@hublo/sentinel 1.2.0-alpha.0 → 1.2.0-alpha.1

package/dist/{chunk-TWL6T237.js → chunk-FLJ2QNFF.js}

@@ -1,7 +1,8 @@
 import {
   REACT_APP_DEFAULTS,
+  REQUIREMENTS,
   isPlainObject
-} from "./chunk-XSCDJZDY.js";
+} from "./chunk-XVDOQ3G3.js";
 
 // src/core/registry.ts
 var adapters = [];
@@ -133,20 +134,6 @@ function readNxProjectName(dir) {
   }
 }
 
-// src/shared/color.ts
-import { styleText } from "util";
-function palette(stream) {
-  const paint = (format, text) => styleText(format, text, { stream });
-  return {
-    ok: (text) => paint(["green", "bold"], text),
-    fail: (text) => paint(["red", "bold"], text),
-    warn: (text) => paint("yellow", text),
-    strong: (text) => paint("bold", text),
-    dim: (text) => paint("dim", text),
-    accent: (text) => paint("cyan", text)
-  };
-}
-
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
 var TARGETS = [
@@ -166,7 +153,21 @@ var SWEEPABLE_TARGETS = TARGETS.filter(
 );
 var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
-// src/roles/build/adapters/vite/vite-dev.adapter.ts
+// src/shared/color.ts
+import { styleText } from "util";
+function palette(stream) {
+  const paint = (format, text) => styleText(format, text, { stream });
+  return {
+    ok: (text) => paint(["green", "bold"], text),
+    fail: (text) => paint(["red", "bold"], text),
+    warn: (text) => paint("yellow", text),
+    strong: (text) => paint("bold", text),
+    dim: (text) => paint("dim", text),
+    accent: (text) => paint("cyan", text)
+  };
+}
+
+// src/roles/build/adapters/vite/vite-role.adapter.ts
 import { spawnSync } from "child_process";
 
 // src/core/config/tool-args.ts
@@ -206,9 +207,9 @@ function binFromOwnInstall(packageName, binName) {
   try {
     const manifest = require2.resolve(`${packageName}/package.json`);
     const bin = require2(manifest).bin;
-    const relative3 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative3) return void 0;
-    const executable = join2(dirname2(manifest), relative3);
+    const relative4 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative4) return void 0;
+    const executable = join2(dirname2(manifest), relative4);
     return existsSync3(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -399,7 +400,7 @@ function buildTarget() {
   return {
     [BUILD_SCRIPT_NAME]: {
       cache: true,
-      inputs: ["default", "^default", `{projectRoot}/${BUILD_CONFIG_FILES[0]}`]
+      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
     }
   };
 }
@@ -417,17 +418,17 @@ var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
 var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
 function appOptions(rest) {
   const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
-  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
+  const kept = tokens.filter((token, at2) => !(at2 === 0 && DEV_SUBCOMMANDS.has(token)));
   return kept.join(" ");
 }
 function composeDevScript(existing, command) {
   if (existing === void 0 || existing.trim() === "") return command;
   const chunks = existing.trim().split(CHAIN);
-  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
-  if (at === -1) return existing;
-  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const at2 = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at2 === -1) return existing;
+  const rest = (chunks[at2] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
   const options = appOptions(rest);
-  chunks[at] = options === "" ? command : `${command} -- ${options}`;
+  chunks[at2] = options === "" ? command : `${command} -- ${options}`;
   return chunks.join(CHAIN);
 }
 
@@ -446,17 +447,24 @@ var NOT_ADOPTED = (configFile, unreadable = null) => ({
 function buildConfigFile(cwd) {
   return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
 }
+function importsSpecifier(source, specifier) {
+  const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
+}
 function importsPreset(source) {
-  const specifier = BUILD_PRESET_SPECIFIER.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${specifier}['"\`]`).test(source);
+  return importsSpecifier(source, BUILD_PRESET_SPECIFIER);
 }
 var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
+  const source = readBuildConfigSource(cwd);
+  if (source === void 0) return void 0;
+  return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
+}
+function readBuildConfigSource(cwd) {
   const configFile = buildConfigFile(cwd);
   if (!configFile) return void 0;
   try {
-    const source = readFileSync4(join6(cwd, configFile), "utf8");
-    return REACT_PLUGIN_SPECIFIERS.some((specifier) => source.includes(specifier)) ? "react" : void 0;
+    return readFileSync4(join6(cwd, configFile), "utf8");
   } catch {
     return void 0;
   }
@@ -489,6 +497,34 @@ function readBuildAdoption(cwd) {
   };
 }
 
+// src/roles/build/requirements.ts
+function atLeast(declared, needed) {
+  const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse2(declared);
+  const right = parse2(needed);
+  for (let at2 = 0; at2 < Math.max(left.length, right.length); at2++) {
+    const a = left[at2] ?? 0;
+    const b = right[at2] ?? 0;
+    if (a !== b) return a > b;
+  }
+  return true;
+}
+function unmetRequirements(preset, declared) {
+  const entry = REQUIREMENTS[preset];
+  if (!entry) return [];
+  return Object.entries(entry.requires).filter(([name, needed]) => {
+    const have = declared[name];
+    return have === void 0 || !atLeast(have, needed);
+  }).map(([name, needed]) => ({ name, declared: declared[name], needed }));
+}
+function describeUnmet(preset, unmet) {
+  const entry = REQUIREMENTS[preset];
+  const list = unmet.map(
+    ({ name, declared, needed }) => `${name} ${declared === void 0 ? "is not declared here" : `is at ${declared}`}, needs >= ${needed}`
+  ).join("; ");
+  return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
+}
+
 // src/roles/build/plan.ts
 function scaffold() {
   return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
@@ -497,8 +533,8 @@ import { tanstackRouter } from '@tanstack/router-plugin/vite'
 import path from 'node:path'
 
 /*
- * Composition comes from sentinel: how the env is loaded, which plugins run under test and
- * which under a real build, the order they run in. The values below are this app's own.
+ * Composition comes from sentinel: which plugins run under test and which under a real build,
+ * the order they run in, and how the env is read. The values below are this app's own.
  *
  * TanStack is passed IN rather than imported by sentinel, because the app codes against it
  * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
@@ -520,6 +556,10 @@ export default defineConfig(({ mode }) =>
     alias: [],
   }),
 )
+
+// If this app reads environment variables, use \`appEnv(__dirname, mode)\` rather than Vite's
+// \`loadEnv\`: it applies the production -> prd normalisation this repo deploys under, which
+// every app was otherwise retyping.
 `;
 }
 function ownedBuildDependencies(cwd) {
@@ -558,10 +598,18 @@ function buildScripts(cwd) {
   return scripts;
 }
 function plan(context) {
+  const manifest = readProjectPackageJson(context.cwd);
+  const unmet = unmetRequirements(context.preset, {
+    ...manifest.dependencies,
+    ...manifest.devDependencies
+  });
+  if (unmet.length > 0) {
+    return { operations: [], skipped: describeUnmet(context.preset, unmet) };
+  }
   if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
     return {
       operations: [],
-      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only; the two SvelteKit configs in this repo share nothing with it.`
+      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
     };
   }
   const notes = [];
@@ -598,83 +646,150 @@ function readsPreset(cwd, configFile) {
 }
 
 // src/roles/build/resolve-vite.ts
-function resolveVite(cwd) {
-  return binFromOwnInstall("vite", "vite") ?? resolveBin(cwd, "vite");
+function resolveViteWith(cwd) {
+  const own = binFromOwnInstall("vite", "vite");
+  if (own) return { bin: own, origin: "sentinel" };
+  const module_ = resolveBin(cwd, "vite");
+  return module_ ? { bin: module_, origin: "module" } : { bin: void 0, origin: "none" };
 }
 function viteOrigin(cwd) {
-  if (binFromOwnInstall("vite", "vite")) return "sentinel";
-  return resolveBin(cwd, "vite") ? "module" : "none";
+  return resolveViteWith(cwd).origin;
 }
 
-// src/roles/build/adapters/vite/vite-dev.adapter.ts
-var ViteDevAdapter = class extends BaseAdapter {
-  target = "dev";
+// src/roles/build/adapters/vite/vite-role.adapter.ts
+var VITE_VALUE_FLAGS = [
+  "--config",
+  "-c",
+  "--mode",
+  "-m",
+  "--outDir",
+  "--logLevel",
+  "--base",
+  "--host",
+  "--port"
+];
+var ViteRoleAdapter = class extends BaseAdapter {
   runner = "vite";
+  /**
+   * The presets this role has something to SAY about, which is wider than the ones it serves.
+   *
+   * React it serves. Svelte it does not, yet, and the difference matters to a developer: the
+   * plugin caps at Vite 6 until its major 7, which needs `svelte ^5.46.4`, so the role applies
+   * once the module moves. `plan` reports that chain and SKIPS, which it can only do if
+   * resolution let it run at all — filtering here would give "no adapter for preset svelte",
+   * which tells nobody what to do about it.
+   *
+   * Nest, node and tools are genuinely declined: there is nothing to bundle, and no version
+   * would change that.
+   */
   appliesTo(preset) {
-    return preset === "react";
+    return preset === "react" || preset === "svelte";
   }
+  /**
+   * `react`, read from the module's Vite config rather than from its dependencies.
+   *
+   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
+   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
+   * during `sentinel --inspect` with no target, which never passes `--preset`.
+   */
   declaredPreset(cwd) {
     return declaredBuildPreset(cwd);
   }
   /**
-   * The same plan as `--build`, deliberately.
+   * The same plan for both targets, deliberately.
    *
-   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without
-   * the other leaves the module half-migrated in a way nothing reports. The operations are
-   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than
-   * additive.
+   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without the
+   * other leaves the module half-migrated in a way nothing reports. The operations are
+   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than additive.
    */
   plan(context) {
     return plan(context);
   }
+  async status(ctx) {
+    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift, unreadable };
+  }
   /**
-   * Start the dev server. It does not return until stopped, so there is no verdict to report
-   * beyond the exit code the developer's own Ctrl-C produces.
+   * Adoption, the binary, and the warning about which copy of Vite is running.
    *
-   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
-   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
-   * running it again would race the watcher that is about to own the file.
+   * A module that has not adopted is reported and PASSES, the same stance every other role
+   * takes: `--run` with no named target sweeps every wired target across the workspace, so
+   * failing here would exit non-zero on every module that has not migrated, which is most of
+   * them.
    */
-  async run(ctx) {
+  prepare(ctx) {
     if (!readBuildAdoption(ctx.cwd).adopted) {
-      process.stderr.write(
-        `sentinel dev(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
-`
+      this.say(
+        `no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.`
       );
-      return { ok: true, code: 0 };
+      return { kind: "stop", result: { ok: true, code: 0 } };
     }
-    const vite = resolveVite(ctx.cwd);
-    if (!vite) {
-      process.stderr.write(
-        `sentinel dev(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
-`
+    const { bin, origin } = resolveViteWith(ctx.cwd);
+    if (!bin) {
+      this.say(
+        `could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.`
       );
-      return { ok: false, code: 1 };
+      return { kind: "stop", result: { ok: false, code: 1 } };
     }
-    if (viteOrigin(ctx.cwd) === "module") {
-      process.stderr.write(
-        `sentinel dev(vite): serving with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one process fail in ways that never mention a version. Remove vite from this module's package.json.
-`
+    if (origin === "module") {
+      this.say(
+        `using the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite fail in ways that never mention a version. Remove vite from this module's package.json.`
       );
     }
-    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: [] });
-    const result = spawnSync(vite, [...options, ...paths], { cwd: ctx.cwd, stdio: "inherit" });
+    return { kind: "ready", vite: bin };
+  }
+  /**
+   * Run Vite with the caller's own arguments after `--`, and report what happened.
+   *
+   * `whenSignalled` is the only difference between the two targets here, and it is a real one:
+   * a build killed by a signal did not produce a bundle, while a dev server killed by Ctrl-C
+   * did exactly what the developer asked.
+   */
+  spawnVite(ctx, vite, argv, whenSignalled) {
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
+      valueFlags: VITE_VALUE_FLAGS
+    });
+    const result = spawnSync(vite, [...argv, ...options, ...paths], {
+      cwd: ctx.cwd,
+      stdio: "inherit"
+    });
     if (result.error) {
-      process.stderr.write(`sentinel dev(vite): could not run vite (${result.error.message})
-`);
+      this.say(`could not run vite (${result.error.message})`);
       return { ok: false, code: 1 };
     }
-    const code = result.status ?? 0;
+    const code = result.status ?? whenSignalled;
     return { ok: code === 0, code };
   }
-  async status(ctx) {
-    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
-    return { adopted, preset, conformant, drift, unreadable };
+  /** One prefix for every message this role emits, so they cannot drift apart. */
+  say(message) {
+    process.stderr.write(`sentinel ${this.label}(vite): ${message}
+`);
   }
 };
 
-// src/roles/build/adapters/vite/vite.adapter.ts
-import { spawnSync as spawnSync3 } from "child_process";
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
+var ViteDevAdapter = class extends ViteRoleAdapter {
+  target = "dev";
+  get label() {
+    return "dev";
+  }
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
+   *
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
+   *
+   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
+   * bare form is the one every version accepts.
+   */
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    return this.spawnVite(ctx, ready.vite, [], 0);
+  }
+};
 
 // src/roles/build/owned-paths.ts
 var PRESET_OWNED_KEYS = [
@@ -683,6 +798,7 @@ var PRESET_OWNED_KEYS = [
   "define",
   "server",
   "build",
+  "nitro",
   "resolve",
   "plugins"
 ];
@@ -714,7 +830,7 @@ function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function sameStrings(a, b) {
-  return a.length === b.length && a.every((value, at) => value === b[at]);
+  return a.length === b.length && a.every((value, at2) => value === b[at2]);
 }
 
 // src/roles/build/prerequisite.ts
@@ -761,83 +877,28 @@ async function resolveBuildConfig(cwd) {
 }
 
 // src/roles/build/adapters/vite/vite.adapter.ts
-var VITE_VALUE_FLAGS = ["--config", "-c", "--mode", "-m", "--outDir", "--logLevel", "--base"];
-var ViteAdapter = class extends BaseAdapter {
+var ViteAdapter = class extends ViteRoleAdapter {
   target = "build";
-  runner = "vite";
-  /**
-   * React only. The two SvelteKit configs in this repo are 34 and 21 lines and share nothing
-   * with the React three; claiming them would mean a preset that fits neither.
-   */
-  appliesTo(preset) {
-    return preset === "react";
-  }
-  /**
-   * `react`, read from the module's Vite config rather than from its dependencies.
-   *
-   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
-   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
-   * during `sentinel --inspect` with no target, which never passes `--preset`.
-   */
-  declaredPreset(cwd) {
-    return declaredBuildPreset(cwd);
-  }
-  plan(context) {
-    return plan(context);
+  get label() {
+    return "build";
   }
   /**
    * Build the module.
    *
-   * A module that has not adopted is reported and passes, the same stance every other role
-   * takes: `--run` with no named target sweeps every wired target across the workspace, so
-   * failing here would exit non-zero on every module that has not migrated, which is most of
-   * them.
+   * Adoption, the binary and the two-copies warning are `prepare`'s, shared with `--dev`. What
+   * is this target's own is the `prebuild` step and the `build` subcommand.
    */
   async run(ctx) {
-    const adoption = readBuildAdoption(ctx.cwd);
-    if (!adoption.adopted) {
-      process.stderr.write(
-        `sentinel build(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
-`
-      );
-      return { ok: true, code: 0 };
-    }
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
     const prerequisite = runPrerequisite(ctx.cwd);
     if (prerequisite.kind === "failed") {
-      process.stderr.write(
-        `sentinel build(vite): the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}
-`
+      this.say(
+        `the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}`
       );
       return { ok: false, code: prerequisite.code };
     }
-    const vite = resolveVite(ctx.cwd);
-    if (!vite) {
-      process.stderr.write(
-        `sentinel build(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
-`
-      );
-      return { ok: false, code: 1 };
-    }
-    if (viteOrigin(ctx.cwd) === "module") {
-      process.stderr.write(
-        `sentinel build(vite): building with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one build fail in ways that never mention a version. Remove vite from this module's package.json.
-`
-      );
-    }
-    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
-      valueFlags: VITE_VALUE_FLAGS
-    });
-    const result = spawnSync3(vite, ["build", ...options, ...paths], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
-    });
-    if (result.error) {
-      process.stderr.write(`sentinel build(vite): could not run vite (${result.error.message})
-`);
-      return { ok: false, code: 1 };
-    }
-    const code = result.status ?? 1;
-    return { ok: code === 0, code };
+    return this.spawnVite(ctx, ready.vite, ["build"], 1);
   }
   /**
    * What this module builds with, without building it.
@@ -883,17 +944,19 @@ var ViteAdapter = class extends BaseAdapter {
       departures: describeDepartures(config, REACT_APP_DEFAULTS),
       additions: appAdditions(config),
       resolved: {
-        base: config.base ?? null,
-        target: config.build?.target ?? null,
-        sourcemap: config.build?.sourcemap ?? null,
-        port: config.server?.port ?? null,
+        base: at(config, "base") ?? null,
+        target: at(config, "build", "target") ?? null,
+        sourcemap: at(config, "build", "sourcemap") ?? null,
+        port: at(config, "server", "port") ?? null,
         // The one number nothing else reports and that no formula predicts: career goes DOWN
         // to 9998 where the others go up, which is why it is data rather than `port + 1`.
-        hmrPort: config.server?.hmr?.port ?? null,
+        hmrPort: at(config, "server", "hmr", "port") ?? null,
         // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
         // would bury everything above it. The count is what tells you whether it moved.
-        aliases: Array.isArray(config.resolve?.alias) ? config.resolve.alias.length : 0,
-        plugins: Array.isArray(config.plugins) ? config.plugins.flat(9).length : 0
+        aliases: countOf(at(config, "resolve", "alias")),
+        // Flattened without a depth limit: Vite lets a plugin be an arbitrarily nested array,
+        // and a magic number here would silently undercount the day someone nests one deeper.
+        plugins: countOf(at(config, "plugins"))
       }
     };
   }
@@ -920,11 +983,18 @@ var ViteAdapter = class extends BaseAdapter {
       }
     };
   }
-  async status(ctx) {
-    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
-    return { adopted, preset, conformant, drift, unreadable };
-  }
 };
+function at(config, ...path) {
+  let value = config;
+  for (const key of path) {
+    if (typeof value !== "object" || value === null) return void 0;
+    value = value[key];
+  }
+  return value;
+}
+function countOf(value) {
+  return Array.isArray(value) ? value.flat(Number.POSITIVE_INFINITY).length : 0;
+}
 
 // src/roles/build/register.ts
 function registerBuild() {
@@ -935,13 +1005,13 @@ function registerBuild() {
 }
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
 import { join as join14 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join8 } from "path";
+import { extname, join as join8, relative } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1000,6 +1070,35 @@ function hasSourceFiles(cwd, extensions) {
   }
   return false;
 }
+function listSourceFiles(cwd, extensions) {
+  const wanted = new Set(extensions);
+  const queue = [cwd];
+  const found = [];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = join8(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
+        continue;
+      }
+      if (wanted.has(extname(entry.name))) found.push(relative(cwd, full));
+    }
+  }
+  return found;
+}
+
+// src/core/named-scope.ts
+var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
+function scopeFlags(paths) {
+  return paths.length > 0 ? [TOLERATE_EMPTY_FLAG] : [];
+}
 
 // src/core/settings.ts
 var WORKSPACE_ROOT_MARKER = "nx.json";
@@ -1007,7 +1106,7 @@ var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
-import { dirname as dirname3, join as join9, relative } from "path";
+import { dirname as dirname3, join as join9, relative as relative2 } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -1080,7 +1179,7 @@ var ROOT_PRETTIER_CONFIGS = [
   "prettier.config.mjs"
 ];
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative(root, moduleDir).replaceAll("\\", "/");
+  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
   const ignorePath = join9(root, PRETTIER_IGNORE);
   const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
@@ -1527,6 +1626,22 @@ var OxfmtAdapter = class extends BaseAdapter {
   appliesTo(_preset) {
     return true;
   }
+  /**
+   * The preset this module COMMITTED to, read from the `$sentinel` block it writes.
+   *
+   * Every other role implements this and format did not, so it was the only one answering from
+   * dependency detection alone. On an adopted Nest module whose own `.oxfmtrc.json` records
+   * `"preset": "nest"`, `--inspect` reported `flavour=node` — the module knew, and the role did
+   * not pass it on. Same command, four rows, two different answers about what the module is.
+   *
+   * It reads the RECORD rather than re-deriving: the block is what `--init` wrote, so it is the
+   * module's declaration, and a re-derivation from hoisted dependencies is exactly the wrong
+   * answer this exists to avoid.
+   */
+  declaredPreset(cwd) {
+    const declared = readFormatAdoption(cwd).preset;
+    return declared !== null && PRESET_NAMES.includes(declared) ? declared : void 0;
+  }
   plan(context) {
     if (!hasSourceFiles(context.cwd, FORMATTABLE_EXTENSIONS)) {
       return {
@@ -1628,7 +1743,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
-    const pass = spawnSync4(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const pass = spawnSync3(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     process.stderr.write(`  ${palette(process.stderr).dim(FORMATTER_DIFFERENCES)}
 `);
     if (pass.status === 0) return;
@@ -1691,10 +1806,14 @@ var OxfmtAdapter = class extends BaseAdapter {
     const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXFMT_VALUE_FLAGS
     });
-    const result = spawnSync4(oxfmt, [mode, ...options, ...paths.length > 0 ? paths : ["."]], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
-    });
+    const result = spawnSync3(
+      oxfmt,
+      [mode, ...scopeFlags(paths), ...options, ...paths.length > 0 ? paths : ["."]],
+      {
+        cwd: ctx.cwd,
+        stdio: "inherit"
+      }
+    );
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1769,7 +1888,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1, metrics: { ...base, unformatted: null } };
     }
-    const result = spawnSync4(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync3(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1886,15 +2005,122 @@ function registerFormat() {
 }
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
-import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync18, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join22 } from "path";
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync20, readFileSync as readFileSync19, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join24 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
   return rules.map((entry) => entry.rule);
 }
 
+// src/core/fix-report.ts
+import { statSync } from "fs";
+import { join as join15 } from "path";
+var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
+function readFailure(output) {
+  const lines = output.split("\n").map((line2) => line2.trim());
+  if (!lines.some((line2) => CONFIG_REFUSED.test(line2))) return void 0;
+  const detail = lines.find((line2) => /invalid config file/i.test(line2));
+  const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
+  return line.split(/:\s*Failed to parse config/i)[0] ?? line;
+}
+function fingerprint(path) {
+  try {
+    const stat = statSync(path);
+    return `${stat.size}:${stat.mtimeMs}`;
+  } catch {
+    return void 0;
+  }
+}
+function snapshotFiles(cwd, extensions) {
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const mark = fingerprint(join15(cwd, file));
+    if (mark !== void 0) snapshot.set(file, mark);
+  }
+  return snapshot;
+}
+function changedSince(cwd, before, extensions) {
+  const changed = [];
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const now = fingerprint(join15(cwd, file));
+    if (now === void 0) continue;
+    if (before.get(file) !== now) changed.push(file);
+  }
+  return changed.sort();
+}
+var NAMED_IN_REPORT = 5;
+function describeFixOutcome(outcome, toolLabel) {
+  if (outcome.failure !== void 0) {
+    return `the ${toolLabel} autofix could not run, so nothing was fixed and this module has not been checked: ${outcome.failure}`;
+  }
+  if (outcome.changed.length === 0) return `the ${toolLabel} autofix changed nothing`;
+  const named = outcome.changed.slice(0, NAMED_IN_REPORT).join(", ");
+  const rest = outcome.changed.length - NAMED_IN_REPORT;
+  const listed = rest > 0 ? `${named} and ${rest} more` : named;
+  return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
+}
+
+// src/roles/lint/module-baseline.ts
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join16 } from "path";
+var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
+var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
+var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
+function holdsFrom(errorCounts) {
+  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
+}
+function renderBaseline(holds, version) {
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
+  return [
+    "{",
+    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
+    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
+    "  // and returns to `error` on its own.",
+    "  //",
+    "  // These rules are held at `warn` because this module ALREADY violated them when it",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` lists what is held; `sentinel --run --lint --json` counts",
+    "  // what is left, per rule. Fix them and re-run `--init --lint` to get the severity back.",
+    '  "rules": {',
+    entries,
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function extendsWithBaseline(current, hasHolds) {
+  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
+}
+function describeHolds(holds) {
+  if (holds.length === 0) return "";
+  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
+  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
+  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
+  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
+}
+function heldRules(cwd) {
+  const path = join16(cwd, LINT_BASELINE_FILE);
+  if (!existsSync13(path)) return [];
+  try {
+    const parsed = parseJsonc(
+      readFileSync12(path, "utf8"),
+      LINT_BASELINE_FILE
+    );
+    return Object.keys(parsed.rules ?? {});
+  } catch {
+    return [];
+  }
+}
+
 // src/roles/lint/config-policy.ts
 var LINT_CONFIG_FILE = ".oxlintrc.json";
 var LINT_SCRIPT_NAME = "lint";
@@ -1907,8 +2133,10 @@ function isSentinelPreset(entry) {
 }
 function extendsWithPreset(current, variant) {
   const own = presetPath(variant);
-  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
-  return [own, ...new Set(others)];
+  const others = [...new Set(current.filter((entry) => entry !== own && !isSentinelPreset(entry)))];
+  const baseline = others.filter((entry) => entry === LINT_BASELINE_SPECIFIER);
+  const rest = others.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return [own, ...rest, ...baseline];
 }
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
@@ -1932,46 +2160,6 @@ function lintTarget() {
   return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
-// src/roles/lint/presets/base.json
-var base_default2 = {
-  rules: {
-    "no-var": "error",
-    "prefer-const": [
-      "error",
-      {
-        destructuring: "any",
-        ignoreReadBeforeAssign: false
-      }
-    ],
-    "prefer-rest-params": "error",
-    "prefer-spread": "error",
-    "typescript/ban-ts-comment": "error",
-    "typescript/no-array-constructor": "error",
-    "typescript/no-duplicate-enum-values": "error",
-    "typescript/no-empty-object-type": "error",
-    "typescript/no-extra-non-null-assertion": "error",
-    "typescript/no-misused-new": "error",
-    "typescript/no-namespace": "error",
-    "typescript/no-non-null-asserted-optional-chain": "error",
-    "typescript/no-this-alias": "error",
-    "typescript/no-unnecessary-type-constraint": "error",
-    "typescript/no-unsafe-declaration-merging": "error",
-    "typescript/no-unsafe-function-type": "error",
-    "typescript/no-unused-expressions": [
-      "error",
-      {
-        allowShortCircuit: false,
-        allowTaggedTemplates: false,
-        allowTernary: false
-      }
-    ],
-    "typescript/no-wrapper-object-types": "error",
-    "typescript/prefer-as-const": "error",
-    "typescript/prefer-namespace-keyword": "error",
-    "typescript/triple-slash-reference": "error"
-  }
-};
-
 // src/roles/lint/presets/nest.json
 var nest_default = {
   plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
@@ -2311,6 +2499,7 @@ var nest_default = {
     "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
     "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent, and unlike the react tier this preset hosts no house-rule plugin, so architectural guards written as AST selectors are not enforced at all. They belong in sentinel's `hublo` plugin, next to the frontend ones: tell us which guards your service relies on. A per-module copy of a house rule drifts, which is the problem sentinel exists to remove.",
     "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
@@ -3264,10 +3453,51 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
 
+// src/roles/lint/presets/shared.json
+var shared_default = {
+  rules: {
+    "no-var": "error",
+    "prefer-const": [
+      "error",
+      {
+        destructuring: "any",
+        ignoreReadBeforeAssign: false
+      }
+    ],
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-constructor": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": [
+      "error",
+      {
+        allowShortCircuit: false,
+        allowTaggedTemplates: false,
+        allowTernary: false
+      }
+    ],
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/triple-slash-reference": "error"
+  }
+};
+
 // src/roles/lint/presets/svelte.json
 var svelte_default = {
   plugins: ["typescript", "oxc"],
@@ -3606,7 +3836,7 @@ var tools_default = {
 };
 
 // src/roles/lint/preset-data.ts
-var BASE_RULES = base_default2.rules;
+var SHARED_RULES = shared_default.rules;
 var PRESET_FILES = {
   nest: nest_default,
   node: node_default,
@@ -3628,15 +3858,18 @@ function hasLintPreset(preset) {
 function presetFile(preset) {
   return VARIANT_FILES[preset] ?? PRESET_FILES[preset] ?? node_default;
 }
-function baseRules() {
-  return BASE_RULES;
+function sharedRules() {
+  return SHARED_RULES;
 }
 function presetRules(preset) {
   return presetFile(preset).rules;
 }
+function uncoveredFor(preset) {
+  return Object.entries(presetFile(preset).uncovered ?? {}).map(([rule, reason]) => ({ rule, reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
 
 // src/roles/lint/rule-data.ts
-var baseRules2 = baseRules();
+var sharedRules2 = sharedRules();
 function isDecision(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -3663,7 +3896,7 @@ function validate(preset, rules) {
   }
 }
 function layered(preset) {
-  const base = baseRules();
+  const base = sharedRules();
   const layer = presetRules(preset);
   validate("base", base);
   validate(preset, layer);
@@ -3702,60 +3935,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { isAbsolute as isAbsolute2, join as join15, resolve as resolve3 } from "path";
-
-// src/roles/lint/module-baseline.ts
-var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
-var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
-var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
-function holdsFrom(errorCounts) {
-  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
-}
-function renderBaseline(holds, version) {
-  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
-  return [
-    "{",
-    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
-    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
-    "  // and returns to `error` on its own.",
-    "  //",
-    "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report, so the build cannot fail on them.",
-    "  //",
-    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
-    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
-    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
-    "  // file rather than live with it.",
-    "  //",
-    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
-    "  // to get the preset severity back.",
-    '  "rules": {',
-    entries,
-    "  }",
-    "}",
-    ""
-  ].join("\n");
-}
-function extendsWithBaseline(current, hasHolds) {
-  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
-  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
-}
-function describeHolds(holds) {
-  if (holds.length === 0) return "";
-  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
-  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
-  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
-  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
-}
-
-// src/roles/lint/extra-layers.ts
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { isAbsolute as isAbsolute2, join as join17, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync13(path)) return void 0;
+  if (!existsSync14(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync12(path, "utf8"),
+      readFileSync13(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3775,7 +3962,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join15(cwd, configFile), "utf8"),
+      readFileSync13(join17(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -3834,8 +4021,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3850,12 +4037,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync13(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync14(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3869,8 +4056,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join16(moduleDir, candidate);
-    if (!existsSync14(absolutePath)) continue;
+    const absolutePath = join18(moduleDir, candidate);
+    if (!existsSync15(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3903,12 +4090,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync15(join17(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync16(join19(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync14(join17(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync15(join19(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -3942,9 +4129,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join18 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3969,30 +4156,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join18(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join18(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join20(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join20(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join18(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join20(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync16(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync17(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join21 } from "path";
 var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
 var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
@@ -4005,11 +4192,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join19(cwd, name)).find((path) => existsSync17(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join21(cwd, name)).find((path) => existsSync18(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync15(config, "utf8");
+    source = readFileSync16(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4063,8 +4250,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync16, statSync } from "fs";
-import { join as join20, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync17, statSync as statSync2 } from "fs";
+import { join as join22, relative as relative3 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4111,10 +4298,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join20(dir, entry);
+    const full = join22(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync(full).isDirectory();
+      isDirectory = statSync2(full).isDirectory();
     } catch {
       continue;
     }
@@ -4131,7 +4318,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync16(file, "utf8");
+      content = readFileSync17(file, "utf8");
     } catch {
       continue;
     }
@@ -4155,7 +4342,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative2(cwd, file),
+        file: relative3(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4259,7 +4446,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync18(join21(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync19(join23(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4357,7 +4544,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4368,7 +4555,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4380,7 +4567,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync17(join21(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync18(join23(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4445,17 +4632,31 @@ var OxlintAdapter = class extends BaseAdapter {
     return presetOfVariant(presetNameFromPath(readLintAdoption(cwd).preset));
   }
   /**
-   * The autofix pass. Output is captured rather than streamed: the fix run is noise, and the
-   * verification run that follows is the one a developer reads.
+   * The autofix pass, and what it did.
+   *
+   * Output is captured rather than streamed: the fix run is noise, and the verification run
+   * that follows is the one a developer reads. But captured is not the same as discarded, and
+   * it used to be discarded, which is why a pass that never ran looked exactly like one that
+   * had nothing to do.
+   *
+   * The exit status cannot be the signal, and neither can the stream. Measured on oxlint: a
+   * healthy run on a module with remaining violations and a run whose `extends` path resolves
+   * nowhere BOTH exit 1 and both write to stdout. One module was checked and one was not, and
+   * nothing in the process result separates them, so the only signal is what the tool said.
    */
   fixPass(ctx, oxlint, env) {
-    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
+    const before = snapshotFiles(ctx.cwd, LINTABLE_EXTENSIONS);
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env,
       maxBuffer: CAPTURE_MAX_BUFFER
     });
-    return result.status ?? 1;
+    if (result.error) return { changed: [], failure: result.error.message };
+    const failure = readFailure(`${result.stdout ?? ""}
+${result.stderr ?? ""}`);
+    if (failure !== void 0) return { changed: [], failure };
+    return { changed: changedSince(ctx.cwd, before, LINTABLE_EXTENSIONS), failure: void 0 };
   }
   /** The module's current `lint` script, so adoption replaces only the eslint part of it. */
   /**
@@ -4478,7 +4679,8 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return;
     const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
-    this.fixPass(ctx, oxlint, env);
+    process.stderr.write(`  ${describeFixOutcome(this.fixPass(ctx, oxlint, env), "lint")}
+`);
     this.writeModuleBaseline(ctx, oxlint, env);
   }
   /**
@@ -4499,20 +4701,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join22(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join22(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync19(configPath)) return;
+    const configPath = join24(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join24(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync20(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync18(configPath, "utf8"),
+        readFileSync19(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join22(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join24(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -4520,7 +4722,7 @@ var OxlintAdapter = class extends BaseAdapter {
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
       );
-      measured = spawnSync5(
+      measured = spawnSync4(
         oxlint,
         [
           "-c",
@@ -4553,14 +4755,14 @@ var OxlintAdapter = class extends BaseAdapter {
     } else {
       rmSync(baselinePath, { force: true });
     }
-    if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
+    if (next.length !== current.length || next.some((entry, at2) => entry !== current[at2])) {
       config.extends = next;
       writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync19(join22(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync20(join24(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4605,9 +4807,10 @@ var OxlintAdapter = class extends BaseAdapter {
       valueFlags: OXLINT_VALUE_FLAGS
     });
     const targets = paths.length > 0 ? paths : ["."];
+    const emptyScope = scopeFlags(paths);
     const lint = (extra) => {
-      const passed = [...extra, ...passedOptions];
-      const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const passed = [...extra, ...emptyScope, ...passedOptions];
+      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -4645,6 +4848,33 @@ var OxlintAdapter = class extends BaseAdapter {
         rule: entry.rule,
         reason: entry.reason
       })),
+      // A FOURTH state, and the only one that was declared and never reported: rules oxlint
+      // cannot run at all, so they can be neither enforced nor disabled. Each preset has
+      // carried this list since the Svelte work, and nothing read it outside a test.
+      //
+      // The gap that made it matter: `no-restricted-syntax` has no oxlint equivalent, so two
+      // architectural guards a Nest service relied on vanished at adoption with nothing said.
+      // The adopter found it himself and rebuilt them as a local plugin. The next one might
+      // not, which is the whole argument for saying it out loud.
+      uncovered: uncoveredFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
+        rule: entry.rule,
+        reason: entry.reason
+      })),
+      // What this module HOLDS: the rules its own baseline lowers to `warn`.
+      //
+      // Distinct from `downgraded` just above, which is the PRESET's doing and identical for
+      // every module on it. These are this module's own debt, and leaving them out was a real
+      // gap: `--inspect` could tell you the preset holds 6 rules while saying nothing about
+      // the 3 your module holds on top, so nobody could see their own debt without opening a
+      // file that says "do not edit by hand".
+      //
+      // Listed, not counted. The list is free — it is the committed file — while a count means
+      // running oxlint, which this verb deliberately does not do (that is what keeps a
+      // 441-module sweep at ~8s per role). `--run --lint --json` carries the per-rule counts.
+      held: heldRules(ctx.cwd).map((rule) => ({
+        rule,
+        reason: `held at \`warn\` by this module's ${LINT_BASELINE_FILE}, because it already violated it when it adopted. \`--run --lint --json\` counts what is left.`
+      })),
       // What this module enforces BEYOND the preset. Not drift, and not covered by anything
       // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
       // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
@@ -4680,7 +4910,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -4690,7 +4920,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync18(join22(cwd, entry), "utf8"),
+          readFileSync19(join24(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4707,7 +4937,7 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return { ok: false, code: 1, metrics: { error: "oxlint not found" } };
     const typeAware = canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [];
-    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) },
@@ -4760,14 +4990,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync19(join22(cwd, target)));
+    return targets.find((target) => !existsSync20(join24(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4798,36 +5028,10 @@ function registerLint() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join24 } from "path";
-
-// src/roles/typescript/presets/base.json
-var base_default3 = {
-  $schema: "https://json.schemastore.org/tsconfig",
-  compilerOptions: {
-    strict: true,
-    noFallthroughCasesInSwitch: true,
-    forceConsistentCasingInFileNames: true,
-    esModuleInterop: true,
-    skipLibCheck: true
-  },
-  deferred: {
-    noImplicitAny: {
-      phase: 2,
-      reason: "the implicit-any migration (TS70xx)"
-    },
-    noUnusedLocals: {
-      phase: 2,
-      reason: "unused-local cleanup (TS6133)"
-    },
-    noUnusedParameters: {
-      phase: 2,
-      reason: "unused-parameter cleanup (TS6133)"
-    }
-  }
-};
+import { join as join26 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -4878,15 +5082,41 @@ var react_default2 = {
   }
 };
 
+// src/roles/typescript/presets/shared.json
+var shared_default2 = {
+  $schema: "https://json.schemastore.org/tsconfig",
+  compilerOptions: {
+    strict: true,
+    noFallthroughCasesInSwitch: true,
+    forceConsistentCasingInFileNames: true,
+    esModuleInterop: true,
+    skipLibCheck: true
+  },
+  deferred: {
+    noImplicitAny: {
+      phase: 2,
+      reason: "the implicit-any migration (TS70xx)"
+    },
+    noUnusedLocals: {
+      phase: 2,
+      reason: "unused-local cleanup (TS6133)"
+    },
+    noUnusedParameters: {
+      phase: 2,
+      reason: "unused-parameter cleanup (TS6133)"
+    }
+  }
+};
+
 // src/roles/typescript/preset-data.ts
-var BASE = base_default3;
+var SHARED = shared_default2;
 var LAYERS = {
   nest: nest_default2,
   node: node_default2,
   react: react_default2
 };
 var SHIPPED_PRESETS = Object.keys(LAYERS).sort();
-var DEFERRED_RULES = Object.entries(BASE.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+var DEFERRED_RULES = Object.entries(SHARED.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
 function validate2() {
   for (const { rule, phase, reason } of DEFERRED_RULES) {
     if (!Number.isInteger(phase) || phase < 2) {
@@ -4899,9 +5129,9 @@ function validate2() {
         `deferred rule "${rule}" has no reason; --inspect reports it and would say nothing`
       );
     }
-    if (rule in BASE.compilerOptions) {
+    if (rule in SHARED.compilerOptions) {
       throw new Error(
-        `"${rule}" is deferred and also set by the base preset; it would be announced as not enforced while being enforced`
+        `"${rule}" is deferred and also set by the shared layer; it would be announced as not enforced while being enforced`
       );
     }
     for (const [preset, layer] of Object.entries(LAYERS)) {
@@ -4921,8 +5151,8 @@ function tsPresetFor(preset) {
   const layer = LAYERS[preset];
   if (!layer) throw new Error(`no TypeScript preset ships for preset "${preset}"`);
   return {
-    ...BASE.$schema === void 0 ? {} : { $schema: BASE.$schema },
-    compilerOptions: { ...BASE.compilerOptions, ...layer.compilerOptions }
+    ...SHARED.$schema === void 0 ? {} : { $schema: SHARED.$schema },
+    compilerOptions: { ...SHARED.compilerOptions, ...layer.compilerOptions }
   };
 }
 
@@ -4982,8 +5212,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync19 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync20 } from "fs";
+import { join as join25 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5076,7 +5306,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync19(join23(context.cwd, target.path), "utf8"),
+    readFileSync20(join25(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5214,7 +5444,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync20(join24(cwd, target.path), "utf8"),
+        readFileSync21(join26(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5227,7 +5457,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join24(cwd, "noop.js")).resolve(preset);
+      createRequire4(join26(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5268,7 +5498,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5303,7 +5533,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5323,7 +5553,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync20(join24(cwd, config), "utf8"),
+        readFileSync21(join26(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5339,7 +5569,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync20(join24(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync21(join26(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5392,7 +5622,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5435,7 +5665,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5543,7 +5773,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync21, readFileSync as readFileSync21, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync22, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
@@ -5555,7 +5785,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync21(absolutePath) ? readFileSync21(absolutePath, "utf8") : void 0;
+  return existsSync22(absolutePath) ? readFileSync22(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5673,8 +5903,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync22, readdirSync as readdirSync3, readFileSync as readFileSync22 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync3, readFileSync as readFileSync23 } from "fs";
+import { join as join27 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5688,11 +5918,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join25(cwd, "package.json");
-  if (!existsSync22(path)) return [];
+  const path = join27(cwd, "package.json");
+  if (!existsSync23(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync22(path, "utf8"),
+      readFileSync23(path, "utf8"),
       path
     );
     return [
@@ -5715,7 +5945,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync22(join25(cwd, name), "utf8"),
+        readFileSync23(join27(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5812,13 +6042,26 @@ async function dispatch(opts) {
   const resolutionPreset = opts.preset ?? declaredPresetFor(opts.target, opts.cwd) ?? detected;
   const adapter = resolve(opts.target, resolutionPreset, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
-  const contradiction = presetContradiction(preset, opts.cwd);
-  if (contradiction !== void 0) {
-    process.stderr.write(`sentinel (${opts.target}): ${contradiction}
+  if (opts.preset !== void 0) {
+    const contradiction = presetContradiction(opts.preset, opts.cwd);
+    if (contradiction !== void 0) {
+      process.stderr.write(`sentinel (${opts.target}): ${contradiction}
 `);
-    return 1;
+      return 1;
+    }
   }
-  const context = { cwd: opts.cwd, preset };
+  let effective = preset;
+  if (opts.preset === void 0 && adapter.declaredPreset?.(opts.cwd) === void 0) {
+    const [signal] = presetSignals(opts.cwd);
+    if (signal !== void 0 && signal.preset !== preset) {
+      effective = signal.preset;
+      process.stderr.write(
+        `  detected "${preset}" from dependencies, but ${signal.evidence}, so adopting as "${signal.preset}". Pass --preset to override.
+`
+      );
+    }
+  }
+  const context = { cwd: opts.cwd, preset: effective };
   const plan3 = await adapter.plan(context);
   if (plan3.blocked) {
     process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
@@ -5866,18 +6109,18 @@ export {
   readOwnVersion,
   readProjectPackageJson,
   readNxProjectName,
+  VERBS,
+  TARGETS,
+  SWEEPABLE_TARGETS,
+  PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
   inspectWorkspacePrep,
   palette,
-  VERBS,
-  TARGETS,
-  SWEEPABLE_TARGETS,
-  PRESET_NAMES,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-TWL6T237.js.map
+//# sourceMappingURL=chunk-FLJ2QNFF.js.map