@hublo/sentinel 1.2.0-alpha.0 → 1.2.0-alpha.10

package/dist/{chunk-TWL6T237.js → chunk-7WB7MQHD.js}

@@ -1,8 +1,3 @@
-import {
-  REACT_APP_DEFAULTS,
-  isPlainObject
-} from "./chunk-XSCDJZDY.js";
-
 // src/core/registry.ts
 var adapters = [];
 var PresetUnsupportedError = class extends Error {
@@ -87,7 +82,7 @@ var BaseAdapter = class {
 
 // src/shared/package-json.ts
 import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { basename, dirname, join } from "path";
 import { fileURLToPath } from "url";
 function readOwnPackage() {
   let dir = dirname(fileURLToPath(import.meta.url));
@@ -132,19 +127,9 @@ function readNxProjectName(dir) {
     return void 0;
   }
 }
-
-// src/shared/color.ts
-import { styleText } from "util";
-function palette(stream) {
-  const paint = (format, text) => styleText(format, text, { stream });
-  return {
-    ok: (text) => paint(["green", "bold"], text),
-    fail: (text) => paint(["red", "bold"], text),
-    warn: (text) => paint("yellow", text),
-    strong: (text) => paint("bold", text),
-    dim: (text) => paint("dim", text),
-    accent: (text) => paint("cyan", text)
-  };
+function moduleName(dir) {
+  const declared = readProjectPackageJson(dir).name;
+  return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
 }
 
 // src/core/domain.ts
@@ -166,7 +151,21 @@ var SWEEPABLE_TARGETS = TARGETS.filter(
 );
 var PRESET_NAMES = ["react", "nest", "svelte", "node", "tools"];
 
-// src/roles/build/adapters/vite/vite-dev.adapter.ts
+// src/shared/color.ts
+import { styleText } from "util";
+function palette(stream) {
+  const paint = (format, text) => styleText(format, text, { stream });
+  return {
+    ok: (text) => paint(["green", "bold"], text),
+    fail: (text) => paint(["red", "bold"], text),
+    warn: (text) => paint("yellow", text),
+    strong: (text) => paint("bold", text),
+    dim: (text) => paint("dim", text),
+    accent: (text) => paint("cyan", text)
+  };
+}
+
+// src/roles/build/adapters/vite/vite-role.adapter.ts
 import { spawnSync } from "child_process";
 
 // src/core/config/tool-args.ts
@@ -206,9 +205,9 @@ function binFromOwnInstall(packageName, binName) {
   try {
     const manifest = require2.resolve(`${packageName}/package.json`);
     const bin = require2(manifest).bin;
-    const relative3 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative3) return void 0;
-    const executable = join2(dirname2(manifest), relative3);
+    const relative6 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative6) return void 0;
+    const executable = join2(dirname2(manifest), relative6);
     return existsSync3(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -221,8 +220,8 @@ function binSearchPath(cwd) {
 }
 
 // src/roles/build/plan.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -242,7 +241,7 @@ function parseJsonc(text, source = "config") {
 
 // src/core/config/manifest.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { basename, join as join3 } from "path";
+import { basename as basename2, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
     const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
@@ -251,7 +250,7 @@ function moduleScripts(cwd) {
     return {};
   }
 }
-function moduleName(cwd) {
+function moduleName2(cwd) {
   try {
     const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
@@ -260,7 +259,7 @@ function moduleName(cwd) {
   }
 }
 function isSelfAdoption(cwd) {
-  return moduleName(cwd) === readOwnPackage().name;
+  return moduleName2(cwd) === readOwnPackage().name;
 }
 function selfCommand(cwd, flags) {
   const own = readOwnPackage();
@@ -279,7 +278,7 @@ function manifestOperation(cwd, scripts) {
   return {
     kind: "merge-json",
     path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+    value: { name: readNxProjectName(cwd) ?? basename2(cwd), private: true, ...value }
   };
 }
 
@@ -383,33 +382,111 @@ function keepsOtherCommands(script, sentinelCommand) {
   return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
 
+// src/roles/build/presets/requirements.json
+var requirements_default = {
+  svelte: {
+    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
+    requires: {
+      "@sveltejs/vite-plugin-svelte": "7.0.0",
+      svelte: "5.46.4"
+    }
+  }
+};
+
+// src/roles/build/presets/toolchain.json
+var toolchain_default = {
+  $comment: "The build toolchain sentinel owns. One table, because three places used to hold parts of it: the list to remove from a module's package.json, the list of import specifiers to rewrite, and the map from a default import to the name sentinel re-exports it under. A package added to one and not the others gives a removal with no rewrite, or an import pointing at a package the module no longer declares.",
+  owned: [
+    {
+      package: "vite",
+      specifier: "vite",
+      named: ["defineConfig", "loadEnv", "mergeConfig"],
+      types: [
+        "Plugin",
+        "PluginOption",
+        "SassPreprocessorOptions",
+        "UserConfig",
+        "UserConfigExport"
+      ],
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+    },
+    {
+      package: "@vitejs/plugin-react",
+      specifier: "@vitejs/plugin-react",
+      default: "react",
+      why: "the React transform. Bound to the Vite that runs it, so it has to come from the same install."
+    },
+    {
+      package: "@tailwindcss/vite",
+      specifier: "@tailwindcss/vite",
+      default: "tailwindcss",
+      why: "the Tailwind pipeline, identical in all three front apps."
+    },
+    {
+      package: "vite-plugin-svgr",
+      specifier: "vite-plugin-svgr",
+      default: "svgr",
+      why: "SVG as components, identical in all three front apps."
+    },
+    {
+      package: "nitro",
+      specifier: "nitro/vite",
+      named: ["nitro"],
+      why: "the SSR server. Note the package and the import specifier differ, which is exactly the kind of split that made three separate lists disagree."
+    }
+  ],
+  add: [
+    {
+      package: "@hublo/sentinel",
+      why: "the module now gets its toolchain from here, so it declares it. Pinned by the installer rather than by us: `--init` writes the dependency, `pnpm install` resolves it."
+    }
+  ],
+  $notOwned: {
+    "@rolldown/plugin-babel": "declared by career and host-admin themselves, not at the root. It supports LocatorJS, a development convenience gated on LOCATORJS=true, not shared build infrastructure. Removing it would remove a feature from two teams, which is their call and must not ride along inside an adoption.",
+    "@locator/babel-jsx": "same, and same owners.",
+    "@tanstack/react-start": "a framework the apps code against: 48 source files import it directly.",
+    "@tanstack/router-plugin": "generates the app's own route tree.",
+    "vite-bundle-analyzer": "at the root at 1.3.7 and imported nowhere, the only mention being a commented-out line in host-admin. Not a candidate to re-export, a candidate to delete from the root."
+  }
+};
+
+// src/roles/build/preset-data.ts
+var REQUIREMENTS = requirements_default;
+var OWNED_PACKAGES = toolchain_default.owned;
+
 // src/roles/build/config-policy.ts
+var COMPANION_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs"
+];
 var BUILD_CONFIG_FILES = [
   "vite.config.ts",
   "vite.config.mts",
   "vite.config.js",
   "vite.config.mjs"
 ];
-var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_PRESET_SPECIFIERS = {
+  react: "@hublo/sentinel/build/react",
+  nest: "@hublo/sentinel/build/nest"
+};
+var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
 var BUILD_SCRIPT_NAME = "build";
-var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
 function buildTarget() {
   return {
     [BUILD_SCRIPT_NAME]: {
       cache: true,
-      inputs: ["default", "^default", `{projectRoot}/${BUILD_CONFIG_FILES[0]}`]
+      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
     }
   };
 }
-var SENTINEL_OWNED_BUILD_PACKAGES = [
-  "vite",
-  "@vitejs/plugin-react",
-  "@tailwindcss/vite",
-  "vite-plugin-svgr",
-  "nitro"
-];
+var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
+  (entry) => entry.package
+);
 
 // src/roles/build/dev-script.ts
 var CHAIN = " -- ";
@@ -431,9 +508,129 @@ function composeDevScript(existing, command) {
   return chunks.join(CHAIN);
 }
 
-// src/roles/build/read-adoption.ts
+// src/roles/build/nest/adopt.ts
+import { relative as relative2 } from "path";
+
+// src/roles/build/nest/nx-target.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join6, relative } from "path";
+var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
+var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
+var readProjectJson = (cwd) => {
+  const path = join6(cwd, "project.json");
+  if (!existsSync6(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+function webpackBuildTarget(cwd) {
+  const project = readProjectJson(cwd);
+  const target = project?.targets?.build;
+  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
+  const { outputPath, main, webpackConfig } = target.options ?? {};
+  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
+    return void 0;
+  }
+  return {
+    project: project.name,
+    outputPath,
+    main,
+    webpackConfig,
+    configurations: target.configurations
+  };
+}
+function refusalFor(cwd, target) {
+  if (workspaceRootFor(cwd, target) === void 0) {
+    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
+  }
+  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
+    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
+  }
+  const live = liveFileReplacements(cwd, target);
+  if (live.length > 0) {
+    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
+  }
+  return void 0;
+}
+function liveFileReplacements(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) return [];
+  const configurations = target.configurations ?? {};
+  const live = [];
+  for (const configuration of Object.values(configurations)) {
+    for (const replacement of configuration.fileReplacements ?? []) {
+      const exists = existsSync6(join6(workspaceRoot, replacement.replace)) || existsSync6(join6(workspaceRoot, replacement.with));
+      if (exists) live.push(replacement.replace);
+    }
+  }
+  return live;
+}
+function workspaceRootFor(cwd, target) {
+  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
+  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
+  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
+}
+function workspaceRootHops(cwd, target) {
+  const root = workspaceRootFor(cwd, target);
+  if (root === void 0) {
+    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
+  }
+  const rel = relative(root, cwd);
+  return rel === "" ? 0 : rel.split(/[\\/]/).length;
+}
+
+// src/roles/build/nest/adopt.ts
+var NEST_CONFIG_FILE = "vite.config.mts";
+function nestConfigSource(cwd, target) {
+  const hops = workspaceRootHops(cwd, target);
+  const up = Array.from({ length: hops }, () => "..").join("/");
+  return `import path from 'node:path'
+
+import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
+
+export default nestService({
+  project: '${target.project}',
+  root: __dirname,
+  workspaceRoot: path.resolve(__dirname, '${up}'),
+  outDir: '${target.outputPath}',
+})
+`;
+}
+function nestBuildTarget(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) {
+    throw new Error(
+      `sentinel build(nest): cannot place ${cwd} inside a workspace from ${target.main}`
+    );
+  }
+  const moduleRoot = relative2(workspaceRoot, cwd);
+  return {
+    executor: "nx:run-commands",
+    outputs: [`{workspaceRoot}/${target.outputPath}`],
+    options: {
+      cwd: moduleRoot,
+      command: "pnpm exec sentinel --run --build",
+      forwardAllArgs: false
+    }
+  };
+}
+function nestAdoptionOperations(cwd, target) {
+  return [
+    { kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) },
+    { kind: "remove-json-keys", path: "project.json", keys: [["targets", "build"]] },
+    {
+      kind: "merge-json",
+      path: "project.json",
+      value: { targets: { build: nestBuildTarget(cwd, target) } }
+    }
+  ];
+}
+
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -444,19 +641,32 @@ var NOT_ADOPTED = (configFile, unreadable = null) => ({
   unreadable
 });
 function buildConfigFile(cwd) {
-  return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
+  return BUILD_CONFIG_FILES.find((name) => existsSync7(join7(cwd, name)));
+}
+function importsSpecifier(source, specifier) {
+  const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
 }
 function importsPreset(source) {
-  const specifier = BUILD_PRESET_SPECIFIER.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${specifier}['"\`]`).test(source);
+  return Object.values(BUILD_PRESET_SPECIFIERS).some(
+    (specifier) => importsSpecifier(source, specifier)
+  );
 }
 var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
+  const source = readBuildConfigSource(cwd);
+  if (source === void 0) {
+    return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
+  }
+  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
+  if (importsPreset(source)) return "react";
+  return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
+}
+function readBuildConfigSource(cwd) {
   const configFile = buildConfigFile(cwd);
   if (!configFile) return void 0;
   try {
-    const source = readFileSync4(join6(cwd, configFile), "utf8");
-    return REACT_PLUGIN_SPECIFIERS.some((specifier) => source.includes(specifier)) ? "react" : void 0;
+    return readFileSync5(join7(cwd, configFile), "utf8");
   } catch {
     return void 0;
   }
@@ -466,7 +676,7 @@ function readBuildAdoption(cwd) {
   if (!configFile) return NOT_ADOPTED(null);
   let source;
   try {
-    source = readFileSync4(join6(cwd, configFile), "utf8");
+    source = readFileSync5(join7(cwd, configFile), "utf8");
   } catch (error) {
     return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
   }
@@ -478,7 +688,9 @@ function readBuildAdoption(cwd) {
   );
   return {
     configFile,
-    preset: "react",
+    // Read from the config rather than assumed: the two presets are adopted the same way and
+    // reporting the wrong one would make `--inspect` lie about what a module builds.
+    preset: declaredBuildPreset(cwd) ?? "react",
     adopted: true,
     conformant: ownDeclarations.length === 0,
     drift: ownDeclarations.map(
@@ -489,39 +701,131 @@ function readBuildAdoption(cwd) {
   };
 }
 
-// src/roles/build/plan.ts
-function scaffold() {
-  return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
-import { tanstackStart } from '@tanstack/react-start/plugin/vite'
-import { tanstackRouter } from '@tanstack/router-plugin/vite'
-import path from 'node:path'
+// src/roles/build/requirements.ts
+function atLeast(declared, needed) {
+  const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse2(declared);
+  const right = parse2(needed);
+  for (let at = 0; at < Math.max(left.length, right.length); at++) {
+    const a = left[at] ?? 0;
+    const b = right[at] ?? 0;
+    if (a !== b) return a > b;
+  }
+  return true;
+}
+function unmetRequirements(preset, declared) {
+  const entry = REQUIREMENTS[preset];
+  if (!entry) return [];
+  return Object.entries(entry.requires).filter(([name, needed]) => {
+    const have = declared[name];
+    return have === void 0 || !atLeast(have, needed);
+  }).map(([name, needed]) => ({ name, declared: declared[name], needed }));
+}
+function describeUnmet(preset, unmet) {
+  const entry = REQUIREMENTS[preset];
+  const list = unmet.map(
+    ({ name, declared, needed }) => `${name} ${declared === void 0 ? "is not declared here" : `is at ${declared}`}, needs >= ${needed}`
+  ).join("; ");
+  return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
+}
 
-/*
- * Composition comes from sentinel: how the env is loaded, which plugins run under test and
- * which under a real build, the order they run in. The values below are this app's own.
- *
- * TanStack is passed IN rather than imported by sentinel, because the app codes against it
- * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
- * Anything sentinel does not set goes in \`overrides\`, which merges over the preset last.
- */
-export default defineConfig(({ mode }) =>
-  reactApp({
-    root: __dirname,
-    mode,
-    base: '/',
-    port: 3000,
-    // Explicit, NOT port + 1: the three apps in this repo disagree, one of them goes down.
-    hmrPort: 3001,
-    router: {
-      routesDirectory: path.resolve(__dirname, 'src/routes'),
-      generatedRouteTree: path.resolve(__dirname, 'src/routeTree.gen.ts'),
-    },
-    tanstack: { start: tanstackStart, router: tanstackRouter },
-    alias: [],
-  }),
-)
-`;
+// src/roles/build/rewrite-imports.ts
+import { parseSync } from "oxc-parser";
+var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
+function esmBlocker(fileName, packageType) {
+  if (/\.(mts|mjs)$/.test(fileName)) return void 0;
+  if (packageType === "module") return void 0;
+  return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
+}
+var DEFAULT_EXPORT_NAMES = Object.fromEntries(
+  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
+    entry.specifier,
+    entry.default
+  ])
+);
+function renderImport(bindings) {
+  const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
+  const values = bindings.filter((b) => !b.typeOnly);
+  const types = bindings.filter((b) => b.typeOnly);
+  const lines = [];
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (types.length > 0) {
+    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  }
+  return lines.join("\n");
+}
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return {
+      kind: "blocked",
+      why: `${fileName} does not parse: ${errors[0]?.message ?? "unknown"}`
+    };
+  }
+  const imports = program.body.filter(
+    (node) => node.type === "ImportDeclaration"
+  );
+  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+    return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
+  }
+  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  if (moving.length === 0) {
+    return {
+      kind: "unchanged",
+      why: "this config imports none of the packages sentinel owns, so there is nothing to move"
+    };
+  }
+  const bindings = [];
+  for (const node of moving) {
+    const from = node.source.value;
+    const specifiers = node.specifiers ?? [];
+    if (specifiers.length === 0) {
+      return { kind: "blocked", why: `\`import '${from}'\` has no bindings to move` };
+    }
+    for (const spec of specifiers) {
+      const typeOnly = node.importKind === "type" || spec.importKind === "type";
+      if (spec.type === "ImportDefaultSpecifier") {
+        const exported = DEFAULT_EXPORT_NAMES[from];
+        if (!exported) {
+          return {
+            kind: "blocked",
+            why: `no sentinel export for the default import of \`${from}\``
+          };
+        }
+        bindings.push({ exported, local: spec.local.name, typeOnly });
+        continue;
+      }
+      if (spec.type === "ImportSpecifier") {
+        bindings.push({
+          exported: spec.imported?.name ?? spec.imported?.value ?? spec.local.name,
+          local: spec.local.name,
+          typeOnly
+        });
+        continue;
+      }
+      return {
+        kind: "blocked",
+        why: `\`import * as ${spec.local.name} from '${from}'\` cannot be mapped onto sentinel's named exports`
+      };
+    }
+  }
+  const spans = moving.map((node) => ({ start: node.start, end: node.end })).sort((left, right) => left.start - right.start);
+  const first = spans[0];
+  const rest = spans.slice(1);
+  let out = source;
+  for (const span of rest.slice().reverse()) {
+    const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
+    out = out.slice(0, span.start) + out.slice(span.end + after);
+  }
+  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  return {
+    kind: "rewritten",
+    source: out,
+    moved: [...new Set(moving.map((node) => node.source.value))].sort()
+  };
 }
+
+// src/roles/build/plan.ts
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -550,32 +854,93 @@ function buildScripts(cwd) {
   };
   const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
   if (existingDev !== void 0) {
+    const own2 = moduleName(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
-      selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND
+      // Trailing `--` for the same reason as the build script: whatever the caller appends
+      // reaches Vite, not sentinel's parser. It goes after `--module`, which is sentinel's own.
+      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2} --`
     );
   }
   return scripts;
 }
 function plan(context) {
+  const manifest = readProjectPackageJson(context.cwd);
+  const unmet = unmetRequirements(context.preset, {
+    ...manifest.dependencies,
+    ...manifest.devDependencies
+  });
+  if (unmet.length > 0) {
+    return { operations: [], skipped: describeUnmet(context.preset, unmet) };
+  }
   if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
     return {
       operations: [],
-      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only; the two SvelteKit configs in this repo share nothing with it.`
+      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
     };
   }
   const notes = [];
   const operations = [];
   const configFile = buildConfigFile(context.cwd);
+  const webpackTarget = webpackBuildTarget(context.cwd);
+  const isNest = declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0;
+  if (isNest) {
+    if (webpackTarget === void 0) {
+      return {
+        operations: [],
+        skipped: `already building through sentinel: ${configFile ?? NEST_CONFIG_FILE} imports the nest preset and the nx target runs it. Nothing to change.`
+      };
+    }
+    const refusal = refusalFor(context.cwd, webpackTarget);
+    if (refusal !== void 0) return { operations: [], blocked: refusal };
+    const dropped = Object.keys(webpackTarget.configurations ?? {});
+    return {
+      operations: nestAdoptionOperations(context.cwd, webpackTarget),
+      notes: [
+        `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
+        ...dropped.length > 0 ? [
+          `dropped the \`${dropped.join("`, `")}\` configuration${dropped.length > 1 ? "s" : ""} from the build target: its fileReplacements point at files that do not exist, so it replaced nothing. A live one would have blocked this instead.`
+        ] : [],
+        `verify with \`nx run ${webpackTarget.project}:generate-swagger-file\` and \`git diff --exit-code\`: it runs the built bundle, so it proves the service boots AND that its published contract did not move.`
+      ]
+    };
+  }
   if (configFile === void 0) {
-    operations.push({ kind: "write", path: BUILD_CONFIG_FILES[0], contents: scaffold() });
-    notes.push(
-      `wrote ${BUILD_CONFIG_FILES[0]} as a starting point. Fill in this app's own values (base, ports, routes); sentinel owns the composition, not the data.`
-    );
-  } else if (!readsPreset(context.cwd, configFile)) {
-    notes.push(
-      `${configFile} is this app's own, so it was left alone. To adopt: import \`reactApp\` from \`${BUILD_PRESET_SPECIFIER}\` and pass it this app's values, keeping \`alias\` and your own plugins verbatim. \`sentinel --inspect --build\` reports what the resolved config departs from and what it adds, before and after.`
-    );
+    return {
+      operations: [],
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (36 services here build through \`@nx/webpack\`), the build role does not apply to it.`
+    };
+  } else {
+    const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
+    if (notEsm !== void 0) return { operations: [], skipped: notEsm };
+    const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+    if (rewrite.kind === "blocked") {
+      return {
+        operations: [],
+        skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
+      };
+    }
+    if (rewrite.kind === "rewritten") {
+      operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+    }
+    for (const name of COMPANION_CONFIG_FILES) {
+      const source = readConfigSource(context.cwd, name);
+      if (source === "") continue;
+      const companion = rewriteBuildImports(source, name);
+      if (companion.kind === "rewritten") {
+        operations.push({ kind: "write", path: name, contents: companion.source });
+        notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
+      } else if (companion.kind === "blocked") {
+        notes.push(
+          `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
+        );
+      }
+    }
+    if (rewrite.kind === "rewritten") {
+      notes.push(
+        `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+      );
+    }
   }
   operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
   operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
@@ -588,134 +953,186 @@ function plan(context) {
   }
   return { operations, notes };
 }
-function readsPreset(cwd, configFile) {
-  if (!existsSync7(join7(cwd, configFile))) return false;
+function readConfigSource(cwd, configFile) {
+  if (!existsSync8(join8(cwd, configFile))) return "";
   try {
-    return readFileSync5(join7(cwd, configFile), "utf8").includes(BUILD_PRESET_SPECIFIER);
+    return readFileSync6(join8(cwd, configFile), "utf8");
   } catch {
-    return false;
+    return "";
   }
 }
 
 // src/roles/build/resolve-vite.ts
-function resolveVite(cwd) {
-  return binFromOwnInstall("vite", "vite") ?? resolveBin(cwd, "vite");
+function resolveViteWith(cwd) {
+  const own = binFromOwnInstall("vite", "vite");
+  if (own) return { bin: own, origin: "sentinel" };
+  const module_ = resolveBin(cwd, "vite");
+  return module_ ? { bin: module_, origin: "module" } : { bin: void 0, origin: "none" };
 }
 function viteOrigin(cwd) {
-  if (binFromOwnInstall("vite", "vite")) return "sentinel";
-  return resolveBin(cwd, "vite") ? "module" : "none";
+  return resolveViteWith(cwd).origin;
 }
 
-// src/roles/build/adapters/vite/vite-dev.adapter.ts
-var ViteDevAdapter = class extends BaseAdapter {
-  target = "dev";
+// src/roles/build/adapters/vite/vite-role.adapter.ts
+var VITE_VALUE_FLAGS = [
+  "--config",
+  "-c",
+  "--mode",
+  "-m",
+  "--outDir",
+  "--logLevel",
+  "--base",
+  "--host",
+  "--port"
+];
+var ViteRoleAdapter = class extends BaseAdapter {
   runner = "vite";
+  /**
+   * The presets this role has something to SAY about, which is wider than the ones it serves.
+   *
+   * React it serves. Svelte it does not, yet, and the difference matters to a developer: the
+   * plugin caps at Vite 6 until its major 7, which needs `svelte ^5.46.4`, so the role applies
+   * once the module moves. `plan` reports that chain and SKIPS, which it can only do if
+   * resolution let it run at all — filtering here would give "no adapter for preset svelte",
+   * which tells nobody what to do about it.
+   *
+   * Nest it now serves too, through `@hublo/sentinel/build/nest`. It used to be declined on the
+   * grounds that "there is nothing to bundle", which was never true: those 36 services bundle
+   * with webpack. What changed is that Nx v24 removes the `@nx/webpack:webpack` executor and
+   * the `composePlugins` / `withNx` helpers their shared config is built on, and nx's own
+   * migration generator refuses every one of them because they use `@nx/js:node`
+   * (nrwl/nx#36389). So the way out runs through here.
+   *
+   * `node` and `tools` remain genuinely declined: nothing under them bundles at all.
+   */
   appliesTo(preset) {
-    return preset === "react";
+    return preset === "react" || preset === "svelte" || preset === "nest";
   }
+  /**
+   * `react`, read from the module's Vite config rather than from its dependencies.
+   *
+   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
+   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
+   * during `sentinel --inspect` with no target, which never passes `--preset`.
+   */
   declaredPreset(cwd) {
     return declaredBuildPreset(cwd);
   }
   /**
-   * The same plan as `--build`, deliberately.
+   * The same plan for both targets, deliberately.
    *
-   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without
-   * the other leaves the module half-migrated in a way nothing reports. The operations are
-   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than
-   * additive.
+   * `build` and `serve` are one app's two calls into one toolchain, so adopting one without the
+   * other leaves the module half-migrated in a way nothing reports. The operations are
+   * idempotent, so `--init --build` and `--init --dev` are interchangeable rather than additive.
    */
   plan(context) {
     return plan(context);
   }
+  async status(ctx) {
+    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
+    return { adopted, preset, conformant, drift, unreadable };
+  }
   /**
-   * Start the dev server. It does not return until stopped, so there is no verdict to report
-   * beyond the exit code the developer's own Ctrl-C produces.
+   * Adoption, the binary, and the warning about which copy of Vite is running.
    *
-   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
-   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
-   * running it again would race the watcher that is about to own the file.
+   * A module that has not adopted is reported and PASSES, the same stance every other role
+   * takes: `--run` with no named target sweeps every wired target across the workspace, so
+   * failing here would exit non-zero on every module that has not migrated, which is most of
+   * them.
    */
-  async run(ctx) {
+  prepare(ctx) {
     if (!readBuildAdoption(ctx.cwd).adopted) {
-      process.stderr.write(
-        `sentinel dev(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
-`
+      this.say(
+        `no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.`
       );
-      return { ok: true, code: 0 };
+      return { kind: "stop", result: { ok: true, code: 0 } };
     }
-    const vite = resolveVite(ctx.cwd);
-    if (!vite) {
-      process.stderr.write(
-        `sentinel dev(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
-`
+    const { bin, origin } = resolveViteWith(ctx.cwd);
+    if (!bin) {
+      this.say(
+        `could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.`
       );
-      return { ok: false, code: 1 };
+      return { kind: "stop", result: { ok: false, code: 1 } };
     }
-    if (viteOrigin(ctx.cwd) === "module") {
-      process.stderr.write(
-        `sentinel dev(vite): serving with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one process fail in ways that never mention a version. Remove vite from this module's package.json.
-`
+    if (origin === "module") {
+      this.say(
+        `using the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite fail in ways that never mention a version. Remove vite from this module's package.json.`
       );
     }
-    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: [] });
-    const result = spawnSync(vite, [...options, ...paths], { cwd: ctx.cwd, stdio: "inherit" });
+    return { kind: "ready", vite: bin };
+  }
+  /**
+   * Run Vite with the caller's own arguments after `--`, and report what happened.
+   *
+   * `whenSignalled` is the only difference between the two targets here, and it is a real one:
+   * a build killed by a signal did not produce a bundle, while a dev server killed by Ctrl-C
+   * did exactly what the developer asked.
+   */
+  spawnVite(ctx, vite, argv, whenSignalled) {
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
+      valueFlags: VITE_VALUE_FLAGS
+    });
+    const result = spawnSync(vite, [...argv, ...options, ...paths], {
+      cwd: ctx.cwd,
+      stdio: "inherit"
+    });
     if (result.error) {
-      process.stderr.write(`sentinel dev(vite): could not run vite (${result.error.message})
-`);
+      this.say(`could not run vite (${result.error.message})`);
       return { ok: false, code: 1 };
     }
-    const code = result.status ?? 0;
+    const code = result.status ?? whenSignalled;
     return { ok: code === 0, code };
   }
-  async status(ctx) {
-    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
-    return { adopted, preset, conformant, drift, unreadable };
+  /** One prefix for every message this role emits, so they cannot drift apart. */
+  say(message) {
+    process.stderr.write(`sentinel ${this.label}(vite): ${message}
+`);
   }
 };
 
-// src/roles/build/adapters/vite/vite.adapter.ts
-import { spawnSync as spawnSync3 } from "child_process";
-
-// src/roles/build/owned-paths.ts
-var PRESET_OWNED_KEYS = [
-  "base",
-  "root",
-  "define",
-  "server",
-  "build",
-  "resolve",
-  "plugins"
-];
-function describeDepartures(config, defaults) {
-  const departures = [];
-  const build = asRecord(config.build);
-  const target = build?.target;
-  if (typeof target === "string" && target !== defaults.target) {
-    departures.push({
-      rule: "build.target",
-      reason: `${target}, where the convention is ${defaults.target}`
-    });
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
+var ViteDevAdapter = class extends ViteRoleAdapter {
+  target = "dev";
+  get label() {
+    return "dev";
   }
-  const server = asRecord(config.server);
-  const hosts = server?.allowedHosts;
-  if (Array.isArray(hosts) && !sameStrings(hosts, defaults.allowedHosts)) {
-    departures.push({
-      rule: "server.allowedHosts",
-      reason: `${JSON.stringify(hosts)}, where the convention is ${JSON.stringify(defaults.allowedHosts)}`
-    });
+  /**
+   * `--init --dev` does the same thing as `--init --build`, and now says so.
+   *
+   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
+   * because adopting one without the other leaves the module half-migrated. What was missing
+   * was only the telling: the run printed a message about the build and nothing about `serve`,
+   * so a developer could believe the dev server had been adopted on its own. Refusing was the
+   * wrong correction, it added friction to a command that already produced the right result.
+   */
+  plan(context) {
+    const planned = super.plan(context);
+    if (planned.operations.length === 0) return planned;
+    return {
+      ...planned,
+      notes: [
+        ...planned.notes ?? [],
+        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
+      ]
+    };
   }
-  return departures;
-}
-function appAdditions(config) {
-  const owned = new Set(PRESET_OWNED_KEYS);
-  return Object.keys(config).filter((key) => !owned.has(key)).sort();
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-}
-function sameStrings(a, b) {
-  return a.length === b.length && a.every((value, at) => value === b[at]);
-}
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
+   *
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
+   *
+   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
+   * bare form is the one every version accepts.
+   */
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    return this.spawnVite(ctx, ready.vite, [], 0);
+  }
+};
 
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -743,122 +1160,55 @@ function runPrerequisite(cwd, env = process.env) {
   return { kind: "ran" };
 }
 
-// src/roles/build/resolve-config.ts
-async function resolveBuildConfig(cwd) {
-  try {
-    const { loadConfigFromFile } = await import("vite");
-    const loaded = await loadConfigFromFile(
-      { command: "build", mode: "production" },
-      void 0,
-      cwd,
-      "silent"
-    );
-    if (!loaded) return { kind: "failed", reason: "Vite found no config file in this module" };
-    return { kind: "loaded", config: loaded.config, from: loaded.path };
-  } catch (error) {
-    return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-  }
-}
-
 // src/roles/build/adapters/vite/vite.adapter.ts
-var VITE_VALUE_FLAGS = ["--config", "-c", "--mode", "-m", "--outDir", "--logLevel", "--base"];
-var ViteAdapter = class extends BaseAdapter {
+var ViteAdapter = class extends ViteRoleAdapter {
   target = "build";
-  runner = "vite";
-  /**
-   * React only. The two SvelteKit configs in this repo are 34 and 21 lines and share nothing
-   * with the React three; claiming them would mean a preset that fits neither.
-   */
-  appliesTo(preset) {
-    return preset === "react";
-  }
-  /**
-   * `react`, read from the module's Vite config rather than from its dependencies.
-   *
-   * Without this the role is unreachable in practice: the toolchain is declared at the ROOT,
-   * so every front app detects as `node` and `appliesTo` filters the adapter out — including
-   * during `sentinel --inspect` with no target, which never passes `--preset`.
-   */
-  declaredPreset(cwd) {
-    return declaredBuildPreset(cwd);
-  }
-  plan(context) {
-    return plan(context);
+  get label() {
+    return "build";
   }
   /**
    * Build the module.
    *
-   * A module that has not adopted is reported and passes, the same stance every other role
-   * takes: `--run` with no named target sweeps every wired target across the workspace, so
-   * failing here would exit non-zero on every module that has not migrated, which is most of
-   * them.
+   * Adoption, the binary and the two-copies warning are `prepare`'s, shared with `--dev`. What
+   * is this target's own is the `prebuild` step and the `build` subcommand.
    */
   async run(ctx) {
-    const adoption = readBuildAdoption(ctx.cwd);
-    if (!adoption.adopted) {
-      process.stderr.write(
-        `sentinel build(vite): no sentinel preset in this module's Vite config; run \`sentinel --init --build\` to adopt.
-`
-      );
-      return { ok: true, code: 0 };
-    }
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
     const prerequisite = runPrerequisite(ctx.cwd);
     if (prerequisite.kind === "failed") {
-      process.stderr.write(
-        `sentinel build(vite): the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}
-`
+      this.say(
+        `the ${PREBUILD_SCRIPT_NAME} step failed, so the build was not started: ${prerequisite.reason}`
       );
       return { ok: false, code: prerequisite.code };
     }
-    const vite = resolveVite(ctx.cwd);
-    if (!vite) {
-      process.stderr.write(
-        `sentinel build(vite): could not find the vite binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
-`
-      );
-      return { ok: false, code: 1 };
-    }
-    if (viteOrigin(ctx.cwd) === "module") {
-      process.stderr.write(
-        `sentinel build(vite): building with the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite in one build fail in ways that never mention a version. Remove vite from this module's package.json.
-`
-      );
-    }
-    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
-      valueFlags: VITE_VALUE_FLAGS
-    });
-    const result = spawnSync3(vite, ["build", ...options, ...paths], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
-    });
-    if (result.error) {
-      process.stderr.write(`sentinel build(vite): could not run vite (${result.error.message})
-`);
-      return { ok: false, code: 1 };
-    }
-    const code = result.status ?? 1;
-    return { ok: code === 0, code };
+    return this.spawnVite(ctx, ready.vite, ["build"], 1);
   }
   /**
-   * What this module builds with, without building it.
+   * What this module builds with, WITHOUT loading its config.
    *
-   * `--inspect` reads the committed config for every role, and the moment `--build` was wired
-   * it joined the sweep — so leaving this to throw would have broken `sentinel --inspect` on
-   * every React module, for a role that had only just arrived. Cheap and honest is the bar.
+   * Everything reported here is read from the manifest and from the config's text: whether the
+   * module imports its toolchain from sentinel, which Vite install would answer, what it still
+   * declares of its own, and whether it has a `prebuild` step.
    *
-   * `vite` is the interesting field and the one nothing else reports: an adopted config takes
-   * its plugins from sentinel, so a module answering `module` here is one build away from the
-   * two-copies failure, and this is where that is visible before it happens.
+   * It used to also load the config through Vite and report where it departed from a preset
+   * and what it added on top. Both were dropped with the preset itself. Adoption changes a
+   * config's IMPORTS and nothing else, so there is no preset the app signed up to and no
+   * distance from it to measure; and computing it meant EXECUTING an app's config, which is
+   * expensive and can fail on its own terms (career throws without `VITE_BRAND_ID`). Reading
+   * a file to report on it must not be able to break.
    *
-   * The resolved config comes from Vite's own loader rather than from parsing the file. See
-   * `resolve-config` for why that is the only honest answer here, and what it costs.
+   * They come back with the shared base, when there is again something an app has chosen to
+   * adopt and can therefore depart from.
    */
   async inspect(ctx) {
     const adoption = readBuildAdoption(ctx.cwd);
-    const base = {
+    return {
       runner: "vite",
       configFile: adoption.configFile,
       ...adoption.unreadable ? { unreadable: adoption.unreadable } : {},
+      // The field nothing else reports: an adopted config takes its plugins from sentinel, so
+      // a module answering `module` here is one build away from the two-copies failure.
       vite: viteOrigin(ctx.cwd),
       // Rendered as a labelled block by the shared renderer, the same shape the lint role's
       // parked rules and the format role's overrides already use.
@@ -868,34 +1218,6 @@ var ViteAdapter = class extends BaseAdapter {
       })),
       prerequisite: moduleScripts(ctx.cwd)[PREBUILD_SCRIPT_NAME] ?? null
     };
-    if (adoption.configFile === null) return base;
-    const resolved = await resolveBuildConfig(ctx.cwd);
-    if (resolved.kind === "failed") {
-      return { ...base, configError: resolved.reason };
-    }
-    const config = resolved.config;
-    return {
-      ...base,
-      // What the app departs from, and what it adds, are different facts. A DEPARTURE is a
-      // disagreement with an opinion the preset holds; an ADDITION is the app needing
-      // something the preset never claimed, which is the preset working rather than being
-      // worked around.
-      departures: describeDepartures(config, REACT_APP_DEFAULTS),
-      additions: appAdditions(config),
-      resolved: {
-        base: config.base ?? null,
-        target: config.build?.target ?? null,
-        sourcemap: config.build?.sourcemap ?? null,
-        port: config.server?.port ?? null,
-        // The one number nothing else reports and that no formula predicts: career goes DOWN
-        // to 9998 where the others go up, which is why it is data rather than `port + 1`.
-        hmrPort: config.server?.hmr?.port ?? null,
-        // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
-        // would bury everything above it. The count is what tells you whether it moved.
-        aliases: Array.isArray(config.resolve?.alias) ? config.resolve.alias.length : 0,
-        plugins: Array.isArray(config.plugins) ? config.plugins.flat(9).length : 0
-      }
-    };
   }
   /**
    * Adoption as data, WITHOUT building.
@@ -920,10 +1242,6 @@ var ViteAdapter = class extends BaseAdapter {
       }
     };
   }
-  async status(ctx) {
-    const { adopted, preset, conformant, drift, unreadable } = readBuildAdoption(ctx.cwd);
-    return { adopted, preset, conformant, drift, unreadable };
-  }
 };
 
 // src/roles/build/register.ts
@@ -935,13 +1253,13 @@ function registerBuild() {
 }
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join8 } from "path";
+import { extname, join as join9, relative as relative3 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -992,7 +1310,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join8(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join9(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -1000,14 +1318,44 @@ function hasSourceFiles(cwd, extensions) {
   }
   return false;
 }
+function listSourceFiles(cwd, extensions) {
+  const wanted = new Set(extensions);
+  const queue = [cwd];
+  const found = [];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = join9(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
+        continue;
+      }
+      if (wanted.has(extname(entry.name))) found.push(relative3(cwd, full));
+    }
+  }
+  return found;
+}
+
+// src/core/named-scope.ts
+var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
+function scopeFlags(paths, options = []) {
+  if (paths.length === 0 || options.includes(TOLERATE_EMPTY_FLAG)) return [];
+  return [TOLERATE_EMPTY_FLAG];
+}
 
 // src/core/settings.ts
 var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
-import { dirname as dirname3, join as join9, relative } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync } from "fs";
+import { dirname as dirname3, join as join10, relative as relative4 } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -1016,7 +1364,7 @@ var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
 function findWorkspaceRoot(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync8(join9(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    if (existsSync9(join10(dir, WORKSPACE_ROOT_MARKER))) return dir;
     const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -1029,9 +1377,9 @@ function declaredNativeTs(pkg) {
   return version || void 0;
 }
 function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join9(root, "package.json");
-  if (!existsSync8(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+  const pkgPath = join10(root, "package.json");
+  if (!existsSync9(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
   const want = declaredNativeTs(pkg);
   if (!want) return void 0;
   const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
@@ -1044,10 +1392,10 @@ function ensureI18nextSingleton(root, dryRun) {
   return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
 }
 function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (!existsSync8(yamlPath)) return void 0;
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (!existsSync9(yamlPath)) return void 0;
   const own = readOwnPackage().name;
-  const lines = readFileSync6(yamlPath, "utf8").split("\n");
+  const lines = readFileSync7(yamlPath, "utf8").split("\n");
   const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
   if (keyIdx === -1) return void 0;
   let lastItemIdx = keyIdx;
@@ -1080,13 +1428,13 @@ var ROOT_PRETTIER_CONFIGS = [
   "prettier.config.mjs"
 ];
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative(root, moduleDir).replaceAll("\\", "/");
+  const rel = relative4(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join9(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
+  const ignorePath = join10(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync9(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync9(join10(root, name)));
   if (!hasPrettier) return void 0;
   const pattern = `/${rel}/`;
-  const existing = existsSync8(ignorePath) ? readFileSync6(ignorePath, "utf8") : "";
+  const existing = existsSync9(ignorePath) ? readFileSync7(ignorePath, "utf8") : "";
   const lines = existing.split("\n");
   if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
     return void 0;
@@ -1122,10 +1470,10 @@ function ensureWorkspacePrep(opts) {
 function inspectWorkspacePrep(root) {
   const entries = [];
   let pkg = {};
-  const pkgPath = join9(root, "package.json");
-  if (existsSync8(pkgPath)) {
+  const pkgPath = join10(root, "package.json");
+  if (existsSync9(pkgPath)) {
     try {
-      pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
     } catch {
       pkg = {};
     }
@@ -1139,9 +1487,9 @@ function inspectWorkspacePrep(root) {
     });
   }
   const own = readOwnPackage().name;
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (existsSync8(yamlPath)) {
-    const yaml = readFileSync6(yamlPath, "utf8");
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (existsSync9(yamlPath)) {
+    const yaml = readFileSync7(yamlPath, "utf8");
     const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
     if (listed) {
       const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
@@ -1228,8 +1576,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1244,11 +1592,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join10(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync9(path)) return [];
+  const path = join11(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync10(path)) return [];
   let contents;
   try {
-    contents = readFileSync7(path, "utf8");
+    contents = readFileSync8(path, "utf8");
   } catch {
     return [];
   }
@@ -1335,13 +1683,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -1370,8 +1718,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join11(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync8(schemaPath, "utf8"));
+    const schemaPath = join12(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync9(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -1402,14 +1750,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync10(join12(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync11(join13(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync9(join12(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync10(join13(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1439,8 +1787,8 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
 var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -1456,11 +1804,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join13(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync11(path)) return NOT_ADOPTED2(null);
+  const path = join14(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync12(path)) return NOT_ADOPTED2(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync11(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -1527,6 +1875,22 @@ var OxfmtAdapter = class extends BaseAdapter {
   appliesTo(_preset) {
     return true;
   }
+  /**
+   * The preset this module COMMITTED to, read from the `$sentinel` block it writes.
+   *
+   * Every other role implements this and format did not, so it was the only one answering from
+   * dependency detection alone. On an adopted Nest module whose own `.oxfmtrc.json` records
+   * `"preset": "nest"`, `--inspect` reported `flavour=node` — the module knew, and the role did
+   * not pass it on. Same command, four rows, two different answers about what the module is.
+   *
+   * It reads the RECORD rather than re-deriving: the block is what `--init` wrote, so it is the
+   * module's declaration, and a re-derivation from hoisted dependencies is exactly the wrong
+   * answer this exists to avoid.
+   */
+  declaredPreset(cwd) {
+    const declared = readFormatAdoption(cwd).preset;
+    return declared !== null && PRESET_NAMES.includes(declared) ? declared : void 0;
+  }
   plan(context) {
     if (!hasSourceFiles(context.cwd, FORMATTABLE_EXTENSIONS)) {
       return {
@@ -1569,7 +1933,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync12(join14(context.cwd, name))
+      (name) => existsSync13(join15(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1628,7 +1992,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
-    const pass = spawnSync4(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const pass = spawnSync3(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     process.stderr.write(`  ${palette(process.stderr).dim(FORMATTER_DIFFERENCES)}
 `);
     if (pass.status === 0) return;
@@ -1691,10 +2055,14 @@ var OxfmtAdapter = class extends BaseAdapter {
     const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXFMT_VALUE_FLAGS
     });
-    const result = spawnSync4(oxfmt, [mode, ...options, ...paths.length > 0 ? paths : ["."]], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
-    });
+    const result = spawnSync3(
+      oxfmt,
+      [mode, ...scopeFlags(paths, options), ...options, ...paths.length > 0 ? paths : ["."]],
+      {
+        cwd: ctx.cwd,
+        stdio: "inherit"
+      }
+    );
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1769,7 +2137,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1, metrics: { ...base, unformatted: null } };
     }
-    const result = spawnSync4(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync3(oxfmt, ["--list-different", "."], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel format(oxfmt): could not run oxfmt (${result.error.message})
@@ -1805,7 +2173,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync11(join14(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -1884,15 +2252,122 @@ function registerFormat() {
   register(new OxfmtAdapter());
   setDefaultRunner("format", "oxfmt");
 }
-
-// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
-import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync18, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join22 } from "path";
-
-// src/core/config/deferred-rules.ts
-function deferredRuleNames(rules) {
-  return rules.map((entry) => entry.rule);
+
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync20, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join25 } from "path";
+
+// src/core/config/deferred-rules.ts
+function deferredRuleNames(rules) {
+  return rules.map((entry) => entry.rule);
+}
+
+// src/core/fix-report.ts
+import { statSync } from "fs";
+import { join as join16 } from "path";
+var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
+function readFailure(output) {
+  const lines = output.split("\n").map((line2) => line2.trim());
+  if (!lines.some((line2) => CONFIG_REFUSED.test(line2))) return void 0;
+  const detail = lines.find((line2) => /invalid config file/i.test(line2));
+  const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
+  return line.split(/:\s*Failed to parse config/i)[0] ?? line;
+}
+function fingerprint(path) {
+  try {
+    const stat = statSync(path);
+    return `${stat.size}:${stat.mtimeMs}`;
+  } catch {
+    return void 0;
+  }
+}
+function snapshotFiles(cwd, extensions) {
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const mark = fingerprint(join16(cwd, file));
+    if (mark !== void 0) snapshot.set(file, mark);
+  }
+  return snapshot;
+}
+function changedSince(cwd, before, extensions) {
+  const changed = [];
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const now = fingerprint(join16(cwd, file));
+    if (now === void 0) continue;
+    if (before.get(file) !== now) changed.push(file);
+  }
+  return changed.sort();
+}
+var NAMED_IN_REPORT = 5;
+function describeFixOutcome(outcome, toolLabel) {
+  if (outcome.failure !== void 0) {
+    return `the ${toolLabel} autofix could not run, so nothing was fixed and this module has not been checked: ${outcome.failure}`;
+  }
+  if (outcome.changed.length === 0) return `the ${toolLabel} autofix changed nothing`;
+  const named = outcome.changed.slice(0, NAMED_IN_REPORT).join(", ");
+  const rest = outcome.changed.length - NAMED_IN_REPORT;
+  const listed = rest > 0 ? `${named} and ${rest} more` : named;
+  return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
+}
+
+// src/roles/lint/module-baseline.ts
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
+var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
+var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
+var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
+function holdsFrom(errorCounts) {
+  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
+}
+function renderBaseline(holds, version) {
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
+  return [
+    "{",
+    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
+    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
+    "  // and returns to `error` on its own.",
+    "  //",
+    "  // These rules are held at `warn` because this module ALREADY violated them when it",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` lists what is held; `sentinel --run --lint --json` counts",
+    "  // what is left, per rule. Fix them and re-run `--init --lint` to get the severity back.",
+    '  "rules": {',
+    entries,
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function extendsWithBaseline(current, hasHolds) {
+  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
+}
+function describeHolds(holds) {
+  if (holds.length === 0) return "";
+  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
+  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
+  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
+  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
+}
+function heldRules(cwd) {
+  const path = join17(cwd, LINT_BASELINE_FILE);
+  if (!existsSync14(path)) return [];
+  try {
+    const parsed = parseJsonc(
+      readFileSync13(path, "utf8"),
+      LINT_BASELINE_FILE
+    );
+    return Object.keys(parsed.rules ?? {});
+  } catch {
+    return [];
+  }
 }
 
 // src/roles/lint/config-policy.ts
@@ -1907,8 +2382,10 @@ function isSentinelPreset(entry) {
 }
 function extendsWithPreset(current, variant) {
   const own = presetPath(variant);
-  const others = current.filter((entry) => entry !== own && !isSentinelPreset(entry));
-  return [own, ...new Set(others)];
+  const others = [...new Set(current.filter((entry) => entry !== own && !isSentinelPreset(entry)))];
+  const baseline = others.filter((entry) => entry === LINT_BASELINE_SPECIFIER);
+  const rest = others.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return [own, ...rest, ...baseline];
 }
 function presetVariant(preset, cwd) {
   const normalised = cwd.replaceAll("\\", "/");
@@ -1932,46 +2409,6 @@ function lintTarget() {
   return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
-// src/roles/lint/presets/base.json
-var base_default2 = {
-  rules: {
-    "no-var": "error",
-    "prefer-const": [
-      "error",
-      {
-        destructuring: "any",
-        ignoreReadBeforeAssign: false
-      }
-    ],
-    "prefer-rest-params": "error",
-    "prefer-spread": "error",
-    "typescript/ban-ts-comment": "error",
-    "typescript/no-array-constructor": "error",
-    "typescript/no-duplicate-enum-values": "error",
-    "typescript/no-empty-object-type": "error",
-    "typescript/no-extra-non-null-assertion": "error",
-    "typescript/no-misused-new": "error",
-    "typescript/no-namespace": "error",
-    "typescript/no-non-null-asserted-optional-chain": "error",
-    "typescript/no-this-alias": "error",
-    "typescript/no-unnecessary-type-constraint": "error",
-    "typescript/no-unsafe-declaration-merging": "error",
-    "typescript/no-unsafe-function-type": "error",
-    "typescript/no-unused-expressions": [
-      "error",
-      {
-        allowShortCircuit: false,
-        allowTaggedTemplates: false,
-        allowTernary: false
-      }
-    ],
-    "typescript/no-wrapper-object-types": "error",
-    "typescript/prefer-as-const": "error",
-    "typescript/prefer-namespace-keyword": "error",
-    "typescript/triple-slash-reference": "error"
-  }
-};
-
 // src/roles/lint/presets/nest.json
 var nest_default = {
   plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
@@ -2311,6 +2748,7 @@ var nest_default = {
     "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
     "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent, and unlike the react tier this preset hosts no house-rule plugin, so architectural guards written as AST selectors are not enforced at all. They belong in sentinel's `hublo` plugin, next to the frontend ones: tell us which guards your service relies on. A per-module copy of a house rule drifts, which is the problem sentinel exists to remove.",
     "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
     "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
@@ -3264,10 +3702,51 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
 
+// src/roles/lint/presets/shared.json
+var shared_default = {
+  rules: {
+    "no-var": "error",
+    "prefer-const": [
+      "error",
+      {
+        destructuring: "any",
+        ignoreReadBeforeAssign: false
+      }
+    ],
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-constructor": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": [
+      "error",
+      {
+        allowShortCircuit: false,
+        allowTaggedTemplates: false,
+        allowTernary: false
+      }
+    ],
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/triple-slash-reference": "error"
+  }
+};
+
 // src/roles/lint/presets/svelte.json
 var svelte_default = {
   plugins: ["typescript", "oxc"],
@@ -3606,7 +4085,7 @@ var tools_default = {
 };
 
 // src/roles/lint/preset-data.ts
-var BASE_RULES = base_default2.rules;
+var SHARED_RULES = shared_default.rules;
 var PRESET_FILES = {
   nest: nest_default,
   node: node_default,
@@ -3628,15 +4107,18 @@ function hasLintPreset(preset) {
 function presetFile(preset) {
   return VARIANT_FILES[preset] ?? PRESET_FILES[preset] ?? node_default;
 }
-function baseRules() {
-  return BASE_RULES;
+function sharedRules() {
+  return SHARED_RULES;
 }
 function presetRules(preset) {
   return presetFile(preset).rules;
 }
+function uncoveredFor(preset) {
+  return Object.entries(presetFile(preset).uncovered ?? {}).map(([rule, reason]) => ({ rule, reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
 
 // src/roles/lint/rule-data.ts
-var baseRules2 = baseRules();
+var sharedRules2 = sharedRules();
 function isDecision(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -3663,7 +4145,7 @@ function validate(preset, rules) {
   }
 }
 function layered(preset) {
-  const base = baseRules();
+  const base = sharedRules();
   const layer = presetRules(preset);
   validate("base", base);
   validate(preset, layer);
@@ -3702,60 +4184,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { isAbsolute as isAbsolute2, join as join15, resolve as resolve3 } from "path";
-
-// src/roles/lint/module-baseline.ts
-var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
-var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
-var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
-function holdsFrom(errorCounts) {
-  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
-}
-function renderBaseline(holds, version) {
-  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
-  return [
-    "{",
-    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
-    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
-    "  // and returns to `error` on its own.",
-    "  //",
-    "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report, so the build cannot fail on them.",
-    "  //",
-    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
-    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
-    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
-    "  // file rather than live with it.",
-    "  //",
-    "  // `sentinel --inspect --lint` counts what is left. Fix them and re-run `--init --lint`",
-    "  // to get the preset severity back.",
-    '  "rules": {',
-    entries,
-    "  }",
-    "}",
-    ""
-  ].join("\n");
-}
-function extendsWithBaseline(current, hasHolds) {
-  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
-  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
-}
-function describeHolds(holds) {
-  if (holds.length === 0) return "";
-  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
-  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
-  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
-  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
-}
-
-// src/roles/lint/extra-layers.ts
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { isAbsolute as isAbsolute2, join as join18, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync13(path)) return void 0;
+  if (!existsSync15(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync12(path, "utf8"),
+      readFileSync14(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3775,7 +4211,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join15(cwd, configFile), "utf8"),
+      readFileSync14(join18(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -3834,8 +4270,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -3850,12 +4286,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync13(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync15(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -3869,8 +4305,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join16(moduleDir, candidate);
-    if (!existsSync14(absolutePath)) continue;
+    const absolutePath = join19(moduleDir, candidate);
+    if (!existsSync16(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -3903,12 +4339,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync15(join17(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync17(join20(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync14(join17(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync16(join20(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -3942,9 +4378,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join18 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join21 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -3969,32 +4405,31 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join18(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join18(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join21(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join21(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join18(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join21(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync16(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync18(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
+import { join as join24 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
-var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
-var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { join as join22 } from "path";
+import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
   return pattern.replace(/^\.\//, "");
@@ -4005,24 +4440,71 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join19(cwd, name)).find((path) => existsSync17(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join22(cwd, name)).find((path) => existsSync19(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync15(config, "utf8");
+    source = readFileSync17(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
   const patterns = /* @__PURE__ */ new Set();
-  for (const block of IGNORE_BLOCKS) {
-    for (const [, body] of source.matchAll(block)) {
-      for (const [, literal] of (body ?? "").matchAll(STRING_LITERAL)) {
-        if (literal) patterns.add(toOxlintPattern(literal));
+  const unresolved = new Set([...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]));
+  const { program, errors } = parseSync2(config, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return { patterns: [], unresolved: [`${config} could not be parsed`] };
+  }
+  walk(program, (node) => {
+    if (node.type === "CallExpression" && calleeName(node) === "globalIgnores") {
+      for (const literal of stringLiterals(firstArrayArgument(node))) {
+        patterns.add(toOxlintPattern(literal));
       }
+      return;
     }
+    if (node.type !== "ObjectExpression") return;
+    const keys = objectKeys(node);
+    if (!keys.includes("ignores")) return;
+    const values = arrayValues(node, "ignores");
+    if (keys.length > 1) {
+      unresolved.add(
+        `ignores scoped to one config block (with ${keys.filter((k) => k !== "ignores").join(", ")}): ${values.join(", ")} \u2014 exempt from those RULES, not excluded from linting`
+      );
+      return;
+    }
+    for (const literal of values) patterns.add(toOxlintPattern(literal));
+  });
+  return { patterns: [...patterns], unresolved: [...unresolved] };
+}
+function walk(node, visit) {
+  if (!node || typeof node !== "object") return;
+  const current = node;
+  if (typeof current.type === "string") visit(current);
+  for (const key of Object.keys(current)) {
+    const value = current[key];
+    if (Array.isArray(value)) for (const entry of value) walk(entry, visit);
+    else if (value && typeof value === "object") walk(value, visit);
   }
-  const unresolved = [...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]);
-  return { patterns: [...patterns], unresolved: [...new Set(unresolved)] };
+}
+function calleeName(node) {
+  const callee = node.callee;
+  return callee?.type === "Identifier" ? callee.name : void 0;
+}
+function firstArrayArgument(node) {
+  const args = node.arguments ?? [];
+  return args.find((argument) => argument?.type === "ArrayExpression");
+}
+function stringLiterals(array) {
+  const elements = array?.elements ?? [];
+  return elements.filter((element) => element?.type === "Literal" && typeof element.value === "string").map((element) => element.value);
+}
+function objectKeys(node) {
+  const properties = node.properties ?? [];
+  return properties.filter((property) => property?.type === "Property" && !property.computed).map((property) => property.key?.name ?? String(property.key?.value ?? "")).filter(Boolean);
+}
+function arrayValues(node, name) {
+  const properties = node.properties ?? [];
+  const found = properties.find((property) => property.key?.name === name);
+  return stringLiterals(found?.value);
 }
 
 // src/roles/lint/lint-script.ts
@@ -4063,8 +4545,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync16, statSync } from "fs";
-import { join as join20, relative as relative2 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync18, statSync as statSync2 } from "fs";
+import { join as join23, relative as relative5 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4111,10 +4593,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join20(dir, entry);
+    const full = join23(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync(full).isDirectory();
+      isDirectory = statSync2(full).isDirectory();
     } catch {
       continue;
     }
@@ -4131,7 +4613,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync16(file, "utf8");
+      content = readFileSync18(file, "utf8");
     } catch {
       continue;
     }
@@ -4155,7 +4637,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative2(cwd, file),
+        file: relative5(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4259,7 +4741,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync18(join21(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync20(join24(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4357,7 +4839,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4368,7 +4850,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync17(join21(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4380,7 +4862,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync17(join21(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync19(join24(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4445,17 +4927,31 @@ var OxlintAdapter = class extends BaseAdapter {
     return presetOfVariant(presetNameFromPath(readLintAdoption(cwd).preset));
   }
   /**
-   * The autofix pass. Output is captured rather than streamed: the fix run is noise, and the
-   * verification run that follows is the one a developer reads.
+   * The autofix pass, and what it did.
+   *
+   * Output is captured rather than streamed: the fix run is noise, and the verification run
+   * that follows is the one a developer reads. But captured is not the same as discarded, and
+   * it used to be discarded, which is why a pass that never ran looked exactly like one that
+   * had nothing to do.
+   *
+   * The exit status cannot be the signal, and neither can the stream. Measured on oxlint: a
+   * healthy run on a module with remaining violations and a run whose `extends` path resolves
+   * nowhere BOTH exit 1 and both write to stdout. One module was checked and one was not, and
+   * nothing in the process result separates them, so the only signal is what the tool said.
    */
   fixPass(ctx, oxlint, env) {
-    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
+    const before = snapshotFiles(ctx.cwd, LINTABLE_EXTENSIONS);
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, "--fix", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env,
       maxBuffer: CAPTURE_MAX_BUFFER
     });
-    return result.status ?? 1;
+    if (result.error) return { changed: [], failure: result.error.message };
+    const failure = readFailure(`${result.stdout ?? ""}
+${result.stderr ?? ""}`);
+    if (failure !== void 0) return { changed: [], failure };
+    return { changed: changedSince(ctx.cwd, before, LINTABLE_EXTENSIONS), failure: void 0 };
   }
   /** The module's current `lint` script, so adoption replaces only the eslint part of it. */
   /**
@@ -4478,7 +4974,8 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return;
     const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
-    this.fixPass(ctx, oxlint, env);
+    process.stderr.write(`  ${describeFixOutcome(this.fixPass(ctx, oxlint, env), "lint")}
+`);
     this.writeModuleBaseline(ctx, oxlint, env);
   }
   /**
@@ -4499,20 +4996,20 @@ var OxlintAdapter = class extends BaseAdapter {
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join22(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join22(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync19(configPath)) return;
+    const configPath = join25(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join25(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync21(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync18(configPath, "utf8"),
+        readFileSync20(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join22(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join25(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -4520,7 +5017,7 @@ var OxlintAdapter = class extends BaseAdapter {
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
       );
-      measured = spawnSync5(
+      measured = spawnSync4(
         oxlint,
         [
           "-c",
@@ -4560,7 +5057,7 @@ var OxlintAdapter = class extends BaseAdapter {
     }
   }
   async run(ctx) {
-    if (!existsSync19(join22(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync21(join25(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4605,9 +5102,10 @@ var OxlintAdapter = class extends BaseAdapter {
       valueFlags: OXLINT_VALUE_FLAGS
     });
     const targets = paths.length > 0 ? paths : ["."];
+    const emptyScope = scopeFlags(paths, passedOptions);
     const lint = (extra) => {
-      const passed = [...extra, ...passedOptions];
-      const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const passed = [...extra, ...emptyScope, ...passedOptions];
+      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -4645,6 +5143,33 @@ var OxlintAdapter = class extends BaseAdapter {
         rule: entry.rule,
         reason: entry.reason
       })),
+      // A FOURTH state, and the only one that was declared and never reported: rules oxlint
+      // cannot run at all, so they can be neither enforced nor disabled. Each preset has
+      // carried this list since the Svelte work, and nothing read it outside a test.
+      //
+      // The gap that made it matter: `no-restricted-syntax` has no oxlint equivalent, so two
+      // architectural guards a Nest service relied on vanished at adoption with nothing said.
+      // The adopter found it himself and rebuilt them as a local plugin. The next one might
+      // not, which is the whole argument for saying it out loud.
+      uncovered: uncoveredFor(presetVariant(ctx.preset, ctx.cwd)).map((entry) => ({
+        rule: entry.rule,
+        reason: entry.reason
+      })),
+      // What this module HOLDS: the rules its own baseline lowers to `warn`.
+      //
+      // Distinct from `downgraded` just above, which is the PRESET's doing and identical for
+      // every module on it. These are this module's own debt, and leaving them out was a real
+      // gap: `--inspect` could tell you the preset holds 6 rules while saying nothing about
+      // the 3 your module holds on top, so nobody could see their own debt without opening a
+      // file that says "do not edit by hand".
+      //
+      // Listed, not counted. The list is free — it is the committed file — while a count means
+      // running oxlint, which this verb deliberately does not do (that is what keeps a
+      // 441-module sweep at ~8s per role). `--run --lint --json` carries the per-rule counts.
+      held: heldRules(ctx.cwd).map((rule) => ({
+        rule,
+        reason: `held at \`warn\` by this module's ${LINT_BASELINE_FILE}, because it already violated it when it adopted. \`--run --lint --json\` counts what is left.`
+      })),
       // What this module enforces BEYOND the preset. Not drift, and not covered by anything
       // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
       // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
@@ -4680,7 +5205,7 @@ var OxlintAdapter = class extends BaseAdapter {
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -4690,7 +5215,7 @@ var OxlintAdapter = class extends BaseAdapter {
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync18(join22(cwd, entry), "utf8"),
+          readFileSync20(join25(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4707,7 +5232,7 @@ var OxlintAdapter = class extends BaseAdapter {
     const oxlint = resolveOxlint(ctx.cwd);
     if (!oxlint) return { ok: false, code: 1, metrics: { error: "oxlint not found" } };
     const typeAware = canRunTypeAware(ctx.cwd) ? ["--type-aware"] : [];
-    const result = spawnSync5(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
+    const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...typeAware, "-f", "json", "."], {
       cwd: ctx.cwd,
       encoding: "utf8",
       env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) },
@@ -4760,14 +5285,14 @@ var OxlintAdapter = class extends BaseAdapter {
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync18(join22(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync19(join22(cwd, target)));
+    return targets.find((target) => !existsSync21(join25(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4798,36 +5323,10 @@ function registerLint() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join24 } from "path";
-
-// src/roles/typescript/presets/base.json
-var base_default3 = {
-  $schema: "https://json.schemastore.org/tsconfig",
-  compilerOptions: {
-    strict: true,
-    noFallthroughCasesInSwitch: true,
-    forceConsistentCasingInFileNames: true,
-    esModuleInterop: true,
-    skipLibCheck: true
-  },
-  deferred: {
-    noImplicitAny: {
-      phase: 2,
-      reason: "the implicit-any migration (TS70xx)"
-    },
-    noUnusedLocals: {
-      phase: 2,
-      reason: "unused-local cleanup (TS6133)"
-    },
-    noUnusedParameters: {
-      phase: 2,
-      reason: "unused-parameter cleanup (TS6133)"
-    }
-  }
-};
+import { join as join27 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -4878,15 +5377,41 @@ var react_default2 = {
   }
 };
 
+// src/roles/typescript/presets/shared.json
+var shared_default2 = {
+  $schema: "https://json.schemastore.org/tsconfig",
+  compilerOptions: {
+    strict: true,
+    noFallthroughCasesInSwitch: true,
+    forceConsistentCasingInFileNames: true,
+    esModuleInterop: true,
+    skipLibCheck: true
+  },
+  deferred: {
+    noImplicitAny: {
+      phase: 2,
+      reason: "the implicit-any migration (TS70xx)"
+    },
+    noUnusedLocals: {
+      phase: 2,
+      reason: "unused-local cleanup (TS6133)"
+    },
+    noUnusedParameters: {
+      phase: 2,
+      reason: "unused-parameter cleanup (TS6133)"
+    }
+  }
+};
+
 // src/roles/typescript/preset-data.ts
-var BASE = base_default3;
+var SHARED = shared_default2;
 var LAYERS = {
   nest: nest_default2,
   node: node_default2,
   react: react_default2
 };
 var SHIPPED_PRESETS = Object.keys(LAYERS).sort();
-var DEFERRED_RULES = Object.entries(BASE.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+var DEFERRED_RULES = Object.entries(SHARED.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
 function validate2() {
   for (const { rule, phase, reason } of DEFERRED_RULES) {
     if (!Number.isInteger(phase) || phase < 2) {
@@ -4899,9 +5424,9 @@ function validate2() {
         `deferred rule "${rule}" has no reason; --inspect reports it and would say nothing`
       );
     }
-    if (rule in BASE.compilerOptions) {
+    if (rule in SHARED.compilerOptions) {
       throw new Error(
-        `"${rule}" is deferred and also set by the base preset; it would be announced as not enforced while being enforced`
+        `"${rule}" is deferred and also set by the shared layer; it would be announced as not enforced while being enforced`
       );
     }
     for (const [preset, layer] of Object.entries(LAYERS)) {
@@ -4921,8 +5446,8 @@ function tsPresetFor(preset) {
   const layer = LAYERS[preset];
   if (!layer) throw new Error(`no TypeScript preset ships for preset "${preset}"`);
   return {
-    ...BASE.$schema === void 0 ? {} : { $schema: BASE.$schema },
-    compilerOptions: { ...BASE.compilerOptions, ...layer.compilerOptions }
+    ...SHARED.$schema === void 0 ? {} : { $schema: SHARED.$schema },
+    compilerOptions: { ...SHARED.compilerOptions, ...layer.compilerOptions }
   };
 }
 
@@ -4982,8 +5507,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync19 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { join as join26 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5076,7 +5601,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync19(join23(context.cwd, target.path), "utf8"),
+    readFileSync21(join26(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5214,7 +5739,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync20(join24(cwd, target.path), "utf8"),
+        readFileSync22(join27(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5227,7 +5752,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join24(cwd, "noop.js")).resolve(preset);
+      createRequire4(join27(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5268,7 +5793,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5303,7 +5828,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5323,7 +5848,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync20(join24(cwd, config), "utf8"),
+        readFileSync22(join27(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5339,7 +5864,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync20(join24(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync22(join27(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5392,7 +5917,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5435,7 +5960,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5487,7 +6012,7 @@ function detectFramework(packageJson) {
 }
 
 // src/core/dispatch.ts
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 
 // src/shared/text.ts
 function ensureLines(current, lines) {
@@ -5543,9 +6068,16 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync21, readFileSync as readFileSync21, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync23, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
+
+// src/shared/deep-merge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve4(cwd);
   const absolutePath = resolve4(root, relativePath);
@@ -5555,7 +6087,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync21(absolutePath) ? readFileSync21(absolutePath, "utf8") : void 0;
+  return existsSync23(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5673,8 +6205,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync22, readdirSync as readdirSync3, readFileSync as readFileSync22 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "fs";
+import { join as join28 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5688,11 +6220,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join25(cwd, "package.json");
-  if (!existsSync22(path)) return [];
+  const path = join28(cwd, "package.json");
+  if (!existsSync24(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync22(path, "utf8"),
+      readFileSync24(path, "utf8"),
       path
     );
     return [
@@ -5715,7 +6247,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync22(join25(cwd, name), "utf8"),
+        readFileSync24(join28(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -5812,13 +6344,26 @@ async function dispatch(opts) {
   const resolutionPreset = opts.preset ?? declaredPresetFor(opts.target, opts.cwd) ?? detected;
   const adapter = resolve(opts.target, resolutionPreset, opts.runner);
   const preset = opts.preset ?? adapter.declaredPreset?.(opts.cwd) ?? detected;
-  const contradiction = presetContradiction(preset, opts.cwd);
-  if (contradiction !== void 0) {
-    process.stderr.write(`sentinel (${opts.target}): ${contradiction}
+  if (opts.preset !== void 0) {
+    const contradiction = presetContradiction(opts.preset, opts.cwd);
+    if (contradiction !== void 0) {
+      process.stderr.write(`sentinel (${opts.target}): ${contradiction}
 `);
-    return 1;
+      return 1;
+    }
+  }
+  let effective = preset;
+  if (opts.preset === void 0 && adapter.declaredPreset?.(opts.cwd) === void 0) {
+    const [signal] = presetSignals(opts.cwd);
+    if (signal !== void 0 && signal.preset !== preset) {
+      effective = signal.preset;
+      process.stderr.write(
+        `  detected "${preset}" from dependencies, but ${signal.evidence}, so adopting as "${signal.preset}". Pass --preset to override.
+`
+      );
+    }
   }
-  const context = { cwd: opts.cwd, preset };
+  const context = { cwd: opts.cwd, preset: effective };
   const plan3 = await adapter.plan(context);
   if (plan3.blocked) {
     process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
@@ -5843,7 +6388,7 @@ async function dispatch(opts) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
 `);
     await adapter.afterInit({
-      module: basename2(opts.cwd),
+      module: basename3(opts.cwd),
       cwd: opts.cwd,
       preset,
       ci: false,
@@ -5865,19 +6410,21 @@ export {
   resolveBin,
   readOwnVersion,
   readProjectPackageJson,
-  readNxProjectName,
+  moduleName,
+  buildConfigFile,
+  VERBS,
+  TARGETS,
+  LONG_RUNNING_TARGETS,
+  SWEEPABLE_TARGETS,
+  PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   ensureWorkspacePrep,
   inspectWorkspacePrep,
   palette,
-  VERBS,
-  TARGETS,
-  SWEEPABLE_TARGETS,
-  PRESET_NAMES,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-TWL6T237.js.map
+//# sourceMappingURL=chunk-7WB7MQHD.js.map