@hublo/sentinel 1.1.7 → 1.2.0-alpha.1

package/dist/{chunk-W73ISYMG.js → chunk-FLJ2QNFF.js}

@@ -1,5 +1,21 @@
+import {
+  REACT_APP_DEFAULTS,
+  REQUIREMENTS,
+  isPlainObject
+} from "./chunk-XVDOQ3G3.js";
+
 // src/core/registry.ts
 var adapters = [];
+var PresetUnsupportedError = class extends Error {
+  constructor(target, preset) {
+    super(`No adapter for target "${target}" handles preset "${preset}".`);
+    this.target = target;
+    this.preset = preset;
+    this.name = "PresetUnsupportedError";
+  }
+  target;
+  preset;
+};
 var defaultRunner = {
   // Filled in by tool branches, e.g. lint: 'eslint', typescript: 'tsc'.
 };
@@ -12,6 +28,14 @@ function setDefaultRunner(target, runner) {
 function all() {
   return adapters;
 }
+function declaredPresetFor(target, cwd) {
+  for (const adapter of adapters) {
+    if (adapter.target !== target) continue;
+    const declared = adapter.declaredPreset?.(cwd);
+    if (declared !== void 0) return declared;
+  }
+  return void 0;
+}
 function availableTargets() {
   return [...new Set(adapters.map((a) => a.target))];
 }
@@ -24,7 +48,7 @@ function resolve(target, preset, runner) {
   }
   const candidates = preset ? forTarget.filter((a) => a.appliesTo(preset)) : forTarget;
   if (candidates.length === 0) {
-    throw new Error(`No adapter for target "${target}" handles preset "${preset}".`);
+    throw new PresetUnsupportedError(target, preset);
   }
   const wanted = runner ?? defaultRunner[target];
   const available = candidates.map((a) => a.runner).join(", ");
@@ -117,11 +141,16 @@ var TARGETS = [
   "format",
   "typescript",
   "build",
+  "dev",
   "test",
   "static-analysis",
   "runtime-analysis",
   "arch"
 ];
+var LONG_RUNNING_TARGETS = ["dev"];
+var SWEEPABLE_TARGETS = TARGETS.filter(
+  (target) => !LONG_RUNNING_TARGETS.includes(target)
+);
 var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
 // src/shared/color.ts
@@ -138,14 +167,67 @@ function palette(stream) {
   };
 }
 
-// src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
+// src/roles/build/adapters/vite/vite-role.adapter.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+
+// src/core/config/tool-args.ts
+import { existsSync as existsSync2 } from "fs";
+import { isAbsolute, resolve as resolve2 } from "path";
+function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
+  const takesValue = new Set(valueFlags);
+  const options = [];
+  const paths = [];
+  let previousTakesValue = false;
+  for (const arg of toolArgs) {
+    const looksLikeOption = arg.startsWith("-");
+    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
+    if (!previousTakesValue && !looksLikeOption && existsSync2(target)) paths.push(arg);
+    else options.push(arg);
+    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+  }
+  return { options, paths };
+}
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync3 } from "fs";
+import { createRequire } from "module";
+import { delimiter, dirname as dirname2, join as join2 } from "path";
+var require2 = createRequire(import.meta.url);
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join2(dir, "node_modules", ".bin", name);
+    if (existsSync3(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function binFromOwnInstall(packageName, binName) {
+  try {
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative4 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative4) return void 0;
+    const executable = join2(dirname2(manifest), relative4);
+    return existsSync3(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function binSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/build/plan.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // src/shared/jsonc.ts
 import { parse, printParseErrorCode } from "jsonc-parser";
@@ -160,11 +242,11 @@ function parseJsonc(text, source = "config") {
 }
 
 // src/core/config/manifest.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { basename, join as join2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { basename, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -172,7 +254,7 @@ function moduleScripts(cwd) {
 }
 function moduleName(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -192,7 +274,7 @@ function manifestOperation(cwd, scripts) {
     scripts,
     devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
   };
-  if (existsSync2(join2(cwd, "package.json"))) {
+  if (existsSync4(join3(cwd, "package.json"))) {
     return { kind: "merge-json", path: "package.json", value };
   }
   return {
@@ -207,7 +289,7 @@ function nxTargetCommand(cwd, target) {
   let project;
   try {
     project = parseJsonc(
-      readFileSync3(join3(cwd, "project.json"), "utf8"),
+      readFileSync3(join4(cwd, "project.json"), "utf8"),
       "project.json"
     );
   } catch {
@@ -237,9 +319,699 @@ function existingCommand(cwd, target) {
   return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
 }
 
+// src/core/config/nx-target.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join5 } from "path";
+function nxTargetOperations(options) {
+  const { cwd, targets } = options;
+  const names = Object.keys(targets);
+  if (names.length === 0) return [];
+  const operations = [];
+  if (existsSync5(join5(cwd, "project.json"))) {
+    operations.push({
+      kind: "remove-json-keys",
+      path: "project.json",
+      keys: names.map((name) => ["targets", name])
+    });
+  }
+  operations.push({
+    kind: "merge-json",
+    path: "package.json",
+    value: { nx: { targets } }
+  });
+  return operations;
+}
+
+// src/core/config/tool-script.ts
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function invokes(segment, binary) {
+  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
+}
+function isSentinelSegment(segment, roleFlag) {
+  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
+  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
+}
+function composeToolScript(existing, options) {
+  const { command } = options;
+  if (!existing || existing.trim() === "") return command;
+  const { roleFlag } = options;
+  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isReplaceable)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
+    }
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script, sentinelCommand) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
+}
+
+// src/roles/build/config-policy.ts
+var BUILD_CONFIG_FILES = [
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.js",
+  "vite.config.mjs"
+];
+var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_SCRIPT_NAME = "build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var DEV_SCRIPT_NAME = "serve";
+var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
+function buildTarget() {
+  return {
+    [BUILD_SCRIPT_NAME]: {
+      cache: true,
+      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
+    }
+  };
+}
+var SENTINEL_OWNED_BUILD_PACKAGES = [
+  "vite",
+  "@vitejs/plugin-react",
+  "@tailwindcss/vite",
+  "vite-plugin-svgr",
+  "nitro"
+];
+
+// src/roles/build/dev-script.ts
+var CHAIN = " -- ";
+var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
+var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
+function appOptions(rest) {
+  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((token, at2) => !(at2 === 0 && DEV_SUBCOMMANDS.has(token)));
+  return kept.join(" ");
+}
+function composeDevScript(existing, command) {
+  if (existing === void 0 || existing.trim() === "") return command;
+  const chunks = existing.trim().split(CHAIN);
+  const at2 = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at2 === -1) return existing;
+  const rest = (chunks[at2] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const options = appOptions(rest);
+  chunks[at2] = options === "" ? command : `${command} -- ${options}`;
+  return chunks.join(CHAIN);
+}
+
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+var NOT_ADOPTED = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  ownDeclarations: [],
+  unreadable
+});
+function buildConfigFile(cwd) {
+  return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
+}
+function importsSpecifier(source, specifier) {
+  const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
+}
+function importsPreset(source) {
+  return importsSpecifier(source, BUILD_PRESET_SPECIFIER);
+}
+var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
+function declaredBuildPreset(cwd) {
+  const source = readBuildConfigSource(cwd);
+  if (source === void 0) return void 0;
+  return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
+}
+function readBuildConfigSource(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return void 0;
+  try {
+    return readFileSync4(join6(cwd, configFile), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function readBuildAdoption(cwd) {
+  const configFile = buildConfigFile(cwd);
+  if (!configFile) return NOT_ADOPTED(null);
+  let source;
+  try {
+    source = readFileSync4(join6(cwd, configFile), "utf8");
+  } catch (error) {
+    return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
+  }
+  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
+  const manifest = readProjectPackageJson(cwd);
+  const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+  const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
+    (name) => ({ name, version: declared[name] })
+  );
+  return {
+    configFile,
+    preset: "react",
+    adopted: true,
+    conformant: ownDeclarations.length === 0,
+    drift: ownDeclarations.map(
+      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
+    ),
+    ownDeclarations,
+    unreadable: null
+  };
+}
+
+// src/roles/build/requirements.ts
+function atLeast(declared, needed) {
+  const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse2(declared);
+  const right = parse2(needed);
+  for (let at2 = 0; at2 < Math.max(left.length, right.length); at2++) {
+    const a = left[at2] ?? 0;
+    const b = right[at2] ?? 0;
+    if (a !== b) return a > b;
+  }
+  return true;
+}
+function unmetRequirements(preset, declared) {
+  const entry = REQUIREMENTS[preset];
+  if (!entry) return [];
+  return Object.entries(entry.requires).filter(([name, needed]) => {
+    const have = declared[name];
+    return have === void 0 || !atLeast(have, needed);
+  }).map(([name, needed]) => ({ name, declared: declared[name], needed }));
+}
+function describeUnmet(preset, unmet) {
+  const entry = REQUIREMENTS[preset];
+  const list = unmet.map(
+    ({ name, declared, needed }) => `${name} ${declared === void 0 ? "is not declared here" : `is at ${declared}`}, needs >= ${needed}`
+  ).join("; ");
+  return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
+}
+
+// src/roles/build/plan.ts
+function scaffold() {
+  return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
+import { tanstackStart } from '@tanstack/react-start/plugin/vite'
+import { tanstackRouter } from '@tanstack/router-plugin/vite'
+import path from 'node:path'
+
+/*
+ * Composition comes from sentinel: which plugins run under test and which under a real build,
+ * the order they run in, and how the env is read. The values below are this app's own.
+ *
+ * TanStack is passed IN rather than imported by sentinel, because the app codes against it
+ * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
+ * Anything sentinel does not set goes in \`overrides\`, which merges over the preset last.
+ */
+export default defineConfig(({ mode }) =>
+  reactApp({
+    root: __dirname,
+    mode,
+    base: '/',
+    port: 3000,
+    // Explicit, NOT port + 1: the three apps in this repo disagree, one of them goes down.
+    hmrPort: 3001,
+    router: {
+      routesDirectory: path.resolve(__dirname, 'src/routes'),
+      generatedRouteTree: path.resolve(__dirname, 'src/routeTree.gen.ts'),
+    },
+    tanstack: { start: tanstackStart, router: tanstackRouter },
+    alias: [],
+  }),
+)
+
+// If this app reads environment variables, use \`appEnv(__dirname, mode)\` rather than Vite's
+// \`loadEnv\`: it applies the production -> prd normalisation this repo deploys under, which
+// every app was otherwise retyping.
+`;
+}
+function ownedBuildDependencies(cwd) {
+  const manifest = readProjectPackageJson(cwd);
+  const keys = [];
+  for (const section of ["dependencies", "devDependencies"]) {
+    const declared = manifest[section];
+    if (!declared) continue;
+    for (const name of SENTINEL_OWNED_BUILD_PACKAGES) {
+      if (name in declared) keys.push([section, name]);
+    }
+  }
+  return keys;
+}
+function invokesVite(segment) {
+  return /(^|\s|\/)vite(\s|$)/.test(segment.trim());
+}
+function buildScripts(cwd) {
+  const own = selfCommand(cwd, "--run --build");
+  const scripts = {
+    [BUILD_SCRIPT_NAME]: composeToolScript(existingCommand(cwd, BUILD_SCRIPT_NAME), {
+      command: own ?? SENTINEL_BUILD_COMMAND,
+      replaces: invokesVite,
+      // Only meaningful for the self case: it lets a re-init correct a sentinel invocation
+      // whose FORM is wrong, without matching another role's script.
+      roleFlag: own === void 0 ? void 0 : "--build"
+    })
+  };
+  const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
+  if (existingDev !== void 0) {
+    scripts[DEV_SCRIPT_NAME] = composeDevScript(
+      existingDev,
+      selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND
+    );
+  }
+  return scripts;
+}
+function plan(context) {
+  const manifest = readProjectPackageJson(context.cwd);
+  const unmet = unmetRequirements(context.preset, {
+    ...manifest.dependencies,
+    ...manifest.devDependencies
+  });
+  if (unmet.length > 0) {
+    return { operations: [], skipped: describeUnmet(context.preset, unmet) };
+  }
+  if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
+    return {
+      operations: [],
+      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
+    };
+  }
+  const notes = [];
+  const operations = [];
+  const configFile = buildConfigFile(context.cwd);
+  if (configFile === void 0) {
+    operations.push({ kind: "write", path: BUILD_CONFIG_FILES[0], contents: scaffold() });
+    notes.push(
+      `wrote ${BUILD_CONFIG_FILES[0]} as a starting point. Fill in this app's own values (base, ports, routes); sentinel owns the composition, not the data.`
+    );
+  } else if (!readsPreset(context.cwd, configFile)) {
+    notes.push(
+      `${configFile} is this app's own, so it was left alone. To adopt: import \`reactApp\` from \`${BUILD_PRESET_SPECIFIER}\` and pass it this app's values, keeping \`alias\` and your own plugins verbatim. \`sentinel --inspect --build\` reports what the resolved config departs from and what it adds, before and after.`
+    );
+  }
+  operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
+  operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
+  const owned = ownedBuildDependencies(context.cwd);
+  if (owned.length > 0) {
+    operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
+    notes.push(
+      `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
+    );
+  }
+  return { operations, notes };
+}
+function readsPreset(cwd, configFile) {
+  if (!existsSync7(join7(cwd, configFile))) return false;
+  try {
+    return readFileSync5(join7(cwd, configFile), "utf8").includes(BUILD_PRESET_SPECIFIER);
+  } catch {
+    return false;
+  }
+}
+
+// src/roles/build/resolve-vite.ts
+function resolveViteWith(cwd) {
+  const own = binFromOwnInstall("vite", "vite");
+  if (own) return { bin: own, origin: "sentinel" };
+  const module_ = resolveBin(cwd, "vite");
+  return module_ ? { bin: module_, origin: "module" } : { bin: void 0, origin: "none" };
+}
+function viteOrigin(cwd) {
+  return resolveViteWith(cwd).origin;
+}
+
+// src/roles/build/adapters/vite/vite-role.adapter.ts
+var VITE_VALUE_FLAGS = [
+  "--config",
+  "-c",
+  "--mode",
+  "-m",
+  "--outDir",
+  "--logLevel",
+  "--base",
+  "--host",
+  "--port"
+];
+var ViteRoleAdapter = class extends BaseAdapter {
+  runner = "vite";
+  /**
+   * The presets this role has something to SAY about, which is wider than the ones it serves.
+   *
+   * React it serves. Svelte it does not, yet, and the difference matters to a developer: the
+   * plugin caps at Vite 6 until its major 7, which needs `svelte ^5.46.4`, so the role applies
+   * once the module moves. `plan` reports that chain and SKIPS, which it can only do if
+   * resolution let it run at all — filtering here would give "no adapter for preset svelte",
+   * which tells nobody what to do about it.
+   *
+   * Nest, node and tools are genuinely declined: there is nothing to bundle, and no version
+   * would change that.
+   */
+  appliesTo(preset) {
+    return preset === "react" || preset === "svelte";
+  }
+  /**
+   * `react`, read from the module's Vite config rather than from its dependencies.
+   *
+   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
+   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
+   * during `sentinel --inspect` with no target, which never passes `--preset`.
+   */
+  declaredPreset(cwd) {
+    return declaredBuildPreset(cwd);
+  }
+  /**
+   * The same plan for both targets, deliberately.
+   *
+   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without the
+   * other leaves the module half-migrated in a way nothing reports. The operations are
+   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than additive.
+   */
+  plan(context) {
+    return plan(context);
+  }
+  async status(ctx) {
+    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift, unreadable };
+  }
+  /**
+   * Adoption, the binary, and the warning about which copy of Vite is running.
+   *
+   * A module that has not adopted is reported and PASSES, the same stance every other role
+   * takes: `--run` with no named target sweeps every wired target across the workspace, so
+   * failing here would exit non-zero on every module that has not migrated, which is most of
+   * them.
+   */
+  prepare(ctx) {
+    if (!readBuildAdoption(ctx.cwd).adopted) {
+      this.say(
+        `no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.`
+      );
+      return { kind: "stop", result: { ok: true, code: 0 } };
+    }
+    const { bin, origin } = resolveViteWith(ctx.cwd);
+    if (!bin) {
+      this.say(
+        `could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.`
+      );
+      return { kind: "stop", result: { ok: false, code: 1 } };
+    }
+    if (origin === "module") {
+      this.say(
+        `using the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite fail in ways that never mention a version. Remove vite from this module's package.json.`
+      );
+    }
+    return { kind: "ready", vite: bin };
+  }
+  /**
+   * Run Vite with the caller's own arguments after `--`, and report what happened.
+   *
+   * `whenSignalled` is the only difference between the two targets here, and it is a real one:
+   * a build killed by a signal did not produce a bundle, while a dev server killed by Ctrl-C
+   * did exactly what the developer asked.
+   */
+  spawnVite(ctx, vite, argv, whenSignalled) {
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
+      valueFlags: VITE_VALUE_FLAGS
+    });
+    const result = spawnSync(vite, [...argv, ...options, ...paths], {
+      cwd: ctx.cwd,
+      stdio: "inherit"
+    });
+    if (result.error) {
+      this.say(`could not run vite (${result.error.message})`);
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? whenSignalled;
+    return { ok: code === 0, code };
+  }
+  /** One prefix for every message this role emits, so they cannot drift apart. */
+  say(message) {
+    process.stderr.write(`sentinel ${this.label}(vite): ${message}
+`);
+  }
+};
+
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
+var ViteDevAdapter = class extends ViteRoleAdapter {
+  target = "dev";
+  get label() {
+    return "dev";
+  }
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
+   *
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
+   *
+   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
+   * bare form is the one every version accepts.
+   */
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    return this.spawnVite(ctx, ready.vite, [], 0);
+  }
+};
+
+// src/roles/build/owned-paths.ts
+var PRESET_OWNED_KEYS = [
+  "base",
+  "root",
+  "define",
+  "server",
+  "build",
+  "nitro",
+  "resolve",
+  "plugins"
+];
+function describeDepartures(config, defaults) {
+  const departures = [];
+  const build = asRecord(config.build);
+  const target = build?.target;
+  if (typeof target === "string" && target !== defaults.target) {
+    departures.push({
+      rule: "build.target",
+      reason: `${target}, where the convention is ${defaults.target}`
+    });
+  }
+  const server = asRecord(config.server);
+  const hosts = server?.allowedHosts;
+  if (Array.isArray(hosts) && !sameStrings(hosts, defaults.allowedHosts)) {
+    departures.push({
+      rule: "server.allowedHosts",
+      reason: `${JSON.stringify(hosts)}, where the convention is ${JSON.stringify(defaults.allowedHosts)}`
+    });
+  }
+  return departures;
+}
+function appAdditions(config) {
+  const owned = new Set(PRESET_OWNED_KEYS);
+  return Object.keys(config).filter((key) => !owned.has(key)).sort();
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function sameStrings(a, b) {
+  return a.length === b.length && a.every((value, at2) => value === b[at2]);
+}
+
+// src/roles/build/prerequisite.ts
+import { spawnSync as spawnSync2 } from "child_process";
+var PREBUILD_SCRIPT_NAME = `pre${BUILD_SCRIPT_NAME}`;
+function insideBuildScript(env = process.env) {
+  return env.npm_lifecycle_event === BUILD_SCRIPT_NAME;
+}
+function runPrerequisite(cwd, env = process.env) {
+  const scripts = moduleScripts(cwd);
+  const script = scripts[PREBUILD_SCRIPT_NAME];
+  if (script === void 0 || script.trim() === "") return { kind: "none" };
+  if (insideBuildScript(env)) return { kind: "already-run" };
+  const result = spawnSync2("pnpm", ["run", PREBUILD_SCRIPT_NAME], { cwd, stdio: "inherit" });
+  if (result.error) {
+    return { kind: "failed", code: 1, reason: result.error.message };
+  }
+  const code = result.status ?? 1;
+  if (code !== 0) {
+    return {
+      kind: "failed",
+      code,
+      reason: `\`pnpm run ${PREBUILD_SCRIPT_NAME}\` exited ${code}`
+    };
+  }
+  return { kind: "ran" };
+}
+
+// src/roles/build/resolve-config.ts
+async function resolveBuildConfig(cwd) {
+  try {
+    const { loadConfigFromFile } = await import("vite");
+    const loaded = await loadConfigFromFile(
+      { command: "build", mode: "production" },
+      void 0,
+      cwd,
+      "silent"
+    );
+    if (!loaded) return { kind: "failed", reason: "Vite found no config file in this module" };
+    return { kind: "loaded", config: loaded.config, from: loaded.path };
+  } catch (error) {
+    return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/roles/build/adapters/vite/vite.adapter.ts
+var ViteAdapter = class extends ViteRoleAdapter {
+  target = "build";
+  get label() {
+    return "build";
+  }
+  /**
+   * Build the module.
+   *
+   * Adoption, the binary and the two-copies warning are `prepare`'s, shared with `--dev`. What
+   * is this target's own is the `prebuild` step and the `build` subcommand.
+   */
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    const prerequisite = runPrerequisite(ctx.cwd);
+    if (prerequisite.kind === "failed") {
+      this.say(
+        `the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}`
+      );
+      return { ok: false, code: prerequisite.code };
+    }
+    return this.spawnVite(ctx, ready.vite, ["build"], 1);
+  }
+  /**
+   * What this module builds with, without building it.
+   *
+   * `--inspect` reads the committed config for every role, and the moment `--build` was wired
+   * it joined the sweep — so leaving this to throw would have broken `sentinel --inspect` on
+   * every React module, for a role that had only just arrived. Cheap and honest is the bar.
+   *
+   * `vite` is the interesting field and the one nothing else reports: an adopted config takes
+   * its plugins from sentinel, so a module answering `module` here is one build away from the
+   * two-copies failure, and this is where that is visible before it happens.
+   *
+   * The resolved config comes from Vite's own loader rather than from parsing the file. See
+   * `resolve-config` for why that is the only honest answer here, and what it costs.
+   */
+  async inspect(ctx) {
+    const adoption = readBuildAdoption(ctx.cwd);
+    const base = {
+      runner: "vite",
+      configFile: adoption.configFile,
+      ...adoption.unreadable ? { unreadable: adoption.unreadable } : {},
+      vite: viteOrigin(ctx.cwd),
+      // Rendered as a labelled block by the shared renderer, the same shape the lint role's
+      // parked rules and the format role's overrides already use.
+      overrides: adoption.ownDeclarations.map(({ name, version }) => ({
+        rule: name,
+        reason: `declared by this module at ${version}, where sentinel owns it`
+      })),
+      prerequisite: moduleScripts(ctx.cwd)[PREBUILD_SCRIPT_NAME] ?? null
+    };
+    if (adoption.configFile === null) return base;
+    const resolved = await resolveBuildConfig(ctx.cwd);
+    if (resolved.kind === "failed") {
+      return { ...base, configError: resolved.reason };
+    }
+    const config = resolved.config;
+    return {
+      ...base,
+      // What the app departs from, and what it adds, are different facts. A DEPARTURE is a
+      // disagreement with an opinion the preset holds; an ADDITION is the app needing
+      // something the preset never claimed, which is the preset working rather than being
+      // worked around.
+      departures: describeDepartures(config, REACT_APP_DEFAULTS),
+      additions: appAdditions(config),
+      resolved: {
+        base: at(config, "base") ?? null,
+        target: at(config, "build", "target") ?? null,
+        sourcemap: at(config, "build", "sourcemap") ?? null,
+        port: at(config, "server", "port") ?? null,
+        // The one number nothing else reports and that no formula predicts: career goes DOWN
+        // to 9998 where the others go up, which is why it is data rather than `port + 1`.
+        hmrPort: at(config, "server", "hmr", "port") ?? null,
+        // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
+        // would bury everything above it. The count is what tells you whether it moved.
+        aliases: countOf(at(config, "resolve", "alias")),
+        // Flattened without a depth limit: Vite lets a plugin be an arbitrarily nested array,
+        // and a magic number here would silently undercount the day someone nests one deeper.
+        plugins: countOf(at(config, "plugins"))
+      }
+    };
+  }
+  /**
+   * Adoption as data, WITHOUT building.
+   *
+   * Deliberately not "run the build and attach metrics". `--report` is what a migration
+   * dashboard calls across the whole workspace, and a bundler is the one tool here where doing
+   * the real work costs minutes per module rather than seconds. A report that nobody can
+   * afford to run is a report nobody runs.
+   *
+   * Bundle size is the metric this will eventually want, and it needs a build to produce. It
+   * belongs behind an explicit opt-in rather than in the default sweep, and the ticket parks
+   * it for exactly that reason.
+   */
+  async report(ctx) {
+    const adoption = readBuildAdoption(ctx.cwd);
+    return {
+      ok: true,
+      code: 0,
+      metrics: {
+        vite: viteOrigin(ctx.cwd),
+        ownBuildDependencies: adoption.ownDeclarations.length
+      }
+    };
+  }
+};
+function at(config, ...path) {
+  let value = config;
+  for (const key of path) {
+    if (typeof value !== "object" || value === null) return void 0;
+    value = value[key];
+  }
+  return value;
+}
+function countOf(value) {
+  return Array.isArray(value) ? value.flat(Number.POSITIVE_INFINITY).length : 0;
+}
+
+// src/roles/build/register.ts
+function registerBuild() {
+  register(new ViteAdapter());
+  setDefaultRunner("build", "vite");
+  register(new ViteDevAdapter());
+  setDefaultRunner("dev", "vite");
+}
+
+// src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
+
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join4 } from "path";
+import { extname, join as join8, relative } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -290,7 +1062,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join4(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join8(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -298,46 +1070,34 @@ function hasSourceFiles(cwd, extensions) {
   }
   return false;
 }
-
-// src/core/config/nx-target.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join5 } from "path";
-function nxTargetOperations(options) {
-  const { cwd, targets } = options;
-  const names = Object.keys(targets);
-  if (names.length === 0) return [];
-  const operations = [];
-  if (existsSync3(join5(cwd, "project.json"))) {
-    operations.push({
-      kind: "remove-json-keys",
-      path: "project.json",
-      keys: names.map((name) => ["targets", name])
-    });
+function listSourceFiles(cwd, extensions) {
+  const wanted = new Set(extensions);
+  const queue = [cwd];
+  const found = [];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = join8(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
+        continue;
+      }
+      if (wanted.has(extname(entry.name))) found.push(relative(cwd, full));
+    }
   }
-  operations.push({
-    kind: "merge-json",
-    path: "package.json",
-    value: { nx: { targets } }
-  });
-  return operations;
+  return found;
 }
 
-// src/core/config/tool-args.ts
-import { existsSync as existsSync4 } from "fs";
-import { isAbsolute, resolve as resolve2 } from "path";
-function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
-  const takesValue = new Set(valueFlags);
-  const options = [];
-  const paths = [];
-  let previousTakesValue = false;
-  for (const arg of toolArgs) {
-    const looksLikeOption = arg.startsWith("-");
-    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
-    if (!previousTakesValue && !looksLikeOption && existsSync4(target)) paths.push(arg);
-    else options.push(arg);
-    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
-  }
-  return { options, paths };
+// src/core/named-scope.ts
+var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
+function scopeFlags(paths) {
+  return paths.length > 0 ? [TOLERATE_EMPTY_FLAG] : [];
 }
 
 // src/core/settings.ts
@@ -345,8 +1105,8 @@ var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync } from "fs";
-import { dirname as dirname2, join as join6, relative } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
+import { dirname as dirname3, join as join9, relative as relative2 } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -355,8 +1115,8 @@ var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
 function findWorkspaceRoot(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync5(join6(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync8(join9(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -368,9 +1128,9 @@ function declaredNativeTs(pkg) {
   return version || void 0;
 }
 function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join6(root, "package.json");
-  if (!existsSync5(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+  const pkgPath = join9(root, "package.json");
+  if (!existsSync8(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
   const want = declaredNativeTs(pkg);
   if (!want) return void 0;
   const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
@@ -383,10 +1143,10 @@ function ensureI18nextSingleton(root, dryRun) {
   return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
 }
 function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join6(root, WORKSPACE_YAML);
-  if (!existsSync5(yamlPath)) return void 0;
+  const yamlPath = join9(root, WORKSPACE_YAML);
+  if (!existsSync8(yamlPath)) return void 0;
   const own = readOwnPackage().name;
-  const lines = readFileSync4(yamlPath, "utf8").split("\n");
+  const lines = readFileSync6(yamlPath, "utf8").split("\n");
   const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
   if (keyIdx === -1) return void 0;
   let lastItemIdx = keyIdx;
@@ -419,13 +1179,13 @@ var ROOT_PRETTIER_CONFIGS = [
   "prettier.config.mjs"
 ];
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative(root, moduleDir).replaceAll("\\", "/");
+  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join6(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync5(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync5(join6(root, name)));
+  const ignorePath = join9(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
   if (!hasPrettier) return void 0;
   const pattern = `/${rel}/`;
-  const existing = existsSync5(ignorePath) ? readFileSync4(ignorePath, "utf8") : "";
+  const existing = existsSync8(ignorePath) ? readFileSync6(ignorePath, "utf8") : "";
   const lines = existing.split("\n");
   if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
     return void 0;
@@ -461,10 +1221,10 @@ function ensureWorkspacePrep(opts) {
 function inspectWorkspacePrep(root) {
   const entries = [];
   let pkg = {};
-  const pkgPath = join6(root, "package.json");
-  if (existsSync5(pkgPath)) {
+  const pkgPath = join9(root, "package.json");
+  if (existsSync8(pkgPath)) {
     try {
-      pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
     } catch {
       pkg = {};
     }
@@ -478,9 +1238,9 @@ function inspectWorkspacePrep(root) {
     });
   }
   const own = readOwnPackage().name;
-  const yamlPath = join6(root, WORKSPACE_YAML);
-  if (existsSync5(yamlPath)) {
-    const yaml = readFileSync4(yamlPath, "utf8");
+  const yamlPath = join9(root, WORKSPACE_YAML);
+  if (existsSync8(yamlPath)) {
+    const yaml = readFileSync6(yamlPath, "utf8");
     const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
     if (listed) {
       const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
@@ -493,39 +1253,6 @@ function inspectWorkspacePrep(root) {
   return entries;
 }
 
-// src/shared/resolve-bin.ts
-import { existsSync as existsSync6 } from "fs";
-import { createRequire } from "module";
-import { delimiter, dirname as dirname3, join as join7 } from "path";
-var require2 = createRequire(import.meta.url);
-function resolveBin(fromDir, name) {
-  let dir = fromDir;
-  for (; ; ) {
-    const candidate = join7(dir, "node_modules", ".bin", name);
-    if (existsSync6(candidate)) return candidate;
-    const parent = dirname3(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function binFromOwnInstall(packageName, binName) {
-  try {
-    const manifest = require2.resolve(`${packageName}/package.json`);
-    const bin = require2(manifest).bin;
-    const relative3 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative3) return void 0;
-    const executable = join7(dirname3(manifest), relative3);
-    return existsSync6(executable) ? executable : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function binSearchPath(cwd) {
-  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
-    " then "
-  );
-}
-
 // src/roles/format/config-policy.ts
 var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
 var FORMAT_SCRIPT_NAME = "format";
@@ -572,48 +1299,6 @@ function formatTargets() {
   };
 }
 
-// src/core/config/tool-script.ts
-var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
-function isSeparatorAt(index) {
-  return index % 2 === 1;
-}
-function invokes(segment, binary) {
-  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
-}
-function isSentinelSegment(segment, roleFlag) {
-  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
-  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
-}
-function composeToolScript(existing, options) {
-  const { command } = options;
-  if (!existing || existing.trim() === "") return command;
-  const { roleFlag } = options;
-  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
-  const parts = existing.split(SEGMENT_SEPARATOR);
-  const commands = parts.filter((_, index) => !isSeparatorAt(index));
-  if (!commands.some(isReplaceable)) return existing;
-  let replacedOnce = false;
-  const rebuilt = parts.map((part, index) => {
-    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
-    if (replacedOnce) return null;
-    replacedOnce = true;
-    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
-  });
-  const kept = [];
-  for (let index = 0; index < rebuilt.length; index += 1) {
-    const part = rebuilt[index];
-    if (part === null) {
-      if (kept.length > 0) kept.pop();
-      continue;
-    }
-    kept.push(part);
-  }
-  return kept.join("").trim();
-}
-function keepsOtherCommands(script, sentinelCommand) {
-  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
-}
-
 // src/roles/format/format-script.ts
 var SENTINEL_FORMAT_COMMAND = "sentinel --run --format";
 function isPrettierSegment(segment) {
@@ -642,8 +1327,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -658,11 +1343,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join8(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync7(path)) return [];
+  const path = join10(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync9(path)) return [];
   let contents;
   try {
-    contents = readFileSync5(path, "utf8");
+    contents = readFileSync7(path, "utf8");
   } catch {
     return [];
   }
@@ -749,13 +1434,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname4, join as join11 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -784,8 +1469,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join9(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync6(schemaPath, "utf8"));
+    const schemaPath = join11(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync8(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -816,14 +1501,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync8(join10(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync10(join12(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync7(join10(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync9(join12(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -853,9 +1538,9 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
-var NOT_ADOPTED = (configFile, unreadable = null) => ({
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
+var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
   adopted: false,
@@ -870,19 +1555,19 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join11(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync9(path)) return NOT_ADOPTED(null);
+  const path = join13(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync11(path)) return NOT_ADOPTED2(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync8(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync10(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
+    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
   }
   const provenance = parsed[PROVENANCE_KEY];
-  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED(FORMAT_CONFIG_FILE);
+  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
   if (!hasFormatPreset(provenance.preset)) {
-    return NOT_ADOPTED(
+    return NOT_ADOPTED2(
       FORMAT_CONFIG_FILE,
       `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
     );
@@ -999,7 +1684,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync10(join12(context.cwd, name))
+      (name) => existsSync12(join14(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1058,7 +1743,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
-    const pass = spawnSync(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const pass = spawnSync3(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     process.stderr.write(`  ${palette(process.stderr).dim(FORMATTER_DIFFERENCES)}
 `);
     if (pass.status === 0) return;
@@ -1121,10 +1806,14 @@ var OxfmtAdapter = class extends BaseAdapter {
     const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXFMT_VALUE_FLAGS
     });
-    const result = spawnSync(oxfmt, [mode, ...options, ...paths.length > 0 ? paths : ["."]], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
-    });
+    const result = spawnSync3(
+      oxfmt,
+      [mode, ...scopeFlags(paths), ...options, ...paths.length > 0 ? paths : ["."]],
+      {
+        cwd: ctx.cwd,
+        stdio: "inherit"
+      }
+    );
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1199,7 +1888,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1, metrics: { ...base, unformatted: null } };
     }
-    const result = spawnSync(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync3(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1235,7 +1924,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync9(join12(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync11(join14(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -1315,30 +2004,139 @@ function registerFormat() {
   setDefaultRunner("format", "oxfmt");
 }
 
-// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync16, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join20 } from "path";
-
-// src/core/config/deferred-rules.ts
-function deferredRuleNames(rules) {
-  return rules.map((entry) => entry.rule);
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync20, readFileSync as readFileSync19, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join24 } from "path";
+
+// src/core/config/deferred-rules.ts
+function deferredRuleNames(rules) {
+  return rules.map((entry) => entry.rule);
+}
+
+// src/core/fix-report.ts
+import { statSync } from "fs";
+import { join as join15 } from "path";
+var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
+function readFailure(output) {
+  const lines = output.split("\n").map((line2) => line2.trim());
+  if (!lines.some((line2) => CONFIG_REFUSED.test(line2))) return void 0;
+  const detail = lines.find((line2) => /invalid config file/i.test(line2));
+  const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
+  return line.split(/:\s*Failed to parse config/i)[0] ?? line;
+}
+function fingerprint(path) {
+  try {
+    const stat = statSync(path);
+    return `${stat.size}:${stat.mtimeMs}`;
+  } catch {
+    return void 0;
+  }
+}
+function snapshotFiles(cwd, extensions) {
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const mark = fingerprint(join15(cwd, file));
+    if (mark !== void 0) snapshot.set(file, mark);
+  }
+  return snapshot;
+}
+function changedSince(cwd, before, extensions) {
+  const changed = [];
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const now = fingerprint(join15(cwd, file));
+    if (now === void 0) continue;
+    if (before.get(file) !== now) changed.push(file);
+  }
+  return changed.sort();
+}
+var NAMED_IN_REPORT = 5;
+function describeFixOutcome(outcome, toolLabel) {
+  if (outcome.failure !== void 0) {
+    return `the ${toolLabel} autofix could not run, so nothing was fixed and this module has not been checked: ${outcome.failure}`;
+  }
+  if (outcome.changed.length === 0) return `the ${toolLabel} autofix changed nothing`;
+  const named = outcome.changed.slice(0, NAMED_IN_REPORT).join(", ");
+  const rest = outcome.changed.length - NAMED_IN_REPORT;
+  const listed = rest > 0 ? `${named} and ${rest} more` : named;
+  return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
+}
+
+// src/roles/lint/module-baseline.ts
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join16 } from "path";
+var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
+var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
+var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
+function holdsFrom(errorCounts) {
+  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
+}
+function renderBaseline(holds, version) {
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
+  return [
+    "{",
+    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
+    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
+    "  // and returns to `error` on its own.",
+    "  //",
+    "  // These rules are held at `warn` because this module ALREADY violated them when it",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` lists what is held; `sentinel --run --lint --json` counts",
+    "  // what is left, per rule. Fix them and re-run `--init --lint` to get the severity back.",
+    '  "rules": {',
+    entries,
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function extendsWithBaseline(current, hasHolds) {
+  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
+}
+function describeHolds(holds) {
+  if (holds.length === 0) return "";
+  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
+  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
+  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
+  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
+}
+function heldRules(cwd) {
+  const path = join16(cwd, LINT_BASELINE_FILE);
+  if (!existsSync13(path)) return [];
+  try {
+    const parsed = parseJsonc(
+      readFileSync12(path, "utf8"),
+      LINT_BASELINE_FILE
+    );
+    return Object.keys(parsed.rules ?? {});
+  } catch {
+    return [];
+  }
 }
 
 // src/roles/lint/config-policy.ts
 var LINT_CONFIG_FILE = ".oxlintrc.json";
 var LINT_SCRIPT_NAME = "lint";
-var PRESET_DIR = "./node_modules/@hublo/sentinel/oxlint";
+var PRESET_DIR = "./node_modules/@hublo/sentinel/lint";
 function presetPath(preset) {
   return `${PRESET_DIR}/${preset}.json`;
 }
 function isSentinelPreset(entry) {
-  return entry.includes("@hublo/sentinel/oxlint/");
+  return /@hublo\/sentinel\/(lint|oxlint)\//.test(entry);
 }
 function extendsWithPreset(current, variant) {
   const own = presetPath(variant);
-  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
-  return [own, ...new Set(others)];
+  const others = [...new Set(current.filter((entry) => entry !== own && !isSentinelPreset(entry)))];
+  const baseline = others.filter((entry) => entry === LINT_BASELINE_SPECIFIER);
+  const rest = others.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return [own, ...rest, ...baseline];
 }
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
@@ -1347,7 +2145,7 @@ function presetVariant(preset, cwd) {
 function presetOfVariant(variant) {
   return variant === "react-lib" ? "react" : variant;
 }
-var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/oxlint\/([a-z-]+)\.json$/;
+var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/(?:lint|oxlint)\/([a-z-]+)\.json$/;
 function presetNameFromPath(preset) {
   return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
 }
@@ -1362,46 +2160,6 @@ function lintTarget() {
   return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
-// src/roles/lint/presets/base.json
-var base_default2 = {
-  rules: {
-    "no-var": "error",
-    "prefer-const": [
-      "error",
-      {
-        destructuring: "any",
-        ignoreReadBeforeAssign: false
-      }
-    ],
-    "prefer-rest-params": "error",
-    "prefer-spread": "error",
-    "typescript/ban-ts-comment": "error",
-    "typescript/no-array-constructor": "error",
-    "typescript/no-duplicate-enum-values": "error",
-    "typescript/no-empty-object-type": "error",
-    "typescript/no-extra-non-null-assertion": "error",
-    "typescript/no-misused-new": "error",
-    "typescript/no-namespace": "error",
-    "typescript/no-non-null-asserted-optional-chain": "error",
-    "typescript/no-this-alias": "error",
-    "typescript/no-unnecessary-type-constraint": "error",
-    "typescript/no-unsafe-declaration-merging": "error",
-    "typescript/no-unsafe-function-type": "error",
-    "typescript/no-unused-expressions": [
-      "error",
-      {
-        allowShortCircuit: false,
-        allowTaggedTemplates: false,
-        allowTernary: false
-      }
-    ],
-    "typescript/no-wrapper-object-types": "error",
-    "typescript/prefer-as-const": "error",
-    "typescript/prefer-namespace-keyword": "error",
-    "typescript/triple-slash-reference": "error"
-  }
-};
-
 // src/roles/lint/presets/nest.json
 var nest_default = {
   plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
@@ -1741,6 +2499,7 @@ var nest_default = {
     "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
     "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent, and unlike the react tier this preset hosts no house-rule plugin, so architectural guards written as AST selectors are not enforced at all. They belong in sentinel's `hublo` plugin, next to the frontend ones: tell us which guards your service relies on. A per-module copy of a house rule drifts, which is the problem sentinel exists to remove.",
     "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
@@ -2694,10 +3453,51 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
 
+// src/roles/lint/presets/shared.json
+var shared_default = {
+  rules: {
+    "no-var": "error",
+    "prefer-const": [
+      "error",
+      {
+        destructuring: "any",
+        ignoreReadBeforeAssign: false
+      }
+    ],
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-constructor": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": [
+      "error",
+      {
+        allowShortCircuit: false,
+        allowTaggedTemplates: false,
+        allowTernary: false
+      }
+    ],
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/triple-slash-reference": "error"
+  }
+};
+
 // src/roles/lint/presets/svelte.json
 var svelte_default = {
   plugins: ["typescript", "oxc"],
@@ -3036,7 +3836,7 @@ var tools_default = {
 };
 
 // src/roles/lint/preset-data.ts
-var BASE_RULES = base_default2.rules;
+var SHARED_RULES = shared_default.rules;
 var PRESET_FILES = {
   nest: nest_default,
   node: node_default,
@@ -3058,15 +3858,18 @@ function hasLintPreset(preset) {
 function presetFile(preset) {
   return VARIANT_FILES[preset] ?? PRESET_FILES[preset] ?? node_default;
 }
-function baseRules() {
-  return BASE_RULES;
+function sharedRules() {
+  return SHARED_RULES;
 }
 function presetRules(preset) {
   return presetFile(preset).rules;
 }
+function uncoveredFor(preset) {
+  return Object.entries(presetFile(preset).uncovered ?? {}).map(([rule, reason]) => ({ rule, reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
 
 // src/roles/lint/rule-data.ts
-var baseRules2 = baseRules();
+var sharedRules2 = sharedRules();
 function isDecision(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -3093,7 +3896,7 @@ function validate(preset, rules) {
   }
 }
 function layered(preset) {
-  const base = baseRules();
+  const base = sharedRules();
   const layer = presetRules(preset);
   validate("base", base);
   validate(preset, layer);
@@ -3132,63 +3935,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { isAbsolute as isAbsolute2, join as join13, resolve as resolve3 } from "path";
-
-// src/roles/lint/module-baseline.ts
-var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
-var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
-var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
-function holdsFrom(errorCounts) {
-  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
-}
-function renderBaseline(holds, version) {
-  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
-  return [
-    "{",
-    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
-    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
-    "  // and returns to `error` on its own.",
-    "  //",
-    "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report, so the build cannot fail on them.",
-    "  //",
-    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
-    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
-    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
-    "  // file rather than live with it.",
-    "  //",
-    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
-    "  // to get the preset severity back.",
-    '  "rules": {',
-    entries,
-    "  }",
-    "}",
-    ""
-  ].join("\n");
-}
-function extendsWithBaseline(current, hasHolds) {
-  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
-  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
-}
-function describeHolds(holds) {
-  if (holds.length === 0) return "";
-  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
-  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
-  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
-  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
-}
-
-// src/roles/lint/extra-layers.ts
-function isSentinelPreset2(entry) {
-  return entry.includes("@hublo/sentinel/oxlint/");
-}
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { isAbsolute as isAbsolute2, join as join17, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync11(path)) return void 0;
+  if (!existsSync14(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync10(path, "utf8"),
+      readFileSync13(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3197,7 +3951,7 @@ function ruleCount(cwd, specifier) {
   }
 }
 function extraLayers(cwd, extendsList) {
-  return extendsList.filter((entry) => !isSentinelPreset2(entry) && entry !== LINT_BASELINE_SPECIFIER).map((entry) => {
+  return extendsList.filter((entry) => !isSentinelPreset(entry) && entry !== LINT_BASELINE_SPECIFIER).map((entry) => {
     const count = ruleCount(cwd, entry);
     return {
       rule: entry,
@@ -3208,7 +3962,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync10(join13(cwd, configFile), "utf8"),
+      readFileSync13(join17(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -3267,8 +4021,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3283,12 +4037,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync11(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync14(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3302,8 +4056,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join14(moduleDir, candidate);
-    if (!existsSync12(absolutePath)) continue;
+    const absolutePath = join18(moduleDir, candidate);
+    if (!existsSync15(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3326,7 +4080,7 @@ function normaliseExtends(value) {
   }
   return [];
 }
-var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
+var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
   adopted: false,
@@ -3336,18 +4090,18 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync13(join15(cwd, target.path))) {
-    return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
+  if (target.reason === "none" || !existsSync16(join19(cwd, target.path))) {
+    return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync12(join15(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync15(join19(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
+    return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
   }
   const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
-  if (preset === null) return NOT_ADOPTED2(target.path);
+  if (preset === null) return NOT_ADOPTED3(target.path);
   const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
   const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
   return {
@@ -3375,9 +4129,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join16 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3402,30 +4156,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join16(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join16(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join20(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join20(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join16(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join20(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync14(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync17(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join21 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -3438,11 +4192,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join17(cwd, name)).find((path) => existsSync15(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join21(cwd, name)).find((path) => existsSync18(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync13(config, "utf8");
+    source = readFileSync16(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -3496,8 +4250,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync14, statSync } from "fs";
-import { join as join18, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync17, statSync as statSync2 } from "fs";
+import { join as join22, relative as relative3 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -3544,10 +4298,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join18(dir, entry);
+    const full = join22(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync(full).isDirectory();
+      isDirectory = statSync2(full).isDirectory();
     } catch {
       continue;
     }
@@ -3564,7 +4318,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync14(file, "utf8");
+      content = readFileSync17(file, "utf8");
     } catch {
       continue;
     }
@@ -3588,7 +4342,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative2(cwd, file),
+        file: relative3(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -3643,7 +4397,7 @@ function summariseByPlugin(rules) {
   }
   return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
 }
-function plan(context) {
+function plan2(context) {
   if (!hasLintPreset(context.preset)) {
     return {
       operations: [],
@@ -3692,7 +4446,7 @@ function plan(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync16(join19(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync19(join23(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -3790,7 +4544,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -3801,7 +4555,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -3813,7 +4567,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync15(join19(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync18(join23(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -3872,23 +4626,37 @@ var OxlintAdapter = class extends BaseAdapter {
    * lines. The adapter stays the contract with the engine.
    */
   plan(context) {
-    return plan(context);
+    return plan2(context);
   }
   declaredPreset(cwd) {
     return presetOfVariant(presetNameFromPath(readLintAdoption(cwd).preset));
   }
   /**
-   * The autofix pass. Output is captured rather than streamed: the fix run is noise, and the
-   * verification run that follows is the one a developer reads.
+   * The autofix pass, and what it did.
+   *
+   * Output is captured rather than streamed: the fix run is noise, and the verification run
+   * that follows is the one a developer reads. But captured is not the same as discarded, and
+   * it used to be discarded, which is why a pass that never ran looked exactly like one that
+   * had nothing to do.
+   *
+   * The exit status cannot be the signal, and neither can the stream. Measured on oxlint: a
+   * healthy run on a module with remaining violations and a run whose `extends` path resolves
+   * nowhere BOTH exit 1 and both write to stdout. One module was checked and one was not, and
+   * nothing in the process result separates them, so the only signal is what the tool said.
    */
   fixPass(ctx, oxlint, env) {
-    const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
+    const before = snapshotFiles(ctx.cwd, LINTABLE_EXTENSIONS);
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env,
       maxBuffer: CAPTURE_MAX_BUFFER
     });
-    return result.status ?? 1;
+    if (result.error) return { changed: [], failure: result.error.message };
+    const failure = readFailure(`${result.stdout ?? ""}
+${result.stderr ?? ""}`);
+    if (failure !== void 0) return { changed: [], failure };
+    return { changed: changedSince(ctx.cwd, before, LINTABLE_EXTENSIONS), failure: void 0 };
   }
   /** The module's current `lint` script, so adoption replaces only the eslint part of it. */
   /**
@@ -3911,7 +4679,8 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return;
     const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
-    this.fixPass(ctx, oxlint, env);
+    process.stderr.write(`  ${describeFixOutcome(this.fixPass(ctx, oxlint, env), "lint")}
+`);
     this.writeModuleBaseline(ctx, oxlint, env);
   }
   /**
@@ -3932,20 +4701,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join20(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join20(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync17(configPath)) return;
+    const configPath = join24(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join24(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync20(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync16(configPath, "utf8"),
+        readFileSync19(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join20(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join24(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -3953,7 +4722,7 @@ var OxlintAdapter = class extends BaseAdapter {
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
       );
-      measured = spawnSync2(
+      measured = spawnSync4(
         oxlint,
         [
           "-c",
@@ -3986,14 +4755,14 @@ var OxlintAdapter = class extends BaseAdapter {
     } else {
       rmSync(baselinePath, { force: true });
     }
-    if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
+    if (next.length !== current.length || next.some((entry, at2) => entry !== current[at2])) {
       config.extends = next;
       writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync17(join20(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync20(join24(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4038,9 +4807,10 @@ var OxlintAdapter = class extends BaseAdapter {
       valueFlags: OXLINT_VALUE_FLAGS
     });
     const targets = paths.length > 0 ? paths : ["."];
+    const emptyScope = scopeFlags(paths);
     const lint = (extra) => {
-      const passed = [...extra, ...passedOptions];
-      const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const passed = [...extra, ...emptyScope, ...passedOptions];
+      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -4078,6 +4848,33 @@ var OxlintAdapter = class extends BaseAdapter {
         rule: entry.rule,
         reason: entry.reason
       })),
+      // A FOURTH state, and the only one that was declared and never reported: rules oxlint
+      // cannot run at all, so they can be neither enforced nor disabled. Each preset has
+      // carried this list since the Svelte work, and nothing read it outside a test.
+      //
+      // The gap that made it matter: `no-restricted-syntax` has no oxlint equivalent, so two
+      // architectural guards a Nest service relied on vanished at adoption with nothing said.
+      // The adopter found it himself and rebuilt them as a local plugin. The next one might
+      // not, which is the whole argument for saying it out loud.
+      uncovered: uncoveredFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
+        rule: entry.rule,
+        reason: entry.reason
+      })),
+      // What this module HOLDS: the rules its own baseline lowers to `warn`.
+      //
+      // Distinct from `downgraded` just above, which is the PRESET's doing and identical for
+      // every module on it. These are this module's own debt, and leaving them out was a real
+      // gap: `--inspect` could tell you the preset holds 6 rules while saying nothing about
+      // the 3 your module holds on top, so nobody could see their own debt without opening a
+      // file that says "do not edit by hand".
+      //
+      // Listed, not counted. The list is free — it is the committed file — while a count means
+      // running oxlint, which this verb deliberately does not do (that is what keeps a
+      // 441-module sweep at ~8s per role). `--run --lint --json` carries the per-rule counts.
+      held: heldRules(ctx.cwd).map((rule) => ({
+        rule,
+        reason: `held at \`warn\` by this module's ${LINT_BASELINE_FILE}, because it already violated it when it adopted. \`--run --lint --json\` counts what is left.`
+      })),
       // What this module enforces BEYOND the preset. Not drift, and not covered by anything
       // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
       // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
@@ -4113,7 +4910,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -4123,7 +4920,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync16(join20(cwd, entry), "utf8"),
+          readFileSync19(join24(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4140,7 +4937,7 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return { ok: false, code: 1, metrics: { error: "oxlint not found" } };
     const typeAware = canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [];
-    const result = spawnSync2(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) },
@@ -4193,14 +4990,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync17(join20(cwd, target)));
+    return targets.find((target) => !existsSync20(join24(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4231,36 +5028,10 @@ function registerLint() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join22 } from "path";
-
-// src/roles/typescript/presets/base.json
-var base_default3 = {
-  $schema: "https://json.schemastore.org/tsconfig",
-  compilerOptions: {
-    strict: true,
-    noFallthroughCasesInSwitch: true,
-    forceConsistentCasingInFileNames: true,
-    esModuleInterop: true,
-    skipLibCheck: true
-  },
-  deferred: {
-    noImplicitAny: {
-      phase: 2,
-      reason: "the implicit-any migration (TS70xx)"
-    },
-    noUnusedLocals: {
-      phase: 2,
-      reason: "unused-local cleanup (TS6133)"
-    },
-    noUnusedParameters: {
-      phase: 2,
-      reason: "unused-parameter cleanup (TS6133)"
-    }
-  }
-};
+import { join as join26 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -4311,15 +5082,41 @@ var react_default2 = {
   }
 };
 
+// src/roles/typescript/presets/shared.json
+var shared_default2 = {
+  $schema: "https://json.schemastore.org/tsconfig",
+  compilerOptions: {
+    strict: true,
+    noFallthroughCasesInSwitch: true,
+    forceConsistentCasingInFileNames: true,
+    esModuleInterop: true,
+    skipLibCheck: true
+  },
+  deferred: {
+    noImplicitAny: {
+      phase: 2,
+      reason: "the implicit-any migration (TS70xx)"
+    },
+    noUnusedLocals: {
+      phase: 2,
+      reason: "unused-local cleanup (TS6133)"
+    },
+    noUnusedParameters: {
+      phase: 2,
+      reason: "unused-parameter cleanup (TS6133)"
+    }
+  }
+};
+
 // src/roles/typescript/preset-data.ts
-var BASE = base_default3;
+var SHARED = shared_default2;
 var LAYERS = {
   nest: nest_default2,
   node: node_default2,
   react: react_default2
 };
 var SHIPPED_PRESETS = Object.keys(LAYERS).sort();
-var DEFERRED_RULES = Object.entries(BASE.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+var DEFERRED_RULES = Object.entries(SHARED.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
 function validate2() {
   for (const { rule, phase, reason } of DEFERRED_RULES) {
     if (!Number.isInteger(phase) || phase < 2) {
@@ -4332,9 +5129,9 @@ function validate2() {
         `deferred rule "${rule}" has no reason; --inspect reports it and would say nothing`
       );
     }
-    if (rule in BASE.compilerOptions) {
+    if (rule in SHARED.compilerOptions) {
       throw new Error(
-        `"${rule}" is deferred and also set by the base preset; it would be announced as not enforced while being enforced`
+        `"${rule}" is deferred and also set by the shared layer; it would be announced as not enforced while being enforced`
       );
     }
     for (const [preset, layer] of Object.entries(LAYERS)) {
@@ -4354,8 +5151,8 @@ function tsPresetFor(preset) {
   const layer = LAYERS[preset];
   if (!layer) throw new Error(`no TypeScript preset ships for preset "${preset}"`);
   return {
-    ...BASE.$schema === void 0 ? {} : { $schema: BASE.$schema },
-    compilerOptions: { ...BASE.compilerOptions, ...layer.compilerOptions }
+    ...SHARED.$schema === void 0 ? {} : { $schema: SHARED.$schema },
+    compilerOptions: { ...SHARED.compilerOptions, ...layer.compilerOptions }
   };
 }
 
@@ -4398,7 +5195,7 @@ function resolveTsconfigTarget(moduleDir) {
 }
 
 // src/roles/typescript/read-adoption.ts
-var SENTINEL_PRESET = /^@hublo\/sentinel\/tsconfig\/[a-z-]+$/;
+var SENTINEL_PRESET = /^@hublo\/sentinel\/(?:typescript|tsconfig)\/[a-z-]+$/;
 function readTsconfigAdoption(cwd) {
   return readAdoption(cwd, {
     candidates: TSCONFIG_CANDIDATES,
@@ -4415,8 +5212,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync20 } from "fs";
+import { join as join25 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -4450,9 +5247,11 @@ function typecheckScripts(cwd) {
     [TYPECHECK_SCRIPT_NAME]: composeTypecheckScript(existingCommand(cwd, TYPECHECK_SCRIPT_NAME))
   };
 }
+var SENTINEL_TS_PRESET = /@hublo\/sentinel\/(?:typescript|tsconfig)\//;
 function composeExtends(current, preset) {
   const chain = typeof current === "string" ? [current] : Array.isArray(current) ? current.filter((entry) => typeof entry === "string") : [];
-  return chain.includes(preset) ? chain : [...chain, preset];
+  const withoutOwn = chain.filter((entry) => entry !== preset && !SENTINEL_TS_PRESET.test(entry));
+  return [...withoutOwn, preset];
 }
 function declaredPreset(cwd) {
   const { preset } = readTsconfigAdoption(cwd);
@@ -4481,7 +5280,7 @@ function planAdoption(context) {
     };
   }
   const target = resolveTsconfigTarget(context.cwd);
-  const preset = `@hublo/sentinel/tsconfig/${context.preset}`;
+  const preset = `@hublo/sentinel/typescript/${context.preset}`;
   const addScript = manifestOperation(context.cwd, typecheckScripts(context.cwd));
   const nxTargets = nxTargetOperations({
     cwd: context.cwd,
@@ -4507,7 +5306,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync17(join21(context.cwd, target.path), "utf8"),
+    readFileSync20(join25(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -4545,7 +5344,7 @@ function planAdoption(context) {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 var SENTINEL_PACKAGE = "@hublo/sentinel";
-var SENTINEL_PRESET_SCOPE = `${SENTINEL_PACKAGE}/tsconfig/`;
+var SENTINEL_PRESET_SCOPES = [`${SENTINEL_PACKAGE}/typescript/`, `${SENTINEL_PACKAGE}/tsconfig/`];
 var DIAGNOSTIC_RE = /^(.+?)\((\d+),(\d+)\): error (TS\d+): (.+)$/;
 function parseDiagnostics(output) {
   const diagnostics = [];
@@ -4645,7 +5444,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync18(join22(cwd, target.path), "utf8"),
+        readFileSync21(join26(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -4654,11 +5453,11 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     }
     const entries = typeof chain === "string" ? [chain] : Array.isArray(chain) ? chain : [];
     const preset = entries.find(
-      (entry) => typeof entry === "string" && entry.startsWith(SENTINEL_PRESET_SCOPE)
+      (entry) => typeof entry === "string" && SENTINEL_PRESET_SCOPES.some((scope) => entry.startsWith(scope))
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join22(cwd, "noop.js")).resolve(preset);
+      createRequire4(join26(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -4699,7 +5498,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync3(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4734,7 +5533,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync3(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4754,7 +5553,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync18(join22(cwd, config), "utf8"),
+        readFileSync21(join26(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -4770,7 +5569,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync18(join22(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync21(join26(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -4823,7 +5622,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync3(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -4866,7 +5665,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync3(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -4892,6 +5691,7 @@ function registerAdapters() {
   registerTypescript();
   registerLint();
   registerFormat();
+  registerBuild();
 }
 
 // src/core/detect-framework.ts
@@ -4973,16 +5773,9 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync22, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve4(cwd);
   const absolutePath = resolve4(root, relativePath);
@@ -4992,7 +5785,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync19(absolutePath) ? readFileSync19(absolutePath, "utf8") : void 0;
+  return existsSync22(absolutePath) ? readFileSync22(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5073,9 +5866,9 @@ function applyOperationTo(current, operation) {
     }
   }
 }
-function preparePlan(cwd, plan2) {
+function preparePlan(cwd, plan3) {
   const prepared = /* @__PURE__ */ new Map();
-  for (const operation of plan2.operations) {
+  for (const operation of plan3.operations) {
     const absolutePath = resolveWithinRoot(cwd, operation.path);
     const existing = prepared.get(operation.path);
     const before = existing?.before ?? readIfExists(absolutePath) ?? "";
@@ -5097,8 +5890,8 @@ function writeFileAtomic(absolutePath, contents) {
   writeFileSync3(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
-function applyPlan(cwd, plan2) {
-  const changed = preparePlan(cwd, plan2).filter((file) => file.before !== file.after);
+function applyPlan(cwd, plan3) {
+  const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
       rmSync2(file.absolutePath, { force: true });
@@ -5110,8 +5903,8 @@ function applyPlan(cwd, plan2) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync20 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync3, readFileSync as readFileSync23 } from "fs";
+import { join as join27 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5125,11 +5918,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join23(cwd, "package.json");
-  if (!existsSync20(path)) return [];
+  const path = join27(cwd, "package.json");
+  if (!existsSync23(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync20(path, "utf8"),
+      readFileSync23(path, "utf8"),
       path
     );
     return [
@@ -5152,7 +5945,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync20(join23(cwd, name), "utf8"),
+        readFileSync23(join27(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5203,14 +5996,14 @@ function resolveFlavour(opts) {
   }
   return detection.preset;
 }
-function previewPlan(opts, plan2) {
-  const changed = preparePlan(opts.cwd, plan2).filter((file) => file.before !== file.after);
+function previewPlan(opts, plan3) {
+  const changed = preparePlan(opts.cwd, plan3).filter((file) => file.before !== file.after);
   if (opts.json) {
     process.stdout.write(
       JSON.stringify(
         {
           dryRun: true,
-          notes: plan2.notes ?? [],
+          notes: plan3.notes ?? [],
           files: changed.map(({ path, before, after, deleted }) => ({
             path,
             action: deleted ? "delete" : before.length === 0 ? "create" : "update",
@@ -5225,7 +6018,7 @@ function previewPlan(opts, plan2) {
     return 0;
   }
   process.stderr.write("  dry run: no files written\n");
-  for (const note of plan2.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (changed.length === 0) {
     process.stderr.write("  nothing to change\n");
@@ -5246,7 +6039,8 @@ async function dispatch(opts) {
     throw new Error(`dispatch handles --init only; --${opts.verb} routes through analyse()`);
   }
   const detected = resolveFlavour(opts);
-  const adapter = resolve(opts.target, detected, opts.runner);
+  const resolutionPreset = opts.preset ?? declaredPresetFor(opts.target, opts.cwd) ?? detected;
+  const adapter = resolve(opts.target, resolutionPreset, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
   if (opts.preset !== void 0) {
     const contradiction = presetContradiction(opts.preset, opts.cwd);
@@ -5268,25 +6062,25 @@ async function dispatch(opts) {
     }
   }
   const context = { cwd: opts.cwd, preset: effective };
-  const plan2 = await adapter.plan(context);
-  if (plan2.blocked) {
-    process.stderr.write(`sentinel (${opts.target}): ${plan2.blocked}
+  const plan3 = await adapter.plan(context);
+  if (plan3.blocked) {
+    process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
 `);
     return 1;
   }
-  if (plan2.skipped) {
-    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan2.skipped}`)}
+  if (plan3.skipped) {
+    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan3.skipped}`)}
 `);
     return 0;
   }
   if (opts.dryRun) {
-    return previewPlan(opts, plan2);
+    return previewPlan(opts, plan3);
   }
-  for (const change of applyPlan(opts.cwd, plan2)) {
+  for (const change of applyPlan(opts.cwd, plan3)) {
     process.stderr.write(`  ${change.deleted ? "removed" : "wrote"} ${change.path}
 `);
   }
-  for (const note of plan2.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (adapter.afterInit) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
@@ -5303,27 +6097,30 @@ async function dispatch(opts) {
 }
 
 export {
+  PresetUnsupportedError,
   register,
   setDefaultRunner,
   all,
+  declaredPresetFor,
   availableTargets,
   resolve,
   BaseAdapter,
+  resolveBin,
   readOwnVersion,
   readProjectPackageJson,
   readNxProjectName,
   VERBS,
   TARGETS,
+  SWEEPABLE_TARGETS,
   PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
   inspectWorkspacePrep,
   palette,
-  resolveBin,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-W73ISYMG.js.map
+//# sourceMappingURL=chunk-FLJ2QNFF.js.map