
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: [] });
+    const result = spawnSync(vite, [...options, ...paths], { cwd: ctx.cwd, stdio: "inherit" });
+    if (result.error) {
+      process.stderr.write(`sentinel dev(vite): could not run vite (${result.error.message})
+`);
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? 0;
+    return { ok: code === 0, code };
+  }
+  async status(ctx) {
+    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift, unreadable };
+  }
+};
+
+// src/roles/build/adapters/vite/vite.adapter.ts
+import { spawnSync as spawnSync3 } from "child_process";
+
+// src/roles/build/owned-paths.ts
+var PRESET_OWNED_KEYS = [
+  "base",
+  "root",
+  "define",
+  "server",
+  "build",
+  "resolve",
+  "plugins"
+];
+function describeDepartures(config, defaults) {
+  const departures = [];
+  const build = asRecord(config.build);
+  const target = build?.target;
+  if (typeof target === "string" && target !== defaults.target) {
+    departures.push({
+      rule: "build.target",
+      reason: `${target}, where the convention is ${defaults.target}`
+    });
+  }
+  const server = asRecord(config.server);
+  const hosts = server?.allowedHosts;
+  if (Array.isArray(hosts) && !sameStrings(hosts, defaults.allowedHosts)) {
+    departures.push({
+      rule: "server.allowedHosts",
+      reason: `${JSON.stringify(hosts)}, where the convention is ${JSON.stringify(defaults.allowedHosts)}`
+    });
+  }
+  return departures;
+}
+function appAdditions(config) {
+  const owned = new Set(PRESET_OWNED_KEYS);
+  return Object.keys(config).filter((key) => !owned.has(key)).sort();
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function sameStrings(a, b) {
+  return a.length === b.length && a.every((value, at) => value === b[at]);
+}
+
+// src/roles/build/prerequisite.ts
+import { spawnSync as spawnSync2 } from "child_process";
+var PREBUILD_SCRIPT_NAME = `pre${BUILD_SCRIPT_NAME}`;
+function insideBuildScript(env = process.env) {
+  return env.npm_lifecycle_event === BUILD_SCRIPT_NAME;
+}
+function runPrerequisite(cwd, env = process.env) {
+  const scripts = moduleScripts(cwd);
+  const script = scripts[PREBUILD_SCRIPT_NAME];
+  if (script === void 0 || script.trim() === "") return { kind: "none" };
+  if (insideBuildScript(env)) return { kind: "already-run" };
+  const result = spawnSync2("pnpm", ["run", PREBUILD_SCRIPT_NAME], { cwd, stdio: "inherit" });
+  if (result.error) {
+    return { kind: "failed", code: 1, reason: result.error.message };
+  }
+  const code = result.status ?? 1;
+  if (code !== 0) {
+    return {
+      kind: "failed",
+      code,
+      reason: `\`pnpm run ${PREBUILD_SCRIPT_NAME}\` exited ${code}`
+    };
+  }
+  return { kind: "ran" };
+}
+
+// src/roles/build/resolve-config.ts
+async function resolveBuildConfig(cwd) {
+  try {
+    const { loadConfigFromFile } = await import("vite");
+    const loaded = await loadConfigFromFile(
+      { command: "build", mode: "production" },
+      void 0,
+      cwd,
+      "silent"
+    );
+    if (!loaded) return { kind: "failed", reason: "Vite found no config file in this module" };
+    return { kind: "loaded", config: loaded.config, from: loaded.path };
+  } catch (error) {
+    return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/roles/build/adapters/vite/vite.adapter.ts
+var VITE_VALUE_FLAGS = ["--config", "-c", "--mode", "-m", "--outDir", "--logLevel", "--base"];
+var ViteAdapter = class extends BaseAdapter {
+  target = "build";
+  runner = "vite";
+  /**
+   * React only. The two SvelteKit configs in this repo are 34 and 21 lines and share nothing
+   * with the React three; claiming them would mean a preset that fits neither.
+   */
+  appliesTo(preset) {
+    return preset === "react";
+  }
+  /**
+   * `react`, read from the module's Vite config rather than from its dependencies.
+   *
+   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
+   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
+   * during `sentinel --inspect` with no target, which never passes `--preset`.
+   */
+  declaredPreset(cwd) {
+    return declaredBuildPreset(cwd);
+  }
+  plan(context) {
+    return plan(context);
+  }
+  /**
+   * Build the module.
+   *
+   * A module that has not adopted is reported and passes, the same stance every other role
+   * takes: `--run` with no named target sweeps every wired target across the workspace, so
+   * failing here would exit non-zero on every module that has not migrated, which is most of
+   * them.
+   */
+  async run(ctx) {
+    const adoption = readBuildAdoption(ctx.cwd);
+    if (!adoption.adopted) {
+      process.stderr.write(
+        `sentinel build(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const prerequisite = runPrerequisite(ctx.cwd);
+    if (prerequisite.kind === "failed") {
+      process.stderr.write(
+        `sentinel build(vite): the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}
+`
+      );
+      return { ok: false, code: prerequisite.code };
+    }
+    const vite = resolveVite(ctx.cwd);
+    if (!vite) {
+      process.stderr.write(
+        `sentinel build(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    if (viteOrigin(ctx.cwd) === "module") {
+      process.stderr.write(
+        `sentinel build(vite): building with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one build fail in ways that never mention a version. Remove vite from this module's package.json.
+`
+      );
+    }
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
+      valueFlags: VITE_VALUE_FLAGS
+    });
+    const result = spawnSync3(vite, ["build", ...options, ...paths], {
+      cwd: ctx.cwd,
+      stdio: "inherit"
+    });
+    if (result.error) {
+      process.stderr.write(`sentinel build(vite): could not run vite (${result.error.message})
+`);
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? 1;
+    return { ok: code === 0, code };
+  }
+  /**
+   * What this module builds with, without building it.
+   *
+   * `--inspect` reads the committed config for every role, and the moment `--build` was wired
+   * it joined the sweep — so leaving this to throw would have broken `sentinel --inspect` on
+   * every React module, for a role that had only just arrived. Cheap and honest is the bar.
+   *
+   * `vite` is the interesting field and the one nothing else reports: an adopted config takes
+   * its plugins from sentinel, so a module answering `module` here is one build away from the
+   * two-copies failure, and this is where that is visible before it happens.
+   *
+   * The resolved config comes from Vite's own loader rather than from parsing the file. See
+   * `resolve-config` for why that is the only honest answer here, and what it costs.
+   */
+  async inspect(ctx) {
+    const adoption = readBuildAdoption(ctx.cwd);
+    const base = {
+      runner: "vite",
+      configFile: adoption.configFile,
+      ...adoption.unreadable ? { unreadable: adoption.unreadable } : {},
+      vite: viteOrigin(ctx.cwd),
+      // Rendered as a labelled block by the shared renderer, the same shape the lint role's
+      // parked rules and the format role's overrides already use.
+      overrides: adoption.ownDeclarations.map(({ name, version }) => ({
+        rule: name,
+        reason: `declared by this module at ${version}, where sentinel owns it`
+      })),
+      prerequisite: moduleScripts(ctx.cwd)[PREBUILD_SCRIPT_NAME] ?? null
+    };
+    if (adoption.configFile === null) return base;
+    const resolved = await resolveBuildConfig(ctx.cwd);
+    if (resolved.kind === "failed") {
+      return { ...base, configError: resolved.reason };
+    }
+    const config = resolved.config;
+    return {
+      ...base,
+      // What the app departs from, and what it adds, are different facts. A DEPARTURE is a
+      // disagreement with an opinion the preset holds; an ADDITION is the app needing
+      // something the preset never claimed, which is the preset working rather than being
+      // worked around.
+      departures: describeDepartures(config, REACT_APP_DEFAULTS),
+      additions: appAdditions(config),
+      resolved: {
+        base: config.base ?? null,
+        target: config.build?.target ?? null,
+        sourcemap: config.build?.sourcemap ?? null,
+        port: config.server?.port ?? null,
+        // The one number nothing else reports and that no formula predicts: career goes DOWN
+        // to 9998 where the others go up, which is why it is data rather than `port + 1`.
+        hmrPort: config.server?.hmr?.port ?? null,
+        // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
+        // would bury everything above it. The count is what tells you whether it moved.
+        aliases: Array.isArray(config.resolve?.alias) ? config.resolve.alias.length : 0,
+        plugins: Array.isArray(config.plugins) ? config.plugins.flat(9).length : 0
+      }
+    };
   }
-  const entry = project.targets?.[target];
-  if (!entry || entry.executor !== "nx:run-commands") return void 0;
-  const { command, commands, cwd: targetCwd } = entry.options ?? {};
-  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
-  if (typeof command === "string" && command.trim() !== "") {
-    return { command: command.trim(), ranInModule };
+  /**
+   * Adoption as data, WITHOUT building.
+   *
+   * Deliberately not "run the build and attach metrics". `--report` is what a migration
+   * dashboard calls across the whole workspace, and a bundler is the one tool here where doing
+   * the real work costs minutes per module rather than seconds. A report that nobody can
+   * afford to run is a report nobody runs.
+   *
+   * Bundle size is the metric this will eventually want, and it needs a build to produce. It
+   * belongs behind an explicit opt-in rather than in the default sweep, and the ticket parks
+   * it for exactly that reason.
+   */
+  async report(ctx) {
+    const adoption = readBuildAdoption(ctx.cwd);
+    return {
+      ok: true,
+      code: 0,
+      metrics: {
+        vite: viteOrigin(ctx.cwd),
+        ownBuildDependencies: adoption.ownDeclarations.length
+      }
+    };
   }
-  if (Array.isArray(commands)) {
-    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
-    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
+  async status(ctx) {
+    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift, unreadable };
   }
-  return void 0;
-}
-function rootedForScript(command) {
-  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
-}
-function existingCommand(cwd, target) {
-  const script = moduleScripts(cwd)[target];
-  if (script !== void 0 && script.trim() !== "") return script;
-  const fromTarget = nxTargetCommand(cwd, target);
-  if (fromTarget === void 0) return void 0;
-  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+};
+
+// src/roles/build/register.ts
+function registerBuild() {
+  register(new ViteAdapter());
+  setDefaultRunner("build", "vite");
+  register(new ViteDevAdapter());
+  setDefaultRunner("dev", "vite");
 }
 
+// src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
+
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join4 } from "path";
+import { extname, join as join8 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -290,7 +992,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join4(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join8(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -299,54 +1001,13 @@ function hasSourceFiles(cwd, extensions) {
   return false;
 }
 
-// src/core/config/nx-target.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join5 } from "path";
-function nxTargetOperations(options) {
-  const { cwd, targets } = options;
-  const names = Object.keys(targets);
-  if (names.length === 0) return [];
-  const operations = [];
-  if (existsSync3(join5(cwd, "project.json"))) {
-    operations.push({
-      kind: "remove-json-keys",
-      path: "project.json",
-      keys: names.map((name) => ["targets", name])
-    });
-  }
-  operations.push({
-    kind: "merge-json",
-    path: "package.json",
-    value: { nx: { targets } }
-  });
-  return operations;
-}
-
-// src/core/config/tool-args.ts
-import { existsSync as existsSync4 } from "fs";
-import { isAbsolute, resolve as resolve2 } from "path";
-function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
-  const takesValue = new Set(valueFlags);
-  const options = [];
-  const paths = [];
-  let previousTakesValue = false;
-  for (const arg of toolArgs) {
-    const looksLikeOption = arg.startsWith("-");
-    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
-    if (!previousTakesValue && !looksLikeOption && existsSync4(target)) paths.push(arg);
-    else options.push(arg);
-    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
-  }
-  return { options, paths };
-}
-
 // src/core/settings.ts
 var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync } from "fs";
-import { dirname as dirname2, join as join6, relative } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
+import { dirname as dirname3, join as join9, relative } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -355,8 +1016,8 @@ var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
 function findWorkspaceRoot(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync5(join6(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync8(join9(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -368,9 +1029,9 @@ function declaredNativeTs(pkg) {
   return version || void 0;
 }
 function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join6(root, "package.json");
-  if (!existsSync5(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+  const pkgPath = join9(root, "package.json");
+  if (!existsSync8(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
   const want = declaredNativeTs(pkg);
   if (!want) return void 0;
   const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
@@ -383,10 +1044,10 @@ function ensureI18nextSingleton(root, dryRun) {
   return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
 }
 function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join6(root, WORKSPACE_YAML);
-  if (!existsSync5(yamlPath)) return void 0;
+  const yamlPath = join9(root, WORKSPACE_YAML);
+  if (!existsSync8(yamlPath)) return void 0;
   const own = readOwnPackage().name;
-  const lines = readFileSync4(yamlPath, "utf8").split("\n");
+  const lines = readFileSync6(yamlPath, "utf8").split("\n");
   const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
   if (keyIdx === -1) return void 0;
   let lastItemIdx = keyIdx;
@@ -421,11 +1082,11 @@ var ROOT_PRETTIER_CONFIGS = [
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
   const rel = relative(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join6(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync5(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync5(join6(root, name)));
+  const ignorePath = join9(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
   if (!hasPrettier) return void 0;
   const pattern = `/${rel}/`;
-  const existing = existsSync5(ignorePath) ? readFileSync4(ignorePath, "utf8") : "";
+  const existing = existsSync8(ignorePath) ? readFileSync6(ignorePath, "utf8") : "";
   const lines = existing.split("\n");
   if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
     return void 0;
@@ -458,38 +1119,39 @@ function ensureWorkspacePrep(opts) {
     opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
   ].filter((message) => message !== void 0);
 }
-
-// src/shared/resolve-bin.ts
-import { existsSync as existsSync6 } from "fs";
-import { createRequire } from "module";
-import { delimiter, dirname as dirname3, join as join7 } from "path";
-var require2 = createRequire(import.meta.url);
-function resolveBin(fromDir, name) {
-  let dir = fromDir;
-  for (; ; ) {
-    const candidate = join7(dir, "node_modules", ".bin", name);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname3(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join9(root, "package.json");
+  if (existsSync8(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
   }
-}
-function binFromOwnInstall(packageName, binName) {
-  try {
-    const manifest = require2.resolve(`${packageName}/package.json`);
-    const bin = require2(manifest).bin;
-    const relative3 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative3) return void 0;
-    const executable = join7(dirname3(manifest), relative3);
-    return existsSync6(executable) ? executable : void 0;
-  } catch {
-    return void 0;
+  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
   }
-}
-function binSearchPath(cwd) {
-  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
-    " then "
-  );
+  const own = readOwnPackage().name;
+  const yamlPath = join9(root, WORKSPACE_YAML);
+  if (existsSync8(yamlPath)) {
+    const yaml = readFileSync6(yamlPath, "utf8");
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
 }
 
 // src/roles/format/config-policy.ts
@@ -514,6 +1176,7 @@ var PERMITTED_LOCAL_KEYS = [
   "experimentalOperatorPosition"
 ];
 var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
+var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
 var PRETTIER_CONFIG_FILES = [
   ".prettierrc",
   ".prettierrc.json",
@@ -537,48 +1200,6 @@ function formatTargets() {
   };
 }
 
-// src/core/config/tool-script.ts
-var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
-function isSeparatorAt(index) {
-  return index % 2 === 1;
-}
-function invokes(segment, binary) {
-  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
-}
-function isSentinelSegment(segment, roleFlag) {
-  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
-  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
-}
-function composeToolScript(existing, options) {
-  const { command } = options;
-  if (!existing || existing.trim() === "") return command;
-  const { roleFlag } = options;
-  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
-  const parts = existing.split(SEGMENT_SEPARATOR);
-  const commands = parts.filter((_, index) => !isSeparatorAt(index));
-  if (!commands.some(isReplaceable)) return existing;
-  let replacedOnce = false;
-  const rebuilt = parts.map((part, index) => {
-    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
-    if (replacedOnce) return null;
-    replacedOnce = true;
-    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
-  });
-  const kept = [];
-  for (let index = 0; index < rebuilt.length; index += 1) {
-    const part = rebuilt[index];
-    if (part === null) {
-      if (kept.length > 0) kept.pop();
-      continue;
-    }
-    kept.push(part);
-  }
-  return kept.join("").trim();
-}
-function keepsOtherCommands(script, sentinelCommand) {
-  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
-}
-
 // src/roles/format/format-script.ts
 var SENTINEL_FORMAT_COMMAND = "sentinel --run --format";
 function isPrettierSegment(segment) {
@@ -607,8 +1228,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -623,11 +1244,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join8(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync7(path)) return [];
+  const path = join10(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync9(path)) return [];
   let contents;
   try {
-    contents = readFileSync5(path, "utf8");
+    contents = readFileSync7(path, "utf8");
   } catch {
     return [];
   }
@@ -714,13 +1335,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname4, join as join11 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -749,8 +1370,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join9(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync6(schemaPath, "utf8"));
+    const schemaPath = join11(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync8(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -781,14 +1402,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join10(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync10(join12(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync7(join10(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync9(join12(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -818,9 +1439,9 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
-var NOT_ADOPTED = (configFile, unreadable = null) => ({
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
+var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
   adopted: false,
@@ -835,19 +1456,19 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join11(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync9(path)) return NOT_ADOPTED(null);
+  const path = join13(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync11(path)) return NOT_ADOPTED2(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync8(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync10(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
+    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
   }
   const provenance = parsed[PROVENANCE_KEY];
-  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED(FORMAT_CONFIG_FILE);
+  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
   if (!hasFormatPreset(provenance.preset)) {
-    return NOT_ADOPTED(
+    return NOT_ADOPTED2(
       FORMAT_CONFIG_FILE,
       `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
     );
@@ -926,7 +1547,9 @@ var OxfmtAdapter = class extends BaseAdapter {
     const localKeys = Object.keys(local).filter((key) => !ALWAYS_LOCAL_KEYS.includes(key)).sort();
     const inherited = inheritedIgnorePatterns(findWorkspaceRoot(context.cwd));
     const declaredIgnores = Array.isArray(local.ignorePatterns) ? local.ignorePatterns.filter((v) => typeof v === "string") : [];
-    const ignorePatterns = [.../* @__PURE__ */ new Set([...declaredIgnores, ...inherited])].sort();
+    const ignorePatterns = [
+      .../* @__PURE__ */ new Set([...declaredIgnores, ...inherited, ...FORMAT_DEFAULT_IGNORES])
+    ].sort();
     if (ignorePatterns.length > 0) local.ignorePatterns = ignorePatterns;
     const unchanged = existing.adopted && existing.conformant;
     const version = unchanged && existing.presetVersion ? existing.presetVersion : own.version;
@@ -946,7 +1569,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync10(join12(context.cwd, name))
+      (name) => existsSync12(join14(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1005,7 +1628,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
-    const pass = spawnSync(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const pass = spawnSync4(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     process.stderr.write(`  ${palette(process.stderr).dim(FORMATTER_DIFFERENCES)}
 `);
     if (pass.status === 0) return;
@@ -1068,7 +1691,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXFMT_VALUE_FLAGS
     });
-    const result = spawnSync(oxfmt, [mode, ...options, ...paths.length > 0 ? paths : ["."]], {
+    const result = spawnSync4(oxfmt, [mode, ...options, ...paths.length > 0 ? paths : ["."]], {
       cwd: ctx.cwd,
       stdio: "inherit"
     });
@@ -1146,7 +1769,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1, metrics: { ...base, unformatted: null } };
     }
-    const result = spawnSync(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync4(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1182,7 +1805,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync9(join12(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync11(join14(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -1263,9 +1886,9 @@ function registerFormat() {
 }
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync15, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join19 } from "path";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync19, readFileSync as readFileSync18, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join22 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -1275,10 +1898,18 @@ function deferredRuleNames(rules) {
 // src/roles/lint/config-policy.ts
 var LINT_CONFIG_FILE = ".oxlintrc.json";
 var LINT_SCRIPT_NAME = "lint";
-var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
+var PRESET_DIR = "./node_modules/@hublo/sentinel/lint";
 function presetPath(preset) {
   return `${PRESET_DIR}/${preset}.json`;
 }
+function isSentinelPreset(entry) {
+  return /@hublo\/sentinel\/(lint|oxlint)\//.test(entry);
+}
+function extendsWithPreset(current, variant) {
+  const own = presetPath(variant);
+  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
+  return [own, ...new Set(others)];
+}
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
   return preset === "react" && /(^|\/)libs\//.test(normalised) ? "react-lib" : preset;
@@ -1286,7 +1917,7 @@ function presetVariant(preset, cwd) {
 function presetOfVariant(variant) {
   return variant === "react-lib" ? "react" : variant;
 }
-var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/oxlint\/([a-z-]+)\.json$/;
+var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/(?:lint|oxlint)\/([a-z-]+)\.json$/;
 function presetNameFromPath(preset) {
   return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
 }
@@ -1298,7 +1929,7 @@ var ESLINT_CONFIG_FILES = [
   "eslint.config.ts"
 ];
 function lintTarget() {
-  return { cache: true, inputs: ["default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
+  return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
 // src/roles/lint/presets/base.json
@@ -1642,8 +2273,8 @@ var nest_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": [
       "error",
@@ -2034,8 +2665,8 @@ var react_lib_default = {
     },
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`. The `never` option is what makes it mean the same thing. Held at warn to match the app tier, where running it over every file found real violations the old rule never reported.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "use-isnan": [
       "error",
@@ -2608,8 +3239,8 @@ var react_default = {
     "typescript/restrict-template-expressions": "error",
     "typescript/return-await": {
       severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. The `never` option matches what no-return-await meant, so this is like-for-like, but it now runs over every file and finds real violations (9 on bff-admin, 5 on host-admin, measured with --type-aware). Held at warn so adoption does not turn a green module red, and raised to error once they are fixed. Switching to the stricter `in-try-catch`, which typescript-eslint recommends because `return await` inside try IS needed for correct error handling, is a separate decision with its own count.",
-      options: ["never"]
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
     },
     "typescript/switch-exhaustiveness-check": {
       severity: "warn",
@@ -3070,6 +3701,10 @@ function downgradedRulesFor(preset) {
   return downgradedFor(preset);
 }
 
+// src/roles/lint/extra-layers.ts
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { isAbsolute as isAbsolute2, join as join15, resolve as resolve3 } from "path";
+
 // src/roles/lint/module-baseline.ts
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
@@ -3078,10 +3713,7 @@ function holdsFrom(errorCounts) {
   return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
 }
 function renderBaseline(holds, version) {
-  const entries = holds.map(
-    ({ rule, count }) => `    // ${count} violation${count === 1 ? "" : "s"} when this module adopted
-    ${JSON.stringify(rule)}: "warn"`
-  ).join(",\n");
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
   return [
     "{",
     `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
@@ -3089,9 +3721,15 @@ function renderBaseline(holds, version) {
     "  // and returns to `error` on its own.",
     "  //",
     "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report; they just cannot fail the build for code",
-    "  // that was there before the migration. Fix them and re-run `--init --lint` to get the",
-    "  // preset severity back.",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
+    "  // to get the preset severity back.",
     '  "rules": {',
     entries,
     "  }",
@@ -3111,6 +3749,41 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 
+// src/roles/lint/extra-layers.ts
+function ruleCount(cwd, specifier) {
+  const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
+  if (!existsSync13(path)) return void 0;
+  try {
+    const parsed = parseJsonc(
+      readFileSync12(path, "utf8"),
+      specifier
+    );
+    return Object.keys(parsed.rules ?? {}).length;
+  } catch {
+    return void 0;
+  }
+}
+function extraLayers(cwd, extendsList) {
+  return extendsList.filter((entry) => !isSentinelPreset(entry) && entry !== LINT_BASELINE_SPECIFIER).map((entry) => {
+    const count = ruleCount(cwd, entry);
+    return {
+      rule: entry,
+      reason: count === void 0 ? "this module extends it, but it could not be read from here" : `${count} rule(s) on top of the preset, applied after it`
+    };
+  });
+}
+function committedExtendsList(cwd, configFile) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync12(join15(cwd, configFile), "utf8"),
+      configFile
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
@@ -3161,8 +3834,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { join as join17 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3177,12 +3850,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { join as join16 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync13(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3196,8 +3869,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join13(moduleDir, candidate);
-    if (!existsSync11(absolutePath)) continue;
+    const absolutePath = join16(moduleDir, candidate);
+    if (!existsSync14(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3220,7 +3893,7 @@ function normaliseExtends(value) {
   }
   return [];
 }
-var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
+var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
   adopted: false,
@@ -3230,18 +3903,18 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync12(join14(cwd, target.path))) {
-    return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
+  if (target.reason === "none" || !existsSync15(join17(cwd, target.path))) {
+    return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync11(join14(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync14(join17(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
+    return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
   }
   const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
-  if (preset === null) return NOT_ADOPTED2(target.path);
+  if (preset === null) return NOT_ADOPTED3(target.path);
   const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
   const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
   return {
@@ -3269,9 +3942,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join15 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3296,30 +3969,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join15(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join15(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join18(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join18(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join15(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join18(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync13(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync16(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
+import { join as join21 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -3332,11 +4005,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join16(cwd, name)).find((path) => existsSync14(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join19(cwd, name)).find((path) => existsSync17(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync12(config, "utf8");
+    source = readFileSync15(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -3390,8 +4063,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync13, statSync } from "fs";
-import { join as join17, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync16, statSync } from "fs";
+import { join as join20, relative as relative2 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -3438,7 +4111,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join17(dir, entry);
+    const full = join20(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync(full).isDirectory();
@@ -3458,7 +4131,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync13(file, "utf8");
+      content = readFileSync16(file, "utf8");
     } catch {
       continue;
     }
@@ -3498,7 +4171,17 @@ var DEFAULT_IGNORE_PATTERNS = [
   "**/dist/**",
   "**/node_modules/**",
   "**/coverage/**",
-  "**/*.mock.ts",
+  // `**/*.mock.ts` used to sit here and has been removed. It was the only entry in this list
+  // with no reason written next to it, and it does not meet the bar the paragraph above sets:
+  // a mock is not build output, not vendored and not generated. It is hand-written TypeScript
+  // that ships with the tests, and lint rules have as much to say about it as about any other
+  // source file. Ignoring it quietly narrowed what an adopted module checks — career lost
+  // `src/test/router.mock.ts`, which its previous ESLint config did lint.
+  //
+  // Measured before removing, because this is the one change that can turn a green module red:
+  // career has 1 such file and it reports nothing; the 15 planning modules have none. 222 exist
+  // repo-wide, and modules adopting later meet them through the baseline, which is exactly what
+  // the baseline is for.
   // Tool configuration is not source. A repo's shared ESLint config ignores these, and every
   // module inherits that; adoption replaces the config chain, so without them the first thing
   // an adopted module lints is its own jest setup file. Found on libs/front/components, where
@@ -3527,7 +4210,7 @@ function summariseByPlugin(rules) {
   }
   return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
 }
-function plan(context) {
+function plan2(context) {
   if (!hasLintPreset(context.preset)) {
     return {
       operations: [],
@@ -3561,7 +4244,7 @@ function plan(context) {
   ].filter((pattern) => !defaults.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
-    extends: [presetPath(variant)],
+    extends: extendsWithPreset(committedExtends(context.cwd), variant),
     ...carried.length > 0 ? { ignorePatterns: carried } : {}
   };
   const operations = [
@@ -3576,7 +4259,7 @@ function plan(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join18(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync18(join21(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -3671,10 +4354,21 @@ function lintScripts(cwd) {
   }
   return rewritten;
 }
+function committedExtends(cwd) {
+  try {
+    const parsed = parseJsonc(
+      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
+      LINT_CONFIG_FILE
+    );
+    return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
+  } catch {
+    return [];
+  }
+}
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync14(join18(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -3686,7 +4380,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync14(join18(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync17(join21(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -3745,7 +4439,7 @@ var OxlintAdapter = class extends BaseAdapter {
    * lines. The adapter stays the contract with the engine.
    */
   plan(context) {
-    return plan(context);
+    return plan2(context);
   }
   declaredPreset(cwd) {
     return presetOfVariant(presetNameFromPath(readLintAdoption(cwd).preset));
@@ -3755,7 +4449,7 @@ var OxlintAdapter = class extends BaseAdapter {
    * verification run that follows is the one a developer reads.
    */
   fixPass(ctx, oxlint, env) {
-    const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
+    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env,
@@ -3805,20 +4499,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join19(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join19(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync16(configPath)) return;
+    const configPath = join22(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join22(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync19(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync15(configPath, "utf8"),
+        readFileSync18(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join19(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join22(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -3826,7 +4520,7 @@ var OxlintAdapter = class extends BaseAdapter {
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
       );
-      measured = spawnSync2(
+      measured = spawnSync5(
         oxlint,
         [
           "-c",
@@ -3866,7 +4560,7 @@ var OxlintAdapter = class extends BaseAdapter {
     }
   }
   async run(ctx) {
-    if (!existsSync16(join19(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync19(join22(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -3913,7 +4607,7 @@ var OxlintAdapter = class extends BaseAdapter {
     const targets = paths.length > 0 ? paths : ["."];
     const lint = (extra) => {
       const passed = [...extra, ...passedOptions];
-      const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -3950,7 +4644,12 @@ var OxlintAdapter = class extends BaseAdapter {
       downgraded: downgradedRulesFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
         rule: entry.rule,
         reason: entry.reason
-      }))
+      })),
+      // What this module enforces BEYOND the preset. Not drift, and not covered by anything
+      // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
+      // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
+      // the extra rules it runs. See `extra-layers` for why that state is legitimate.
+      layers: extraLayers(ctx.cwd, committedExtendsList(ctx.cwd, LINT_CONFIG_FILE))
     };
   }
   /** How many rules the extended preset enforces, read from the preset on disk. */
@@ -3981,7 +4680,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -3991,7 +4690,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync15(join19(cwd, entry), "utf8"),
+          readFileSync18(join22(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4008,7 +4707,7 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return { ok: false, code: 1, metrics: { error: "oxlint not found" } };
     const typeAware = canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [];
-    const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
+    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) },
@@ -4061,14 +4760,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync16(join19(cwd, target)));
+    return targets.find((target) => !existsSync19(join22(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4099,10 +4798,10 @@ function registerLint() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join21 } from "path";
+import { join as join24 } from "path";
 
 // src/roles/typescript/presets/base.json
 var base_default3 = {
@@ -4266,7 +4965,7 @@ function resolveTsconfigTarget(moduleDir) {
 }
 
 // src/roles/typescript/read-adoption.ts
-var SENTINEL_PRESET = /^@hublo\/sentinel\/tsconfig\/[a-z-]+$/;
+var SENTINEL_PRESET = /^@hublo\/sentinel\/(?:typescript|tsconfig)\/[a-z-]+$/;
 function readTsconfigAdoption(cwd) {
   return readAdoption(cwd, {
     candidates: TSCONFIG_CANDIDATES,
@@ -4283,8 +4982,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync16 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { join as join23 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -4306,7 +5005,10 @@ function keepsForeignChecker(existing) {
 
 // src/roles/typescript/adapters/tsc/plan.ts
 var INSTALL_NOTE = "run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve";
-var TYPECHECK_TARGET = { cache: true, inputs: ["default", "{projectRoot}/tsconfig.json"] };
+var TYPECHECK_TARGET = {
+  cache: true,
+  inputs: ["default", "^default", "{projectRoot}/tsconfig.json"]
+};
 function typecheckScripts(cwd) {
   return {
     // Reads the nx target too, not only the npm script: five modules in this repo keep a
@@ -4315,9 +5017,11 @@ function typecheckScripts(cwd) {
     [TYPECHECK_SCRIPT_NAME]: composeTypecheckScript(existingCommand(cwd, TYPECHECK_SCRIPT_NAME))
   };
 }
+var SENTINEL_TS_PRESET = /@hublo\/sentinel\/(?:typescript|tsconfig)\//;
 function composeExtends(current, preset) {
   const chain = typeof current === "string" ? [current] : Array.isArray(current) ? current.filter((entry) => typeof entry === "string") : [];
-  return chain.includes(preset) ? chain : [...chain, preset];
+  const withoutOwn = chain.filter((entry) => entry !== preset && !SENTINEL_TS_PRESET.test(entry));
+  return [...withoutOwn, preset];
 }
 function declaredPreset(cwd) {
   const { preset } = readTsconfigAdoption(cwd);
@@ -4346,7 +5050,7 @@ function planAdoption(context) {
     };
   }
   const target = resolveTsconfigTarget(context.cwd);
-  const preset = `@hublo/sentinel/tsconfig/${context.preset}`;
+  const preset = `@hublo/sentinel/typescript/${context.preset}`;
   const addScript = manifestOperation(context.cwd, typecheckScripts(context.cwd));
   const nxTargets = nxTargetOperations({
     cwd: context.cwd,
@@ -4372,7 +5076,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync16(join20(context.cwd, target.path), "utf8"),
+    readFileSync19(join23(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -4410,7 +5114,7 @@ function planAdoption(context) {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 var SENTINEL_PACKAGE = "@hublo/sentinel";
-var SENTINEL_PRESET_SCOPE = `${SENTINEL_PACKAGE}/tsconfig/`;
+var SENTINEL_PRESET_SCOPES = [`${SENTINEL_PACKAGE}/typescript/`, `${SENTINEL_PACKAGE}/tsconfig/`];
 var DIAGNOSTIC_RE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.+)$/;
 function parseDiagnostics(output) {
   const diagnostics = [];
@@ -4510,7 +5214,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync17(join21(cwd, target.path), "utf8"),
+        readFileSync20(join24(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -4519,11 +5223,11 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     }
     const entries = typeof chain === "string" ? [chain] : Array.isArray(chain) ? chain : [];
     const preset = entries.find(
-      (entry) => typeof entry === "string" && entry.startsWith(SENTINEL_PRESET_SCOPE)
+      (entry) => typeof entry === "string" && SENTINEL_PRESET_SCOPES.some((scope) => entry.startsWith(scope))
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join21(cwd, "noop.js")).resolve(preset);
+      createRequire4(join24(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -4564,7 +5268,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync3(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4599,7 +5303,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync3(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4619,7 +5323,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync17(join21(cwd, config), "utf8"),
+        readFileSync20(join24(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -4635,7 +5339,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync17(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync20(join24(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -4688,7 +5392,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync3(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4731,7 +5435,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync3(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -4757,6 +5461,7 @@ function registerAdapters() {
   registerTypescript();
   registerLint();
   registerFormat();
+  registerBuild();
 }
 
 // src/core/detect-framework.ts
@@ -4838,26 +5543,19 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3, sep } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync21, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
-  const root = resolve3(cwd);
-  const absolutePath = resolve3(root, relativePath);
+  const root = resolve4(cwd);
+  const absolutePath = resolve4(root, relativePath);
   if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
     throw new Error(`Refusing to write outside the module root: "${relativePath}".`);
   }
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync18(absolutePath) ? readFileSync18(absolutePath, "utf8") : void 0;
+  return existsSync21(absolutePath) ? readFileSync21(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -4938,9 +5636,9 @@ function applyOperationTo(current, operation) {
     }
   }
 }
-function preparePlan(cwd, plan2) {
+function preparePlan(cwd, plan3) {
   const prepared = /* @__PURE__ */ new Map();
-  for (const operation of plan2.operations) {
+  for (const operation of plan3.operations) {
     const absolutePath = resolveWithinRoot(cwd, operation.path);
     const existing = prepared.get(operation.path);
     const before = existing?.before ?? readIfExists(absolutePath) ?? "";
@@ -4962,8 +5660,8 @@ function writeFileAtomic(absolutePath, contents) {
   writeFileSync3(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
-function applyPlan(cwd, plan2) {
-  const changed = preparePlan(cwd, plan2).filter((file) => file.before !== file.after);
+function applyPlan(cwd, plan3) {
+  const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
       rmSync2(file.absolutePath, { force: true });
@@ -4975,8 +5673,8 @@ function applyPlan(cwd, plan2) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync19 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync22, readdirSync as readdirSync3, readFileSync as readFileSync22 } from "fs";
+import { join as join25 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -4990,11 +5688,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join22(cwd, "package.json");
-  if (!existsSync19(path)) return [];
+  const path = join25(cwd, "package.json");
+  if (!existsSync22(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync19(path, "utf8"),
+      readFileSync22(path, "utf8"),
       path
     );
     return [
@@ -5017,7 +5715,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync19(join22(cwd, name), "utf8"),
+        readFileSync22(join25(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5068,14 +5766,14 @@ function resolveFlavour(opts) {
   }
   return detection.preset;
 }
-function previewPlan(opts, plan2) {
-  const changed = preparePlan(opts.cwd, plan2).filter((file) => file.before !== file.after);
+function previewPlan(opts, plan3) {
+  const changed = preparePlan(opts.cwd, plan3).filter((file) => file.before !== file.after);
   if (opts.json) {
     process.stdout.write(
       JSON.stringify(
         {
           dryRun: true,
-          notes: plan2.notes ?? [],
+          notes: plan3.notes ?? [],
           files: changed.map(({ path, before, after, deleted }) => ({
             path,
             action: deleted ? "delete" : before.length === 0 ? "create" : "update",
@@ -5090,7 +5788,7 @@ function previewPlan(opts, plan2) {
     return 0;
   }
   process.stderr.write("  dry run: no files written\n");
-  for (const note of plan2.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (changed.length === 0) {
     process.stderr.write("  nothing to change\n");
@@ -5111,7 +5809,8 @@ async function dispatch(opts) {
     throw new Error(`dispatch handles --init only; --${opts.verb} routes through analyse()`);
   }
   const detected = resolveFlavour(opts);
-  const adapter = resolve(opts.target, detected, opts.runner);
+  const resolutionPreset = opts.preset ?? declaredPresetFor(opts.target, opts.cwd) ?? detected;
+  const adapter = resolve(opts.target, resolutionPreset, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
   const contradiction = presetContradiction(preset, opts.cwd);
   if (contradiction !== void 0) {
@@ -5120,25 +5819,25 @@ async function dispatch(opts) {
     return 1;
   }
   const context = { cwd: opts.cwd, preset };
-  const plan2 = await adapter.plan(context);
-  if (plan2.blocked) {
-    process.stderr.write(`sentinel (${opts.target}): ${plan2.blocked}
+  const plan3 = await adapter.plan(context);
+  if (plan3.blocked) {
+    process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
 `);
     return 1;
   }
-  if (plan2.skipped) {
-    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan2.skipped}`)}
+  if (plan3.skipped) {
+    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan3.skipped}`)}
 `);
     return 0;
   }
   if (opts.dryRun) {
-    return previewPlan(opts, plan2);
+    return previewPlan(opts, plan3);
   }
-  for (const change of applyPlan(opts.cwd, plan2)) {
+  for (const change of applyPlan(opts.cwd, plan3)) {
     process.stderr.write(`  ${change.deleted ? "removed" : "wrote"} ${change.path}
 `);
   }
-  for (const note of plan2.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (adapter.afterInit) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
@@ -5155,26 +5854,30 @@ async function dispatch(opts) {
 }
 
 export {
+  PresetUnsupportedError,
   register,
   setDefaultRunner,
   all,
+  declaredPresetFor,
   availableTargets,
   resolve,
   BaseAdapter,
+  resolveBin,
   readOwnVersion,
   readProjectPackageJson,
   readNxProjectName,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
+  inspectWorkspacePrep,
   palette,
-  resolveBin,
   VERBS,
   TARGETS,
+  SWEEPABLE_TARGETS,
   PRESET_NAMES,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-RLVLDC5H.js.map
+//# sourceMappingURL=chunk-TWL6T237.js.map