@hublo/sentinel 1.2.0-alpha.1 → 1.2.0-alpha.11

package/dist/{chunk-FLJ2QNFF.js → chunk-6VOQDDZD.js}

@@ -1,9 +1,3 @@
-import {
-  REACT_APP_DEFAULTS,
-  REQUIREMENTS,
-  isPlainObject
-} from "./chunk-XVDOQ3G3.js";
-
 // src/core/registry.ts
 var adapters = [];
 var PresetUnsupportedError = class extends Error {
@@ -88,7 +82,7 @@ var BaseAdapter = class {
 
 // src/shared/package-json.ts
 import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
+import { basename, dirname, join } from "path";
 import { fileURLToPath } from "url";
 function readOwnPackage() {
   let dir = dirname(fileURLToPath(import.meta.url));
@@ -133,6 +127,10 @@ function readNxProjectName(dir) {
     return void 0;
   }
 }
+function moduleName(dir) {
+  const declared = readProjectPackageJson(dir).name;
+  return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
+}
 
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
@@ -207,9 +205,9 @@ function binFromOwnInstall(packageName, binName) {
   try {
     const manifest = require2.resolve(`${packageName}/package.json`);
     const bin = require2(manifest).bin;
-    const relative4 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative4) return void 0;
-    const executable = join2(dirname2(manifest), relative4);
+    const relative6 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative6) return void 0;
+    const executable = join2(dirname2(manifest), relative6);
     return existsSync3(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -222,8 +220,8 @@ function binSearchPath(cwd) {
 }
 
 // src/roles/build/plan.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -243,7 +241,7 @@ function parseJsonc(text, source = "config") {
 
 // src/core/config/manifest.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { basename, join as join3 } from "path";
+import { basename as basename2, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
     const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
@@ -252,7 +250,7 @@ function moduleScripts(cwd) {
     return {};
   }
 }
-function moduleName(cwd) {
+function moduleName2(cwd) {
   try {
     const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
@@ -261,7 +259,7 @@ function moduleName(cwd) {
   }
 }
 function isSelfAdoption(cwd) {
-  return moduleName(cwd) === readOwnPackage().name;
+  return moduleName2(cwd) === readOwnPackage().name;
 }
 function selfCommand(cwd, flags) {
   const own = readOwnPackage();
@@ -280,7 +278,7 @@ function manifestOperation(cwd, scripts) {
   return {
     kind: "merge-json",
     path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename(cwd), private: true, ...value }
+    value: { name: readNxProjectName(cwd) ?? basename2(cwd), private: true, ...value }
   };
 }
 
@@ -384,16 +382,98 @@ function keepsOtherCommands(script, sentinelCommand) {
   return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
 
+// src/roles/build/presets/requirements.json
+var requirements_default = {
+  svelte: {
+    why: "sentinel ships Vite 8, and @sveltejs/vite-plugin-svelte caps at Vite 6 until its major 7",
+    requires: {
+      "@sveltejs/vite-plugin-svelte": "7.0.0",
+      svelte: "5.46.4"
+    }
+  }
+};
+
+// src/roles/build/presets/toolchain.json
+var toolchain_default = {
+  $comment: "The build toolchain sentinel owns. One table, because three places used to hold parts of it: the list to remove from a module's package.json, the list of import specifiers to rewrite, and the map from a default import to the name sentinel re-exports it under. A package added to one and not the others gives a removal with no rewrite, or an import pointing at a package the module no longer declares.",
+  owned: [
+    {
+      package: "vite",
+      specifier: "vite",
+      named: ["defineConfig", "loadEnv", "mergeConfig"],
+      types: [
+        "Plugin",
+        "PluginOption",
+        "SassPreprocessorOptions",
+        "UserConfig",
+        "UserConfigExport"
+      ],
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+    },
+    {
+      package: "@vitejs/plugin-react",
+      specifier: "@vitejs/plugin-react",
+      default: "react",
+      why: "the React transform. Bound to the Vite that runs it, so it has to come from the same install."
+    },
+    {
+      package: "@tailwindcss/vite",
+      specifier: "@tailwindcss/vite",
+      default: "tailwindcss",
+      why: "the Tailwind pipeline, identical in all three front apps."
+    },
+    {
+      package: "vite-plugin-svgr",
+      specifier: "vite-plugin-svgr",
+      default: "svgr",
+      why: "SVG as components, identical in all three front apps."
+    },
+    {
+      package: "nitro",
+      specifier: "nitro/vite",
+      named: ["nitro"],
+      why: "the SSR server. Note the package and the import specifier differ, which is exactly the kind of split that made three separate lists disagree."
+    }
+  ],
+  add: [
+    {
+      package: "@hublo/sentinel",
+      why: "the module now gets its toolchain from here, so it declares it. Pinned by the installer rather than by us: `--init` writes the dependency, `pnpm install` resolves it."
+    }
+  ],
+  $notOwned: {
+    "@rolldown/plugin-babel": "declared by career and host-admin themselves, not at the root. It supports LocatorJS, a development convenience gated on LOCATORJS=true, not shared build infrastructure. Removing it would remove a feature from two teams, which is their call and must not ride along inside an adoption.",
+    "@locator/babel-jsx": "same, and same owners.",
+    "@tanstack/react-start": "a framework the apps code against: 48 source files import it directly.",
+    "@tanstack/router-plugin": "generates the app's own route tree.",
+    "vite-bundle-analyzer": "at the root at 1.3.7 and imported nowhere, the only mention being a commented-out line in host-admin. Not a candidate to re-export, a candidate to delete from the root."
+  }
+};
+
+// src/roles/build/preset-data.ts
+var REQUIREMENTS = requirements_default;
+var OWNED_PACKAGES = toolchain_default.owned;
+
 // src/roles/build/config-policy.ts
+var COMPANION_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs"
+];
 var BUILD_CONFIG_FILES = [
   "vite.config.ts",
   "vite.config.mts",
   "vite.config.js",
   "vite.config.mjs"
 ];
-var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_PRESET_SPECIFIERS = {
+  react: "@hublo/sentinel/build/react",
+  nest: "@hublo/sentinel/build/nest"
+};
+var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
 var BUILD_SCRIPT_NAME = "build";
-var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
 function buildTarget() {
@@ -404,13 +484,9 @@ function buildTarget() {
     }
   };
 }
-var SENTINEL_OWNED_BUILD_PACKAGES = [
-  "vite",
-  "@vitejs/plugin-react",
-  "@tailwindcss/vite",
-  "vite-plugin-svgr",
-  "nitro"
-];
+var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
+  (entry) => entry.package
+);
 
 // src/roles/build/dev-script.ts
 var CHAIN = " -- ";
@@ -418,23 +494,143 @@ var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
 var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
 function appOptions(rest) {
   const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
-  const kept = tokens.filter((token, at2) => !(at2 === 0 && DEV_SUBCOMMANDS.has(token)));
+  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
   return kept.join(" ");
 }
 function composeDevScript(existing, command) {
   if (existing === void 0 || existing.trim() === "") return command;
   const chunks = existing.trim().split(CHAIN);
-  const at2 = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
-  if (at2 === -1) return existing;
-  const rest = (chunks[at2] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at === -1) return existing;
+  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
   const options = appOptions(rest);
-  chunks[at2] = options === "" ? command : `${command} -- ${options}`;
+  chunks[at] = options === "" ? command : `${command} -- ${options}`;
   return chunks.join(CHAIN);
 }
 
-// src/roles/build/read-adoption.ts
+// src/roles/build/nest/adopt.ts
+import { relative as relative2 } from "path";
+
+// src/roles/build/nest/nx-target.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join6, relative } from "path";
+var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
+var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
+var readProjectJson = (cwd) => {
+  const path = join6(cwd, "project.json");
+  if (!existsSync6(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+function webpackBuildTarget(cwd) {
+  const project = readProjectJson(cwd);
+  const target = project?.targets?.build;
+  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
+  const { outputPath, main, webpackConfig } = target.options ?? {};
+  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
+    return void 0;
+  }
+  return {
+    project: project.name,
+    outputPath,
+    main,
+    webpackConfig,
+    configurations: target.configurations
+  };
+}
+function refusalFor(cwd, target) {
+  if (workspaceRootFor(cwd, target) === void 0) {
+    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
+  }
+  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
+    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
+  }
+  const live = liveFileReplacements(cwd, target);
+  if (live.length > 0) {
+    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
+  }
+  return void 0;
+}
+function liveFileReplacements(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) return [];
+  const configurations = target.configurations ?? {};
+  const live = [];
+  for (const configuration of Object.values(configurations)) {
+    for (const replacement of configuration.fileReplacements ?? []) {
+      const exists = existsSync6(join6(workspaceRoot, replacement.replace)) || existsSync6(join6(workspaceRoot, replacement.with));
+      if (exists) live.push(replacement.replace);
+    }
+  }
+  return live;
+}
+function workspaceRootFor(cwd, target) {
+  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
+  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
+  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
+}
+function workspaceRootHops(cwd, target) {
+  const root = workspaceRootFor(cwd, target);
+  if (root === void 0) {
+    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
+  }
+  const rel = relative(root, cwd);
+  return rel === "" ? 0 : rel.split(/[\\/]/).length;
+}
+
+// src/roles/build/nest/adopt.ts
+var NEST_CONFIG_FILE = "vite.config.mts";
+function nestConfigSource(cwd, target) {
+  const hops = workspaceRootHops(cwd, target);
+  const up = Array.from({ length: hops }, () => "..").join("/");
+  return `import path from 'node:path'
+
+import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
+
+export default nestService({
+  project: '${target.project}',
+  root: __dirname,
+  workspaceRoot: path.resolve(__dirname, '${up}'),
+  outDir: '${target.outputPath}',
+})
+`;
+}
+function nestBuildTarget(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) {
+    throw new Error(
+      `sentinel build(nest): cannot place ${cwd} inside a workspace from ${target.main}`
+    );
+  }
+  const moduleRoot = relative2(workspaceRoot, cwd);
+  return {
+    executor: "nx:run-commands",
+    outputs: [`{workspaceRoot}/${target.outputPath}`],
+    options: {
+      cwd: moduleRoot,
+      command: "pnpm exec sentinel --run --build",
+      forwardAllArgs: false
+    }
+  };
+}
+function nestAdoptionOperations(cwd, target) {
+  return [
+    { kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) },
+    { kind: "remove-json-keys", path: "project.json", keys: [["targets", "build"]] },
+    {
+      kind: "merge-json",
+      path: "project.json",
+      value: { targets: { build: nestBuildTarget(cwd, target) } }
+    }
+  ];
+}
+
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join7 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -445,26 +641,33 @@ var NOT_ADOPTED = (configFile, unreadable = null) => ({
   unreadable
 });
 function buildConfigFile(cwd) {
-  return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
+  return BUILD_CONFIG_FILES.find((name) => existsSync7(join7(cwd, name)));
 }
 function importsSpecifier(source, specifier) {
   const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
 }
 function importsPreset(source) {
-  return importsSpecifier(source, BUILD_PRESET_SPECIFIER);
+  return Object.values(BUILD_PRESET_SPECIFIERS).some(
+    (specifier) => importsSpecifier(source, specifier)
+  );
 }
 var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
   const source = readBuildConfigSource(cwd);
-  if (source === void 0) return void 0;
+  if (source === void 0) {
+    if (buildConfigFile(cwd) !== void 0) return void 0;
+    return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
+  }
+  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
+  if (importsPreset(source)) return "react";
   return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
 }
 function readBuildConfigSource(cwd) {
   const configFile = buildConfigFile(cwd);
   if (!configFile) return void 0;
   try {
-    return readFileSync4(join6(cwd, configFile), "utf8");
+    return readFileSync5(join7(cwd, configFile), "utf8");
   } catch {
     return void 0;
   }
@@ -474,7 +677,7 @@ function readBuildAdoption(cwd) {
   if (!configFile) return NOT_ADOPTED(null);
   let source;
   try {
-    source = readFileSync4(join6(cwd, configFile), "utf8");
+    source = readFileSync5(join7(cwd, configFile), "utf8");
   } catch (error) {
     return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
   }
@@ -486,7 +689,9 @@ function readBuildAdoption(cwd) {
   );
   return {
     configFile,
-    preset: "react",
+    // Read from the config rather than assumed: the two presets are adopted the same way and
+    // reporting the wrong one would make `--inspect` lie about what a module builds.
+    preset: declaredBuildPreset(cwd) ?? "react",
     adopted: true,
     conformant: ownDeclarations.length === 0,
     drift: ownDeclarations.map(
@@ -502,9 +707,9 @@ function atLeast(declared, needed) {
   const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
   const left = parse2(declared);
   const right = parse2(needed);
-  for (let at2 = 0; at2 < Math.max(left.length, right.length); at2++) {
-    const a = left[at2] ?? 0;
-    const b = right[at2] ?? 0;
+  for (let at = 0; at < Math.max(left.length, right.length); at++) {
+    const a = left[at] ?? 0;
+    const b = right[at] ?? 0;
     if (a !== b) return a > b;
   }
   return true;
@@ -525,43 +730,103 @@ function describeUnmet(preset, unmet) {
   return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
 }
 
-// src/roles/build/plan.ts
-function scaffold() {
-  return `import { defineConfig, reactApp } from '${BUILD_PRESET_SPECIFIER}'
-import { tanstackStart } from '@tanstack/react-start/plugin/vite'
-import { tanstackRouter } from '@tanstack/router-plugin/vite'
-import path from 'node:path'
-
-/*
- * Composition comes from sentinel: which plugins run under test and which under a real build,
- * the order they run in, and how the env is read. The values below are this app's own.
- *
- * TanStack is passed IN rather than imported by sentinel, because the app codes against it
- * directly. \`alias\` is passed through verbatim and never read, so nothing in it can be lost.
- * Anything sentinel does not set goes in \`overrides\`, which merges over the preset last.
- */
-export default defineConfig(({ mode }) =>
-  reactApp({
-    root: __dirname,
-    mode,
-    base: '/',
-    port: 3000,
-    // Explicit, NOT port + 1: the three apps in this repo disagree, one of them goes down.
-    hmrPort: 3001,
-    router: {
-      routesDirectory: path.resolve(__dirname, 'src/routes'),
-      generatedRouteTree: path.resolve(__dirname, 'src/routeTree.gen.ts'),
-    },
-    tanstack: { start: tanstackStart, router: tanstackRouter },
-    alias: [],
-  }),
-)
-
-// If this app reads environment variables, use \`appEnv(__dirname, mode)\` rather than Vite's
-// \`loadEnv\`: it applies the production -> prd normalisation this repo deploys under, which
-// every app was otherwise retyping.
-`;
+// src/roles/build/rewrite-imports.ts
+import { parseSync } from "oxc-parser";
+var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
+function esmBlocker(fileName, packageType) {
+  if (/\.(mts|mjs)$/.test(fileName)) return void 0;
+  if (packageType === "module") return void 0;
+  return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
+}
+var DEFAULT_EXPORT_NAMES = Object.fromEntries(
+  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
+    entry.specifier,
+    entry.default
+  ])
+);
+function renderImport(bindings) {
+  const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
+  const values = bindings.filter((b) => !b.typeOnly);
+  const types = bindings.filter((b) => b.typeOnly);
+  const lines = [];
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (types.length > 0) {
+    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  }
+  return lines.join("\n");
+}
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return {
+      kind: "blocked",
+      why: `${fileName} does not parse: ${errors[0]?.message ?? "unknown"}`
+    };
+  }
+  const imports = program.body.filter(
+    (node) => node.type === "ImportDeclaration"
+  );
+  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+    return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
+  }
+  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  if (moving.length === 0) {
+    return {
+      kind: "unchanged",
+      why: "this config imports none of the packages sentinel owns, so there is nothing to move"
+    };
+  }
+  const bindings = [];
+  for (const node of moving) {
+    const from = node.source.value;
+    const specifiers = node.specifiers ?? [];
+    if (specifiers.length === 0) {
+      return { kind: "blocked", why: `\`import '${from}'\` has no bindings to move` };
+    }
+    for (const spec of specifiers) {
+      const typeOnly = node.importKind === "type" || spec.importKind === "type";
+      if (spec.type === "ImportDefaultSpecifier") {
+        const exported = DEFAULT_EXPORT_NAMES[from];
+        if (!exported) {
+          return {
+            kind: "blocked",
+            why: `no sentinel export for the default import of \`${from}\``
+          };
+        }
+        bindings.push({ exported, local: spec.local.name, typeOnly });
+        continue;
+      }
+      if (spec.type === "ImportSpecifier") {
+        bindings.push({
+          exported: spec.imported?.name ?? spec.imported?.value ?? spec.local.name,
+          local: spec.local.name,
+          typeOnly
+        });
+        continue;
+      }
+      return {
+        kind: "blocked",
+        why: `\`import * as ${spec.local.name} from '${from}'\` cannot be mapped onto sentinel's named exports`
+      };
+    }
+  }
+  const spans = moving.map((node) => ({ start: node.start, end: node.end })).sort((left, right) => left.start - right.start);
+  const first = spans[0];
+  const rest = spans.slice(1);
+  let out = source;
+  for (const span of rest.slice().reverse()) {
+    const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
+    out = out.slice(0, span.start) + out.slice(span.end + after);
+  }
+  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  return {
+    kind: "rewritten",
+    source: out,
+    moved: [...new Set(moving.map((node) => node.source.value))].sort()
+  };
 }
+
+// src/roles/build/plan.ts
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -590,9 +855,12 @@ function buildScripts(cwd) {
   };
   const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
   if (existingDev !== void 0) {
+    const own2 = moduleName(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
-      selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND
+      // Trailing `--` for the same reason as the build script: whatever the caller appends
+      // reaches Vite, not sentinel's parser. It goes after `--module`, which is sentinel's own.
+      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2} --`
     );
   }
   return scripts;
@@ -606,23 +874,57 @@ function plan(context) {
   if (unmet.length > 0) {
     return { operations: [], skipped: describeUnmet(context.preset, unmet) };
   }
-  if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
+  const declaredPreset2 = declaredBuildPreset(context.cwd);
+  const configFile = buildConfigFile(context.cwd);
+  if (declaredPreset2 === void 0 && configFile !== void 0) {
     return {
       operations: [],
-      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
+      skipped: `this module has a Vite config, but it builds neither a React app (no @vitejs/plugin-react or @tanstack/react-start) nor a Nest service (no ${BUILD_PRESET_SPECIFIERS.nest}). Those are the two families this role serves.`
     };
   }
+  const webpackTarget = webpackBuildTarget(context.cwd);
+  if (declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0) {
+    return planNestService(context, configFile, webpackTarget);
+  }
+  if (configFile === void 0) {
+    return {
+      operations: [],
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (36 services here build through \`@nx/webpack\`), the build role does not apply to it.`
+    };
+  }
+  return planReactApp(context, configFile);
+}
+function planReactApp(context, configFile) {
   const notes = [];
   const operations = [];
-  const configFile = buildConfigFile(context.cwd);
-  if (configFile === void 0) {
-    operations.push({ kind: "write", path: BUILD_CONFIG_FILES[0], contents: scaffold() });
-    notes.push(
-      `wrote ${BUILD_CONFIG_FILES[0]} as a starting point. Fill in this app's own values (base, ports, routes); sentinel owns the composition, not the data.`
-    );
-  } else if (!readsPreset(context.cwd, configFile)) {
+  const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
+  if (notEsm !== void 0) return { operations: [], skipped: notEsm };
+  const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+  if (rewrite.kind === "blocked") {
+    return {
+      operations: [],
+      skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
+    };
+  }
+  if (rewrite.kind === "rewritten") {
+    operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+  }
+  for (const name of COMPANION_CONFIG_FILES) {
+    const source = readConfigSource(context.cwd, name);
+    if (source === "") continue;
+    const companion = rewriteBuildImports(source, name);
+    if (companion.kind === "rewritten") {
+      operations.push({ kind: "write", path: name, contents: companion.source });
+      notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
+    } else if (companion.kind === "blocked") {
+      notes.push(
+        `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
+      );
+    }
+  }
+  if (rewrite.kind === "rewritten") {
     notes.push(
-      `${configFile} is this app's own, so it was left alone. To adopt: import \`reactApp\` from \`${BUILD_PRESET_SPECIFIER}\` and pass it this app's values, keeping \`alias\` and your own plugins verbatim. \`sentinel --inspect --build\` reports what the resolved config departs from and what it adds, before and after.`
+      `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
     );
   }
   operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
@@ -636,12 +938,33 @@ function plan(context) {
   }
   return { operations, notes };
 }
-function readsPreset(cwd, configFile) {
-  if (!existsSync7(join7(cwd, configFile))) return false;
+function planNestService(context, configFile, webpackTarget) {
+  if (webpackTarget === void 0) {
+    return {
+      operations: [],
+      skipped: `already building through sentinel: ${configFile ?? NEST_CONFIG_FILE} imports the nest preset and the nx target runs it. Nothing to change.`
+    };
+  }
+  const refusal = refusalFor(context.cwd, webpackTarget);
+  if (refusal !== void 0) return { operations: [], blocked: refusal };
+  const dropped = Object.keys(webpackTarget.configurations ?? {});
+  return {
+    operations: nestAdoptionOperations(context.cwd, webpackTarget),
+    notes: [
+      `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
+      ...dropped.length > 0 ? [
+        `dropped the \`${dropped.join("`, `")}\` configuration${dropped.length > 1 ? "s" : ""} from the build target: its fileReplacements point at files that do not exist, so it replaced nothing. A live one would have blocked this instead.`
+      ] : [],
+      `verify with \`nx run ${webpackTarget.project}:generate-swagger-file\` and \`git diff --exit-code\`: it runs the built bundle, so it proves the service boots AND that its published contract did not move.`
+    ]
+  };
+}
+function readConfigSource(cwd, configFile) {
+  if (!existsSync8(join8(cwd, configFile))) return "";
   try {
-    return readFileSync5(join7(cwd, configFile), "utf8").includes(BUILD_PRESET_SPECIFIER);
+    return readFileSync6(join8(cwd, configFile), "utf8");
   } catch {
-    return false;
+    return "";
   }
 }
 
@@ -679,11 +1002,17 @@ var ViteRoleAdapter = class extends BaseAdapter {
    * resolution let it run at all — filtering here would give "no adapter for preset svelte",
    * which tells nobody what to do about it.
    *
-   * Nest, node and tools are genuinely declined: there is nothing to bundle, and no version
-   * would change that.
+   * Nest it now serves too, through `@hublo/sentinel/build/nest`. It used to be declined on the
+   * grounds that "there is nothing to bundle", which was never true: those 36 services bundle
+   * with webpack. What changed is that Nx v24 removes the `@nx/webpack:webpack` executor and
+   * the `composePlugins` / `withNx` helpers their shared config is built on, and nx's own
+   * migration generator refuses every one of them because they use `@nx/js:node`
+   * (nrwl/nx#36389). So the way out runs through here.
+   *
+   * `node` and `tools` remain genuinely declined: nothing under them bundles at all.
    */
   appliesTo(preset) {
-    return preset === "react" || preset === "svelte";
+    return preset === "react" || preset === "svelte" || preset === "nest";
   }
   /**
    * `react`, read from the module's Vite config rather than from its dependencies.
@@ -773,6 +1102,26 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
   get label() {
     return "dev";
   }
+  /**
+   * `--init --dev` does the same thing as `--init --build`, and now says so.
+   *
+   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
+   * because adopting one without the other leaves the module half-migrated. What was missing
+   * was only the telling: the run printed a message about the build and nothing about `serve`,
+   * so a developer could believe the dev server had been adopted on its own. Refusing was the
+   * wrong correction, it added friction to a command that already produced the right result.
+   */
+  plan(context) {
+    const planned = super.plan(context);
+    if (planned.operations.length === 0) return planned;
+    return {
+      ...planned,
+      notes: [
+        ...planned.notes ?? [],
+        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
+      ]
+    };
+  }
   /**
    * Start the dev server. It does not return until stopped, so there is no verdict to report
    * beyond the exit code the developer's own Ctrl-C produces.
@@ -791,48 +1140,6 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
   }
 };
 
-// src/roles/build/owned-paths.ts
-var PRESET_OWNED_KEYS = [
-  "base",
-  "root",
-  "define",
-  "server",
-  "build",
-  "nitro",
-  "resolve",
-  "plugins"
-];
-function describeDepartures(config, defaults) {
-  const departures = [];
-  const build = asRecord(config.build);
-  const target = build?.target;
-  if (typeof target === "string" && target !== defaults.target) {
-    departures.push({
-      rule: "build.target",
-      reason: `${target}, where the convention is ${defaults.target}`
-    });
-  }
-  const server = asRecord(config.server);
-  const hosts = server?.allowedHosts;
-  if (Array.isArray(hosts) && !sameStrings(hosts, defaults.allowedHosts)) {
-    departures.push({
-      rule: "server.allowedHosts",
-      reason: `${JSON.stringify(hosts)}, where the convention is ${JSON.stringify(defaults.allowedHosts)}`
-    });
-  }
-  return departures;
-}
-function appAdditions(config) {
-  const owned = new Set(PRESET_OWNED_KEYS);
-  return Object.keys(config).filter((key) => !owned.has(key)).sort();
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-}
-function sameStrings(a, b) {
-  return a.length === b.length && a.every((value, at2) => value === b[at2]);
-}
-
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
 var PREBUILD_SCRIPT_NAME = `pre${BUILD_SCRIPT_NAME}`;
@@ -859,23 +1166,6 @@ function runPrerequisite(cwd, env = process.env) {
   return { kind: "ran" };
 }
 
-// src/roles/build/resolve-config.ts
-async function resolveBuildConfig(cwd) {
-  try {
-    const { loadConfigFromFile } = await import("vite");
-    const loaded = await loadConfigFromFile(
-      { command: "build", mode: "production" },
-      void 0,
-      cwd,
-      "silent"
-    );
-    if (!loaded) return { kind: "failed", reason: "Vite found no config file in this module" };
-    return { kind: "loaded", config: loaded.config, from: loaded.path };
-  } catch (error) {
-    return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-  }
-}
-
 // src/roles/build/adapters/vite/vite.adapter.ts
 var ViteAdapter = class extends ViteRoleAdapter {
   target = "build";
@@ -901,25 +1191,30 @@ var ViteAdapter = class extends ViteRoleAdapter {
     return this.spawnVite(ctx, ready.vite, ["build"], 1);
   }
   /**
-   * What this module builds with, without building it.
+   * What this module builds with, WITHOUT loading its config.
    *
-   * `--inspect` reads the committed config for every role, and the moment `--build` was wired
-   * it joined the sweep — so leaving this to throw would have broken `sentinel --inspect` on
-   * every React module, for a role that had only just arrived. Cheap and honest is the bar.
+   * Everything reported here is read from the manifest and from the config's text: whether the
+   * module imports its toolchain from sentinel, which Vite install would answer, what it still
+   * declares of its own, and whether it has a `prebuild` step.
    *
-   * `vite` is the interesting field and the one nothing else reports: an adopted config takes
-   * its plugins from sentinel, so a module answering `module` here is one build away from the
-   * two-copies failure, and this is where that is visible before it happens.
+   * It used to also load the config through Vite and report where it departed from a preset
+   * and what it added on top. Both were dropped with the preset itself. Adoption changes a
+   * config's IMPORTS and nothing else, so there is no preset the app signed up to and no
+   * distance from it to measure; and computing it meant EXECUTING an app's config, which is
+   * expensive and can fail on its own terms (career throws without `VITE_BRAND_ID`). Reading
+   * a file to report on it must not be able to break.
    *
-   * The resolved config comes from Vite's own loader rather than from parsing the file. See
-   * `resolve-config` for why that is the only honest answer here, and what it costs.
+   * They come back with the shared base, when there is again something an app has chosen to
+   * adopt and can therefore depart from.
    */
   async inspect(ctx) {
     const adoption = readBuildAdoption(ctx.cwd);
-    const base = {
+    return {
       runner: "vite",
       configFile: adoption.configFile,
       ...adoption.unreadable ? { unreadable: adoption.unreadable } : {},
+      // The field nothing else reports: an adopted config takes its plugins from sentinel, so
+      // a module answering `module` here is one build away from the two-copies failure.
       vite: viteOrigin(ctx.cwd),
       // Rendered as a labelled block by the shared renderer, the same shape the lint role's
       // parked rules and the format role's overrides already use.
@@ -929,36 +1224,6 @@ var ViteAdapter = class extends ViteRoleAdapter {
       })),
       prerequisite: moduleScripts(ctx.cwd)[PREBUILD_SCRIPT_NAME] ?? null
     };
-    if (adoption.configFile === null) return base;
-    const resolved = await resolveBuildConfig(ctx.cwd);
-    if (resolved.kind === "failed") {
-      return { ...base, configError: resolved.reason };
-    }
-    const config = resolved.config;
-    return {
-      ...base,
-      // What the app departs from, and what it adds, are different facts. A DEPARTURE is a
-      // disagreement with an opinion the preset holds; an ADDITION is the app needing
-      // something the preset never claimed, which is the preset working rather than being
-      // worked around.
-      departures: describeDepartures(config, REACT_APP_DEFAULTS),
-      additions: appAdditions(config),
-      resolved: {
-        base: at(config, "base") ?? null,
-        target: at(config, "build", "target") ?? null,
-        sourcemap: at(config, "build", "sourcemap") ?? null,
-        port: at(config, "server", "port") ?? null,
-        // The one number nothing else reports and that no formula predicts: career goes DOWN
-        // to 9998 where the others go up, which is why it is data rather than `port + 1`.
-        hmrPort: at(config, "server", "hmr", "port") ?? null,
-        // Counted, not listed. It is 56-67% of every config today, and printing 296 entries
-        // would bury everything above it. The count is what tells you whether it moved.
-        aliases: countOf(at(config, "resolve", "alias")),
-        // Flattened without a depth limit: Vite lets a plugin be an arbitrarily nested array,
-        // and a magic number here would silently undercount the day someone nests one deeper.
-        plugins: countOf(at(config, "plugins"))
-      }
-    };
   }
   /**
    * Adoption as data, WITHOUT building.
@@ -984,17 +1249,6 @@ var ViteAdapter = class extends ViteRoleAdapter {
     };
   }
 };
-function at(config, ...path) {
-  let value = config;
-  for (const key of path) {
-    if (typeof value !== "object" || value === null) return void 0;
-    value = value[key];
-  }
-  return value;
-}
-function countOf(value) {
-  return Array.isArray(value) ? value.flat(Number.POSITIVE_INFINITY).length : 0;
-}
 
 // src/roles/build/register.ts
 function registerBuild() {
@@ -1006,12 +1260,12 @@ function registerBuild() {
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join8, relative } from "path";
+import { extname, join as join9, relative as relative3 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1062,7 +1316,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join8(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join9(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -1083,12 +1337,12 @@ function listSourceFiles(cwd, extensions) {
       continue;
     }
     for (const entry of entries) {
-      const full = join8(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
         continue;
       }
-      if (wanted.has(extname(entry.name))) found.push(relative(cwd, full));
+      if (wanted.has(extname(entry.name))) found.push(relative3(cwd, full));
     }
   }
   return found;
@@ -1096,8 +1350,9 @@ function listSourceFiles(cwd, extensions) {
 
 // src/core/named-scope.ts
 var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
-function scopeFlags(paths) {
-  return paths.length > 0 ? [TOLERATE_EMPTY_FLAG] : [];
+function scopeFlags(paths, options = []) {
+  if (paths.length === 0 || options.includes(TOLERATE_EMPTY_FLAG)) return [];
+  return [TOLERATE_EMPTY_FLAG];
 }
 
 // src/core/settings.ts
@@ -1105,8 +1360,8 @@ var WORKSPACE_ROOT_MARKER = "nx.json";
 var DEFAULT_MAX_DIAGNOSTICS = 100;
 
 // src/core/workspace-prep.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
-import { dirname as dirname3, join as join9, relative as relative2 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync } from "fs";
+import { dirname as dirname3, join as join10, relative as relative4 } from "path";
 var OVERRIDE_KEY = "i18next>typescript";
 var NATIVE_TS_ALIAS = "@typescript/native";
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -1115,7 +1370,7 @@ var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
 function findWorkspaceRoot(startDir) {
   let dir = startDir;
   for (; ; ) {
-    if (existsSync8(join9(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    if (existsSync9(join10(dir, WORKSPACE_ROOT_MARKER))) return dir;
     const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -1128,9 +1383,9 @@ function declaredNativeTs(pkg) {
   return version || void 0;
 }
 function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join9(root, "package.json");
-  if (!existsSync8(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+  const pkgPath = join10(root, "package.json");
+  if (!existsSync9(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
   const want = declaredNativeTs(pkg);
   if (!want) return void 0;
   const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
@@ -1143,10 +1398,10 @@ function ensureI18nextSingleton(root, dryRun) {
   return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
 }
 function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (!existsSync8(yamlPath)) return void 0;
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (!existsSync9(yamlPath)) return void 0;
   const own = readOwnPackage().name;
-  const lines = readFileSync6(yamlPath, "utf8").split("\n");
+  const lines = readFileSync7(yamlPath, "utf8").split("\n");
   const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
   if (keyIdx === -1) return void 0;
   let lastItemIdx = keyIdx;
@@ -1179,13 +1434,13 @@ var ROOT_PRETTIER_CONFIGS = [
   "prettier.config.mjs"
 ];
 function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
+  const rel = relative4(root, moduleDir).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join9(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
+  const ignorePath = join10(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync9(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync9(join10(root, name)));
   if (!hasPrettier) return void 0;
   const pattern = `/${rel}/`;
-  const existing = existsSync8(ignorePath) ? readFileSync6(ignorePath, "utf8") : "";
+  const existing = existsSync9(ignorePath) ? readFileSync7(ignorePath, "utf8") : "";
   const lines = existing.split("\n");
   if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
     return void 0;
@@ -1221,10 +1476,10 @@ function ensureWorkspacePrep(opts) {
 function inspectWorkspacePrep(root) {
   const entries = [];
   let pkg = {};
-  const pkgPath = join9(root, "package.json");
-  if (existsSync8(pkgPath)) {
+  const pkgPath = join10(root, "package.json");
+  if (existsSync9(pkgPath)) {
     try {
-      pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+      pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
     } catch {
       pkg = {};
     }
@@ -1238,9 +1493,9 @@ function inspectWorkspacePrep(root) {
     });
   }
   const own = readOwnPackage().name;
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (existsSync8(yamlPath)) {
-    const yaml = readFileSync6(yamlPath, "utf8");
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (existsSync9(yamlPath)) {
+    const yaml = readFileSync7(yamlPath, "utf8");
     const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
     if (listed) {
       const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
@@ -1327,8 +1582,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1343,11 +1598,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join10(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync9(path)) return [];
+  const path = join11(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync10(path)) return [];
   let contents;
   try {
-    contents = readFileSync7(path, "utf8");
+    contents = readFileSync8(path, "utf8");
   } catch {
     return [];
   }
@@ -1434,13 +1689,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -1469,8 +1724,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join11(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync8(schemaPath, "utf8"));
+    const schemaPath = join12(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync9(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -1501,14 +1756,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync10(join12(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync11(join13(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync9(join12(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync10(join13(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1538,8 +1793,8 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
 var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -1555,11 +1810,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join13(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync11(path)) return NOT_ADOPTED2(null);
+  const path = join14(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync12(path)) return NOT_ADOPTED2(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync11(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -1684,7 +1939,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync12(join14(context.cwd, name))
+      (name) => existsSync13(join15(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1808,7 +2063,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     });
     const result = spawnSync3(
       oxfmt,
-      [mode, ...scopeFlags(paths), ...options, ...paths.length > 0 ? paths : ["."]],
+      [mode, ...scopeFlags(paths, options), ...options, ...paths.length > 0 ? paths : ["."]],
       {
         cwd: ctx.cwd,
         stdio: "inherit"
@@ -1924,7 +2179,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync11(join14(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -2006,8 +2261,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync19, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync20, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join25 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2016,7 +2271,7 @@ function deferredRuleNames(rules) {
 
 // src/core/fix-report.ts
 import { statSync } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -2036,7 +2291,7 @@ function fingerprint(path) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join15(cwd, file));
+    const mark = fingerprint(join16(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -2044,7 +2299,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join15(cwd, file));
+    const now = fingerprint(join16(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -2063,8 +2318,8 @@ function describeFixOutcome(outcome, toolLabel) {
 }
 
 // src/roles/lint/module-baseline.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
 var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
@@ -2108,11 +2363,11 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 function heldRules(cwd) {
-  const path = join16(cwd, LINT_BASELINE_FILE);
-  if (!existsSync13(path)) return [];
+  const path = join17(cwd, LINT_BASELINE_FILE);
+  if (!existsSync14(path)) return [];
   try {
     const parsed = parseJsonc(
-      readFileSync12(path, "utf8"),
+      readFileSync13(path, "utf8"),
       LINT_BASELINE_FILE
     );
     return Object.keys(parsed.rules ?? {});
@@ -3935,14 +4190,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { isAbsolute as isAbsolute2, join as join17, resolve as resolve3 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { isAbsolute as isAbsolute2, join as join18, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync14(path)) return void 0;
+  if (!existsSync15(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync13(path, "utf8"),
+      readFileSync14(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3962,7 +4217,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join17(cwd, configFile), "utf8"),
+      readFileSync14(join18(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4021,8 +4276,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -4037,12 +4292,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync14(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync15(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -4056,8 +4311,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join18(moduleDir, candidate);
-    if (!existsSync15(absolutePath)) continue;
+    const absolutePath = join19(moduleDir, candidate);
+    if (!existsSync16(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -4090,12 +4345,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync16(join19(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync17(join20(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync15(join19(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync16(join20(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -4129,9 +4384,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join20 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join21 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -4156,32 +4411,31 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join20(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join20(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join21(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join21(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join20(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join21(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync17(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync18(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
+import { join as join24 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join21 } from "path";
-var IGNORE_BLOCKS = [/\bignores\s*:\s*\[([^\]]*)\]/g, /\bglobalIgnores\s*\(\s*\[([^\]]*)\]/g];
-var STRING_LITERAL = /['"`]([^'"`]+)['"`]/g;
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { join as join22 } from "path";
+import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
   return pattern.replace(/^\.\//, "");
@@ -4192,24 +4446,71 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join21(cwd, name)).find((path) => existsSync18(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join22(cwd, name)).find((path) => existsSync19(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync16(config, "utf8");
+    source = readFileSync17(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
   const patterns = /* @__PURE__ */ new Set();
-  for (const block of IGNORE_BLOCKS) {
-    for (const [, body] of source.matchAll(block)) {
-      for (const [, literal] of (body ?? "").matchAll(STRING_LITERAL)) {
-        if (literal) patterns.add(toOxlintPattern(literal));
+  const unresolved = new Set([...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]));
+  const { program, errors } = parseSync2(config, source, { sourceType: "module" });
+  if (errors.length > 0) {
+    return { patterns: [], unresolved: [`${config} could not be parsed`] };
+  }
+  walk(program, (node) => {
+    if (node.type === "CallExpression" && calleeName(node) === "globalIgnores") {
+      for (const literal of stringLiterals(firstArrayArgument(node))) {
+        patterns.add(toOxlintPattern(literal));
       }
+      return;
     }
+    if (node.type !== "ObjectExpression") return;
+    const keys = objectKeys(node);
+    if (!keys.includes("ignores")) return;
+    const values = arrayValues(node, "ignores");
+    if (keys.length > 1) {
+      unresolved.add(
+        `ignores scoped to one config block (with ${keys.filter((k) => k !== "ignores").join(", ")}): ${values.join(", ")} \u2014 exempt from those RULES, not excluded from linting`
+      );
+      return;
+    }
+    for (const literal of values) patterns.add(toOxlintPattern(literal));
+  });
+  return { patterns: [...patterns], unresolved: [...unresolved] };
+}
+function walk(node, visit) {
+  if (!node || typeof node !== "object") return;
+  const current = node;
+  if (typeof current.type === "string") visit(current);
+  for (const key of Object.keys(current)) {
+    const value = current[key];
+    if (Array.isArray(value)) for (const entry of value) walk(entry, visit);
+    else if (value && typeof value === "object") walk(value, visit);
   }
-  const unresolved = [...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]);
-  return { patterns: [...patterns], unresolved: [...new Set(unresolved)] };
+}
+function calleeName(node) {
+  const callee = node.callee;
+  return callee?.type === "Identifier" ? callee.name : void 0;
+}
+function firstArrayArgument(node) {
+  const args = node.arguments ?? [];
+  return args.find((argument) => argument?.type === "ArrayExpression");
+}
+function stringLiterals(array) {
+  const elements = array?.elements ?? [];
+  return elements.filter((element) => element?.type === "Literal" && typeof element.value === "string").map((element) => element.value);
+}
+function objectKeys(node) {
+  const properties = node.properties ?? [];
+  return properties.filter((property) => property?.type === "Property" && !property.computed).map((property) => property.key?.name ?? String(property.key?.value ?? "")).filter(Boolean);
+}
+function arrayValues(node, name) {
+  const properties = node.properties ?? [];
+  const found = properties.find((property) => property.key?.name === name);
+  return stringLiterals(found?.value);
 }
 
 // src/roles/lint/lint-script.ts
@@ -4250,8 +4551,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync17, statSync as statSync2 } from "fs";
-import { join as join22, relative as relative3 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync18, statSync as statSync2 } from "fs";
+import { join as join23, relative as relative5 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4298,7 +4599,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join22(dir, entry);
+    const full = join23(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync2(full).isDirectory();
@@ -4318,7 +4619,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync17(file, "utf8");
+      content = readFileSync18(file, "utf8");
     } catch {
       continue;
     }
@@ -4342,7 +4643,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative3(cwd, file),
+        file: relative5(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4446,7 +4747,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync19(join23(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync20(join24(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4544,7 +4845,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4555,7 +4856,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4567,7 +4868,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync18(join23(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync19(join24(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4701,20 +5002,20 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join24(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join24(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync20(configPath)) return;
+    const configPath = join25(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join25(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync21(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync19(configPath, "utf8"),
+        readFileSync20(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join24(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join25(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -4755,14 +5056,14 @@ ${result.stderr ?? ""}`);
     } else {
       rmSync(baselinePath, { force: true });
     }
-    if (next.length !== current.length || next.some((entry, at2) => entry !== current[at2])) {
+    if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
       writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync20(join24(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync21(join25(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4807,7 +5108,7 @@ ${result.stderr ?? ""}`);
       valueFlags: OXLINT_VALUE_FLAGS
     });
     const targets = paths.length > 0 ? paths : ["."];
-    const emptyScope = scopeFlags(paths);
+    const emptyScope = scopeFlags(paths, passedOptions);
     const lint = (extra) => {
       const passed = [...extra, ...emptyScope, ...passedOptions];
       const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
@@ -4910,7 +5211,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -4920,7 +5221,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync19(join24(cwd, entry), "utf8"),
+          readFileSync20(join25(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4990,14 +5291,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync20(join24(cwd, target)));
+    return targets.find((target) => !existsSync21(join25(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5029,9 +5330,9 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5212,8 +5513,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync20 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { join as join26 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5306,7 +5607,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync20(join25(context.cwd, target.path), "utf8"),
+    readFileSync21(join26(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5444,7 +5745,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync21(join26(cwd, target.path), "utf8"),
+        readFileSync22(join27(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5457,7 +5758,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join26(cwd, "noop.js")).resolve(preset);
+      createRequire4(join27(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5553,7 +5854,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync21(join26(cwd, config), "utf8"),
+        readFileSync22(join27(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5569,7 +5870,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync21(join26(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync22(join27(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5717,7 +6018,7 @@ function detectFramework(packageJson) {
 }
 
 // src/core/dispatch.ts
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 
 // src/shared/text.ts
 function ensureLines(current, lines) {
@@ -5773,9 +6074,16 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync22, readFileSync as readFileSync22, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync23, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
+
+// src/shared/deep-merge.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve4(cwd);
   const absolutePath = resolve4(root, relativePath);
@@ -5785,7 +6093,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync22(absolutePath) ? readFileSync22(absolutePath, "utf8") : void 0;
+  return existsSync23(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5903,8 +6211,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync23, readdirSync as readdirSync3, readFileSync as readFileSync23 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "fs";
+import { join as join28 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5918,11 +6226,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join27(cwd, "package.json");
-  if (!existsSync23(path)) return [];
+  const path = join28(cwd, "package.json");
+  if (!existsSync24(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync23(path, "utf8"),
+      readFileSync24(path, "utf8"),
       path
     );
     return [
@@ -5945,7 +6253,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync23(join27(cwd, name), "utf8"),
+        readFileSync24(join28(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -6086,7 +6394,7 @@ async function dispatch(opts) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
 `);
     await adapter.afterInit({
-      module: basename2(opts.cwd),
+      module: basename3(opts.cwd),
       cwd: opts.cwd,
       preset,
       ci: false,
@@ -6108,9 +6416,11 @@ export {
   resolveBin,
   readOwnVersion,
   readProjectPackageJson,
-  readNxProjectName,
+  moduleName,
+  buildConfigFile,
   VERBS,
   TARGETS,
+  LONG_RUNNING_TARGETS,
   SWEEPABLE_TARGETS,
   PRESET_NAMES,
   WORKSPACE_ROOT_MARKER,
@@ -6123,4 +6433,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-FLJ2QNFF.js.map
+//# sourceMappingURL=chunk-6VOQDDZD.js.map