@hublo/sentinel 1.2.0-alpha.15 → 1.2.0-alpha.17

package/dist/bin/sentinel.js

@@ -22,7 +22,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-RV34GQVH.js";
+} from "../chunk-CWJX5DVF.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-RV34GQVH.js → chunk-CWJX5DVF.js}

@@ -333,11 +333,19 @@ var BUILD_SCRIPT_NAME = "build";
 var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
-function buildTarget(configFiles = BUILD_CONFIG_FILES) {
+var BUILD_OUTPUT_CANDIDATES = ["dist", ".output", "build"];
+function buildTarget(options) {
+  const { moduleName: moduleName3, configFiles = BUILD_CONFIG_FILES, outputs } = options;
   return {
     [BUILD_SCRIPT_NAME]: {
+      executor: "nx:run-commands",
+      options: {
+        command: `pnpm --filter ${moduleName3} run ${BUILD_SCRIPT_NAME}`,
+        forwardAllArgs: false
+      },
       cache: true,
-      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)]
+      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)],
+      outputs: [...outputs]
     }
   };
 }
@@ -457,9 +465,9 @@ function binFromOwnInstall(packageName, binName) {
   try {
     const manifest = require2.resolve(`${packageName}/package.json`);
     const bin = require2(manifest).bin;
-    const relative6 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative6) return void 0;
-    const executable = join4(dirname2(manifest), relative6);
+    const relative5 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative5) return void 0;
+    const executable = join4(dirname2(manifest), relative5);
     return existsSync5(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -472,8 +480,8 @@ function binSearchPath(cwd) {
 }
 
 // src/roles/build/plan.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
 
 // src/core/config/existing-command.ts
 import { readFileSync as readFileSync5 } from "fs";
@@ -656,7 +664,8 @@ function composeDevScript(existing, command) {
 }
 
 // src/roles/build/nest/adopt.ts
-import { relative as relative2 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 var NEST_CONFIG_FILE = "vite.config.mts";
 function nestConfigSource(cwd, target) {
   const hops = workspaceRootHops(cwd, target);
@@ -673,34 +682,18 @@ export default nestService({
 })
 `;
 }
-function nestBuildTarget(cwd, target) {
-  const workspaceRoot = workspaceRootFor(cwd, target);
-  if (workspaceRoot === void 0) {
-    throw new Error(
-      `sentinel build(nest): cannot place ${cwd} inside a workspace from ${target.main}`
-    );
-  }
-  const moduleRoot = relative2(workspaceRoot, cwd);
-  return {
-    executor: "nx:run-commands",
-    outputs: [`{workspaceRoot}/${target.outputPath}`],
-    options: {
-      cwd: moduleRoot,
-      command: "pnpm exec sentinel --run --build",
-      forwardAllArgs: false
-    }
-  };
+function nestBuildOutputs(target) {
+  return [`{workspaceRoot}/${target.outputPath}`];
+}
+var OUT_DIR_IN_CONFIG = /^\s*outDir:\s*'([^']+)'/m;
+function nestOutputsFromConfig(cwd) {
+  const configPath = join8(cwd, NEST_CONFIG_FILE);
+  if (!existsSync8(configPath)) return void 0;
+  const outDir = OUT_DIR_IN_CONFIG.exec(readFileSync6(configPath, "utf8"))?.[1];
+  return outDir === void 0 ? void 0 : [`{workspaceRoot}/${outDir}`];
 }
 function nestAdoptionOperations(cwd, target) {
-  return [
-    { kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) },
-    { kind: "remove-json-keys", path: "project.json", keys: [["targets", "build"]] },
-    {
-      kind: "merge-json",
-      path: "project.json",
-      value: { targets: { build: nestBuildTarget(cwd, target) } }
-    }
-  ];
+  return [{ kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) }];
 }
 
 // src/roles/build/requirements.ts
@@ -836,6 +829,13 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
 }
 
 // src/roles/build/plan.ts
+function packageNameFor(cwd) {
+  return readProjectPackageJson(cwd).name;
+}
+function candidateOutputs() {
+  return BUILD_OUTPUT_CANDIDATES.map((name) => `{projectRoot}/${name}`);
+}
+var NO_PACKAGE_NAME = `this module's package.json declares no \`name\`, so the nx build target would have no way to reach it: the command is \`pnpm --filter <name> run build\`, and an unnamed package matches nothing. Name the package and re-run; nothing was written.`;
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -893,7 +893,7 @@ function plan(context) {
   }
   const webpackTarget = webpackBuildTarget(context.cwd);
   if (declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0) {
-    return planNestService(context, configFile, webpackTarget);
+    return planNestService(context, webpackTarget);
   }
   if (configFile === void 0) {
     return {
@@ -908,6 +908,8 @@ function planReactApp(context, configFile) {
   const operations = [];
   const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
   if (notEsm !== void 0) return { operations: [], skipped: notEsm };
+  const packageName = packageNameFor(context.cwd);
+  if (packageName === void 0) return { operations: [], skipped: NO_PACKAGE_NAME };
   const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
   if (rewrite.kind === "blocked") {
     return {
@@ -937,7 +939,12 @@ function planReactApp(context, configFile) {
     );
   }
   operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
-  operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
+  operations.push(
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({ moduleName: packageName, outputs: candidateOutputs() })
+    })
+  );
   const owned = ownedBuildDependencies(context.cwd);
   if (owned.length > 0) {
     operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
@@ -947,27 +954,33 @@ function planReactApp(context, configFile) {
   }
   return { operations, notes };
 }
-function planNestService(context, configFile, webpackTarget) {
-  if (webpackTarget === void 0) {
+function planNestService(context, webpackTarget) {
+  const packageName = packageNameFor(context.cwd);
+  if (packageName === void 0) return { operations: [], skipped: NO_PACKAGE_NAME };
+  const outputs = webpackTarget === void 0 ? nestOutputsFromConfig(context.cwd) : nestBuildOutputs(webpackTarget);
+  if (outputs === void 0) {
     return {
       operations: [],
-      skipped: `already building through sentinel: ${configFile ?? NEST_CONFIG_FILE} imports the nest preset and the nx target runs it. Nothing to change.`
+      blocked: `${NEST_CONFIG_FILE} does not declare an \`outDir\`, so sentinel cannot say where this service's build lands. Declaring an nx target without it would cache the build and restore nothing from that cache. Nothing was written.`
     };
   }
+  const metadata = [
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({
+        moduleName: packageName,
+        configFiles: [NEST_CONFIG_FILE],
+        outputs
+      })
+    }),
+    manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND })
+  ];
+  if (webpackTarget === void 0) return { operations: metadata };
   const refusal = refusalFor(context.cwd, webpackTarget);
   if (refusal !== void 0) return { operations: [], blocked: refusal };
   const dropped = Object.keys(webpackTarget.configurations ?? {});
   return {
-    operations: [
-      ...nestAdoptionOperations(context.cwd, webpackTarget),
-      // The same nx metadata the React path writes, and for the same reason: declaring `inputs`
-      // at all REPLACES nx's default `['default','^default']`, so a target that declares none
-      // runs on defaults while every other target this module has declares them. The Nest path
-      // wrote none, which left its build the one target that could replay a stale bundle after a
-      // dependency changed. One name, because a Nest service's config can only be `.mts`.
-      ...nxTargetMetadataOperations({ cwd: context.cwd, targets: buildTarget([NEST_CONFIG_FILE]) }),
-      manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND })
-    ],
+    operations: [...nestAdoptionOperations(context.cwd, webpackTarget), ...metadata],
     notes: [
       `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
       ...dropped.length > 0 ? [
@@ -978,9 +991,9 @@ function planNestService(context, configFile, webpackTarget) {
   };
 }
 function readConfigSource(cwd, configFile) {
-  if (!existsSync8(join8(cwd, configFile))) return "";
+  if (!existsSync9(join9(cwd, configFile))) return "";
   try {
-    return readFileSync6(join8(cwd, configFile), "utf8");
+    return readFileSync7(join9(cwd, configFile), "utf8");
   } catch {
     return "";
   }
@@ -1164,6 +1177,199 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
   }
 };
 
+// src/roles/build/declared-outputs.ts
+import { existsSync as existsSync11, statSync } from "fs";
+import { join as join11 } from "path";
+
+// src/core/workspace-prep.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync } from "fs";
+import { dirname as dirname3, join as join10, relative as relative2 } from "path";
+
+// src/core/settings.ts
+var WORKSPACE_ROOT_MARKER = "nx.json";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+
+// src/core/workspace-prep.ts
+var OVERRIDE_KEY = "i18next>typescript";
+var NATIVE_TS_ALIAS = "@typescript/native";
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
+var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
+function findWorkspaceRoot(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync10(join10(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function declaredNativeTs(pkg) {
+  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
+  if (!spec) return void 0;
+  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
+  return version || void 0;
+}
+function ensureI18nextSingleton(root, dryRun) {
+  const pkgPath = join10(root, "package.json");
+  if (!existsSync10(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
+  const want = declaredNativeTs(pkg);
+  if (!want) return void 0;
+  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (have === want) return void 0;
+  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
+  pkg.pnpm ??= {};
+  pkg.pnpm.overrides ??= {};
+  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
+  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
+}
+function ensureReleaseAgeAllowList(root, dryRun) {
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (!existsSync10(yamlPath)) return void 0;
+  const own = readOwnPackage().name;
+  const lines = readFileSync8(yamlPath, "utf8").split("\n");
+  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
+  if (keyIdx === -1) return void 0;
+  let lastItemIdx = keyIdx;
+  let indent = "  ";
+  for (let i = keyIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(LIST_ITEM);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastItemIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
+  }
+  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
+  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
+}
+var PRETTIER_IGNORE = ".prettierignore";
+var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
+var ROOT_PRETTIER_CONFIGS = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function ensureFormatterExclusion(root, moduleDir, dryRun) {
+  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
+  if (rel === "" || rel.startsWith("..")) return void 0;
+  const ignorePath = join10(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync10(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync10(join10(root, name)));
+  if (!hasPrettier) return void 0;
+  const pattern = `/${rel}/`;
+  const existing = existsSync10(ignorePath) ? readFileSync8(ignorePath, "utf8") : "";
+  const lines = existing.split("\n");
+  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
+    return void 0;
+  }
+  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
+  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
+  if (headerIdx === -1) {
+    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
+
+`;
+    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
+${pattern}
+`);
+  } else {
+    let end = headerIdx + 1;
+    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
+    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
+    writeFileSync(
+      ignorePath,
+      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
+    );
+  }
+  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
+}
+function ensureWorkspacePrep(opts) {
+  const dryRun = Boolean(opts.dryRun);
+  return [
+    ensureI18nextSingleton(opts.root, dryRun),
+    ensureReleaseAgeAllowList(opts.root, dryRun),
+    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
+  ].filter((message) => message !== void 0);
+}
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join10(root, "package.json");
+  if (existsSync10(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
+  }
+  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
+  }
+  const own = readOwnPackage().name;
+  const yamlPath = join10(root, WORKSPACE_YAML);
+  if (existsSync10(yamlPath)) {
+    const yaml = readFileSync8(yamlPath, "utf8");
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
+}
+
+// src/roles/build/declared-outputs.ts
+function declaredBuildTarget(cwd) {
+  return readProjectPackageJson(cwd).nx?.targets?.[BUILD_SCRIPT_NAME];
+}
+function resolveOutputToken(token, cwd) {
+  if (token.startsWith("{projectRoot}/")) return join11(cwd, token.slice("{projectRoot}/".length));
+  if (token.startsWith("{workspaceRoot}/")) {
+    const root = findWorkspaceRoot(cwd);
+    return root === void 0 ? void 0 : join11(root, token.slice("{workspaceRoot}/".length));
+  }
+  return join11(cwd, token);
+}
+function writtenSince(path, startedAt) {
+  if (!existsSync11(path)) return false;
+  try {
+    return statSync(path).mtimeMs >= startedAt;
+  } catch {
+    return true;
+  }
+}
+function outputsProblem(cwd, startedAt) {
+  const target = declaredBuildTarget(cwd);
+  if (target === void 0) return void 0;
+  const declared = target.outputs ?? [];
+  if (declared.length === 0) {
+    if (target.cache !== true) return void 0;
+    return `this module's nx build target sets \`cache: true\` and declares no \`outputs\`, so nx will cache this build and restore nothing from it: the next cache hit reports success and leaves no build on disk. Add the directory this build writes to under \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json, or re-run \`sentinel --init --build\`, which declares it.`;
+  }
+  const resolved = declared.map((token) => ({ token, path: resolveOutputToken(token, cwd) })).filter((entry) => entry.path !== void 0);
+  if (resolved.length === 0) return void 0;
+  if (resolved.some((entry) => writtenSince(entry.path, startedAt))) return void 0;
+  return `the build wrote nothing to any of the directories this module declares as its nx \`outputs\` (${declared.join(", ")}), so nx would cache this build and restore an empty result from it. Whatever directory the build DID write to belongs in \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json. The build itself succeeded; only its cache declaration is wrong.`;
+}
+
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
 var PREBUILD_SCRIPT_NAME = `pre${BUILD_SCRIPT_NAME}`;
@@ -1212,7 +1418,15 @@ var ViteAdapter = class extends ViteRoleAdapter {
       );
       return { ok: false, code: prerequisite.code };
     }
-    return this.spawnVite(ctx, ready.vite, ["build"], 1);
+    const startedAt = Date.now();
+    const result = await this.spawnVite(ctx, ready.vite, ["build"], 1);
+    if (!result.ok) return result;
+    const problem = outputsProblem(ctx.cwd, startedAt);
+    if (problem !== void 0) {
+      this.say(problem);
+      return { ok: false, code: 1 };
+    }
+    return result;
   }
   /**
    * What this module builds with, WITHOUT loading its config.
@@ -1284,12 +1498,12 @@ function registerBuild() {
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join9, relative as relative3 } from "path";
+import { extname, join as join12, relative as relative3 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1340,7 +1554,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join9(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join12(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -1361,7 +1575,7 @@ function listSourceFiles(cwd, extensions) {
       continue;
     }
     for (const entry of entries) {
-      const full = join9(dir, entry.name);
+      const full = join12(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
         continue;
@@ -1379,159 +1593,6 @@ function scopeFlags(paths, options = []) {
   return [TOLERATE_EMPTY_FLAG];
 }
 
-// src/core/settings.ts
-var WORKSPACE_ROOT_MARKER = "nx.json";
-var DEFAULT_MAX_DIAGNOSTICS = 100;
-
-// src/core/workspace-prep.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync } from "fs";
-import { dirname as dirname3, join as join10, relative as relative4 } from "path";
-var OVERRIDE_KEY = "i18next>typescript";
-var NATIVE_TS_ALIAS = "@typescript/native";
-var WORKSPACE_YAML = "pnpm-workspace.yaml";
-var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
-var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
-function findWorkspaceRoot(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync9(join10(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname3(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function declaredNativeTs(pkg) {
-  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
-  if (!spec) return void 0;
-  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
-  return version || void 0;
-}
-function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join10(root, "package.json");
-  if (!existsSync9(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
-  const want = declaredNativeTs(pkg);
-  if (!want) return void 0;
-  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (have === want) return void 0;
-  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
-  pkg.pnpm ??= {};
-  pkg.pnpm.overrides ??= {};
-  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
-}
-function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join10(root, WORKSPACE_YAML);
-  if (!existsSync9(yamlPath)) return void 0;
-  const own = readOwnPackage().name;
-  const lines = readFileSync7(yamlPath, "utf8").split("\n");
-  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
-  if (keyIdx === -1) return void 0;
-  let lastItemIdx = keyIdx;
-  let indent = "  ";
-  for (let i = keyIdx + 1; i < lines.length; i++) {
-    const match = lines[i]?.match(LIST_ITEM);
-    if (!match) break;
-    indent = match[1] ?? indent;
-    lastItemIdx = i;
-    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
-  }
-  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
-  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
-  writeFileSync(yamlPath, lines.join("\n"));
-  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
-}
-var PRETTIER_IGNORE = ".prettierignore";
-var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
-var ROOT_PRETTIER_CONFIGS = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.json5",
-  ".prettierrc.yml",
-  ".prettierrc.yaml",
-  ".prettierrc.js",
-  ".prettierrc.cjs",
-  ".prettierrc.mjs",
-  "prettier.config.js",
-  "prettier.config.cjs",
-  "prettier.config.mjs"
-];
-function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative4(root, moduleDir).replaceAll("\\", "/");
-  if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join10(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync9(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync9(join10(root, name)));
-  if (!hasPrettier) return void 0;
-  const pattern = `/${rel}/`;
-  const existing = existsSync9(ignorePath) ? readFileSync7(ignorePath, "utf8") : "";
-  const lines = existing.split("\n");
-  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
-    return void 0;
-  }
-  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
-  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
-  if (headerIdx === -1) {
-    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
-
-`;
-    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
-${pattern}
-`);
-  } else {
-    let end = headerIdx + 1;
-    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
-    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
-    writeFileSync(
-      ignorePath,
-      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
-    );
-  }
-  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
-}
-function ensureWorkspacePrep(opts) {
-  const dryRun = Boolean(opts.dryRun);
-  return [
-    ensureI18nextSingleton(opts.root, dryRun),
-    ensureReleaseAgeAllowList(opts.root, dryRun),
-    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
-  ].filter((message) => message !== void 0);
-}
-function inspectWorkspacePrep(root) {
-  const entries = [];
-  let pkg = {};
-  const pkgPath = join10(root, "package.json");
-  if (existsSync9(pkgPath)) {
-    try {
-      pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
-    } catch {
-      pkg = {};
-    }
-  }
-  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (pinned !== void 0) {
-    const stillForks = declaredNativeTs(pkg);
-    entries.push({
-      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
-      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
-    });
-  }
-  const own = readOwnPackage().name;
-  const yamlPath = join10(root, WORKSPACE_YAML);
-  if (existsSync9(yamlPath)) {
-    const yaml = readFileSync7(yamlPath, "utf8");
-    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
-    if (listed) {
-      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
-      entries.push({
-        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
-        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
-      });
-    }
-  }
-  return entries;
-}
-
 // src/roles/format/config-policy.ts
 var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
 var FORMAT_SCRIPT_NAME = "format";
@@ -1606,8 +1667,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1622,11 +1683,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join11(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync10(path)) return [];
+  const path = join13(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync12(path)) return [];
   let contents;
   try {
-    contents = readFileSync8(path, "utf8");
+    contents = readFileSync9(path, "utf8");
   } catch {
     return [];
   }
@@ -1713,13 +1774,13 @@ function formatPresetFor(preset) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname4, join as join14 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -1748,8 +1809,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join12(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync9(schemaPath, "utf8"));
+    const schemaPath = join14(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync10(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -1780,14 +1841,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync11(join13(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync13(join15(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(join13(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync11(join15(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1817,8 +1878,8 @@ function readPrettierSettings(cwd) {
 }
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { join as join16 } from "path";
 var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -1834,11 +1895,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join14(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync12(path)) return NOT_ADOPTED2(null);
+  const path = join16(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync14(path)) return NOT_ADOPTED2(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync11(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync12(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -1963,7 +2024,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync13(join15(context.cwd, name))
+      (name) => existsSync15(join17(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -2203,7 +2264,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync13(join17(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -2285,8 +2346,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync20, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync21, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join27 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2294,8 +2355,8 @@ function deferredRuleNames(rules) {
 }
 
 // src/core/fix-report.ts
-import { statSync } from "fs";
-import { join as join16 } from "path";
+import { statSync as statSync2 } from "fs";
+import { join as join18 } from "path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -2306,7 +2367,7 @@ function readFailure(output) {
 }
 function fingerprint(path) {
   try {
-    const stat = statSync(path);
+    const stat = statSync2(path);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -2315,7 +2376,7 @@ function fingerprint(path) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join16(cwd, file));
+    const mark = fingerprint(join18(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -2323,7 +2384,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join16(cwd, file));
+    const now = fingerprint(join18(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -2342,8 +2403,8 @@ function describeFixOutcome(outcome, toolLabel) {
 }
 
 // src/roles/lint/module-baseline.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { join as join19 } from "path";
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
 var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
@@ -2387,11 +2448,11 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 function heldRules(cwd) {
-  const path = join17(cwd, LINT_BASELINE_FILE);
-  if (!existsSync14(path)) return [];
+  const path = join19(cwd, LINT_BASELINE_FILE);
+  if (!existsSync16(path)) return [];
   try {
     const parsed = parseJsonc(
-      readFileSync13(path, "utf8"),
+      readFileSync14(path, "utf8"),
       LINT_BASELINE_FILE
     );
     return Object.keys(parsed.rules ?? {});
@@ -4214,14 +4275,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { isAbsolute as isAbsolute2, join as join18, resolve as resolve3 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { isAbsolute as isAbsolute2, join as join20, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync15(path)) return void 0;
+  if (!existsSync17(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync14(path, "utf8"),
+      readFileSync15(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -4241,7 +4302,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync14(join18(cwd, configFile), "utf8"),
+      readFileSync15(join20(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4300,8 +4361,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { join as join22 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -4316,12 +4377,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join21 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync15(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync16(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -4335,8 +4396,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join19(moduleDir, candidate);
-    if (!existsSync16(absolutePath)) continue;
+    const absolutePath = join21(moduleDir, candidate);
+    if (!existsSync18(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -4369,12 +4430,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync17(join20(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync19(join22(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync16(join20(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync17(join22(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -4408,9 +4469,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join21 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -4435,30 +4496,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join21(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join21(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join23(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join23(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join21(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join23(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync18(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync20(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync20 } from "fs";
+import { join as join26 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
+import { join as join24 } from "path";
 import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
@@ -4470,11 +4531,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join22(cwd, name)).find((path) => existsSync19(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join24(cwd, name)).find((path) => existsSync21(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync17(config, "utf8");
+    source = readFileSync18(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4575,8 +4636,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync18, statSync as statSync2 } from "fs";
-import { join as join23, relative as relative5 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync19, statSync as statSync3 } from "fs";
+import { join as join25, relative as relative4 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4623,10 +4684,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join23(dir, entry);
+    const full = join25(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync2(full).isDirectory();
+      isDirectory = statSync3(full).isDirectory();
     } catch {
       continue;
     }
@@ -4643,7 +4704,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync18(file, "utf8");
+      content = readFileSync19(file, "utf8");
     } catch {
       continue;
     }
@@ -4667,7 +4728,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative5(cwd, file),
+        file: relative4(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4771,7 +4832,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync20(join24(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync22(join26(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4869,7 +4930,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync20(join26(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4880,7 +4941,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync20(join26(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4892,7 +4953,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync19(join24(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync20(join26(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -5026,20 +5087,20 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join25(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join25(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync21(configPath)) return;
+    const configPath = join27(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join27(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync23(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync20(configPath, "utf8"),
+        readFileSync21(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join25(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join27(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -5087,7 +5148,7 @@ ${result.stderr ?? ""}`);
     }
   }
   async run(ctx) {
-    if (!existsSync21(join25(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync23(join27(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -5235,7 +5296,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -5245,7 +5306,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync20(join25(cwd, entry), "utf8"),
+          readFileSync21(join27(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -5315,14 +5376,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync21(join25(cwd, target)));
+    return targets.find((target) => !existsSync23(join27(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5354,9 +5415,9 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync23 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5537,8 +5598,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync21 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync22 } from "fs";
+import { join as join28 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5631,7 +5692,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync21(join26(context.cwd, target.path), "utf8"),
+    readFileSync22(join28(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5769,7 +5830,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync22(join27(cwd, target.path), "utf8"),
+        readFileSync23(join29(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5782,7 +5843,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join27(cwd, "noop.js")).resolve(preset);
+      createRequire4(join29(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5878,7 +5939,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync22(join27(cwd, config), "utf8"),
+        readFileSync23(join29(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5894,7 +5955,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync22(join27(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync24(join29(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -6098,7 +6159,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync23, readFileSync as readFileSync23, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync24, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -6117,7 +6178,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync23(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
+  return existsSync25(absolutePath) ? readFileSync24(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -6235,8 +6296,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync24, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync3, readFileSync as readFileSync25 } from "fs";
+import { join as join30 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -6250,11 +6311,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join28(cwd, "package.json");
-  if (!existsSync24(path)) return [];
+  const path = join30(cwd, "package.json");
+  if (!existsSync26(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync24(path, "utf8"),
+      readFileSync25(path, "utf8"),
       path
     );
     return [
@@ -6277,7 +6338,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync24(join28(cwd, name), "utf8"),
+        readFileSync25(join30(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -6442,19 +6503,19 @@ export {
   buildConfigFile,
   BaseAdapter,
   resolveBin,
+  WORKSPACE_ROOT_MARKER,
+  findWorkspaceRoot,
+  ensureWorkspacePrep,
+  inspectWorkspacePrep,
   VERBS,
   TARGETS,
   LONG_RUNNING_TARGETS,
   SWEEPABLE_TARGETS,
   PRESET_NAMES,
-  WORKSPACE_ROOT_MARKER,
-  findWorkspaceRoot,
-  ensureWorkspacePrep,
-  inspectWorkspacePrep,
   palette,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-RV34GQVH.js.map
+//# sourceMappingURL=chunk-CWJX5DVF.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-RV34GQVH.js";
+} from "./chunk-CWJX5DVF.js";
 export {
   BaseAdapter,
   all,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.15",
+  "version": "1.2.0-alpha.17",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",