@hublo/sentinel 1.2.0-alpha.3 → 1.2.0-alpha.31

package/dist/{chunk-YZ4EKBK7.js → chunk-PLZ45MWU.js}

@@ -67,19 +67,6 @@ function resolve(target, preset, runner) {
   return matching[0];
 }
 
-// src/core/base-adapter.ts
-var BaseAdapter = class {
-  inspect(_ctx) {
-    throw new Error(`${this.runner}: --inspect not implemented yet`);
-  }
-  report(_ctx) {
-    throw new Error(`${this.runner}: --report not implemented yet`);
-  }
-  status(_ctx) {
-    throw new Error(`${this.runner}: --status not implemented yet`);
-  }
-};
-
 // src/shared/package-json.ts
 import { existsSync, readFileSync } from "fs";
 import { basename, dirname, join } from "path";
@@ -132,6 +119,19 @@ function moduleName(dir) {
   return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
 }
 
+// src/core/base-adapter.ts
+var BaseAdapter = class {
+  inspect(_ctx) {
+    throw new Error(`${this.runner}: --inspect not implemented yet`);
+  }
+  report(_ctx) {
+    throw new Error(`${this.runner}: --report not implemented yet`);
+  }
+  status(_ctx) {
+    throw new Error(`${this.runner}: --status not implemented yet`);
+  }
+};
+
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
 var TARGETS = [
@@ -165,86 +165,99 @@ function palette(stream) {
   };
 }
 
-// src/roles/build/adapters/vite/vite-role.adapter.ts
-import { spawnSync } from "child_process";
-
-// src/core/config/tool-args.ts
-import { existsSync as existsSync2 } from "fs";
-import { isAbsolute, resolve as resolve2 } from "path";
-function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
-  const takesValue = new Set(valueFlags);
-  const options = [];
-  const paths = [];
-  let previousTakesValue = false;
-  for (const arg of toolArgs) {
-    const looksLikeOption = arg.startsWith("-");
-    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
-    if (!previousTakesValue && !looksLikeOption && existsSync2(target)) paths.push(arg);
-    else options.push(arg);
-    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+// src/roles/build/nest/nx-target.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2, relative } from "path";
+var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
+var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
+var readProjectJson = (cwd) => {
+  const path = join2(cwd, "project.json");
+  if (!existsSync2(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
   }
-  return { options, paths };
+};
+function webpackBuildTarget(cwd) {
+  const project = readProjectJson(cwd);
+  const target = project?.targets?.build;
+  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
+  const { outputPath, main, webpackConfig, transformers, assets } = target.options ?? {};
+  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
+    return void 0;
+  }
+  return {
+    project: project.name,
+    outputPath,
+    main,
+    webpackConfig,
+    configurations: target.configurations,
+    transformers,
+    assets
+  };
 }
-
-// src/shared/resolve-bin.ts
-import { existsSync as existsSync3 } from "fs";
-import { createRequire } from "module";
-import { delimiter, dirname as dirname2, join as join2 } from "path";
-var require2 = createRequire(import.meta.url);
-function resolveBin(fromDir, name) {
-  let dir = fromDir;
-  for (; ; ) {
-    const candidate = join2(dir, "node_modules", ".bin", name);
-    if (existsSync3(candidate)) return candidate;
-    const parent = dirname2(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
+function refusalFor(cwd, target) {
+  if (workspaceRootFor(cwd, target) === void 0) {
+    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
   }
+  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
+    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
+  }
+  const live = liveFileReplacements(cwd, target);
+  if (live.length > 0) {
+    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
+  }
+  return void 0;
 }
-function binFromOwnInstall(packageName, binName) {
-  try {
-    const manifest = require2.resolve(`${packageName}/package.json`);
-    const bin = require2(manifest).bin;
-    const relative4 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative4) return void 0;
-    const executable = join2(dirname2(manifest), relative4);
-    return existsSync3(executable) ? executable : void 0;
-  } catch {
-    return void 0;
+function liveFileReplacements(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) return [];
+  const configurations = target.configurations ?? {};
+  const live = [];
+  for (const configuration of Object.values(configurations)) {
+    for (const replacement of configuration.fileReplacements ?? []) {
+      const exists = existsSync2(join2(workspaceRoot, replacement.replace)) || existsSync2(join2(workspaceRoot, replacement.with));
+      if (exists) live.push(replacement.replace);
+    }
   }
+  return live;
 }
-function binSearchPath(cwd) {
-  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
-    " then "
-  );
+function workspaceRootFor(cwd, target) {
+  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
+  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
+  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
+}
+function workspaceRootHops(cwd, target) {
+  const root = workspaceRootFor(cwd, target);
+  if (root === void 0) {
+    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
+  }
+  const rel = relative(root, cwd);
+  return rel === "" ? 0 : rel.split(/[\\/]/).length;
 }
 
-// src/roles/build/plan.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
-
-// src/core/config/existing-command.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 
-// src/shared/jsonc.ts
-import { parse, printParseErrorCode } from "jsonc-parser";
-function parseJsonc(text, source = "config") {
-  const errors = [];
-  const value = parse(text, errors, { allowTrailingComma: true });
-  if (errors.length > 0) {
-    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
-    throw new Error(`${source}: malformed JSONC (${details}).`);
-  }
-  return value;
+// src/core/config/module-type.ts
+function esmReadiness(fileName, packageType) {
+  if (/\.(mts|mjs)$/.test(fileName)) return { kind: "ready" };
+  if (packageType === "module") return { kind: "ready" };
+  const rename = fileName.replace(/\.(ts|js)$/, ".mts");
+  return {
+    kind: "blocked",
+    why: `sentinel is ESM only, and this module ${packageType === void 0 ? 'declares no `"type"`' : `declares \`"type": "${packageType}"\``}, so Node loads ${fileName} as CommonJS and the import fails. Two remedies, and adoption takes neither by itself because both reach beyond this build: add \`"type": "module"\` to this module's package.json, which changes how EVERY \`.js\` here loads, or rename the config to \`${rename}\`, which settles it in the filename where nothing can undo it.`
+  };
 }
 
 // src/core/config/manifest.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join3(cwd, "package.json"), "utf8"));
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -252,7 +265,7 @@ function moduleScripts(cwd) {
 }
 function moduleName2(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -266,120 +279,36 @@ function selfCommand(cwd, flags) {
   if (!isSelfAdoption(cwd) || !own.bin) return void 0;
   return `node ${own.bin.replace(/^\.\//, "")} ${flags}`;
 }
+function adoptedPackageName(cwd) {
+  return readProjectPackageJson(cwd).name ?? readNxProjectName(cwd) ?? basename2(cwd);
+}
 function manifestOperation(cwd, scripts) {
   const own = readOwnPackage();
   const value = {
     scripts,
     devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
   };
-  if (existsSync4(join3(cwd, "package.json"))) {
+  if (existsSync3(join3(cwd, "package.json"))) {
     return { kind: "merge-json", path: "package.json", value };
   }
   return {
     kind: "merge-json",
     path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename2(cwd), private: true, ...value }
+    value: { name: adoptedPackageName(cwd), private: true, ...value }
   };
 }
 
-// src/core/config/existing-command.ts
-function nxTargetCommand(cwd, target) {
-  let project;
+// src/core/config/project-json.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+function projectTargets(cwd) {
+  const path = join4(cwd, "project.json");
+  if (!existsSync4(path)) return void 0;
   try {
-    project = parseJsonc(
-      readFileSync3(join4(cwd, "project.json"), "utf8"),
-      "project.json"
-    );
+    return JSON.parse(readFileSync4(path, "utf8")).targets;
   } catch {
     return void 0;
   }
-  const entry = project.targets?.[target];
-  if (!entry || entry.executor !== "nx:run-commands") return void 0;
-  const { command, commands, cwd: targetCwd } = entry.options ?? {};
-  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
-  if (typeof command === "string" && command.trim() !== "") {
-    return { command: command.trim(), ranInModule };
-  }
-  if (Array.isArray(commands)) {
-    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
-    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
-  }
-  return void 0;
-}
-function rootedForScript(command) {
-  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
-}
-function existingCommand(cwd, target) {
-  const script = moduleScripts(cwd)[target];
-  if (script !== void 0 && script.trim() !== "") return script;
-  const fromTarget = nxTargetCommand(cwd, target);
-  if (fromTarget === void 0) return void 0;
-  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
-}
-
-// src/core/config/nx-target.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
-function nxTargetOperations(options) {
-  const { cwd, targets } = options;
-  const names = Object.keys(targets);
-  if (names.length === 0) return [];
-  const operations = [];
-  if (existsSync5(join5(cwd, "project.json"))) {
-    operations.push({
-      kind: "remove-json-keys",
-      path: "project.json",
-      keys: names.map((name) => ["targets", name])
-    });
-  }
-  operations.push({
-    kind: "merge-json",
-    path: "package.json",
-    value: { nx: { targets } }
-  });
-  return operations;
-}
-
-// src/core/config/tool-script.ts
-var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
-function isSeparatorAt(index) {
-  return index % 2 === 1;
-}
-function invokes(segment, binary) {
-  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
-}
-function isSentinelSegment(segment, roleFlag) {
-  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
-  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
-}
-function composeToolScript(existing, options) {
-  const { command } = options;
-  if (!existing || existing.trim() === "") return command;
-  const { roleFlag } = options;
-  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
-  const parts = existing.split(SEGMENT_SEPARATOR);
-  const commands = parts.filter((_, index) => !isSeparatorAt(index));
-  if (!commands.some(isReplaceable)) return existing;
-  let replacedOnce = false;
-  const rebuilt = parts.map((part, index) => {
-    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
-    if (replacedOnce) return null;
-    replacedOnce = true;
-    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
-  });
-  const kept = [];
-  for (let index = 0; index < rebuilt.length; index += 1) {
-    const part = rebuilt[index];
-    if (part === null) {
-      if (kept.length > 0) kept.pop();
-      continue;
-    }
-    kept.push(part);
-  }
-  return kept.join("").trim();
-}
-function keepsOtherCommands(script, sentinelCommand) {
-  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
 
 // src/roles/build/presets/requirements.json
@@ -408,7 +337,8 @@ var toolchain_default = {
         "UserConfig",
         "UserConfigExport"
       ],
-      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck.",
+      floor: "Never below 8.2.2. Vite 8.0.8 resolves rolldown 1.0.0-rc.15, a release candidate whose deferred-module-initialisation codegen is broken: it wrapped a plain re-export barrel in an init helper, then required the module without binding its exports before calling the very function that binding provides. Measured, that crashed 7 of the 8 Nest services with a transformer at their first require (`init_<module> is not defined`), and quietly moved the published contract of 4 others. 8.2.2 resolves rolldown 1.2.6 and all 35 services regenerate their committed OpenAPI document identically. The version is not a preference, it is the floor at which those measurements hold."
     },
     {
       package: "@vitejs/plugin-react",
@@ -467,16 +397,28 @@ var BUILD_CONFIG_FILES = [
   "vite.config.js",
   "vite.config.mjs"
 ];
-var BUILD_PRESET_SPECIFIER = "@hublo/sentinel/build/react";
+var BUILD_PRESET_SPECIFIERS = {
+  react: "@hublo/sentinel/build/react",
+  nest: "@hublo/sentinel/build/nest"
+};
+var BUILD_PRESET_SPECIFIER = BUILD_PRESET_SPECIFIERS.react;
 var BUILD_SCRIPT_NAME = "build";
-var SENTINEL_BUILD_COMMAND = "sentinel --run --build";
+var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
-function buildTarget() {
+var BUILD_OUTPUT_CANDIDATES = ["dist", ".output", "build"];
+function buildTarget(options) {
+  const { moduleName: moduleName3, configFiles = BUILD_CONFIG_FILES, outputs } = options;
   return {
     [BUILD_SCRIPT_NAME]: {
+      executor: "nx:run-commands",
+      options: {
+        command: `pnpm --filter ${moduleName3} run ${BUILD_SCRIPT_NAME}`,
+        forwardAllArgs: false
+      },
       cache: true,
-      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
+      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)],
+      outputs: [...outputs]
     }
   };
 }
@@ -484,29 +426,58 @@ var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
   (entry) => entry.package
 );
 
-// src/roles/build/dev-script.ts
-var CHAIN = " -- ";
-var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
-var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
-function appOptions(rest) {
-  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
-  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
-  return kept.join(" ");
-}
-function composeDevScript(existing, command) {
-  if (existing === void 0 || existing.trim() === "") return command;
-  const chunks = existing.trim().split(CHAIN);
-  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
-  if (at === -1) return existing;
-  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
-  const options = appOptions(rest);
-  chunks[at] = options === "" ? command : `${command} -- ${options}`;
-  return chunks.join(CHAIN);
+// src/roles/build/adoption-drift.ts
+function buildAdoptionDrift(cwd) {
+  const drift = [];
+  const manifest = readProjectPackageJson(cwd);
+  const script = moduleScripts(cwd)[BUILD_SCRIPT_NAME];
+  if (script === void 0) {
+    drift.push(
+      `has no \`${BUILD_SCRIPT_NAME}\` npm script, so \`pnpm run ${BUILD_SCRIPT_NAME}\` does not build it and only nx can`
+    );
+  } else if (!script.includes(SENTINEL_BUILD_COMMAND.replace(/ --$/, ""))) {
+    drift.push(
+      `its \`${BUILD_SCRIPT_NAME}\` script does not invoke sentinel (${script}), so the config points at sentinel while the script runs something else`
+    );
+  }
+  const target = manifest.nx?.targets?.[BUILD_SCRIPT_NAME];
+  if (target === void 0) {
+    drift.push(
+      `declares no \`nx.targets.${BUILD_SCRIPT_NAME}\`, so its build runs on nx's default inputs while every other target it has declares its own`
+    );
+  } else {
+    if (target.cache === true && (target.outputs ?? []).length === 0) {
+      drift.push(
+        `caches its build and declares no \`outputs\`, so nx stores nothing and a cache hit reports success with no build on disk`
+      );
+    }
+    const inputs = target.inputs ?? [];
+    if (inputs.length > 0 && !inputs.includes("^default")) {
+      drift.push(
+        `declares \`inputs\` without \`^default\`, which REPLACES nx's default and stops hashing its dependencies: the build can replay a stale bundle after one changes`
+      );
+    }
+    if (target.options?.forwardAllArgs !== false) {
+      drift.push(
+        `does not set \`forwardAllArgs: false\`, so a caller's extra flag reaches the bundler, which refuses it (the image passes \`--generatePackageJson\`)`
+      );
+    }
+  }
+  if (projectTargets(cwd)?.[BUILD_SCRIPT_NAME] !== void 0) {
+    drift.push(
+      `still declares a \`${BUILD_SCRIPT_NAME}\` target in project.json beside the one in package.json, so the module has two and which runs depends on the caller`
+    );
+  }
+  const devScript = moduleScripts(cwd)[DEV_SCRIPT_NAME];
+  if (devScript?.includes(SENTINEL_DEV_COMMAND) === true && projectTargets(cwd)?.[DEV_SCRIPT_NAME] !== void 0) {
+    drift.push(
+      `runs its \`${DEV_SCRIPT_NAME}\` script through sentinel but still declares a \`${DEV_SCRIPT_NAME}\` target in project.json, so one dev server has two declarations and editing the target stops the script from being what runs`
+    );
+  }
+  return drift;
 }
 
 // src/roles/build/read-adoption.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join6 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -517,19 +488,25 @@ var NOT_ADOPTED = (configFile, unreadable = null) => ({
   unreadable
 });
 function buildConfigFile(cwd) {
-  return BUILD_CONFIG_FILES.find((name) => existsSync6(join6(cwd, name)));
+  return BUILD_CONFIG_FILES.find((name) => existsSync5(join5(cwd, name)));
 }
 function importsSpecifier(source, specifier) {
   const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`(?:from|import)\\s*\\(?\\s*['"\`]${escaped}(?:/[^'"\`]*)?['"\`]`).test(source);
 }
 function importsPreset(source) {
-  return importsSpecifier(source, BUILD_PRESET_SPECIFIER);
+  return Object.values(BUILD_PRESET_SPECIFIERS).some(
+    (specifier) => importsSpecifier(source, specifier)
+  );
 }
 var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
   const source = readBuildConfigSource(cwd);
-  if (source === void 0) return void 0;
+  if (source === void 0) {
+    if (buildConfigFile(cwd) !== void 0) return void 0;
+    return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
+  }
+  if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
   if (importsPreset(source)) return "react";
   return REACT_PLUGIN_SPECIFIERS.some((specifier) => importsSpecifier(source, specifier)) ? "react" : void 0;
 }
@@ -537,7 +514,7 @@ function readBuildConfigSource(cwd) {
   const configFile = buildConfigFile(cwd);
   if (!configFile) return void 0;
   try {
-    return readFileSync4(join6(cwd, configFile), "utf8");
+    return readFileSync5(join5(cwd, configFile), "utf8");
   } catch {
     return void 0;
   }
@@ -547,38 +524,494 @@ function readBuildAdoption(cwd) {
   if (!configFile) return NOT_ADOPTED(null);
   let source;
   try {
-    source = readFileSync4(join6(cwd, configFile), "utf8");
+    source = readFileSync5(join5(cwd, configFile), "utf8");
   } catch (error) {
     return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
   }
-  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
+  if (!importsPreset(source)) {
+    const esm = esmReadiness(configFile, readProjectPackageJson(cwd).type);
+    return NOT_ADOPTED(configFile, esm.kind === "blocked" ? esm.why : null);
+  }
   const manifest = readProjectPackageJson(cwd);
   const declared = { ...manifest.dependencies, ...manifest.devDependencies };
   const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
     (name) => ({ name, version: declared[name] })
   );
+  const drift = [
+    ...ownDeclarations.map(
+      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
+    ),
+    ...buildAdoptionDrift(cwd)
+  ];
   return {
     configFile,
-    preset: "react",
+    // Read from the config rather than assumed: the two presets are adopted the same way and
+    // reporting the wrong one would make `--inspect` lie about what a module builds.
+    preset: declaredBuildPreset(cwd) ?? "react",
     adopted: true,
-    conformant: ownDeclarations.length === 0,
-    drift: ownDeclarations.map(
-      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
-    ),
+    conformant: drift.length === 0,
+    drift,
     ownDeclarations,
     unreadable: null
   };
 }
 
-// src/roles/build/requirements.ts
-function atLeast(declared, needed) {
-  const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
-  const left = parse2(declared);
-  const right = parse2(needed);
-  for (let at = 0; at < Math.max(left.length, right.length); at++) {
-    const a = left[at] ?? 0;
-    const b = right[at] ?? 0;
-    if (a !== b) return a > b;
+// src/roles/build/adapters/vite/vite-role.adapter.ts
+import { spawnSync } from "child_process";
+
+// src/core/config/tool-args.ts
+import { existsSync as existsSync6 } from "fs";
+import { isAbsolute, resolve as resolve2 } from "path";
+function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
+  const takesValue = new Set(valueFlags);
+  const options = [];
+  const paths = [];
+  let previousTakesValue = false;
+  for (const arg of toolArgs) {
+    const looksLikeOption = arg.startsWith("-");
+    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
+    if (!previousTakesValue && !looksLikeOption && existsSync6(target)) paths.push(arg);
+    else options.push(arg);
+    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+  }
+  return { options, paths };
+}
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync7 } from "fs";
+import { createRequire } from "module";
+import { delimiter, dirname as dirname2, join as join6 } from "path";
+var require2 = createRequire(import.meta.url);
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join6(dir, "node_modules", ".bin", name);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function binFromOwnInstall(packageName, binName) {
+  try {
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative5 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative5) return void 0;
+    const executable = join6(dirname2(manifest), relative5);
+    return existsSync7(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function binSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/build/plan.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { join as join11 } from "path";
+
+// src/core/config/existing-command.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
+
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+// src/core/config/existing-command.ts
+function nxTargetCommand(cwd, target) {
+  let project;
+  try {
+    project = parseJsonc(
+      readFileSync6(join7(cwd, "project.json"), "utf8"),
+      "project.json"
+    );
+  } catch {
+    return void 0;
+  }
+  const entry = project.targets?.[target];
+  if (!entry || entry.executor !== "nx:run-commands") return void 0;
+  const { command, commands, cwd: targetCwd } = entry.options ?? {};
+  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
+  if (typeof command === "string" && command.trim() !== "") {
+    return { command: command.trim(), ranInModule };
+  }
+  if (Array.isArray(commands)) {
+    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
+    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
+  }
+  return void 0;
+}
+function rootedForScript(command) {
+  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
+}
+function existingCommand(cwd, target) {
+  const script = moduleScripts(cwd)[target];
+  if (script !== void 0 && script.trim() !== "") return script;
+  const fromTarget = nxTargetCommand(cwd, target);
+  if (fromTarget === void 0) return void 0;
+  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+}
+
+// src/core/config/nx-target.ts
+import { existsSync as existsSync8 } from "fs";
+import { join as join8 } from "path";
+function nxTargetMetadataOperations(options) {
+  const { targets } = options;
+  if (Object.keys(targets).length === 0) return [];
+  return [{ kind: "merge-json", path: "package.json", value: { nx: { targets } } }];
+}
+function nxTargetOperations(options) {
+  const { cwd, targets } = options;
+  const names = Object.keys(targets);
+  if (names.length === 0) return [];
+  const operations = [];
+  if (existsSync8(join8(cwd, "project.json"))) {
+    operations.push({
+      kind: "remove-json-keys",
+      path: "project.json",
+      keys: names.map((name) => ["targets", name])
+    });
+  }
+  operations.push(...nxTargetMetadataOperations(options));
+  return operations;
+}
+
+// src/core/config/tool-script.ts
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function invokes(segment, binary) {
+  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
+}
+function isSentinelSegment(segment, roleFlag) {
+  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
+  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
+}
+function composeToolScript(existing, options) {
+  const { command } = options;
+  if (!existing || existing.trim() === "") return command;
+  const { roleFlag } = options;
+  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isReplaceable)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
+    }
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script, sentinelCommand) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
+}
+
+// src/roles/format/read-adoption.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+
+// src/roles/format/config-policy.ts
+var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
+var FORMAT_SCRIPT_NAME = "format";
+var PROVENANCE_KEY = "$sentinel";
+var PERMITTED_LOCAL_KEYS = [
+  "useTabs",
+  "tabWidth",
+  "printWidth",
+  "semi",
+  "singleQuote",
+  "jsxSingleQuote",
+  "trailingComma",
+  "quoteProps",
+  "bracketSpacing",
+  "bracketSameLine",
+  "arrowParens",
+  "endOfLine",
+  "objectWrap",
+  "proseWrap",
+  "experimentalOperatorPosition"
+];
+var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
+var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
+var PRETTIER_CONFIG_FILES = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function formatTargets() {
+  return {
+    [FORMAT_SCRIPT_NAME]: {
+      cache: true,
+      inputs: ["default", `{projectRoot}/${FORMAT_CONFIG_FILE}`]
+    },
+    [`${FORMAT_SCRIPT_NAME}:fix`]: { cache: false }
+  };
+}
+
+// src/roles/format/presets/base.json
+var base_default = {
+  printWidth: 80,
+  semi: false,
+  singleQuote: true,
+  trailingComma: "all",
+  sortPackageJson: false,
+  sortImports: false
+};
+
+// src/roles/format/presets/nest-imports.json
+var nest_imports_default = {
+  customGroups: [
+    {
+      groupName: "workspace",
+      elementNamePattern: ["@hublo/**", "@shared/**", "@front/**", "@network/**"]
+    }
+  ],
+  groups: ["builtin", "external", "workspace", ["parent", "index"], "sibling"],
+  newlinesBetween: true,
+  order: "asc",
+  ignoreCase: false
+};
+
+// src/roles/format/preset-data.ts
+var FORMAT_PRESETS = ["base", "svelte", "nest"];
+function hasFormatPreset(name) {
+  return FORMAT_PRESETS.includes(name);
+}
+function formatPresetName(declared) {
+  if (declared === "svelte") return "svelte";
+  if (declared === "nest") return "nest";
+  return "base";
+}
+function formatPresetFor(preset) {
+  const base = base_default;
+  const name = formatPresetName(preset);
+  if (name === "svelte") return { ...base, svelte: true };
+  if (name === "nest") return { ...base, sortImports: nest_imports_default };
+  return base;
+}
+
+// src/roles/format/read-adoption.ts
+var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  local: {},
+  presetVersion: null,
+  effective: {},
+  unreadable
+});
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function readFormatAdoption(cwd) {
+  const path = join9(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync9(path)) return NOT_ADOPTED2(null);
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync7(path, "utf8"), FORMAT_CONFIG_FILE);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
+  }
+  const provenance = parsed[PROVENANCE_KEY];
+  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
+  if (!hasFormatPreset(provenance.preset)) {
+    return NOT_ADOPTED2(
+      FORMAT_CONFIG_FILE,
+      `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
+    );
+  }
+  const declaredLocal = Array.isArray(provenance.local) ? provenance.local : [];
+  const preset = formatPresetFor(provenance.preset);
+  const drift = [];
+  const local = {};
+  for (const [key, expected] of Object.entries(preset)) {
+    if (declaredLocal.includes(key)) {
+      local[key] = parsed[key];
+      continue;
+    }
+    if (!(key in parsed) || !sameValue(parsed[key], expected)) drift.push(key);
+  }
+  for (const key of declaredLocal) {
+    if (!(key in preset)) local[key] = parsed[key];
+  }
+  for (const key of ALWAYS_LOCAL_KEYS) {
+    if (key in parsed) local[key] = parsed[key];
+  }
+  return {
+    configFile: FORMAT_CONFIG_FILE,
+    preset: provenance.preset,
+    adopted: true,
+    conformant: drift.length === 0,
+    drift,
+    local,
+    presetVersion: typeof provenance.version === "string" ? provenance.version : null,
+    effective: parsed,
+    unreadable: null
+  };
+}
+
+// src/roles/build/dev-script.ts
+var CHAIN = " -- ";
+var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
+var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
+function appOptions(rest) {
+  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
+  return kept.join(" ");
+}
+function composeDevScript(existing, command) {
+  if (existing === void 0 || existing.trim() === "") return command;
+  const chunks = existing.trim().split(CHAIN);
+  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at === -1) return existing;
+  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const options = appOptions(rest);
+  chunks[at] = options === "" ? `${command} --` : `${command} -- ${options}`;
+  return chunks.join(CHAIN);
+}
+
+// src/roles/build/dev-target.ts
+var DELEGATION_KEYS = /* @__PURE__ */ new Set(["executor", "options"]);
+var DELEGATION_OPTION_KEYS = /* @__PURE__ */ new Set(["command", "cwd"]);
+function delegatesToScript(target, scriptName) {
+  if (typeof target !== "object" || target === null || Array.isArray(target)) return false;
+  const entries = target;
+  if (!Object.keys(entries).every((key) => DELEGATION_KEYS.has(key))) return false;
+  if (entries["executor"] !== "nx:run-commands") return false;
+  const options = entries["options"];
+  if (typeof options !== "object" || options === null || Array.isArray(options)) return false;
+  const declared = options;
+  if (!Object.keys(declared).every((key) => DELEGATION_OPTION_KEYS.has(key))) return false;
+  const command = declared["command"];
+  if (typeof command !== "string") return false;
+  return new RegExp(String.raw`(^|\s)run\s+${scriptName}$`).test(command.trim());
+}
+function devScriptIsAdopted(devScript) {
+  return devScript !== void 0 && devScript.includes(SENTINEL_DEV_COMMAND);
+}
+function devTargetOperations(cwd, devScript) {
+  if (!devScriptIsAdopted(devScript)) return { operations: [] };
+  const target = projectTargets(cwd)?.[DEV_SCRIPT_NAME];
+  if (target === void 0) return { operations: [] };
+  if (!delegatesToScript(target, DEV_SCRIPT_NAME)) {
+    return {
+      operations: [],
+      note: `left the \`${DEV_SCRIPT_NAME}\` target in project.json alone: it does more than call \`pnpm run ${DEV_SCRIPT_NAME}\`, so removing it would drop behaviour this role never declared. Move what it does into the script, or keep it and accept the second home.`
+    };
+  }
+  return {
+    operations: [
+      { kind: "remove-json-keys", path: "project.json", keys: [["targets", DEV_SCRIPT_NAME]] }
+    ],
+    note: `removed the \`${DEV_SCRIPT_NAME}\` target from project.json: it only called \`pnpm run ${DEV_SCRIPT_NAME}\`, which nx infers from the script itself. host-admin has run without that target all along.`
+  };
+}
+
+// src/roles/build/nest/adopt.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join10 } from "path";
+var NEST_CONFIG_FILE = "vite.config.mts";
+function asSource(value, depth) {
+  const pad = "  ".repeat(depth);
+  const inner = "  ".repeat(depth + 1);
+  if (Array.isArray(value)) {
+    if (value.length === 0) return "[]";
+    return `[
+${value.map((item) => `${inner}${asSource(item, depth + 1)}`).join(",\n")},
+${pad}]`;
+  }
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0) return "{}";
+    return `{
+${entries.map(([key, item]) => `${inner}${asKey(key)}: ${asSource(item, depth + 1)}`).join(",\n")},
+${pad}}`;
+  }
+  if (typeof value === "string") return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error(
+    `sentinel build(nest): cannot write ${typeof value} into the generated config. The build target carries a shape this translation was not written for, and it should refuse rather than emit something nobody has read.`
+  );
+}
+function asKey(key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `'${key}'`;
+}
+function nestConfigSource(cwd, target) {
+  const hops = workspaceRootHops(cwd, target);
+  const up = Array.from({ length: hops }, () => "..").join("/");
+  const carried = (name, value) => value === void 0 || value.length === 0 ? "" : `  ${name}: ${asSource(value, 1)},
+`;
+  return `import path from 'node:path'
+
+import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
+
+export default nestService({
+  project: '${target.project}',
+  root: __dirname,
+  workspaceRoot: path.resolve(__dirname, '${up}'),
+  outDir: '${target.outputPath}',
+${carried("transformers", target.transformers)}${carried("assets", target.assets)}})
+`;
+}
+function nestBuildOutputs(target) {
+  return [`{workspaceRoot}/${target.outputPath}`];
+}
+var OUT_DIR_IN_CONFIG = /^\s*outDir:\s*'([^']+)'/m;
+function nestOutputsFromConfig(cwd) {
+  const configPath = join10(cwd, NEST_CONFIG_FILE);
+  if (!existsSync10(configPath)) return void 0;
+  const outDir = OUT_DIR_IN_CONFIG.exec(readFileSync8(configPath, "utf8"))?.[1];
+  return outDir === void 0 ? void 0 : [`{workspaceRoot}/${outDir}`];
+}
+function nestAdoptionOperations(cwd, target) {
+  return [{ kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) }];
+}
+
+// src/roles/build/requirements.ts
+function atLeast(declared, needed) {
+  const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse2(declared);
+  const right = parse2(needed);
+  for (let at = 0; at < Math.max(left.length, right.length); at++) {
+    const a = left[at] ?? 0;
+    const b = right[at] ?? 0;
+    if (a !== b) return a > b;
   }
   return true;
 }
@@ -598,32 +1031,27 @@ function describeUnmet(preset, unmet) {
   return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
 }
 
-// src/roles/build/rewrite-imports.ts
+// src/core/config/rewrite-imports.ts
 import { parseSync } from "oxc-parser";
-var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
-function esmBlocker(fileName, packageType) {
-  if (/\.(mts|mjs)$/.test(fileName)) return void 0;
-  if (packageType === "module") return void 0;
-  return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
-}
-var DEFAULT_EXPORT_NAMES = Object.fromEntries(
-  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
-    entry.specifier,
-    entry.default
-  ])
+var movedSpecifiers = (toolchain) => new Set(toolchain.owned.map((entry) => entry.specifier));
+var defaultExportNames = (toolchain) => Object.fromEntries(
+  toolchain.owned.filter((entry) => entry.default !== void 0).map((entry) => [entry.specifier, entry.default])
 );
-function renderImport(bindings) {
+function renderImport(bindings, presetSpecifier, semi) {
   const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
+  const end = semi ? ";" : "";
   const values = bindings.filter((b) => !b.typeOnly);
   const types = bindings.filter((b) => b.typeOnly);
   const lines = [];
-  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${presetSpecifier}'${end}`);
   if (types.length > 0) {
-    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+    lines.push(`import type { ${render(types)} } from '${presetSpecifier}'${end}`);
   }
   return lines.join("\n");
 }
-function rewriteBuildImports(source, fileName = "vite.config.ts") {
+function rewriteToolchainImports(toolchain, source, fileName) {
+  const moved = movedSpecifiers(toolchain);
+  const defaults = defaultExportNames(toolchain);
   const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
   if (errors.length > 0) {
     return {
@@ -634,10 +1062,10 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   const imports = program.body.filter(
     (node) => node.type === "ImportDeclaration"
   );
-  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+  if (imports.some((node) => node.source.value === toolchain.presetSpecifier)) {
     return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
   }
-  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  const moving = imports.filter((node) => moved.has(node.source.value));
   if (moving.length === 0) {
     return {
       kind: "unchanged",
@@ -654,7 +1082,7 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     for (const spec of specifiers) {
       const typeOnly = node.importKind === "type" || spec.importKind === "type";
       if (spec.type === "ImportDefaultSpecifier") {
-        const exported = DEFAULT_EXPORT_NAMES[from];
+        const exported = defaults[from];
         if (!exported) {
           return {
             kind: "blocked",
@@ -686,7 +1114,8 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
     out = out.slice(0, span.start) + out.slice(span.end + after);
   }
-  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  const semi = source.slice(first.start, first.end).trimEnd().endsWith(";");
+  out = out.slice(0, first.start) + renderImport(bindings, toolchain.presetSpecifier, semi) + out.slice(first.end);
   return {
     kind: "rewritten",
     source: out,
@@ -694,7 +1123,19 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   };
 }
 
+// src/roles/build/rewrite-imports.ts
+var BUILD_TOOLCHAIN = {
+  presetSpecifier: BUILD_PRESET_SPECIFIER,
+  owned: OWNED_PACKAGES
+};
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  return rewriteToolchainImports(BUILD_TOOLCHAIN, source, fileName);
+}
+
 // src/roles/build/plan.ts
+function candidateOutputs() {
+  return BUILD_OUTPUT_CANDIDATES.map((name) => `{projectRoot}/${name}`);
+}
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -726,6 +1167,8 @@ function buildScripts(cwd) {
     const own2 = moduleName(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
+      // No trailing `--` here: `composeDevScript` owns the separator, and adding one on both
+      // sides produced `-- --`, handing Vite an argument nobody wrote.
       `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
     );
   }
@@ -740,54 +1183,73 @@ function plan(context) {
   if (unmet.length > 0) {
     return { operations: [], skipped: describeUnmet(context.preset, unmet) };
   }
-  if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
+  const declaredPreset2 = declaredBuildPreset(context.cwd);
+  const configFile = buildConfigFile(context.cwd);
+  if (declaredPreset2 === void 0 && configFile !== void 0) {
+    return {
+      operations: [],
+      skipped: `this module has a Vite config, but it builds neither a React app (no @vitejs/plugin-react or @tanstack/react-start) nor a Nest service (no ${BUILD_PRESET_SPECIFIERS.nest}). Those are the two families this role serves.`
+    };
+  }
+  const webpackTarget = webpackBuildTarget(context.cwd);
+  if (declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0) {
+    return planNestService(context, webpackTarget);
+  }
+  if (configFile === void 0) {
     return {
       operations: [],
-      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through \`@nx/webpack\`), the build role does not apply to it.`
     };
   }
+  return planReactApp(context, configFile);
+}
+function planReactApp(context, configFile) {
   const notes = [];
   const operations = [];
-  const configFile = buildConfigFile(context.cwd);
-  if (configFile === void 0) {
+  const esm = esmReadiness(configFile, readProjectPackageJson(context.cwd).type);
+  if (esm.kind === "blocked") return { operations: [], skipped: esm.why };
+  const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+  if (rewrite.kind === "blocked") {
     return {
       operations: [],
-      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 projects here build through \`@nx/webpack\`), the build role does not apply to it.`
+      skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
     };
-  } else {
-    const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
-    if (notEsm !== void 0) return { operations: [], skipped: notEsm };
-    const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
-    if (rewrite.kind === "blocked") {
-      return {
-        operations: [],
-        skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
-      };
-    }
-    if (rewrite.kind === "rewritten") {
-      operations.push({ kind: "write", path: configFile, contents: rewrite.source });
-    }
-    for (const name of COMPANION_CONFIG_FILES) {
-      const source = readConfigSource(context.cwd, name);
-      if (source === "") continue;
-      const companion = rewriteBuildImports(source, name);
-      if (companion.kind === "rewritten") {
-        operations.push({ kind: "write", path: name, contents: companion.source });
-        notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
-      } else if (companion.kind === "blocked") {
-        notes.push(
-          `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
-        );
-      }
-    }
-    if (rewrite.kind === "rewritten") {
+  }
+  if (rewrite.kind === "rewritten") {
+    operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+  }
+  for (const name of COMPANION_CONFIG_FILES) {
+    const source = readConfigSource(context.cwd, name);
+    if (source === "") continue;
+    const companion = rewriteBuildImports(source, name);
+    if (companion.kind === "rewritten") {
+      operations.push({ kind: "write", path: name, contents: companion.source });
+      notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
+    } else if (companion.kind === "blocked") {
       notes.push(
-        `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+        `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
       );
     }
   }
-  operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
-  operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
+  if (rewrite.kind === "rewritten") {
+    notes.push(
+      `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+    );
+  }
+  const scripts = buildScripts(context.cwd);
+  operations.push(manifestOperation(context.cwd, scripts));
+  operations.push(
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({
+        moduleName: adoptedPackageName(context.cwd),
+        outputs: candidateOutputs()
+      })
+    })
+  );
+  const dev = devTargetOperations(context.cwd, scripts[DEV_SCRIPT_NAME]);
+  operations.push(...dev.operations);
+  if (dev.note !== void 0) notes.push(dev.note);
   const owned = ownedBuildDependencies(context.cwd);
   if (owned.length > 0) {
     operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
@@ -795,12 +1257,53 @@ function plan(context) {
       `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
     );
   }
+  const formatted = readFormatAdoption(context.cwd).adopted;
+  notes.push(
+    formatted ? `run \`sentinel --run --format --fix\` on this module: adoption rewrote ${configFile}, and a rewritten import can be longer than your formatter wraps at.` : `this module is formatted by the workspace, not by sentinel, so format ${configFile} with whatever owns it before committing: a rewritten import can be longer than that formatter wraps at, and the check would fail on a file nobody typed.`
+  );
+  notes.push(
+    `this config is code, and it runs before the build does: any environment variable it reads has to be present wherever you build, including a fresh clone, another CI job or an image. Adoption does not change what it reads, but a failure there arrives early and names this role rather than the variable.`
+  );
   return { operations, notes };
 }
+function planNestService(context, webpackTarget) {
+  const outputs = webpackTarget === void 0 ? nestOutputsFromConfig(context.cwd) : nestBuildOutputs(webpackTarget);
+  if (outputs === void 0) {
+    return {
+      operations: [],
+      blocked: `${NEST_CONFIG_FILE} does not declare an \`outDir\`, so sentinel cannot say where this service's build lands. Declaring an nx target without it would cache the build and restore nothing from that cache. Nothing was written.`
+    };
+  }
+  const metadata = [
+    manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND }),
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({
+        moduleName: adoptedPackageName(context.cwd),
+        configFiles: [NEST_CONFIG_FILE],
+        outputs
+      })
+    })
+  ];
+  if (webpackTarget === void 0) return { operations: metadata };
+  const refusal = refusalFor(context.cwd, webpackTarget);
+  if (refusal !== void 0) return { operations: [], blocked: refusal };
+  const dropped = Object.keys(webpackTarget.configurations ?? {});
+  return {
+    operations: [...nestAdoptionOperations(context.cwd, webpackTarget), ...metadata],
+    notes: [
+      `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
+      ...dropped.length > 0 ? [
+        `dropped the \`${dropped.join("`, `")}\` configuration${dropped.length > 1 ? "s" : ""} from the build target: its fileReplacements point at files that do not exist, so it replaced nothing. A live one would have blocked this instead.`
+      ] : [],
+      `verify with \`nx run ${webpackTarget.project}:generate-swagger-file\` and \`git diff --exit-code\`: it runs the built bundle, so it proves the service boots AND that its published contract did not move.`
+    ]
+  };
+}
 function readConfigSource(cwd, configFile) {
-  if (!existsSync7(join7(cwd, configFile))) return "";
+  if (!existsSync11(join11(cwd, configFile))) return "";
   try {
-    return readFileSync5(join7(cwd, configFile), "utf8");
+    return readFileSync9(join11(cwd, configFile), "utf8");
   } catch {
     return "";
   }
@@ -840,11 +1343,17 @@ var ViteRoleAdapter = class extends BaseAdapter {
    * resolution let it run at all — filtering here would give "no adapter for preset svelte",
    * which tells nobody what to do about it.
    *
-   * Nest, node and tools are genuinely declined: there is nothing to bundle, and no version
-   * would change that.
+   * Nest it now serves too, through `@hublo/sentinel/build/nest`. It used to be declined on the
+   * grounds that "there is nothing to bundle", which was never true: those 38 services bundle
+   * with webpack. What changed is that Nx v24 removes the `@nx/webpack:webpack` executor and
+   * the `composePlugins` / `withNx` helpers their shared config is built on, and nx's own
+   * migration generator refuses every one of them because they use `@nx/js:node`
+   * (nrwl/nx#36389). So the way out runs through here.
+   *
+   * `node` and `tools` remain genuinely declined: nothing under them bundles at all.
    */
   appliesTo(preset) {
-    return preset === "react" || preset === "svelte";
+    return preset === "react" || preset === "svelte" || preset === "nest";
   }
   /**
    * `react`, read from the module's Vite config rather than from its dependencies.
@@ -935,40 +1444,252 @@ var ViteDevAdapter = class extends ViteRoleAdapter {
     return "dev";
   }
   /**
-   * There is no such thing as adopting the dev server on its own.
+   * `--init --dev` does the same thing as `--init --build`, and now says so.
+   *
+   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
+   * because adopting one without the other leaves the module half-migrated. What was missing
+   * was only the telling: the run printed a message about the build and nothing about `serve`,
+   * so a developer could believe the dev server had been adopted on its own. Refusing was the
+   * wrong correction, it added friction to a command that already produced the right result.
+   */
+  plan(context) {
+    if (declaredBuildPreset(context.cwd) === "nest" || webpackBuildTarget(context.cwd)) {
+      return {
+        operations: [],
+        skipped: `a Nest service has no dev server, so --dev has nothing to adopt here. Its build is \`sentinel --init --build\`, and it runs as a Node process afterwards.`
+      };
+    }
+    const planned = super.plan(context);
+    if (planned.operations.length === 0) return planned;
+    return {
+      ...planned,
+      notes: [
+        ...planned.notes ?? [],
+        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
+      ]
+    };
+  }
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
    *
-   * `ViteRoleAdapter.plan()` is shared with `--build` because everything else about the two
-   * targets is shared, and inheriting it here made `--init --dev` perform the FULL build
-   * adoption, silently, under a message that only ever mentioned the build. Exiting 0 on that
-   * is the worst of the options: it teaches that dev can be adopted by itself, and that belief
-   * is what produces the half-migrated module this role exists to prevent (see the class
-   * comment above, and `registerBuild`).
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
    *
-   * A single plan writes both scripts, so the honest answer is to name the command that does
-   * it rather than to do it under a different name.
+   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
+   * bare form is the one every version accepts.
    */
-  plan() {
-    throw new Error(
-      "the dev server is adopted together with the build, never on its own. Run --init --build: one plan writes both the `build` and the `serve` scripts."
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    return this.spawnVite(ctx, ready.vite, [], 0);
+  }
+};
+
+// src/roles/build/declared-outputs.ts
+import { existsSync as existsSync13, rmSync, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join13 } from "path";
+
+// src/core/workspace-prep.ts
+import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync } from "fs";
+import { dirname as dirname3, join as join12, relative as relative2 } from "path";
+
+// src/core/settings.ts
+var WORKSPACE_ROOT_MARKER = "nx.json";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+
+// src/core/workspace-prep.ts
+var OVERRIDE_KEY = "i18next>typescript";
+var NATIVE_TS_ALIAS = "@typescript/native";
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
+var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
+function findWorkspaceRoot(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync12(join12(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function declaredNativeTs(pkg) {
+  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
+  if (!spec) return void 0;
+  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
+  return version || void 0;
+}
+function ensureI18nextSingleton(root, dryRun) {
+  const pkgPath = join12(root, "package.json");
+  if (!existsSync12(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+  const want = declaredNativeTs(pkg);
+  if (!want) return void 0;
+  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (have === want) return void 0;
+  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
+  pkg.pnpm ??= {};
+  pkg.pnpm.overrides ??= {};
+  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
+  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
+}
+function ensureReleaseAgeAllowList(root, dryRun) {
+  const yamlPath = join12(root, WORKSPACE_YAML);
+  if (!existsSync12(yamlPath)) return void 0;
+  const own = readOwnPackage().name;
+  const lines = readFileSync10(yamlPath, "utf8").split("\n");
+  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
+  if (keyIdx === -1) return void 0;
+  let lastItemIdx = keyIdx;
+  let indent = "  ";
+  for (let i = keyIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(LIST_ITEM);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastItemIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
+  }
+  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
+  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
+}
+var PRETTIER_IGNORE = ".prettierignore";
+var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
+var ROOT_PRETTIER_CONFIGS = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function ensureFormatterExclusion(root, moduleDir, dryRun) {
+  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
+  if (rel === "" || rel.startsWith("..")) return void 0;
+  const ignorePath = join12(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync12(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync12(join12(root, name)));
+  if (!hasPrettier) return void 0;
+  const pattern = `/${rel}/`;
+  const existing = existsSync12(ignorePath) ? readFileSync10(ignorePath, "utf8") : "";
+  const lines = existing.split("\n");
+  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
+    return void 0;
+  }
+  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
+  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
+  if (headerIdx === -1) {
+    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
+
+`;
+    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
+${pattern}
+`);
+  } else {
+    let end = headerIdx + 1;
+    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
+    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
+    writeFileSync(
+      ignorePath,
+      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
     );
   }
-  /**
-   * Start the dev server. It does not return until stopped, so there is no verdict to report
-   * beyond the exit code the developer's own Ctrl-C produces.
-   *
-   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
-   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
-   * running it again would race the watcher that is about to own the file.
-   *
-   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
-   * bare form is the one every version accepts.
-   */
-  async run(ctx) {
-    const ready = this.prepare(ctx);
-    if (ready.kind === "stop") return ready.result;
-    return this.spawnVite(ctx, ready.vite, [], 0);
+  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
+}
+function ensureWorkspacePrep(opts) {
+  const dryRun = Boolean(opts.dryRun);
+  return [
+    ensureI18nextSingleton(opts.root, dryRun),
+    ensureReleaseAgeAllowList(opts.root, dryRun),
+    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
+  ].filter((message) => message !== void 0);
+}
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join12(root, "package.json");
+  if (existsSync12(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
+  }
+  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
+    });
+  }
+  const own = readOwnPackage().name;
+  const yamlPath = join12(root, WORKSPACE_YAML);
+  if (existsSync12(yamlPath)) {
+    const yaml = readFileSync10(yamlPath, "utf8");
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
+  }
+  return entries;
+}
+
+// src/roles/build/declared-outputs.ts
+function declaredBuildTarget(cwd) {
+  return readProjectPackageJson(cwd).nx?.targets?.[BUILD_SCRIPT_NAME];
+}
+function resolveOutputToken(token, cwd) {
+  if (token.startsWith("{projectRoot}/")) return join13(cwd, token.slice("{projectRoot}/".length));
+  if (token.startsWith("{workspaceRoot}/")) {
+    const root = findWorkspaceRoot(cwd);
+    return root === void 0 ? void 0 : join13(root, token.slice("{workspaceRoot}/".length));
+  }
+  return join13(cwd, token);
+}
+function buildStamp(cwd) {
+  const marker = join13(cwd, `.sentinel-build-stamp-${process.pid}`);
+  try {
+    writeFileSync2(marker, "");
+    const stamp = statSync(marker).mtimeMs;
+    rmSync(marker, { force: true });
+    return stamp;
+  } catch {
+    return Date.now();
+  }
+}
+function writtenSince(path, startedAt) {
+  if (!existsSync13(path)) return false;
+  try {
+    return statSync(path).mtimeMs >= startedAt;
+  } catch {
+    return true;
+  }
+}
+function outputsProblem(cwd, startedAt) {
+  const target = declaredBuildTarget(cwd);
+  if (target === void 0) return void 0;
+  const declared = target.outputs ?? [];
+  if (declared.length === 0) {
+    if (target.cache !== true) return void 0;
+    return `this module's nx build target sets \`cache: true\` and declares no \`outputs\`, so nx will cache this build and restore nothing from it: the next cache hit reports success and leaves no build on disk. Add the directory this build writes to under \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json, or re-run \`sentinel --init --build\`, which declares it.`;
   }
-};
+  const resolved = declared.map((token) => ({ token, path: resolveOutputToken(token, cwd) })).filter((entry) => entry.path !== void 0);
+  if (resolved.length === 0) return void 0;
+  if (resolved.some((entry) => writtenSince(entry.path, startedAt))) return void 0;
+  return `the build wrote nothing to any of the directories this module declares as its nx \`outputs\` (${declared.join(", ")}), so nx would cache this build and restore an empty result from it. Whatever directory the build DID write to belongs in \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json. The build itself succeeded; only its cache declaration is wrong.`;
+}
 
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -1018,7 +1739,15 @@ var ViteAdapter = class extends ViteRoleAdapter {
       );
       return { ok: false, code: prerequisite.code };
     }
-    return this.spawnVite(ctx, ready.vite, ["build"], 1);
+    const startedAt = buildStamp(ctx.cwd);
+    const result = await this.spawnVite(ctx, ready.vite, ["build"], 1);
+    if (!result.ok) return result;
+    const problem = outputsProblem(ctx.cwd, startedAt);
+    if (problem !== void 0) {
+      this.say(problem);
+      return { ok: false, code: 1 };
+    }
+    return result;
   }
   /**
    * What this module builds with, WITHOUT loading its config.
@@ -1090,12 +1819,12 @@ function registerBuild() {
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join8, relative } from "path";
+import { extname, join as join14, relative as relative3 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1146,7 +1875,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join8(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join14(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -1167,12 +1896,12 @@ function listSourceFiles(cwd, extensions) {
       continue;
     }
     for (const entry of entries) {
-      const full = join8(dir, entry.name);
+      const full = join14(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
         continue;
       }
-      if (wanted.has(extname(entry.name))) found.push(relative(cwd, full));
+      if (wanted.has(extname(entry.name))) found.push(relative3(cwd, full));
     }
   }
   return found;
@@ -1180,207 +1909,9 @@ function listSourceFiles(cwd, extensions) {
 
 // src/core/named-scope.ts
 var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
-function scopeFlags(paths) {
-  return paths.length > 0 ? [TOLERATE_EMPTY_FLAG] : [];
-}
-
-// src/core/settings.ts
-var WORKSPACE_ROOT_MARKER = "nx.json";
-var DEFAULT_MAX_DIAGNOSTICS = 100;
-
-// src/core/workspace-prep.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
-import { dirname as dirname3, join as join9, relative as relative2 } from "path";
-var OVERRIDE_KEY = "i18next>typescript";
-var NATIVE_TS_ALIAS = "@typescript/native";
-var WORKSPACE_YAML = "pnpm-workspace.yaml";
-var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
-var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
-function findWorkspaceRoot(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync8(join9(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname3(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function declaredNativeTs(pkg) {
-  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
-  if (!spec) return void 0;
-  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
-  return version || void 0;
-}
-function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join9(root, "package.json");
-  if (!existsSync8(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
-  const want = declaredNativeTs(pkg);
-  if (!want) return void 0;
-  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (have === want) return void 0;
-  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
-  pkg.pnpm ??= {};
-  pkg.pnpm.overrides ??= {};
-  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
-}
-function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (!existsSync8(yamlPath)) return void 0;
-  const own = readOwnPackage().name;
-  const lines = readFileSync6(yamlPath, "utf8").split("\n");
-  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
-  if (keyIdx === -1) return void 0;
-  let lastItemIdx = keyIdx;
-  let indent = "  ";
-  for (let i = keyIdx + 1; i < lines.length; i++) {
-    const match = lines[i]?.match(LIST_ITEM);
-    if (!match) break;
-    indent = match[1] ?? indent;
-    lastItemIdx = i;
-    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
-  }
-  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
-  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
-  writeFileSync(yamlPath, lines.join("\n"));
-  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
-}
-var PRETTIER_IGNORE = ".prettierignore";
-var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
-var ROOT_PRETTIER_CONFIGS = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.json5",
-  ".prettierrc.yml",
-  ".prettierrc.yaml",
-  ".prettierrc.js",
-  ".prettierrc.cjs",
-  ".prettierrc.mjs",
-  "prettier.config.js",
-  "prettier.config.cjs",
-  "prettier.config.mjs"
-];
-function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
-  if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join9(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync8(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync8(join9(root, name)));
-  if (!hasPrettier) return void 0;
-  const pattern = `/${rel}/`;
-  const existing = existsSync8(ignorePath) ? readFileSync6(ignorePath, "utf8") : "";
-  const lines = existing.split("\n");
-  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
-    return void 0;
-  }
-  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
-  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
-  if (headerIdx === -1) {
-    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
-
-`;
-    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
-${pattern}
-`);
-  } else {
-    let end = headerIdx + 1;
-    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
-    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
-    writeFileSync(
-      ignorePath,
-      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
-    );
-  }
-  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
-}
-function ensureWorkspacePrep(opts) {
-  const dryRun = Boolean(opts.dryRun);
-  return [
-    ensureI18nextSingleton(opts.root, dryRun),
-    ensureReleaseAgeAllowList(opts.root, dryRun),
-    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
-  ].filter((message) => message !== void 0);
-}
-function inspectWorkspacePrep(root) {
-  const entries = [];
-  let pkg = {};
-  const pkgPath = join9(root, "package.json");
-  if (existsSync8(pkgPath)) {
-    try {
-      pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
-    } catch {
-      pkg = {};
-    }
-  }
-  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (pinned !== void 0) {
-    const stillForks = declaredNativeTs(pkg);
-    entries.push({
-      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
-      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
-    });
-  }
-  const own = readOwnPackage().name;
-  const yamlPath = join9(root, WORKSPACE_YAML);
-  if (existsSync8(yamlPath)) {
-    const yaml = readFileSync6(yamlPath, "utf8");
-    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
-    if (listed) {
-      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
-      entries.push({
-        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
-        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
-      });
-    }
-  }
-  return entries;
-}
-
-// src/roles/format/config-policy.ts
-var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
-var FORMAT_SCRIPT_NAME = "format";
-var PROVENANCE_KEY = "$sentinel";
-var PERMITTED_LOCAL_KEYS = [
-  "useTabs",
-  "tabWidth",
-  "printWidth",
-  "semi",
-  "singleQuote",
-  "jsxSingleQuote",
-  "trailingComma",
-  "quoteProps",
-  "bracketSpacing",
-  "bracketSameLine",
-  "arrowParens",
-  "endOfLine",
-  "objectWrap",
-  "proseWrap",
-  "experimentalOperatorPosition"
-];
-var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
-var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
-var PRETTIER_CONFIG_FILES = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.json5",
-  ".prettierrc.yml",
-  ".prettierrc.yaml",
-  ".prettierrc.js",
-  ".prettierrc.cjs",
-  ".prettierrc.mjs",
-  "prettier.config.js",
-  "prettier.config.cjs",
-  "prettier.config.mjs"
-];
-function formatTargets() {
-  return {
-    [FORMAT_SCRIPT_NAME]: {
-      cache: true,
-      inputs: ["default", `{projectRoot}/${FORMAT_CONFIG_FILE}`]
-    },
-    [`${FORMAT_SCRIPT_NAME}:fix`]: { cache: false }
-  };
+function scopeFlags(paths, options = []) {
+  if (paths.length === 0 || options.includes(TOLERATE_EMPTY_FLAG)) return [];
+  return [TOLERATE_EMPTY_FLAG];
 }
 
 // src/roles/format/format-script.ts
@@ -1411,8 +1942,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1427,11 +1958,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join10(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync9(path)) return [];
+  const path = join15(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync14(path)) return [];
   let contents;
   try {
-    contents = readFileSync7(path, "utf8");
+    contents = readFileSync11(path, "utf8");
   } catch {
     return [];
   }
@@ -1453,78 +1984,36 @@ function unparseableFiles(output) {
     const location = LOCATION.exec(raw);
     if (location && pending) {
       diagnostics.push({
-        file: location[1] ?? "",
-        line: Number(location[2] ?? 0),
-        message: pending
-      });
-      pending = void 0;
-      continue;
-    }
-    const message = MESSAGE.exec(raw);
-    if (message) pending = message[1];
-  }
-  return diagnostics;
-}
-function oxfmtSaid(output) {
-  const lines = plain(output).split("\n");
-  const diagnostic = lines.find((line) => MESSAGE.test(line));
-  if (diagnostic) return MESSAGE.exec(diagnostic)?.[1] ?? diagnostic.trim();
-  return [...lines].reverse().find((line) => line.trim().length > 0)?.trim() ?? "no output";
-}
-function needsSvelteCompiler(output) {
-  return /svelte\/compiler/.test(output);
-}
-
-// src/roles/format/presets/base.json
-var base_default = {
-  printWidth: 80,
-  semi: false,
-  singleQuote: true,
-  trailingComma: "all",
-  sortPackageJson: false,
-  sortImports: false
-};
-
-// src/roles/format/presets/nest-imports.json
-var nest_imports_default = {
-  customGroups: [
-    {
-      groupName: "workspace",
-      elementNamePattern: ["@hublo/**", "@shared/**", "@front/**", "@network/**"]
-    }
-  ],
-  groups: ["builtin", "external", "workspace", ["parent", "index"], "sibling"],
-  newlinesBetween: true,
-  order: "asc",
-  ignoreCase: false
-};
-
-// src/roles/format/preset-data.ts
-var FORMAT_PRESETS = ["base", "svelte", "nest"];
-function hasFormatPreset(name) {
-  return FORMAT_PRESETS.includes(name);
+        file: location[1] ?? "",
+        line: Number(location[2] ?? 0),
+        message: pending
+      });
+      pending = void 0;
+      continue;
+    }
+    const message = MESSAGE.exec(raw);
+    if (message) pending = message[1];
+  }
+  return diagnostics;
 }
-function formatPresetName(declared) {
-  if (declared === "svelte") return "svelte";
-  if (declared === "nest") return "nest";
-  return "base";
+function oxfmtSaid(output) {
+  const lines = plain(output).split("\n");
+  const diagnostic = lines.find((line) => MESSAGE.test(line));
+  if (diagnostic) return MESSAGE.exec(diagnostic)?.[1] ?? diagnostic.trim();
+  return [...lines].reverse().find((line) => line.trim().length > 0)?.trim() ?? "no output";
 }
-function formatPresetFor(preset) {
-  const base = base_default;
-  const name = formatPresetName(preset);
-  if (name === "svelte") return { ...base, svelte: true };
-  if (name === "nest") return { ...base, sortImports: nest_imports_default };
-  return base;
+function needsSvelteCompiler(output) {
+  return /svelte\/compiler/.test(output);
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -1553,8 +2042,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join11(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync8(schemaPath, "utf8"));
+    const schemaPath = join16(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync12(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -1585,14 +2074,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync10(join12(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync15(join17(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync9(join12(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync13(join17(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1621,71 +2110,6 @@ function readPrettierSettings(cwd) {
   return { options, file, unresolved };
 }
 
-// src/roles/format/read-adoption.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
-var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
-  configFile,
-  preset: null,
-  adopted: false,
-  conformant: false,
-  drift: [],
-  local: {},
-  presetVersion: null,
-  effective: {},
-  unreadable
-});
-function sameValue(a, b) {
-  return JSON.stringify(a) === JSON.stringify(b);
-}
-function readFormatAdoption(cwd) {
-  const path = join13(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync11(path)) return NOT_ADOPTED2(null);
-  let parsed;
-  try {
-    parsed = parseJsonc(readFileSync10(path, "utf8"), FORMAT_CONFIG_FILE);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
-  }
-  const provenance = parsed[PROVENANCE_KEY];
-  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
-  if (!hasFormatPreset(provenance.preset)) {
-    return NOT_ADOPTED2(
-      FORMAT_CONFIG_FILE,
-      `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
-    );
-  }
-  const declaredLocal = Array.isArray(provenance.local) ? provenance.local : [];
-  const preset = formatPresetFor(provenance.preset);
-  const drift = [];
-  const local = {};
-  for (const [key, expected] of Object.entries(preset)) {
-    if (declaredLocal.includes(key)) {
-      local[key] = parsed[key];
-      continue;
-    }
-    if (!(key in parsed) || !sameValue(parsed[key], expected)) drift.push(key);
-  }
-  for (const key of declaredLocal) {
-    if (!(key in preset)) local[key] = parsed[key];
-  }
-  for (const key of ALWAYS_LOCAL_KEYS) {
-    if (key in parsed) local[key] = parsed[key];
-  }
-  return {
-    configFile: FORMAT_CONFIG_FILE,
-    preset: provenance.preset,
-    adopted: true,
-    conformant: drift.length === 0,
-    drift,
-    local,
-    presetVersion: typeof provenance.version === "string" ? provenance.version : null,
-    effective: parsed,
-    unreadable: null
-  };
-}
-
 // src/roles/format/unenforced.ts
 function unenforcedFormatOptions(options) {
   const gaps = [];
@@ -1768,7 +2192,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync12(join14(context.cwd, name))
+      (name) => existsSync16(join18(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -1892,7 +2316,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     });
     const result = spawnSync3(
       oxfmt,
-      [mode, ...scopeFlags(paths), ...options, ...paths.length > 0 ? paths : ["."]],
+      [mode, ...scopeFlags(paths, options), ...options, ...paths.length > 0 ? paths : ["."]],
       {
         cwd: ctx.cwd,
         stdio: "inherit"
@@ -2008,7 +2432,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync11(join14(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync14(join18(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -2090,8 +2514,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync19, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync22, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join28 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2099,8 +2523,8 @@ function deferredRuleNames(rules) {
 }
 
 // src/core/fix-report.ts
-import { statSync } from "fs";
-import { join as join15 } from "path";
+import { statSync as statSync2 } from "fs";
+import { join as join19 } from "path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -2111,7 +2535,7 @@ function readFailure(output) {
 }
 function fingerprint(path) {
   try {
-    const stat = statSync(path);
+    const stat = statSync2(path);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -2120,7 +2544,7 @@ function fingerprint(path) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join15(cwd, file));
+    const mark = fingerprint(join19(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -2128,7 +2552,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join15(cwd, file));
+    const now = fingerprint(join19(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -2147,8 +2571,8 @@ function describeFixOutcome(outcome, toolLabel) {
 }
 
 // src/roles/lint/module-baseline.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join20 } from "path";
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
 var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
@@ -2192,11 +2616,11 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 function heldRules(cwd) {
-  const path = join16(cwd, LINT_BASELINE_FILE);
-  if (!existsSync13(path)) return [];
+  const path = join20(cwd, LINT_BASELINE_FILE);
+  if (!existsSync17(path)) return [];
   try {
     const parsed = parseJsonc(
-      readFileSync12(path, "utf8"),
+      readFileSync15(path, "utf8"),
       LINT_BASELINE_FILE
     );
     return Object.keys(parsed.rules ?? {});
@@ -2627,7 +3051,8 @@ var react_lib_default = {
     {
       name: "storybook",
       specifier: "eslint-plugin-storybook"
-    }
+    },
+    "../plugins/hublo.js"
   ],
   settings: null,
   renames: {
@@ -2636,6 +3061,7 @@ var react_lib_default = {
   rules: {
     curly: ["error", "all"],
     "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
     "jest-dom/prefer-checked": "error",
     "jest-dom/prefer-empty": "error",
     "jest-dom/prefer-enabled-disabled": "error",
@@ -2987,7 +3413,7 @@ var react_lib_default = {
   ],
   uncovered: {
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, which is why the app tier hosts `../plugins/hublo.js`. The library tier enforces none of those rules today, so it hosts nothing.",
+    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, so this tier hosts `../plugins/hublo.js` too. It enforces exactly one of them: `hublo/no-regex-lookbehind`, because a library is where that bug is WRITTEN and it reaches an app tier only by being imported (HUB-43431 shipped from libs/front/components into the worker app). The palette selectors stay app-tier only.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -3051,6 +3477,7 @@ var react_default = {
       severity: "off",
       reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
     },
+    "hublo/no-regex-lookbehind": "error",
     "jest/expect-expect": {
       severity: "off",
       reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
@@ -3537,7 +3964,7 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Two are hosted today: the eight palette selectors as `hublo/no-palette-common`, and the lookbehind selector as `hublo/no-regex-lookbehind`. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -4019,14 +4446,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { isAbsolute as isAbsolute2, join as join17, resolve as resolve3 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { isAbsolute as isAbsolute2, join as join21, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync14(path)) return void 0;
+  if (!existsSync18(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync13(path, "utf8"),
+      readFileSync16(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -4046,7 +4473,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join17(cwd, configFile), "utf8"),
+      readFileSync16(join21(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4105,8 +4532,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -4121,12 +4548,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { join as join22 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync14(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync17(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -4140,8 +4567,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join18(moduleDir, candidate);
-    if (!existsSync15(absolutePath)) continue;
+    const absolutePath = join22(moduleDir, candidate);
+    if (!existsSync19(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -4174,12 +4601,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync16(join19(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync20(join23(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync15(join19(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync18(join23(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -4213,9 +4640,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join20 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -4240,30 +4667,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join20(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join20(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join24(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join24(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join20(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join24(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync17(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync21(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
+import { join as join27 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
+import { join as join25 } from "path";
 import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
@@ -4275,11 +4702,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join21(cwd, name)).find((path) => existsSync18(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join25(cwd, name)).find((path) => existsSync22(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync16(config, "utf8");
+    source = readFileSync19(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4380,8 +4807,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync17, statSync as statSync2 } from "fs";
-import { join as join22, relative as relative3 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync20, statSync as statSync3 } from "fs";
+import { join as join26, relative as relative4 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4428,10 +4855,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join22(dir, entry);
+    const full = join26(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync2(full).isDirectory();
+      isDirectory = statSync3(full).isDirectory();
     } catch {
       continue;
     }
@@ -4448,7 +4875,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync17(file, "utf8");
+      content = readFileSync20(file, "utf8");
     } catch {
       continue;
     }
@@ -4472,7 +4899,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative3(cwd, file),
+        file: relative4(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4576,7 +5003,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync19(join23(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync23(join27(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4674,7 +5101,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4685,7 +5112,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync18(join23(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4697,7 +5124,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync18(join23(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync21(join27(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4831,23 +5258,23 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join24(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join24(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync20(configPath)) return;
+    const configPath = join28(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join28(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync24(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync19(configPath, "utf8"),
+        readFileSync22(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join24(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join28(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
-      writeFileSync2(
+      writeFileSync3(
         measurePath,
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
@@ -4865,7 +5292,7 @@ ${result.stderr ?? ""}`);
         { cwd: ctx.cwd, encoding: "utf8", env, maxBuffer: CAPTURE_MAX_BUFFER }
       );
     } finally {
-      rmSync(measurePath, { force: true });
+      rmSync2(measurePath, { force: true });
     }
     if (measured.error || !(measured.stdout ?? "").includes('"diagnostics"')) {
       process.stderr.write(
@@ -4879,20 +5306,20 @@ ${result.stderr ?? ""}`);
     const holds = holdsFrom(errorCountsByConfigRule(measured.stdout ?? ""));
     const next = extendsWithBaseline(current, holds.length > 0);
     if (holds.length > 0) {
-      writeFileSync2(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      writeFileSync3(baselinePath, renderBaseline(holds, readOwnPackage().version));
       process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
 `);
     } else {
-      rmSync(baselinePath, { force: true });
+      rmSync2(baselinePath, { force: true });
     }
     if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
-      writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
+      writeFileSync3(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync20(join24(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync24(join28(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4937,7 +5364,7 @@ ${result.stderr ?? ""}`);
       valueFlags: OXLINT_VALUE_FLAGS
     });
     const targets = paths.length > 0 ? paths : ["."];
-    const emptyScope = scopeFlags(paths);
+    const emptyScope = scopeFlags(paths, passedOptions);
     const lint = (extra) => {
       const passed = [...extra, ...emptyScope, ...passedOptions];
       const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
@@ -5040,7 +5467,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync22(join28(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -5050,7 +5477,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync19(join24(cwd, entry), "utf8"),
+          readFileSync22(join28(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -5120,14 +5547,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync22(join28(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync20(join24(cwd, target)));
+    return targets.find((target) => !existsSync24(join28(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5157,11 +5584,355 @@ function registerLint() {
   setDefaultRunner("lint", "oxlint");
 }
 
-// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+// src/roles/test/adapters/vitest/vitest.adapter.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync26 } from "fs";
+import { join as join30 } from "path";
+
+// src/roles/test/presets/toolchain.json
+var toolchain_default2 = {
+  $comment: "The test toolchain sentinel owns. Same shape and same rule as the build one: a single table drives what `--init` removes from a module's package.json, which import specifiers move, and the name each default import is re-exported under, so the three cannot disagree.",
+  owned: [
+    {
+      package: "vitest",
+      specifier: "vitest/config",
+      named: ["defineConfig", "mergeConfig"],
+      types: ["ConfigEnv", "TestUserConfig", "ViteUserConfig"],
+      why: "the runner itself, declared at the workspace ROOT today, which is what stops a module being testable on its own. Note the package is `vitest` and the specifier is `vitest/config`: the same split as nitro on the build side, and the reason one table holds both."
+    },
+    {
+      package: "vite",
+      specifier: "vite",
+      named: ["loadEnv"],
+      why: "`loadEnv` has no equivalent in `vitest/config`, and two of the six configs import it from vite to build their test env. Re-exported here rather than claimed: the BUILD role owns the `vite` package, and two roles owning one package is how a version conflict gets written down twice."
+    }
+  ]
+};
+
+// src/roles/test/preset-data.ts
+var OWNED_TEST_PACKAGES = toolchain_default2.owned;
+
+// src/roles/test/config-policy.ts
+var TEST_PRESET_SPECIFIER = "@hublo/sentinel/test/react";
+var TEST_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.js",
+  "vitest.config.mjs"
+];
+var TEST_OWNED_PACKAGES = OWNED_TEST_PACKAGES;
+var SENTINEL_OWNED_TEST_PACKAGES = TEST_OWNED_PACKAGES.filter(
+  (entry) => entry.package !== "vite"
+).map((entry) => entry.package);
+var TEST_TOOLCHAIN = {
+  presetSpecifier: TEST_PRESET_SPECIFIER,
+  owned: TEST_OWNED_PACKAGES
+};
+var TEST_SCRIPT_NAME = "test";
+var SENTINEL_TEST_COMMAND = "sentinel --run --test --";
+var VITEST_INVOCATION = /(^|&&\s*|\|\|\s*|;\s*)(?:npx\s+|pnpm\s+(?:exec\s+|dlx\s+)?)?vitest\b([^&|;]*)/g;
+function rewriteVitestScript(command) {
+  return command.replace(VITEST_INVOCATION, (_match, lead, tail) => {
+    const args = tail.trim().split(/\s+/).filter(Boolean);
+    const oneShot = args[0] === "run" || args.includes("--run");
+    const rest = args.filter((arg, index) => !(index === 0 && arg === "run") && arg !== "--run");
+    const passthrough = oneShot ? rest : ["--watch", ...rest];
+    const suffix = passthrough.length > 0 ? ` -- ${passthrough.join(" ")}` : "";
+    const trailing = /\s$/.test(tail) ? " " : "";
+    return `${lead}sentinel --run --test${suffix}${trailing}`;
+  });
+}
+function testTarget(options) {
+  const { configFiles, outputs } = options;
+  const cached = outputs !== void 0 && outputs.length > 0;
+  return {
+    [TEST_SCRIPT_NAME]: {
+      cache: cached,
+      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)],
+      ...cached ? { outputs: [...outputs] } : {}
+    }
+  };
+}
+
+// src/roles/test/read-adoption.ts
+import { existsSync as existsSync25, readFileSync as readFileSync23, readdirSync as readdirSync3 } from "fs";
+import { join as join29 } from "path";
+var JEST_CONFIG_FILES = [
+  "jest.config.ts",
+  "jest.config.js",
+  "jest.prisma.config.ts",
+  "jest.functional.config.ts",
+  "jest.integration-config.ts"
+];
+function testConfigFile(cwd) {
+  return TEST_CONFIG_FILES.find((name) => existsSync25(join29(cwd, name)));
+}
+function jestConfigFiles(cwd) {
+  return JEST_CONFIG_FILES.filter((name) => existsSync25(join29(cwd, name)));
+}
+function rootJestConfigFiles(cwd) {
+  const root = findWorkspaceRoot(cwd);
+  if (root === void 0 || root === cwd) return [];
+  return JEST_CONFIG_FILES.filter((name) => existsSync25(join29(root, name)));
+}
+var TEST_FILE = /[.-](spec|test)\.[cm]?[jt]sx?$/;
+var NOT_WALKED = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".git", ".nx", ".turbo"]);
+function hasTestFiles(cwd) {
+  const stack = [cwd];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!NOT_WALKED.has(entry.name)) stack.push(join29(dir, entry.name));
+      } else if (TEST_FILE.test(entry.name)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function readTestConfigSource(cwd, fileName) {
+  try {
+    return readFileSync23(join29(cwd, fileName), "utf8");
+  } catch {
+    return "";
+  }
+}
+function importsPreset2(source) {
+  const escaped = TEST_PRESET_SPECIFIER.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(String.raw`(?:from|import)\s*\(?\s*['"]${escaped}['"]`).test(source);
+}
+function readTestAdoption(cwd) {
+  const manifest = readProjectPackageJson(cwd);
+  const jestConfigs = jestConfigFiles(cwd);
+  const configFile = testConfigFile(cwd);
+  const declared = { ...manifest.dependencies, ...manifest.devDependencies };
+  const ownDeclarations = ["vitest", "jest", "@nx/jest", "jest-mock-extended", "@swc/jest"].filter((name) => declared[name] !== void 0).map((name) => ({ name, version: declared[name] }));
+  if (configFile === void 0) {
+    const hasTests = hasTestFiles(cwd);
+    const inheritsRootConfig = hasTests && jestConfigs.length === 0 && rootJestConfigFiles(cwd).length > 0;
+    return {
+      configFile: null,
+      preset: null,
+      adopted: false,
+      conformant: false,
+      drift: [],
+      unreadable: null,
+      state: hasTests ? "jest" : "no-tests",
+      runner: hasTests ? "jest" : "none",
+      jestConfigs,
+      inheritsRootConfig,
+      ownDeclarations
+    };
+  }
+  const source = readTestConfigSource(cwd, configFile);
+  if (source === "") {
+    return {
+      configFile,
+      preset: null,
+      adopted: false,
+      conformant: false,
+      drift: [],
+      unreadable: `${configFile} could not be read`,
+      state: "vitest-own-toolchain",
+      runner: "vitest",
+      jestConfigs,
+      inheritsRootConfig: false,
+      // it has a config of its own, readable or not
+      ownDeclarations
+    };
+  }
+  const adopted = importsPreset2(source);
+  const script = moduleScripts(cwd)["test"];
+  return {
+    configFile,
+    preset: adopted ? "react" : null,
+    adopted,
+    conformant: adopted && script !== void 0 && jestConfigs.length === 0,
+    drift: [],
+    unreadable: null,
+    state: adopted ? "adopted" : "vitest-own-toolchain",
+    runner: "vitest",
+    jestConfigs,
+    inheritsRootConfig: false,
+    // local always wins: this module is out of the root's reach
+    ownDeclarations
+  };
+}
+
+// src/roles/test/plan.ts
+function ownedTestDependencies(cwd, declared) {
+  return declared.filter((entry) => SENTINEL_OWNED_TEST_PACKAGES.includes(entry.name)).flatMap((entry) => [
+    ["dependencies", entry.name],
+    ["devDependencies", entry.name]
+  ]).filter(([section]) => section !== void 0);
+}
+function plan3(context) {
+  const configFile = testConfigFile(context.cwd);
+  const adoption = readTestAdoption(context.cwd);
+  if (configFile === void 0) {
+    return {
+      operations: [],
+      skipped: adoption.state === "jest" ? `this module tests with jest (${adoption.jestConfigs.join(", ")}). Migrating it moves its test FILES as well as its config, which is the next step of this role and not this one.` : `this module has no test config and no test files, so there is nothing to point at sentinel. What it needs is its jest leftovers removed, which is a cleanup rather than an adoption.`
+    };
+  }
+  const operations = [];
+  const notes = [];
+  const rewrite = rewriteToolchainImports(
+    TEST_TOOLCHAIN,
+    readTestConfigSource(context.cwd, configFile),
+    configFile
+  );
+  if (rewrite.kind === "blocked") {
+    return {
+      operations: [],
+      skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
+    };
+  }
+  if (rewrite.kind === "rewritten") {
+    operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+    notes.push(
+      `${configFile} now imports ${rewrite.moved.join(", ")} from sentinel. Only the import lines changed: every alias, setup file, timeout and coverage path is untouched, so this suite runs what it ran before.`
+    );
+  }
+  const existing = projectTargets(context.cwd)?.[TEST_SCRIPT_NAME];
+  const outputs = existing?.outputs ?? [];
+  if (outputs.length === 0) {
+    notes.push(
+      `this target declares no \`outputs\`, so it is left UNCACHED. Caching a run that restores nothing is the defect where nx reports a hit and the coverage directory is empty; if this module writes coverage, declare where and the target can cache.`
+    );
+  }
+  const siblingScripts = {};
+  for (const [name, command] of Object.entries(moduleScripts(context.cwd))) {
+    if (name === TEST_SCRIPT_NAME || typeof command !== "string") continue;
+    const rewritten = rewriteVitestScript(command);
+    if (rewritten !== command) siblingScripts[name] = rewritten;
+  }
+  if (Object.keys(siblingScripts).length > 0) {
+    notes.push(
+      `rewrote ${Object.keys(siblingScripts).join(", ")} to run through sentinel: they called vitest directly, and the dependency they relied on is removed below. A watch script keeps watching, through \`-- --watch\`.`
+    );
+  }
+  operations.push(
+    manifestOperation(context.cwd, {
+      [TEST_SCRIPT_NAME]: SENTINEL_TEST_COMMAND,
+      ...siblingScripts
+    })
+  );
+  operations.push(
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: testTarget({ configFiles: [configFile], outputs })
+    })
+  );
+  const owned = ownedTestDependencies(context.cwd, adoption.ownDeclarations);
+  if (owned.length > 0) {
+    operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
+    notes.push(
+      `removed ${[...new Set(owned.map(([, name]) => name))].join(", ")} from this module: sentinel owns the runner now, and two copies of Vitest in one run give the plugins a different Vite than the one running them.`
+    );
+  }
+  if (adoption.jestConfigs.length > 0) {
+    notes.push(
+      `${adoption.jestConfigs.join(", ")} is still here beside the Vitest config. It is not this step's to delete, since something may still run it, but the workspace cannot drop jest while it exists.`
+    );
+  }
+  return { operations, notes };
+}
+
+// src/roles/test/adapters/vitest/vitest.adapter.ts
+function resolveVitest(cwd) {
+  const fromSentinel = join30(
+    new URL("../../../../../node_modules/.bin/vitest", import.meta.url).pathname
+  );
+  if (existsSync26(fromSentinel)) return { bin: fromSentinel, origin: "sentinel" };
+  const fromModule = join30(cwd, "node_modules", ".bin", "vitest");
+  return existsSync26(fromModule) ? { bin: fromModule, origin: "module" } : { bin: void 0, origin: "module" };
+}
+var VitestAdapter = class extends BaseAdapter {
+  target = "test";
+  runner = "vitest";
+  appliesTo(_preset) {
+    return true;
+  }
+  plan(context) {
+    return plan3(context);
+  }
+  async status(ctx) {
+    return Promise.resolve(readTestAdoption(ctx.cwd));
+  }
+  async inspect(ctx) {
+    const adoption = readTestAdoption(ctx.cwd);
+    return Promise.resolve({
+      state: adoption.state,
+      runner: adoption.runner,
+      configFile: adoption.configFile,
+      jestConfigs: adoption.jestConfigs,
+      adopted: adoption.adopted,
+      conformant: adoption.conformant,
+      drift: adoption.drift,
+      unreadable: adoption.unreadable
+    });
+  }
+  /**
+   * Run the module's tests.
+   *
+   * A module that has not adopted is reported and PASSES, the stance every role takes: `--run`
+   * with no named target sweeps the workspace, so failing here would exit non-zero on the 107
+   * modules still on jest, which says nothing anyone can act on.
+   */
+  async run(ctx) {
+    const adoption = readTestAdoption(ctx.cwd);
+    if (!adoption.adopted) {
+      this.say(
+        adoption.state === "jest" ? `this module tests with jest (${adoption.jestConfigs.join(", ")}); run \`sentinel --init --test\` to migrate it.` : adoption.state === "no-tests" ? `this module has no tests.` : `no sentinel preset in this module's Vitest config; run \`sentinel --init --test\` to adopt.`
+      );
+      return Promise.resolve({ ok: true, code: 0 });
+    }
+    const { bin, origin } = resolveVitest(ctx.cwd);
+    if (bin === void 0) {
+      this.say(`could not find the vitest binary. Run \`pnpm install\` in the module.`);
+      return Promise.resolve({ ok: false, code: 1 });
+    }
+    if (origin === "module") {
+      this.say(
+        `using the MODULE's vitest, not sentinel's. An adopted config gets its plugins from sentinel, and two copies fail in ways that never mention a version. Remove vitest from this module's package.json.`
+      );
+    }
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: [] });
+    const watching = options.includes("--watch") || options.includes("-w");
+    const argv = watching ? [...options, ...paths] : ["run", ...options, ...paths];
+    const result = spawnSync5(bin, argv, { cwd: ctx.cwd, stdio: "inherit" });
+    if (result.error) {
+      this.say(`could not run vitest (${result.error.message})`);
+      return Promise.resolve({ ok: false, code: 1 });
+    }
+    const code = result.status ?? 1;
+    return Promise.resolve({ ok: code === 0, code });
+  }
+  say(message) {
+    process.stderr.write(`sentinel test(vitest): ${message}
+`);
+  }
+};
+
+// src/roles/test/register.ts
+function registerTest() {
+  register(new VitestAdapter());
+  setDefaultRunner("test", "vitest");
+}
+
+// src/roles/typescript/adapters/tsc/tsc.adapter.ts
+import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync27, readFileSync as readFileSync25 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join26 } from "path";
+import { join as join32 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5342,8 +6113,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync20 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync24 } from "fs";
+import { join as join31 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5436,7 +6207,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync20(join25(context.cwd, target.path), "utf8"),
+    readFileSync24(join31(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5574,7 +6345,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync21(join26(cwd, target.path), "utf8"),
+        readFileSync25(join32(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5587,7 +6358,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join26(cwd, "noop.js")).resolve(preset);
+      createRequire4(join32(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5628,7 +6399,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5663,7 +6434,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5683,7 +6454,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync21(join26(cwd, config), "utf8"),
+        readFileSync25(join32(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5699,7 +6470,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync21(join26(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync27(join32(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5752,7 +6523,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5795,7 +6566,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5822,6 +6593,7 @@ function registerAdapters() {
   registerLint();
   registerFormat();
   registerBuild();
+  registerTest();
 }
 
 // src/core/detect-framework.ts
@@ -5903,7 +6675,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync22, readFileSync as readFileSync22, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync26, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -5922,7 +6694,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync22(absolutePath) ? readFileSync22(absolutePath, "utf8") : void 0;
+  return existsSync28(absolutePath) ? readFileSync26(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -6003,9 +6775,9 @@ function applyOperationTo(current, operation) {
     }
   }
 }
-function preparePlan(cwd, plan3) {
+function preparePlan(cwd, plan4) {
   const prepared = /* @__PURE__ */ new Map();
-  for (const operation of plan3.operations) {
+  for (const operation of plan4.operations) {
     const absolutePath = resolveWithinRoot(cwd, operation.path);
     const existing = prepared.get(operation.path);
     const before = existing?.before ?? readIfExists(absolutePath) ?? "";
@@ -6024,14 +6796,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync3(tempPath, contents);
+  writeFileSync4(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
-function applyPlan(cwd, plan3) {
-  const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
+function applyPlan(cwd, plan4) {
+  const changed = preparePlan(cwd, plan4).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync2(file.absolutePath, { force: true });
+      rmSync3(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -6040,8 +6812,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync23, readdirSync as readdirSync3, readFileSync as readFileSync23 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync4, readFileSync as readFileSync27 } from "fs";
+import { join as join33 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -6055,11 +6827,11 @@ var DEPENDENCY_SIGNALS = [
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join27(cwd, "package.json");
-  if (!existsSync23(path)) return [];
+  const path = join33(cwd, "package.json");
+  if (!existsSync29(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync23(path, "utf8"),
+      readFileSync27(path, "utf8"),
       path
     );
     return [
@@ -6073,7 +6845,7 @@ function dependencyNames(cwd) {
 function declaresJsx(cwd) {
   let entries;
   try {
-    entries = readdirSync3(cwd).filter(
+    entries = readdirSync4(cwd).filter(
       (name) => name.startsWith("tsconfig") && name.endsWith(".json")
     );
   } catch {
@@ -6082,7 +6854,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync23(join27(cwd, name), "utf8"),
+        readFileSync27(join33(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -6133,14 +6905,14 @@ function resolveFlavour(opts) {
   }
   return detection.preset;
 }
-function previewPlan(opts, plan3) {
-  const changed = preparePlan(opts.cwd, plan3).filter((file) => file.before !== file.after);
+function previewPlan(opts, plan4) {
+  const changed = preparePlan(opts.cwd, plan4).filter((file) => file.before !== file.after);
   if (opts.json) {
     process.stdout.write(
       JSON.stringify(
         {
           dryRun: true,
-          notes: plan3.notes ?? [],
+          notes: plan4.notes ?? [],
           files: changed.map(({ path, before, after, deleted }) => ({
             path,
             action: deleted ? "delete" : before.length === 0 ? "create" : "update",
@@ -6155,7 +6927,7 @@ function previewPlan(opts, plan3) {
     return 0;
   }
   process.stderr.write("  dry run: no files written\n");
-  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan4.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (changed.length === 0) {
     process.stderr.write("  nothing to change\n");
@@ -6199,25 +6971,25 @@ async function dispatch(opts) {
     }
   }
   const context = { cwd: opts.cwd, preset: effective };
-  const plan3 = await adapter.plan(context);
-  if (plan3.blocked) {
-    process.stderr.write(`sentinel (${opts.target}): ${plan3.blocked}
+  const plan4 = await adapter.plan(context);
+  if (plan4.blocked) {
+    process.stderr.write(`sentinel (${opts.target}): ${plan4.blocked}
 `);
     return 1;
   }
-  if (plan3.skipped) {
-    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan3.skipped}`)}
+  if (plan4.skipped) {
+    process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${plan4.skipped}`)}
 `);
     return 0;
   }
   if (opts.dryRun) {
-    return previewPlan(opts, plan3);
+    return previewPlan(opts, plan4);
   }
-  for (const change of applyPlan(opts.cwd, plan3)) {
+  for (const change of applyPlan(opts.cwd, plan4)) {
     process.stderr.write(`  ${change.deleted ? "removed" : "wrote"} ${change.path}
 `);
   }
-  for (const note of plan3.notes ?? []) process.stderr.write(`  ${note}
+  for (const note of plan4.notes ?? []) process.stderr.write(`  ${note}
 `);
   if (adapter.afterInit) {
     process.stderr.write(`  fixing what ${opts.target} can fix automatically...
@@ -6241,24 +7013,25 @@ export {
   declaredPresetFor,
   availableTargets,
   resolve,
-  BaseAdapter,
-  resolveBin,
   readOwnVersion,
   readProjectPackageJson,
   moduleName,
+  buildConfigFile,
+  BaseAdapter,
+  resolveBin,
+  WORKSPACE_ROOT_MARKER,
+  findWorkspaceRoot,
+  ensureWorkspacePrep,
+  inspectWorkspacePrep,
   VERBS,
   TARGETS,
   LONG_RUNNING_TARGETS,
   SWEEPABLE_TARGETS,
   PRESET_NAMES,
-  WORKSPACE_ROOT_MARKER,
-  findWorkspaceRoot,
-  ensureWorkspacePrep,
-  inspectWorkspacePrep,
   palette,
   registerAdapters,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-YZ4EKBK7.js.map
+//# sourceMappingURL=chunk-PLZ45MWU.js.map