@hublo/sentinel 1.2.0-alpha.9 → 1.3.0

package/dist/{chunk-6RH3LZQZ.js → chunk-676GBPMS.js}

@@ -67,19 +67,6 @@ function resolve(target, preset, runner) {
   return matching[0];
 }
 
-// src/core/base-adapter.ts
-var BaseAdapter = class {
-  inspect(_ctx) {
-    throw new Error(`${this.runner}: --inspect not implemented yet`);
-  }
-  report(_ctx) {
-    throw new Error(`${this.runner}: --report not implemented yet`);
-  }
-  status(_ctx) {
-    throw new Error(`${this.runner}: --status not implemented yet`);
-  }
-};
-
 // src/shared/package-json.ts
 import { existsSync, readFileSync } from "fs";
 import { basename, dirname, join } from "path";
@@ -132,6 +119,19 @@ function moduleName(dir) {
   return readNxProjectName(dir) ?? (declared === void 0 ? basename(dir) : declared);
 }
 
+// src/core/base-adapter.ts
+var BaseAdapter = class {
+  inspect(_ctx) {
+    throw new Error(`${this.runner}: --inspect not implemented yet`);
+  }
+  report(_ctx) {
+    throw new Error(`${this.runner}: --report not implemented yet`);
+  }
+  status(_ctx) {
+    throw new Error(`${this.runner}: --status not implemented yet`);
+  }
+};
+
 // src/core/domain.ts
 var VERBS = ["run", "inspect", "init", "migrate", "report", "status"];
 var TARGETS = [
@@ -165,86 +165,99 @@ function palette(stream) {
   };
 }
 
-// src/roles/build/adapters/vite/vite-role.adapter.ts
-import { spawnSync } from "child_process";
-
-// src/core/config/tool-args.ts
-import { existsSync as existsSync2 } from "fs";
-import { isAbsolute, resolve as resolve2 } from "path";
-function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
-  const takesValue = new Set(valueFlags);
-  const options = [];
-  const paths = [];
-  let previousTakesValue = false;
-  for (const arg of toolArgs) {
-    const looksLikeOption = arg.startsWith("-");
-    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
-    if (!previousTakesValue && !looksLikeOption && existsSync2(target)) paths.push(arg);
-    else options.push(arg);
-    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+// src/roles/build/nest/nx-target.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2, relative } from "path";
+var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
+var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
+var readProjectJson = (cwd) => {
+  const path = join2(cwd, "project.json");
+  if (!existsSync2(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
   }
-  return { options, paths };
+};
+function webpackBuildTarget(cwd) {
+  const project = readProjectJson(cwd);
+  const target = project?.targets?.build;
+  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
+  const { outputPath, main, webpackConfig, transformers, assets } = target.options ?? {};
+  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
+    return void 0;
+  }
+  return {
+    project: project.name,
+    outputPath,
+    main,
+    webpackConfig,
+    configurations: target.configurations,
+    transformers,
+    assets
+  };
 }
-
-// src/shared/resolve-bin.ts
-import { existsSync as existsSync3 } from "fs";
-import { createRequire } from "module";
-import { delimiter, dirname as dirname2, join as join2 } from "path";
-var require2 = createRequire(import.meta.url);
-function resolveBin(fromDir, name) {
-  let dir = fromDir;
-  for (; ; ) {
-    const candidate = join2(dir, "node_modules", ".bin", name);
-    if (existsSync3(candidate)) return candidate;
-    const parent = dirname2(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
+function refusalFor(cwd, target) {
+  if (workspaceRootFor(cwd, target) === void 0) {
+    return `this service's build target declares \`main: ${target.main}\`, which does not place this directory inside a workspace. Every value the config needs is derived from that path, so a wrong one would resolve \`workspaceRoot\` to the service itself and leave the alias table resolving nothing. Nothing was written.`;
+  }
+  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
+    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
+  }
+  const live = liveFileReplacements(cwd, target);
+  if (live.length > 0) {
+    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
   }
+  return void 0;
 }
-function binFromOwnInstall(packageName, binName) {
-  try {
-    const manifest = require2.resolve(`${packageName}/package.json`);
-    const bin = require2(manifest).bin;
-    const relative6 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative6) return void 0;
-    const executable = join2(dirname2(manifest), relative6);
-    return existsSync3(executable) ? executable : void 0;
-  } catch {
-    return void 0;
+function liveFileReplacements(cwd, target) {
+  const workspaceRoot = workspaceRootFor(cwd, target);
+  if (workspaceRoot === void 0) return [];
+  const configurations = target.configurations ?? {};
+  const live = [];
+  for (const configuration of Object.values(configurations)) {
+    for (const replacement of configuration.fileReplacements ?? []) {
+      const exists = existsSync2(join2(workspaceRoot, replacement.replace)) || existsSync2(join2(workspaceRoot, replacement.with));
+      if (exists) live.push(replacement.replace);
+    }
   }
+  return live;
 }
-function binSearchPath(cwd) {
-  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
-    " then "
-  );
+function workspaceRootFor(cwd, target) {
+  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
+  if (moduleRoot === target.main || !cwd.endsWith(moduleRoot)) return void 0;
+  return cwd.slice(0, cwd.length - moduleRoot.length - 1);
+}
+function workspaceRootHops(cwd, target) {
+  const root = workspaceRootFor(cwd, target);
+  if (root === void 0) {
+    throw new Error(`sentinel build(nest): cannot place ${cwd} in a workspace from ${target.main}`);
+  }
+  const rel = relative(root, cwd);
+  return rel === "" ? 0 : rel.split(/[\\/]/).length;
 }
 
-// src/roles/build/plan.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { join as join8 } from "path";
-
-// src/core/config/existing-command.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+// src/roles/build/read-adoption.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 
-// src/shared/jsonc.ts
-import { parse, printParseErrorCode } from "jsonc-parser";
-function parseJsonc(text, source = "config") {
-  const errors = [];
-  const value = parse(text, errors, { allowTrailingComma: true });
-  if (errors.length > 0) {
-    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
-    throw new Error(`${source}: malformed JSONC (${details}).`);
-  }
-  return value;
+// src/core/config/module-type.ts
+function esmReadiness(fileName, packageType) {
+  if (/\.(mts|mjs)$/.test(fileName)) return { kind: "ready" };
+  if (packageType === "module") return { kind: "ready" };
+  const rename = fileName.replace(/\.(ts|js)$/, ".mts");
+  return {
+    kind: "blocked",
+    why: `sentinel is ESM only, and this module ${packageType === void 0 ? 'declares no `"type"`' : `declares \`"type": "${packageType}"\``}, so Node loads ${fileName} as CommonJS and the import fails. Two remedies, and adoption takes neither by itself because both reach beyond this build: add \`"type": "module"\` to this module's package.json, which changes how EVERY \`.js\` here loads, or rename the config to \`${rename}\`, which settles it in the filename where nothing can undo it.`
+  };
 }
 
 // src/core/config/manifest.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { basename as basename2, join as join3 } from "path";
 function moduleScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join3(cwd, "package.json"), "utf8"));
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -252,7 +265,7 @@ function moduleScripts(cwd) {
 }
 function moduleName2(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join3(cwd, "package.json"), "utf8"));
     return pkg.name;
   } catch {
     return void 0;
@@ -266,122 +279,25 @@ function selfCommand(cwd, flags) {
   if (!isSelfAdoption(cwd) || !own.bin) return void 0;
   return `node ${own.bin.replace(/^\.\//, "")} ${flags}`;
 }
+function adoptedPackageName(cwd) {
+  return readProjectPackageJson(cwd).name ?? readNxProjectName(cwd) ?? basename2(cwd);
+}
 function manifestOperation(cwd, scripts) {
   const own = readOwnPackage();
   const value = {
     scripts,
     devDependencies: { [own.name]: isSelfAdoption(cwd) ? "link:." : own.version }
   };
-  if (existsSync4(join3(cwd, "package.json"))) {
+  if (existsSync3(join3(cwd, "package.json"))) {
     return { kind: "merge-json", path: "package.json", value };
   }
   return {
     kind: "merge-json",
     path: "package.json",
-    value: { name: readNxProjectName(cwd) ?? basename2(cwd), private: true, ...value }
+    value: { name: adoptedPackageName(cwd), private: true, ...value }
   };
 }
 
-// src/core/config/existing-command.ts
-function nxTargetCommand(cwd, target) {
-  let project;
-  try {
-    project = parseJsonc(
-      readFileSync3(join4(cwd, "project.json"), "utf8"),
-      "project.json"
-    );
-  } catch {
-    return void 0;
-  }
-  const entry = project.targets?.[target];
-  if (!entry || entry.executor !== "nx:run-commands") return void 0;
-  const { command, commands, cwd: targetCwd } = entry.options ?? {};
-  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
-  if (typeof command === "string" && command.trim() !== "") {
-    return { command: command.trim(), ranInModule };
-  }
-  if (Array.isArray(commands)) {
-    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
-    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
-  }
-  return void 0;
-}
-function rootedForScript(command) {
-  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
-}
-function existingCommand(cwd, target) {
-  const script = moduleScripts(cwd)[target];
-  if (script !== void 0 && script.trim() !== "") return script;
-  const fromTarget = nxTargetCommand(cwd, target);
-  if (fromTarget === void 0) return void 0;
-  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
-}
-
-// src/core/config/nx-target.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
-function nxTargetOperations(options) {
-  const { cwd, targets } = options;
-  const names = Object.keys(targets);
-  if (names.length === 0) return [];
-  const operations = [];
-  if (existsSync5(join5(cwd, "project.json"))) {
-    operations.push({
-      kind: "remove-json-keys",
-      path: "project.json",
-      keys: names.map((name) => ["targets", name])
-    });
-  }
-  operations.push({
-    kind: "merge-json",
-    path: "package.json",
-    value: { nx: { targets } }
-  });
-  return operations;
-}
-
-// src/core/config/tool-script.ts
-var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
-function isSeparatorAt(index) {
-  return index % 2 === 1;
-}
-function invokes(segment, binary) {
-  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
-}
-function isSentinelSegment(segment, roleFlag) {
-  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
-  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
-}
-function composeToolScript(existing, options) {
-  const { command } = options;
-  if (!existing || existing.trim() === "") return command;
-  const { roleFlag } = options;
-  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
-  const parts = existing.split(SEGMENT_SEPARATOR);
-  const commands = parts.filter((_, index) => !isSeparatorAt(index));
-  if (!commands.some(isReplaceable)) return existing;
-  let replacedOnce = false;
-  const rebuilt = parts.map((part, index) => {
-    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
-    if (replacedOnce) return null;
-    replacedOnce = true;
-    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
-  });
-  const kept = [];
-  for (let index = 0; index < rebuilt.length; index += 1) {
-    const part = rebuilt[index];
-    if (part === null) {
-      if (kept.length > 0) kept.pop();
-      continue;
-    }
-    kept.push(part);
-  }
-  return kept.join("").trim();
-}
-function keepsOtherCommands(script, sentinelCommand) {
-  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
-}
-
 // src/roles/build/presets/requirements.json
 var requirements_default = {
   svelte: {
@@ -408,7 +324,8 @@ var toolchain_default = {
         "UserConfig",
         "UserConfigExport"
       ],
-      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck."
+      why: "the bundler itself. `defineConfig`, `loadEnv` and `mergeConfig` are what every config in this repo imports from it, and the types travel with them: a config importing PluginOption from a package it no longer declares builds but does not typecheck.",
+      floor: "Never below 8.2.2. Vite 8.0.8 resolves rolldown 1.0.0-rc.15, a release candidate whose deferred-module-initialisation codegen is broken: it wrapped a plain re-export barrel in an init helper, then required the module without binding its exports before calling the very function that binding provides. Measured, that crashed 7 of the 8 Nest services with a transformer at their first require (`init_<module> is not defined`), and quietly moved the published contract of 4 others. 8.2.2 resolves rolldown 1.2.6 and all 35 services regenerate their committed OpenAPI document identically. The version is not a preference, it is the floor at which those measurements hold."
     },
     {
       package: "@vitejs/plugin-react",
@@ -476,11 +393,19 @@ var BUILD_SCRIPT_NAME = "build";
 var SENTINEL_BUILD_COMMAND = "sentinel --run --build --";
 var DEV_SCRIPT_NAME = "serve";
 var SENTINEL_DEV_COMMAND = "sentinel --run --dev";
-function buildTarget() {
+var BUILD_OUTPUT_CANDIDATES = ["dist", ".output", "build"];
+function buildTarget(options) {
+  const { moduleName: moduleName3, configFiles = BUILD_CONFIG_FILES, outputs } = options;
   return {
     [BUILD_SCRIPT_NAME]: {
+      executor: "nx:run-commands",
+      options: {
+        command: `pnpm --filter ${moduleName3} run ${BUILD_SCRIPT_NAME}`,
+        forwardAllArgs: false
+      },
       cache: true,
-      inputs: ["default", "^default", ...BUILD_CONFIG_FILES.map((name) => `{projectRoot}/${name}`)]
+      inputs: ["default", "^default", ...configFiles.map((name) => `{projectRoot}/${name}`)],
+      outputs: [...outputs]
     }
   };
 }
@@ -488,136 +413,71 @@ var SENTINEL_OWNED_BUILD_PACKAGES = OWNED_PACKAGES.map(
   (entry) => entry.package
 );
 
-// src/roles/build/dev-script.ts
-var CHAIN = " -- ";
-var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
-var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
-function appOptions(rest) {
-  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
-  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
-  return kept.join(" ");
-}
-function composeDevScript(existing, command) {
-  if (existing === void 0 || existing.trim() === "") return command;
-  const chunks = existing.trim().split(CHAIN);
-  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
-  if (at === -1) return existing;
-  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
-  const options = appOptions(rest);
-  chunks[at] = options === "" ? command : `${command} -- ${options}`;
-  return chunks.join(CHAIN);
-}
-
-// src/roles/build/nest/adopt.ts
-import { relative as relative2 } from "path";
-
-// src/roles/build/nest/nx-target.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
-import { join as join6, relative } from "path";
-var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
-var TRANSLATABLE_WEBPACK_CONFIG = "tools/webpack-configs/update.webpack.config.js";
-var readProjectJson = (cwd) => {
-  const path = join6(cwd, "project.json");
-  if (!existsSync6(path)) return void 0;
+// src/roles/build/project-json.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+function projectTargets(cwd) {
+  const path = join4(cwd, "project.json");
+  if (!existsSync4(path)) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8")).targets;
   } catch {
     return void 0;
   }
-};
-function webpackBuildTarget(cwd) {
-  const project = readProjectJson(cwd);
-  const target = project?.targets?.build;
-  if (target?.executor !== DEPRECATED_NX_BUILDER) return void 0;
-  const { outputPath, main, webpackConfig } = target.options ?? {};
-  if (typeof project?.name !== "string" || typeof outputPath !== "string" || typeof main !== "string" || typeof webpackConfig !== "string") {
-    return void 0;
-  }
-  return {
-    project: project.name,
-    outputPath,
-    main,
-    webpackConfig,
-    configurations: target.configurations
-  };
 }
-function refusalFor(cwd, target) {
-  if (target.webpackConfig !== TRANSLATABLE_WEBPACK_CONFIG) {
-    return `this service builds with ${target.webpackConfig}, not the shared ${TRANSLATABLE_WEBPACK_CONFIG} this preset reproduces. Its own config adds loaders or rules the preset has no equivalent for, and translating it anyway would produce a build that succeeds and a service that fails later. Read that file, decide what the Vite config needs, and write it by hand. Nothing was written.`;
-  }
-  const live = liveFileReplacements(cwd, target);
-  if (live.length > 0) {
-    return `this service's production configuration replaces ${live.join(", ")}, and those files exist. The preset has no equivalent, so translating the target would drop a real substitution. Nothing was written.`;
+
+// src/roles/build/adoption-drift.ts
+function buildAdoptionDrift(cwd) {
+  const drift = [];
+  const manifest = readProjectPackageJson(cwd);
+  const script = moduleScripts(cwd)[BUILD_SCRIPT_NAME];
+  if (script === void 0) {
+    drift.push(
+      `has no \`${BUILD_SCRIPT_NAME}\` npm script, so \`pnpm run ${BUILD_SCRIPT_NAME}\` does not build it and only nx can`
+    );
+  } else if (!script.includes(SENTINEL_BUILD_COMMAND.replace(/ --$/, ""))) {
+    drift.push(
+      `its \`${BUILD_SCRIPT_NAME}\` script does not invoke sentinel (${script}), so the config points at sentinel while the script runs something else`
+    );
   }
-  return void 0;
-}
-function liveFileReplacements(cwd, target) {
-  const workspaceRoot = workspaceRootFor(cwd, target);
-  const configurations = target.configurations ?? {};
-  const live = [];
-  for (const configuration of Object.values(configurations)) {
-    for (const replacement of configuration.fileReplacements ?? []) {
-      const exists = existsSync6(join6(workspaceRoot, replacement.replace)) || existsSync6(join6(workspaceRoot, replacement.with));
-      if (exists) live.push(replacement.replace);
+  const target = manifest.nx?.targets?.[BUILD_SCRIPT_NAME];
+  if (target === void 0) {
+    drift.push(
+      `declares no \`nx.targets.${BUILD_SCRIPT_NAME}\`, so its build runs on nx's default inputs while every other target it has declares its own`
+    );
+  } else {
+    if (target.cache === true && (target.outputs ?? []).length === 0) {
+      drift.push(
+        `caches its build and declares no \`outputs\`, so nx stores nothing and a cache hit reports success with no build on disk`
+      );
     }
-  }
-  return live;
-}
-function workspaceRootFor(cwd, target) {
-  const moduleRoot = target.main.replace(/\/src\/.*$/, "");
-  const suffix = cwd.endsWith(moduleRoot) ? moduleRoot : "";
-  return suffix === "" ? cwd : cwd.slice(0, cwd.length - suffix.length - 1);
-}
-function workspaceRootHops(cwd, target) {
-  const root = workspaceRootFor(cwd, target);
-  const rel = relative(root, cwd);
-  return rel === "" ? 0 : rel.split(/[\\/]/).length;
-}
-
-// src/roles/build/nest/adopt.ts
-var NEST_CONFIG_FILE = "vite.config.mts";
-function nestConfigSource(cwd, target) {
-  const hops = workspaceRootHops(cwd, target);
-  const up = Array.from({ length: hops }, () => "..").join("/");
-  return `import path from 'node:path'
-
-import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
-
-export default nestService({
-  project: '${target.project}',
-  root: __dirname,
-  workspaceRoot: path.resolve(__dirname, '${up}'),
-  outDir: '${target.outputPath}',
-})
-`;
-}
-function nestBuildTarget(cwd, target) {
-  const moduleRoot = relative2(workspaceRootFor(cwd, target), cwd);
-  return {
-    executor: "nx:run-commands",
-    outputs: [`{workspaceRoot}/${target.outputPath}`],
-    options: {
-      cwd: moduleRoot,
-      command: "pnpm exec sentinel --run --build",
-      forwardAllArgs: false
+    const inputs = target.inputs ?? [];
+    if (inputs.length > 0 && !inputs.includes("^default")) {
+      drift.push(
+        `declares \`inputs\` without \`^default\`, which REPLACES nx's default and stops hashing its dependencies: the build can replay a stale bundle after one changes`
+      );
     }
-  };
-}
-function nestAdoptionOperations(cwd, target) {
-  return [
-    { kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) },
-    { kind: "remove-json-keys", path: "project.json", keys: [["targets", "build"]] },
-    {
-      kind: "merge-json",
-      path: "project.json",
-      value: { targets: { build: nestBuildTarget(cwd, target) } }
+    if (target.options?.forwardAllArgs !== false) {
+      drift.push(
+        `does not set \`forwardAllArgs: false\`, so a caller's extra flag reaches the bundler, which refuses it (the image passes \`--generatePackageJson\`)`
+      );
     }
-  ];
+  }
+  if (projectTargets(cwd)?.[BUILD_SCRIPT_NAME] !== void 0) {
+    drift.push(
+      `still declares a \`${BUILD_SCRIPT_NAME}\` target in project.json beside the one in package.json, so the module has two and which runs depends on the caller`
+    );
+  }
+  const devScript = moduleScripts(cwd)[DEV_SCRIPT_NAME];
+  if (devScript?.includes(SENTINEL_DEV_COMMAND) === true && projectTargets(cwd)?.[DEV_SCRIPT_NAME] !== void 0) {
+    drift.push(
+      `runs its \`${DEV_SCRIPT_NAME}\` script through sentinel but still declares a \`${DEV_SCRIPT_NAME}\` target in project.json, so one dev server has two declarations and editing the target stops the script from being what runs`
+    );
+  }
+  return drift;
 }
 
 // src/roles/build/read-adoption.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
 var NOT_ADOPTED = (configFile, unreadable = null) => ({
   configFile,
   preset: null,
@@ -628,7 +488,7 @@ var NOT_ADOPTED = (configFile, unreadable = null) => ({
   unreadable
 });
 function buildConfigFile(cwd) {
-  return BUILD_CONFIG_FILES.find((name) => existsSync7(join7(cwd, name)));
+  return BUILD_CONFIG_FILES.find((name) => existsSync5(join5(cwd, name)));
 }
 function importsSpecifier(source, specifier) {
   const escaped = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -643,6 +503,7 @@ var REACT_PLUGIN_SPECIFIERS = ["@vitejs/plugin-react", "@tanstack/react-start"];
 function declaredBuildPreset(cwd) {
   const source = readBuildConfigSource(cwd);
   if (source === void 0) {
+    if (buildConfigFile(cwd) !== void 0) return void 0;
     return webpackBuildTarget(cwd) === void 0 ? void 0 : "nest";
   }
   if (importsSpecifier(source, BUILD_PRESET_SPECIFIERS.nest)) return "nest";
@@ -653,7 +514,7 @@ function readBuildConfigSource(cwd) {
   const configFile = buildConfigFile(cwd);
   if (!configFile) return void 0;
   try {
-    return readFileSync5(join7(cwd, configFile), "utf8");
+    return readFileSync5(join5(cwd, configFile), "utf8");
   } catch {
     return void 0;
   }
@@ -663,31 +524,485 @@ function readBuildAdoption(cwd) {
   if (!configFile) return NOT_ADOPTED(null);
   let source;
   try {
-    source = readFileSync5(join7(cwd, configFile), "utf8");
+    source = readFileSync5(join5(cwd, configFile), "utf8");
   } catch (error) {
     return NOT_ADOPTED(configFile, error instanceof Error ? error.message : String(error));
   }
-  if (!importsPreset(source)) return NOT_ADOPTED(configFile);
+  if (!importsPreset(source)) {
+    const esm = esmReadiness(configFile, readProjectPackageJson(cwd).type);
+    return NOT_ADOPTED(configFile, esm.kind === "blocked" ? esm.why : null);
+  }
   const manifest = readProjectPackageJson(cwd);
   const declared = { ...manifest.dependencies, ...manifest.devDependencies };
   const ownDeclarations = SENTINEL_OWNED_BUILD_PACKAGES.filter((name) => name in declared).map(
     (name) => ({ name, version: declared[name] })
   );
+  const drift = [
+    ...ownDeclarations.map(
+      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
+    ),
+    ...buildAdoptionDrift(cwd)
+  ];
   return {
     configFile,
     // Read from the config rather than assumed: the two presets are adopted the same way and
     // reporting the wrong one would make `--inspect` lie about what a module builds.
     preset: declaredBuildPreset(cwd) ?? "react",
     adopted: true,
-    conformant: ownDeclarations.length === 0,
-    drift: ownDeclarations.map(
-      ({ name, version }) => `declares ${name}@${version} of its own; sentinel owns it, and two copies in one build give the plugins a different Vite than the one running them`
-    ),
+    conformant: drift.length === 0,
+    drift,
     ownDeclarations,
     unreadable: null
   };
 }
 
+// src/roles/build/adapters/vite/vite-role.adapter.ts
+import { spawnSync } from "child_process";
+
+// src/core/config/tool-args.ts
+import { existsSync as existsSync6 } from "fs";
+import { isAbsolute, resolve as resolve2 } from "path";
+function splitToolArgs(cwd, toolArgs = [], { valueFlags = [] } = {}) {
+  const takesValue = new Set(valueFlags);
+  const options = [];
+  const paths = [];
+  let previousTakesValue = false;
+  for (const arg of toolArgs) {
+    const looksLikeOption = arg.startsWith("-");
+    const target = isAbsolute(arg) ? arg : resolve2(cwd, arg);
+    if (!previousTakesValue && !looksLikeOption && existsSync6(target)) paths.push(arg);
+    else options.push(arg);
+    previousTakesValue = !arg.includes("=") && takesValue.has(arg);
+  }
+  return { options, paths };
+}
+
+// src/shared/resolve-bin.ts
+import { existsSync as existsSync7 } from "fs";
+import { createRequire } from "module";
+import { delimiter, dirname as dirname2, join as join6 } from "path";
+var require2 = createRequire(import.meta.url);
+function resolveBin(fromDir, name) {
+  let dir = fromDir;
+  for (; ; ) {
+    const candidate = join6(dir, "node_modules", ".bin", name);
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function binFromOwnInstall(packageName, binName) {
+  try {
+    const manifest = require2.resolve(`${packageName}/package.json`);
+    const bin = require2(manifest).bin;
+    const relative5 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative5) return void 0;
+    const executable = join6(dirname2(manifest), relative5);
+    return existsSync7(executable) ? executable : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function binSearchPath(cwd) {
+  return [`${cwd}${delimiter}node_modules/.bin (and parents)`, "sentinel's own install"].join(
+    " then "
+  );
+}
+
+// src/roles/build/plan.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { join as join11 } from "path";
+
+// src/core/config/existing-command.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
+
+// src/shared/jsonc.ts
+import { parse, printParseErrorCode } from "jsonc-parser";
+function parseJsonc(text, source = "config") {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    const details = errors.map((error) => printParseErrorCode(error.error)).join(", ");
+    throw new Error(`${source}: malformed JSONC (${details}).`);
+  }
+  return value;
+}
+
+// src/core/config/existing-command.ts
+function nxTargetCommand(cwd, target) {
+  let project;
+  try {
+    project = parseJsonc(
+      readFileSync6(join7(cwd, "project.json"), "utf8"),
+      "project.json"
+    );
+  } catch {
+    return void 0;
+  }
+  const entry = project.targets?.[target];
+  if (!entry || entry.executor !== "nx:run-commands") return void 0;
+  const { command, commands, cwd: targetCwd } = entry.options ?? {};
+  const ranInModule = typeof targetCwd === "string" && targetCwd.trim() !== "";
+  if (typeof command === "string" && command.trim() !== "") {
+    return { command: command.trim(), ranInModule };
+  }
+  if (Array.isArray(commands)) {
+    const parts = commands.filter((c) => typeof c === "string" && c.trim() !== "");
+    if (parts.length > 0) return { command: parts.map((c) => c.trim()).join(" && "), ranInModule };
+  }
+  return void 0;
+}
+function rootedForScript(command) {
+  return command.replace(/(^|&&\s*)pnpm exec /g, "$1pnpm --workspace-root exec ");
+}
+function existingCommand(cwd, target) {
+  const script = moduleScripts(cwd)[target];
+  if (script !== void 0 && script.trim() !== "") return script;
+  const fromTarget = nxTargetCommand(cwd, target);
+  if (fromTarget === void 0) return void 0;
+  return fromTarget.ranInModule ? fromTarget.command : rootedForScript(fromTarget.command);
+}
+
+// src/core/config/nx-target.ts
+import { existsSync as existsSync8 } from "fs";
+import { join as join8 } from "path";
+function nxTargetMetadataOperations(options) {
+  const { targets } = options;
+  if (Object.keys(targets).length === 0) return [];
+  return [{ kind: "merge-json", path: "package.json", value: { nx: { targets } } }];
+}
+function nxTargetOperations(options) {
+  const { cwd, targets } = options;
+  const names = Object.keys(targets);
+  if (names.length === 0) return [];
+  const operations = [];
+  if (existsSync8(join8(cwd, "project.json"))) {
+    operations.push({
+      kind: "remove-json-keys",
+      path: "project.json",
+      keys: names.map((name) => ["targets", name])
+    });
+  }
+  operations.push(...nxTargetMetadataOperations(options));
+  return operations;
+}
+
+// src/core/config/tool-script.ts
+var SEGMENT_SEPARATOR = /(\s*(?:&&|\|\||;|&|\|)\s*)/;
+function isSeparatorAt(index) {
+  return index % 2 === 1;
+}
+function invokes(segment, binary) {
+  return new RegExp(String.raw`(^|[\s/])${binary}(\s|$)`).test(segment.trim());
+}
+function isSentinelSegment(segment, roleFlag) {
+  const runsSentinel = invokes(segment, "sentinel") || segment.includes("bin/sentinel.js");
+  return runsSentinel && new RegExp(String.raw`(^|\s)${roleFlag}(\s|$)`).test(segment);
+}
+function composeToolScript(existing, options) {
+  const { command } = options;
+  if (!existing || existing.trim() === "") return command;
+  const { roleFlag } = options;
+  const isReplaceable = (segment) => options.replaces(segment) || roleFlag !== void 0 && isSentinelSegment(segment, roleFlag);
+  const parts = existing.split(SEGMENT_SEPARATOR);
+  const commands = parts.filter((_, index) => !isSeparatorAt(index));
+  if (!commands.some(isReplaceable)) return existing;
+  let replacedOnce = false;
+  const rebuilt = parts.map((part, index) => {
+    if (isSeparatorAt(index) || !isReplaceable(part)) return part;
+    if (replacedOnce) return null;
+    replacedOnce = true;
+    return options.keepFix && /(^|\s)--fix(\s|$)/.test(part) ? `${command} --fix` : command;
+  });
+  const kept = [];
+  for (let index = 0; index < rebuilt.length; index += 1) {
+    const part = rebuilt[index];
+    if (part === null) {
+      if (kept.length > 0) kept.pop();
+      continue;
+    }
+    kept.push(part);
+  }
+  return kept.join("").trim();
+}
+function keepsOtherCommands(script, sentinelCommand) {
+  return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
+}
+
+// src/roles/format/read-adoption.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+
+// src/roles/format/config-policy.ts
+var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
+var FORMAT_SCRIPT_NAME = "format";
+var PROVENANCE_KEY = "$sentinel";
+var PERMITTED_LOCAL_KEYS = [
+  "useTabs",
+  "tabWidth",
+  "printWidth",
+  "semi",
+  "singleQuote",
+  "jsxSingleQuote",
+  "trailingComma",
+  "quoteProps",
+  "bracketSpacing",
+  "bracketSameLine",
+  "arrowParens",
+  "endOfLine",
+  "objectWrap",
+  "proseWrap",
+  "experimentalOperatorPosition"
+];
+var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
+var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
+var PRETTIER_CONFIG_FILES = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function formatTargets() {
+  return {
+    [FORMAT_SCRIPT_NAME]: {
+      cache: true,
+      inputs: ["default", `{projectRoot}/${FORMAT_CONFIG_FILE}`]
+    },
+    [`${FORMAT_SCRIPT_NAME}:fix`]: { cache: false }
+  };
+}
+
+// src/roles/format/presets/base.json
+var base_default = {
+  printWidth: 80,
+  semi: false,
+  singleQuote: true,
+  trailingComma: "all",
+  sortPackageJson: false,
+  sortImports: false
+};
+
+// src/roles/format/presets/nest-imports.json
+var nest_imports_default = {
+  customGroups: [
+    {
+      groupName: "workspace",
+      elementNamePattern: ["@hublo/**", "@shared/**", "@front/**", "@network/**"]
+    }
+  ],
+  groups: ["builtin", "external", "workspace", ["parent", "index"], "sibling"],
+  newlinesBetween: true,
+  order: "asc",
+  ignoreCase: false
+};
+
+// src/roles/format/preset-data.ts
+var FORMAT_PRESETS = ["base", "svelte", "nest"];
+function hasFormatPreset(name) {
+  return FORMAT_PRESETS.includes(name);
+}
+function formatPresetName(declared) {
+  if (declared === "svelte") return "svelte";
+  if (declared === "nest") return "nest";
+  return "base";
+}
+function formatPresetFor(preset) {
+  const base = base_default;
+  const name = formatPresetName(preset);
+  if (name === "svelte") return { ...base, svelte: true };
+  if (name === "nest") return { ...base, sortImports: nest_imports_default };
+  return base;
+}
+
+// src/roles/format/read-adoption.ts
+var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  local: {},
+  presetVersion: null,
+  effective: {},
+  unreadable
+});
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function readFormatAdoption(cwd) {
+  const path = join9(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync9(path)) return NOT_ADOPTED2(null);
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync7(path, "utf8"), FORMAT_CONFIG_FILE);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
+  }
+  const provenance = parsed[PROVENANCE_KEY];
+  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
+  if (!hasFormatPreset(provenance.preset)) {
+    return NOT_ADOPTED2(
+      FORMAT_CONFIG_FILE,
+      `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
+    );
+  }
+  const declaredLocal = Array.isArray(provenance.local) ? provenance.local : [];
+  const preset = formatPresetFor(provenance.preset);
+  const drift = [];
+  const local = {};
+  for (const [key, expected] of Object.entries(preset)) {
+    if (declaredLocal.includes(key)) {
+      local[key] = parsed[key];
+      continue;
+    }
+    if (!(key in parsed) || !sameValue(parsed[key], expected)) drift.push(key);
+  }
+  for (const key of declaredLocal) {
+    if (!(key in preset)) local[key] = parsed[key];
+  }
+  for (const key of ALWAYS_LOCAL_KEYS) {
+    if (key in parsed) local[key] = parsed[key];
+  }
+  return {
+    configFile: FORMAT_CONFIG_FILE,
+    preset: provenance.preset,
+    adopted: true,
+    conformant: drift.length === 0,
+    drift,
+    local,
+    presetVersion: typeof provenance.version === "string" ? provenance.version : null,
+    effective: parsed,
+    unreadable: null
+  };
+}
+
+// src/roles/build/dev-script.ts
+var CHAIN = " -- ";
+var VITE_TOKEN = /(^|\s|\/)vite(\s|$)/;
+var DEV_SUBCOMMANDS = /* @__PURE__ */ new Set(["dev", "serve"]);
+function appOptions(rest) {
+  const tokens = (rest ?? "").trim().split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((token, at) => !(at === 0 && DEV_SUBCOMMANDS.has(token)));
+  return kept.join(" ");
+}
+function composeDevScript(existing, command) {
+  if (existing === void 0 || existing.trim() === "") return command;
+  const chunks = existing.trim().split(CHAIN);
+  const at = chunks.map((chunk) => VITE_TOKEN.test(chunk)).lastIndexOf(true);
+  if (at === -1) return existing;
+  const rest = (chunks[at] ?? "").replace(/^.*?(^|\s|\/)vite(\s|$)/, "");
+  const options = appOptions(rest);
+  chunks[at] = options === "" ? `${command} --` : `${command} -- ${options}`;
+  return chunks.join(CHAIN);
+}
+
+// src/roles/build/dev-target.ts
+var DELEGATION_KEYS = /* @__PURE__ */ new Set(["executor", "options"]);
+var DELEGATION_OPTION_KEYS = /* @__PURE__ */ new Set(["command", "cwd"]);
+function delegatesToScript(target, scriptName) {
+  if (typeof target !== "object" || target === null || Array.isArray(target)) return false;
+  const entries = target;
+  if (!Object.keys(entries).every((key) => DELEGATION_KEYS.has(key))) return false;
+  if (entries["executor"] !== "nx:run-commands") return false;
+  const options = entries["options"];
+  if (typeof options !== "object" || options === null || Array.isArray(options)) return false;
+  const declared = options;
+  if (!Object.keys(declared).every((key) => DELEGATION_OPTION_KEYS.has(key))) return false;
+  const command = declared["command"];
+  if (typeof command !== "string") return false;
+  return new RegExp(String.raw`(^|\s)run\s+${scriptName}$`).test(command.trim());
+}
+function devScriptIsAdopted(devScript) {
+  return devScript !== void 0 && devScript.includes(SENTINEL_DEV_COMMAND);
+}
+function devTargetOperations(cwd, devScript) {
+  if (!devScriptIsAdopted(devScript)) return { operations: [] };
+  const target = projectTargets(cwd)?.[DEV_SCRIPT_NAME];
+  if (target === void 0) return { operations: [] };
+  if (!delegatesToScript(target, DEV_SCRIPT_NAME)) {
+    return {
+      operations: [],
+      note: `left the \`${DEV_SCRIPT_NAME}\` target in project.json alone: it does more than call \`pnpm run ${DEV_SCRIPT_NAME}\`, so removing it would drop behaviour this role never declared. Move what it does into the script, or keep it and accept the second home.`
+    };
+  }
+  return {
+    operations: [
+      { kind: "remove-json-keys", path: "project.json", keys: [["targets", DEV_SCRIPT_NAME]] }
+    ],
+    note: `removed the \`${DEV_SCRIPT_NAME}\` target from project.json: it only called \`pnpm run ${DEV_SCRIPT_NAME}\`, which nx infers from the script itself. host-admin has run without that target all along.`
+  };
+}
+
+// src/roles/build/nest/adopt.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join10 } from "path";
+var NEST_CONFIG_FILE = "vite.config.mts";
+function asSource(value, depth) {
+  const pad = "  ".repeat(depth);
+  const inner = "  ".repeat(depth + 1);
+  if (Array.isArray(value)) {
+    if (value.length === 0) return "[]";
+    return `[
+${value.map((item) => `${inner}${asSource(item, depth + 1)}`).join(",\n")},
+${pad}]`;
+  }
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0) return "{}";
+    return `{
+${entries.map(([key, item]) => `${inner}${asKey(key)}: ${asSource(item, depth + 1)}`).join(",\n")},
+${pad}}`;
+  }
+  if (typeof value === "string") return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  throw new Error(
+    `sentinel build(nest): cannot write ${typeof value} into the generated config. The build target carries a shape this translation was not written for, and it should refuse rather than emit something nobody has read.`
+  );
+}
+function asKey(key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `'${key}'`;
+}
+function nestConfigSource(cwd, target) {
+  const hops = workspaceRootHops(cwd, target);
+  const up = Array.from({ length: hops }, () => "..").join("/");
+  const carried = (name, value) => value === void 0 || value.length === 0 ? "" : `  ${name}: ${asSource(value, 1)},
+`;
+  return `import path from 'node:path'
+
+import { nestService } from '${BUILD_PRESET_SPECIFIERS.nest}'
+
+export default nestService({
+  project: '${target.project}',
+  root: __dirname,
+  workspaceRoot: path.resolve(__dirname, '${up}'),
+  outDir: '${target.outputPath}',
+${carried("transformers", target.transformers)}${carried("assets", target.assets)}})
+`;
+}
+function nestBuildOutputs(target) {
+  return [`{workspaceRoot}/${target.outputPath}`];
+}
+var OUT_DIR_IN_CONFIG = /^\s*outDir:\s*'([^']+)'/m;
+function nestOutputsFromConfig(cwd) {
+  const configPath = join10(cwd, NEST_CONFIG_FILE);
+  if (!existsSync10(configPath)) return void 0;
+  const outDir = OUT_DIR_IN_CONFIG.exec(readFileSync8(configPath, "utf8"))?.[1];
+  return outDir === void 0 ? void 0 : [`{workspaceRoot}/${outDir}`];
+}
+function nestAdoptionOperations(cwd, target) {
+  return [{ kind: "write", path: NEST_CONFIG_FILE, contents: nestConfigSource(cwd, target) }];
+}
+
 // src/roles/build/requirements.ts
 function atLeast(declared, needed) {
   const parse2 = (value) => value.replace(/^[\^~>=<\s]+/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -716,32 +1031,26 @@ function describeUnmet(preset, unmet) {
   return `the build role does not apply to this module yet: ${list}. ${entry?.why ?? ""}. Nothing was written. Raise those versions, check the module still builds and its tests still pass, then re-run \`sentinel --init --build\`.`;
 }
 
-// src/roles/build/rewrite-imports.ts
+// src/core/config/rewrite-imports.ts
 import { parseSync } from "oxc-parser";
-var MOVED_SPECIFIERS = new Set(OWNED_PACKAGES.map((entry) => entry.specifier));
-function esmBlocker(fileName, packageType) {
-  if (/\.(mts|mjs)$/.test(fileName)) return void 0;
-  if (packageType === "module") return void 0;
-  return `sentinel is ESM only, and this module does not declare \`"type": "module"\`, so Vite would load ${fileName} as CommonJS and fail to require it. Add \`"type": "module"\` to this module's package.json, or rename the config to \`${fileName.replace(/\.(ts|js)$/, ".m$1")}\`, then run this again.`;
-}
-var DEFAULT_EXPORT_NAMES = Object.fromEntries(
-  OWNED_PACKAGES.filter((entry) => entry.default !== void 0).map((entry) => [
-    entry.specifier,
-    entry.default
-  ])
+var movedSpecifiers = (toolchain) => new Set(toolchain.owned.map((entry) => entry.specifier));
+var defaultExportNames = (toolchain) => Object.fromEntries(
+  toolchain.owned.filter((entry) => entry.default !== void 0).map((entry) => [entry.specifier, entry.default])
 );
-function renderImport(bindings) {
+function renderImport(bindings, presetSpecifier) {
   const render = (list) => list.map((b) => b.exported === b.local ? b.exported : `${b.exported} as ${b.local}`).sort((left, right) => left.localeCompare(right)).join(", ");
   const values = bindings.filter((b) => !b.typeOnly);
   const types = bindings.filter((b) => b.typeOnly);
   const lines = [];
-  if (values.length > 0) lines.push(`import { ${render(values)} } from '${BUILD_PRESET_SPECIFIER}'`);
+  if (values.length > 0) lines.push(`import { ${render(values)} } from '${presetSpecifier}'`);
   if (types.length > 0) {
-    lines.push(`import type { ${render(types)} } from '${BUILD_PRESET_SPECIFIER}'`);
+    lines.push(`import type { ${render(types)} } from '${presetSpecifier}'`);
   }
   return lines.join("\n");
 }
-function rewriteBuildImports(source, fileName = "vite.config.ts") {
+function rewriteToolchainImports(toolchain, source, fileName) {
+  const moved = movedSpecifiers(toolchain);
+  const defaults = defaultExportNames(toolchain);
   const { program, errors } = parseSync(fileName, source, { sourceType: "module" });
   if (errors.length > 0) {
     return {
@@ -752,10 +1061,10 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   const imports = program.body.filter(
     (node) => node.type === "ImportDeclaration"
   );
-  if (imports.some((node) => node.source.value === BUILD_PRESET_SPECIFIER)) {
+  if (imports.some((node) => node.source.value === toolchain.presetSpecifier)) {
     return { kind: "unchanged", why: "this config already imports its toolchain from sentinel" };
   }
-  const moving = imports.filter((node) => MOVED_SPECIFIERS.has(node.source.value));
+  const moving = imports.filter((node) => moved.has(node.source.value));
   if (moving.length === 0) {
     return {
       kind: "unchanged",
@@ -772,7 +1081,7 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     for (const spec of specifiers) {
       const typeOnly = node.importKind === "type" || spec.importKind === "type";
       if (spec.type === "ImportDefaultSpecifier") {
-        const exported = DEFAULT_EXPORT_NAMES[from];
+        const exported = defaults[from];
         if (!exported) {
           return {
             kind: "blocked",
@@ -804,7 +1113,7 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
     const after = out.slice(span.end).match(/^\r?\n/)?.[0].length ?? 0;
     out = out.slice(0, span.start) + out.slice(span.end + after);
   }
-  out = out.slice(0, first.start) + renderImport(bindings) + out.slice(first.end);
+  out = out.slice(0, first.start) + renderImport(bindings, toolchain.presetSpecifier) + out.slice(first.end);
   return {
     kind: "rewritten",
     source: out,
@@ -812,7 +1121,19 @@ function rewriteBuildImports(source, fileName = "vite.config.ts") {
   };
 }
 
+// src/roles/build/rewrite-imports.ts
+var BUILD_TOOLCHAIN = {
+  presetSpecifier: BUILD_PRESET_SPECIFIER,
+  owned: OWNED_PACKAGES
+};
+function rewriteBuildImports(source, fileName = "vite.config.ts") {
+  return rewriteToolchainImports(BUILD_TOOLCHAIN, source, fileName);
+}
+
 // src/roles/build/plan.ts
+function candidateOutputs() {
+  return BUILD_OUTPUT_CANDIDATES.map((name) => `{projectRoot}/${name}`);
+}
 function ownedBuildDependencies(cwd) {
   const manifest = readProjectPackageJson(cwd);
   const keys = [];
@@ -844,9 +1165,9 @@ function buildScripts(cwd) {
     const own2 = moduleName(cwd);
     scripts[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
-      // Trailing `--` for the same reason as the build script: whatever the caller appends
-      // reaches Vite, not sentinel's parser. It goes after `--module`, which is sentinel's own.
-      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2} --`
+      // No trailing `--` here: `composeDevScript` owns the separator, and adding one on both
+      // sides produced `-- --`, handing Vite an argument nobody wrote.
+      `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
     );
   }
   return scripts;
@@ -860,70 +1181,73 @@ function plan(context) {
   if (unmet.length > 0) {
     return { operations: [], skipped: describeUnmet(context.preset, unmet) };
   }
-  if (declaredBuildPreset(context.cwd) === void 0 && buildConfigFile(context.cwd) !== void 0) {
+  const declaredPreset2 = declaredBuildPreset(context.cwd);
+  const configFile = buildConfigFile(context.cwd);
+  if (declaredPreset2 === void 0 && configFile !== void 0) {
     return {
       operations: [],
-      skipped: `this module has a Vite config, but it does not build a React app (no @vitejs/plugin-react or @tanstack/react-start in it). The build role ships a React preset only.`
+      skipped: `this module has a Vite config, but it builds neither a React app (no @vitejs/plugin-react or @tanstack/react-start) nor a Nest service (no ${BUILD_PRESET_SPECIFIERS.nest}). Those are the two families this role serves.`
     };
   }
-  const notes = [];
-  const operations = [];
-  const configFile = buildConfigFile(context.cwd);
   const webpackTarget = webpackBuildTarget(context.cwd);
-  if (configFile === void 0 && webpackTarget !== void 0) {
-    const refusal = refusalFor(context.cwd, webpackTarget);
-    if (refusal !== void 0) return { operations: [], blocked: refusal };
-    const dropped = Object.keys(webpackTarget.configurations ?? {});
+  if (declaredBuildPreset(context.cwd) === "nest" || webpackTarget !== void 0) {
+    return planNestService(context, webpackTarget);
+  }
+  if (configFile === void 0) {
     return {
-      operations: nestAdoptionOperations(context.cwd, webpackTarget),
-      notes: [
-        `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
-        ...dropped.length > 0 ? [
-          `dropped the \`${dropped.join("`, `")}\` configuration${dropped.length > 1 ? "s" : ""} from the build target: its fileReplacements point at files that do not exist, so it replaced nothing. A live one would have blocked this instead.`
-        ] : [],
-        `verify with \`nx run ${webpackTarget.project}:generate-swagger-file\` and \`git diff --exit-code\`: it runs the built bundle, so it proves the service boots AND that its published contract did not move.`
-      ]
+      operations: [],
+      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through \`@nx/webpack\`), the build role does not apply to it.`
     };
   }
-  if (configFile === void 0) {
+  return planReactApp(context, configFile);
+}
+function planReactApp(context, configFile) {
+  const notes = [];
+  const operations = [];
+  const esm = esmReadiness(configFile, readProjectPackageJson(context.cwd).type);
+  if (esm.kind === "blocked") return { operations: [], skipped: esm.why };
+  const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
+  if (rewrite.kind === "blocked") {
     return {
       operations: [],
-      skipped: `no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 projects here build through \`@nx/webpack\`), the build role does not apply to it.`
+      skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
     };
-  } else {
-    const notEsm = esmBlocker(configFile, readProjectPackageJson(context.cwd).type);
-    if (notEsm !== void 0) return { operations: [], skipped: notEsm };
-    const rewrite = rewriteBuildImports(readConfigSource(context.cwd, configFile), configFile);
-    if (rewrite.kind === "blocked") {
-      return {
-        operations: [],
-        skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
-      };
-    }
-    if (rewrite.kind === "rewritten") {
-      operations.push({ kind: "write", path: configFile, contents: rewrite.source });
-    }
-    for (const name of COMPANION_CONFIG_FILES) {
-      const source = readConfigSource(context.cwd, name);
-      if (source === "") continue;
-      const companion = rewriteBuildImports(source, name);
-      if (companion.kind === "rewritten") {
-        operations.push({ kind: "write", path: name, contents: companion.source });
-        notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
-      } else if (companion.kind === "blocked") {
-        notes.push(
-          `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
-        );
-      }
-    }
-    if (rewrite.kind === "rewritten") {
+  }
+  if (rewrite.kind === "rewritten") {
+    operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+  }
+  for (const name of COMPANION_CONFIG_FILES) {
+    const source = readConfigSource(context.cwd, name);
+    if (source === "") continue;
+    const companion = rewriteBuildImports(source, name);
+    if (companion.kind === "rewritten") {
+      operations.push({ kind: "write", path: name, contents: companion.source });
+      notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
+    } else if (companion.kind === "blocked") {
       notes.push(
-        `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+        `${name} imports the toolchain and could NOT be pointed at sentinel: ${companion.why}. It will stop resolving when the workspace root drops these packages, and it will fail your TESTS rather than your build.`
       );
     }
   }
-  operations.push(manifestOperation(context.cwd, buildScripts(context.cwd)));
-  operations.push(...nxTargetOperations({ cwd: context.cwd, targets: buildTarget() }));
+  if (rewrite.kind === "rewritten") {
+    notes.push(
+      `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
+    );
+  }
+  const scripts = buildScripts(context.cwd);
+  operations.push(manifestOperation(context.cwd, scripts));
+  operations.push(
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({
+        moduleName: adoptedPackageName(context.cwd),
+        outputs: candidateOutputs()
+      })
+    })
+  );
+  const dev = devTargetOperations(context.cwd, scripts[DEV_SCRIPT_NAME]);
+  operations.push(...dev.operations);
+  if (dev.note !== void 0) notes.push(dev.note);
   const owned = ownedBuildDependencies(context.cwd);
   if (owned.length > 0) {
     operations.push({ kind: "remove-json-keys", path: "package.json", keys: owned });
@@ -931,12 +1255,53 @@ function plan(context) {
       `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
     );
   }
+  const formatted = readFormatAdoption(context.cwd).adopted;
+  notes.push(
+    formatted ? `run \`sentinel --run --format --fix\` on this module: adoption rewrote ${configFile}, and a rewritten import can be longer than your formatter wraps at.` : `this module is formatted by the workspace, not by sentinel, so format ${configFile} with whatever owns it before committing: a rewritten import can be longer than that formatter wraps at, and the check would fail on a file nobody typed.`
+  );
+  notes.push(
+    `this config is code, and it runs before the build does: any environment variable it reads has to be present wherever you build, including a fresh clone, another CI job or an image. Adoption does not change what it reads, but a failure there arrives early and names this role rather than the variable.`
+  );
   return { operations, notes };
 }
+function planNestService(context, webpackTarget) {
+  const outputs = webpackTarget === void 0 ? nestOutputsFromConfig(context.cwd) : nestBuildOutputs(webpackTarget);
+  if (outputs === void 0) {
+    return {
+      operations: [],
+      blocked: `${NEST_CONFIG_FILE} does not declare an \`outDir\`, so sentinel cannot say where this service's build lands. Declaring an nx target without it would cache the build and restore nothing from that cache. Nothing was written.`
+    };
+  }
+  const metadata = [
+    manifestOperation(context.cwd, { [BUILD_SCRIPT_NAME]: SENTINEL_BUILD_COMMAND }),
+    ...nxTargetOperations({
+      cwd: context.cwd,
+      targets: buildTarget({
+        moduleName: adoptedPackageName(context.cwd),
+        configFiles: [NEST_CONFIG_FILE],
+        outputs
+      })
+    })
+  ];
+  if (webpackTarget === void 0) return { operations: metadata };
+  const refusal = refusalFor(context.cwd, webpackTarget);
+  if (refusal !== void 0) return { operations: [], blocked: refusal };
+  const dropped = Object.keys(webpackTarget.configurations ?? {});
+  return {
+    operations: [...nestAdoptionOperations(context.cwd, webpackTarget), ...metadata],
+    notes: [
+      `wrote ${NEST_CONFIG_FILE} and pointed the nx build target at sentinel. The target stays \`nx:run-commands\` with \`forwardAllArgs: false\`, so the image's \`--generatePackageJson\` still works and the Dockerfile needs no change.`,
+      ...dropped.length > 0 ? [
+        `dropped the \`${dropped.join("`, `")}\` configuration${dropped.length > 1 ? "s" : ""} from the build target: its fileReplacements point at files that do not exist, so it replaced nothing. A live one would have blocked this instead.`
+      ] : [],
+      `verify with \`nx run ${webpackTarget.project}:generate-swagger-file\` and \`git diff --exit-code\`: it runs the built bundle, so it proves the service boots AND that its published contract did not move.`
+    ]
+  };
+}
 function readConfigSource(cwd, configFile) {
-  if (!existsSync8(join8(cwd, configFile))) return "";
+  if (!existsSync11(join11(cwd, configFile))) return "";
   try {
-    return readFileSync6(join8(cwd, configFile), "utf8");
+    return readFileSync9(join11(cwd, configFile), "utf8");
   } catch {
     return "";
   }
@@ -1039,80 +1404,334 @@ var ViteRoleAdapter = class extends BaseAdapter {
         `using the MODULE's vite, not sentinel's. An adopted config gets its plugins from sentinel, and two copies of Vite fail in ways that never mention a version. Remove vite from this module's package.json.`
       );
     }
-    return { kind: "ready", vite: bin };
+    return { kind: "ready", vite: bin };
+  }
+  /**
+   * Run Vite with the caller's own arguments after `--`, and report what happened.
+   *
+   * `whenSignalled` is the only difference between the two targets here, and it is a real one:
+   * a build killed by a signal did not produce a bundle, while a dev server killed by Ctrl-C
+   * did exactly what the developer asked.
+   */
+  spawnVite(ctx, vite, argv, whenSignalled) {
+    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
+      valueFlags: VITE_VALUE_FLAGS
+    });
+    const result = spawnSync(vite, [...argv, ...options, ...paths], {
+      cwd: ctx.cwd,
+      stdio: "inherit"
+    });
+    if (result.error) {
+      this.say(`could not run vite (${result.error.message})`);
+      return { ok: false, code: 1 };
+    }
+    const code = result.status ?? whenSignalled;
+    return { ok: code === 0, code };
+  }
+  /** One prefix for every message this role emits, so they cannot drift apart. */
+  say(message) {
+    process.stderr.write(`sentinel ${this.label}(vite): ${message}
+`);
+  }
+};
+
+// src/roles/build/adapters/vite/vite-dev.adapter.ts
+var ViteDevAdapter = class extends ViteRoleAdapter {
+  target = "dev";
+  get label() {
+    return "dev";
+  }
+  /**
+   * `--init --dev` does the same thing as `--init --build`, and now says so.
+   *
+   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
+   * because adopting one without the other leaves the module half-migrated. What was missing
+   * was only the telling: the run printed a message about the build and nothing about `serve`,
+   * so a developer could believe the dev server had been adopted on its own. Refusing was the
+   * wrong correction, it added friction to a command that already produced the right result.
+   */
+  plan(context) {
+    if (declaredBuildPreset(context.cwd) === "nest" || webpackBuildTarget(context.cwd)) {
+      return {
+        operations: [],
+        skipped: `a Nest service has no dev server, so --dev has nothing to adopt here. Its build is \`sentinel --init --build\`, and it runs as a Node process afterwards.`
+      };
+    }
+    const planned = super.plan(context);
+    if (planned.operations.length === 0) return planned;
+    return {
+      ...planned,
+      notes: [
+        ...planned.notes ?? [],
+        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
+      ]
+    };
+  }
+  /**
+   * Start the dev server. It does not return until stopped, so there is no verdict to report
+   * beyond the exit code the developer's own Ctrl-C produces.
+   *
+   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
+   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
+   * running it again would race the watcher that is about to own the file.
+   *
+   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
+   * bare form is the one every version accepts.
+   */
+  async run(ctx) {
+    const ready = this.prepare(ctx);
+    if (ready.kind === "stop") return ready.result;
+    return this.spawnVite(ctx, ready.vite, [], 0);
+  }
+};
+
+// src/roles/build/declared-outputs.ts
+import { existsSync as existsSync13, rmSync, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join13 } from "path";
+
+// src/core/workspace-prep.ts
+import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync } from "fs";
+import { dirname as dirname3, join as join12, relative as relative2 } from "path";
+
+// src/core/settings.ts
+var WORKSPACE_ROOT_MARKER = "nx.json";
+var DEFAULT_MAX_DIAGNOSTICS = 100;
+
+// src/core/workspace-prep.ts
+var OVERRIDE_KEY = "i18next>typescript";
+var NATIVE_TS_ALIAS = "@typescript/native";
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
+var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
+var MAP_ENTRY = /^(\s+)(.*?):\s+(.*?)\s*$/;
+function findWorkspaceRoot(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    if (existsSync12(join12(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function declaredNativeTs(pkg) {
+  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
+  if (!spec) return void 0;
+  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
+  return version || void 0;
+}
+function ensureI18nextSingleton(root, dryRun) {
+  const pkgPath = join12(root, "package.json");
+  if (!existsSync12(pkgPath)) return void 0;
+  const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+  const want = declaredNativeTs(pkg);
+  if (!want) return void 0;
+  const yamlPath = join12(root, WORKSPACE_YAML);
+  if (!existsSync12(yamlPath)) return void 0;
+  const lines = readFileSync10(yamlPath, "utf8").split("\n");
+  const entry = findOverrideEntry(lines);
+  if (entry.valueIdx !== void 0 && entry.value === want) return void 0;
+  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`;
+  applyOverride(lines, entry, want);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`;
+}
+function findOverrideEntry(lines) {
+  const blockIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === "overrides:");
+  if (blockIdx === -1) return { indent: "  " };
+  let lastEntryIdx = blockIdx;
+  let indent = "  ";
+  for (let i = blockIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(MAP_ENTRY);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastEntryIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === OVERRIDE_KEY) {
+      return {
+        valueIdx: i,
+        value: (match[3] ?? "").replace(/^['"]|['"]$/g, ""),
+        blockIdx,
+        lastEntryIdx,
+        indent
+      };
+    }
+  }
+  return { blockIdx, lastEntryIdx, indent };
+}
+function applyOverride(lines, entry, want) {
+  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`;
+  if (entry.valueIdx !== void 0) {
+    lines[entry.valueIdx] = line;
+    return;
+  }
+  if (entry.lastEntryIdx !== void 0) {
+    lines.splice(entry.lastEntryIdx + 1, 0, line);
+    return;
+  }
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  lines.push("overrides:", line, "");
+}
+function ensureReleaseAgeAllowList(root, dryRun) {
+  const yamlPath = join12(root, WORKSPACE_YAML);
+  if (!existsSync12(yamlPath)) return void 0;
+  const own = readOwnPackage().name;
+  const lines = readFileSync10(yamlPath, "utf8").split("\n");
+  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
+  if (keyIdx === -1) return void 0;
+  let lastItemIdx = keyIdx;
+  let indent = "  ";
+  for (let i = keyIdx + 1; i < lines.length; i++) {
+    const match = lines[i]?.match(LIST_ITEM);
+    if (!match) break;
+    indent = match[1] ?? indent;
+    lastItemIdx = i;
+    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
+  }
+  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
+  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
+  writeFileSync(yamlPath, lines.join("\n"));
+  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
+}
+var PRETTIER_IGNORE = ".prettierignore";
+var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
+var ROOT_PRETTIER_CONFIGS = [
+  ".prettierrc",
+  ".prettierrc.json",
+  ".prettierrc.json5",
+  ".prettierrc.yml",
+  ".prettierrc.yaml",
+  ".prettierrc.js",
+  ".prettierrc.cjs",
+  ".prettierrc.mjs",
+  "prettier.config.js",
+  "prettier.config.cjs",
+  "prettier.config.mjs"
+];
+function ensureFormatterExclusion(root, moduleDir, dryRun) {
+  const rel = relative2(root, moduleDir).replaceAll("\\", "/");
+  if (rel === "" || rel.startsWith("..")) return void 0;
+  const ignorePath = join12(root, PRETTIER_IGNORE);
+  const hasPrettier = existsSync12(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync12(join12(root, name)));
+  if (!hasPrettier) return void 0;
+  const pattern = `/${rel}/`;
+  const existing = existsSync12(ignorePath) ? readFileSync10(ignorePath, "utf8") : "";
+  const lines = existing.split("\n");
+  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
+    return void 0;
+  }
+  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
+  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
+  if (headerIdx === -1) {
+    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
+
+`;
+    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
+${pattern}
+`);
+  } else {
+    let end = headerIdx + 1;
+    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
+    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
+    writeFileSync(
+      ignorePath,
+      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
+    );
+  }
+  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
+}
+function ensureWorkspacePrep(opts) {
+  const dryRun = Boolean(opts.dryRun);
+  return [
+    ensureI18nextSingleton(opts.root, dryRun),
+    ensureReleaseAgeAllowList(opts.root, dryRun),
+    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
+  ].filter((message) => message !== void 0);
+}
+function inspectWorkspacePrep(root) {
+  const entries = [];
+  let pkg = {};
+  const pkgPath = join12(root, "package.json");
+  if (existsSync12(pkgPath)) {
+    try {
+      pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+    } catch {
+      pkg = {};
+    }
   }
-  /**
-   * Run Vite with the caller's own arguments after `--`, and report what happened.
-   *
-   * `whenSignalled` is the only difference between the two targets here, and it is a real one:
-   * a build killed by a signal did not produce a bundle, while a dev server killed by Ctrl-C
-   * did exactly what the developer asked.
-   */
-  spawnVite(ctx, vite, argv, whenSignalled) {
-    const { options, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
-      valueFlags: VITE_VALUE_FLAGS
+  const yamlPath = join12(root, WORKSPACE_YAML);
+  const yaml = existsSync12(yamlPath) ? readFileSync10(yamlPath, "utf8") : void 0;
+  const pinned = yaml === void 0 ? void 0 : findOverrideEntry(yaml.split("\n")).value;
+  if (pinned !== void 0) {
+    const stillForks = declaredNativeTs(pkg);
+    entries.push({
+      rule: `${WORKSPACE_YAML} \u2192 overrides.${OVERRIDE_KEY}`,
+      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
     });
-    const result = spawnSync(vite, [...argv, ...options, ...paths], {
-      cwd: ctx.cwd,
-      stdio: "inherit"
+  }
+  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
+  if (legacy !== void 0) {
+    entries.push({
+      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
+      reason: `pinned to ${legacy}, but pnpm 11 no longer reads the \`pnpm\` field of package.json and says nothing about it, so this override is not applied. Move it to ${WORKSPACE_YAML} under \`overrides:\`, which pnpm 10 and 11 both read.`
     });
-    if (result.error) {
-      this.say(`could not run vite (${result.error.message})`);
-      return { ok: false, code: 1 };
-    }
-    const code = result.status ?? whenSignalled;
-    return { ok: code === 0, code };
   }
-  /** One prefix for every message this role emits, so they cannot drift apart. */
-  say(message) {
-    process.stderr.write(`sentinel ${this.label}(vite): ${message}
-`);
+  const own = readOwnPackage().name;
+  if (yaml !== void 0) {
+    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
+    if (listed) {
+      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
+      entries.push({
+        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
+        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
+      });
+    }
   }
-};
+  return entries;
+}
 
-// src/roles/build/adapters/vite/vite-dev.adapter.ts
-var ViteDevAdapter = class extends ViteRoleAdapter {
-  target = "dev";
-  get label() {
-    return "dev";
+// src/roles/build/declared-outputs.ts
+function declaredBuildTarget(cwd) {
+  return readProjectPackageJson(cwd).nx?.targets?.[BUILD_SCRIPT_NAME];
+}
+function resolveOutputToken(token, cwd) {
+  if (token.startsWith("{projectRoot}/")) return join13(cwd, token.slice("{projectRoot}/".length));
+  if (token.startsWith("{workspaceRoot}/")) {
+    const root = findWorkspaceRoot(cwd);
+    return root === void 0 ? void 0 : join13(root, token.slice("{workspaceRoot}/".length));
   }
-  /**
-   * `--init --dev` does the same thing as `--init --build`, and now says so.
-   *
-   * The shared plan is deliberate (see `ViteRoleAdapter.plan`): one plan writes both scripts,
-   * because adopting one without the other leaves the module half-migrated. What was missing
-   * was only the telling: the run printed a message about the build and nothing about `serve`,
-   * so a developer could believe the dev server had been adopted on its own. Refusing was the
-   * wrong correction, it added friction to a command that already produced the right result.
-   */
-  plan(context) {
-    const planned = super.plan(context);
-    if (planned.operations.length === 0) return planned;
-    return {
-      ...planned,
-      notes: [
-        ...planned.notes ?? [],
-        "--init --dev adopts the build too: one plan writes both `build` and `serve`."
-      ]
-    };
+  return join13(cwd, token);
+}
+function buildStamp(cwd) {
+  const marker = join13(cwd, `.sentinel-build-stamp-${process.pid}`);
+  try {
+    writeFileSync2(marker, "");
+    const stamp = statSync(marker).mtimeMs;
+    rmSync(marker, { force: true });
+    return stamp;
+  } catch {
+    return Date.now();
   }
-  /**
-   * Start the dev server. It does not return until stopped, so there is no verdict to report
-   * beyond the exit code the developer's own Ctrl-C produces.
-   *
-   * No `prebuild` here, unlike `--run --build`: the artefact this repo generates before a build
-   * is produced by the watcher that WRAPS this command (`run-with-runtime-artifact-watch`), and
-   * running it again would race the watcher that is about to own the file.
-   *
-   * No subcommand either. `vite`, `vite dev` and `vite serve` all start the server, and the
-   * bare form is the one every version accepts.
-   */
-  async run(ctx) {
-    const ready = this.prepare(ctx);
-    if (ready.kind === "stop") return ready.result;
-    return this.spawnVite(ctx, ready.vite, [], 0);
+}
+function writtenSince(path, startedAt) {
+  if (!existsSync13(path)) return false;
+  try {
+    return statSync(path).mtimeMs >= startedAt;
+  } catch {
+    return true;
   }
-};
+}
+function outputsProblem(cwd, startedAt) {
+  const target = declaredBuildTarget(cwd);
+  if (target === void 0) return void 0;
+  const declared = target.outputs ?? [];
+  if (declared.length === 0) {
+    if (target.cache !== true) return void 0;
+    return `this module's nx build target sets \`cache: true\` and declares no \`outputs\`, so nx will cache this build and restore nothing from it: the next cache hit reports success and leaves no build on disk. Add the directory this build writes to under \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json, or re-run \`sentinel --init --build\`, which declares it.`;
+  }
+  const resolved = declared.map((token) => ({ token, path: resolveOutputToken(token, cwd) })).filter((entry) => entry.path !== void 0);
+  if (resolved.length === 0) return void 0;
+  if (resolved.some((entry) => writtenSince(entry.path, startedAt))) return void 0;
+  return `the build wrote nothing to any of the directories this module declares as its nx \`outputs\` (${declared.join(", ")}), so nx would cache this build and restore an empty result from it. Whatever directory the build DID write to belongs in \`nx.targets.${BUILD_SCRIPT_NAME}.outputs\` in package.json. The build itself succeeded; only its cache declaration is wrong.`;
+}
 
 // src/roles/build/prerequisite.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -1162,7 +1781,15 @@ var ViteAdapter = class extends ViteRoleAdapter {
       );
       return { ok: false, code: prerequisite.code };
     }
-    return this.spawnVite(ctx, ready.vite, ["build"], 1);
+    const startedAt = buildStamp(ctx.cwd);
+    const result = await this.spawnVite(ctx, ready.vite, ["build"], 1);
+    if (!result.ok) return result;
+    const problem = outputsProblem(ctx.cwd, startedAt);
+    if (problem !== void 0) {
+      this.say(problem);
+      return { ok: false, code: 1 };
+    }
+    return result;
   }
   /**
    * What this module builds with, WITHOUT loading its config.
@@ -1234,12 +1861,12 @@ function registerBuild() {
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { join as join18 } from "path";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "fs";
-import { extname, join as join9, relative as relative3 } from "path";
+import { extname, join as join14, relative as relative3 } from "path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1274,258 +1901,59 @@ var FORMATTABLE_EXTENSIONS = [
   ".yml",
   ".html",
   ".css",
-  ".scss",
-  ".hbs"
-];
-function hasSourceFiles(cwd, extensions) {
-  const wanted = new Set(extensions);
-  const queue = [cwd];
-  while (queue.length > 0) {
-    const dir = queue.pop();
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join9(dir, entry.name));
-        continue;
-      }
-      if (wanted.has(extname(entry.name))) return true;
-    }
-  }
-  return false;
-}
-function listSourceFiles(cwd, extensions) {
-  const wanted = new Set(extensions);
-  const queue = [cwd];
-  const found = [];
-  while (queue.length > 0) {
-    const dir = queue.pop();
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const full = join9(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
-        continue;
-      }
-      if (wanted.has(extname(entry.name))) found.push(relative3(cwd, full));
-    }
-  }
-  return found;
-}
-
-// src/core/named-scope.ts
-var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
-function scopeFlags(paths, options = []) {
-  if (paths.length === 0 || options.includes(TOLERATE_EMPTY_FLAG)) return [];
-  return [TOLERATE_EMPTY_FLAG];
-}
-
-// src/core/settings.ts
-var WORKSPACE_ROOT_MARKER = "nx.json";
-var DEFAULT_MAX_DIAGNOSTICS = 100;
-
-// src/core/workspace-prep.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync } from "fs";
-import { dirname as dirname3, join as join10, relative as relative4 } from "path";
-var OVERRIDE_KEY = "i18next>typescript";
-var NATIVE_TS_ALIAS = "@typescript/native";
-var WORKSPACE_YAML = "pnpm-workspace.yaml";
-var RELEASE_AGE_KEY = "minimumReleaseAgeExclude";
-var LIST_ITEM = /^(\s*)-\s+(.*?)\s*$/;
-function findWorkspaceRoot(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    if (existsSync9(join10(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname3(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
-function declaredNativeTs(pkg) {
-  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS];
-  if (!spec) return void 0;
-  const version = spec.slice(spec.lastIndexOf("@") + 1).replace(/^[\^~>=<\s]+/, "");
-  return version || void 0;
-}
-function ensureI18nextSingleton(root, dryRun) {
-  const pkgPath = join10(root, "package.json");
-  if (!existsSync9(pkgPath)) return void 0;
-  const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
-  const want = declaredNativeTs(pkg);
-  if (!want) return void 0;
-  const have = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (have === want) return void 0;
-  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} (i18next singleton)`;
-  pkg.pnpm ??= {};
-  pkg.pnpm.overrides ??= {};
-  pkg.pnpm.overrides[OVERRIDE_KEY] = want;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-  return `pinned ${OVERRIDE_KEY} to ${want} in package.json (i18next singleton)`;
-}
-function ensureReleaseAgeAllowList(root, dryRun) {
-  const yamlPath = join10(root, WORKSPACE_YAML);
-  if (!existsSync9(yamlPath)) return void 0;
-  const own = readOwnPackage().name;
-  const lines = readFileSync7(yamlPath, "utf8").split("\n");
-  const keyIdx = lines.findIndex((line) => line.replace(/\s+$/, "") === `${RELEASE_AGE_KEY}:`);
-  if (keyIdx === -1) return void 0;
-  let lastItemIdx = keyIdx;
-  let indent = "  ";
-  for (let i = keyIdx + 1; i < lines.length; i++) {
-    const match = lines[i]?.match(LIST_ITEM);
-    if (!match) break;
-    indent = match[1] ?? indent;
-    lastItemIdx = i;
-    if ((match[2] ?? "").replace(/^['"]|['"]$/g, "") === own) return void 0;
-  }
-  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`;
-  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`);
-  writeFileSync(yamlPath, lines.join("\n"));
-  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
-}
-var PRETTIER_IGNORE = ".prettierignore";
-var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
-var ROOT_PRETTIER_CONFIGS = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.json5",
-  ".prettierrc.yml",
-  ".prettierrc.yaml",
-  ".prettierrc.js",
-  ".prettierrc.cjs",
-  ".prettierrc.mjs",
-  "prettier.config.js",
-  "prettier.config.cjs",
-  "prettier.config.mjs"
-];
-function ensureFormatterExclusion(root, moduleDir, dryRun) {
-  const rel = relative4(root, moduleDir).replaceAll("\\", "/");
-  if (rel === "" || rel.startsWith("..")) return void 0;
-  const ignorePath = join10(root, PRETTIER_IGNORE);
-  const hasPrettier = existsSync9(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync9(join10(root, name)));
-  if (!hasPrettier) return void 0;
-  const pattern = `/${rel}/`;
-  const existing = existsSync9(ignorePath) ? readFileSync7(ignorePath, "utf8") : "";
-  const lines = existing.split("\n");
-  if (lines.some((line) => line.trim().replace(/\/$/, "") === pattern.replace(/\/$/, ""))) {
-    return void 0;
-  }
-  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`;
-  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER);
-  if (headerIdx === -1) {
-    const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
-
-`;
-    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}
-${pattern}
-`);
-  } else {
-    let end = headerIdx + 1;
-    while (end < lines.length && lines[end]?.trim().startsWith("/")) end += 1;
-    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort();
-    writeFileSync(
-      ignorePath,
-      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join("\n")
-    );
+  ".scss",
+  ".hbs"
+];
+function hasSourceFiles(cwd, extensions) {
+  const wanted = new Set(extensions);
+  const queue = [cwd];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join14(dir, entry.name));
+        continue;
+      }
+      if (wanted.has(extname(entry.name))) return true;
+    }
   }
-  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
-}
-function ensureWorkspacePrep(opts) {
-  const dryRun = Boolean(opts.dryRun);
-  return [
-    ensureI18nextSingleton(opts.root, dryRun),
-    ensureReleaseAgeAllowList(opts.root, dryRun),
-    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
-  ].filter((message) => message !== void 0);
+  return false;
 }
-function inspectWorkspacePrep(root) {
-  const entries = [];
-  let pkg = {};
-  const pkgPath = join10(root, "package.json");
-  if (existsSync9(pkgPath)) {
+function listSourceFiles(cwd, extensions) {
+  const wanted = new Set(extensions);
+  const queue = [cwd];
+  const found = [];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    let entries;
     try {
-      pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+      entries = readdirSync(dir, { withFileTypes: true });
     } catch {
-      pkg = {};
+      continue;
     }
-  }
-  const pinned = pkg.pnpm?.overrides?.[OVERRIDE_KEY];
-  if (pinned !== void 0) {
-    const stillForks = declaredNativeTs(pkg);
-    entries.push({
-      rule: `package.json \u2192 pnpm.overrides.${OVERRIDE_KEY}`,
-      reason: stillForks === void 0 ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing forks any more. This override is now dead config and can be removed.` : `pinned to ${pinned}, matching the second TypeScript the root declares (${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, not only adopted ones. It retires with the second TypeScript.`
-    });
-  }
-  const own = readOwnPackage().name;
-  const yamlPath = join10(root, WORKSPACE_YAML);
-  if (existsSync9(yamlPath)) {
-    const yaml = readFileSync7(yamlPath, "utf8");
-    const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
-    if (listed) {
-      const gated = new RegExp(`^\\s*minimumReleaseAge\\s*:`, "m").test(yaml);
-      entries.push({
-        rule: `${WORKSPACE_YAML} \u2192 ${RELEASE_AGE_KEY}: ${own}`,
-        reason: gated ? `${own} is exempt from this workspace's release-age gate, so a freshly published version installs instead of being held. That is a standing exemption from a supply-chain control: the exposure is one bump wide, since the version is pinned and the lockfile carries its integrity, so a re-publish of the same version does not pass. Retire it once a bump can simply wait out the window.` : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so there is no gate to be exempt from. This entry is now dead config and can be removed.`
-      });
+    for (const entry of entries) {
+      const full = join14(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
+        continue;
+      }
+      if (wanted.has(extname(entry.name))) found.push(relative3(cwd, full));
     }
   }
-  return entries;
+  return found;
 }
 
-// src/roles/format/config-policy.ts
-var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
-var FORMAT_SCRIPT_NAME = "format";
-var PROVENANCE_KEY = "$sentinel";
-var PERMITTED_LOCAL_KEYS = [
-  "useTabs",
-  "tabWidth",
-  "printWidth",
-  "semi",
-  "singleQuote",
-  "jsxSingleQuote",
-  "trailingComma",
-  "quoteProps",
-  "bracketSpacing",
-  "bracketSameLine",
-  "arrowParens",
-  "endOfLine",
-  "objectWrap",
-  "proseWrap",
-  "experimentalOperatorPosition"
-];
-var ALWAYS_LOCAL_KEYS = ["ignorePatterns", "overrides"];
-var FORMAT_DEFAULT_IGNORES = ["**/*.toml"];
-var PRETTIER_CONFIG_FILES = [
-  ".prettierrc",
-  ".prettierrc.json",
-  ".prettierrc.json5",
-  ".prettierrc.yml",
-  ".prettierrc.yaml",
-  ".prettierrc.js",
-  ".prettierrc.cjs",
-  ".prettierrc.mjs",
-  "prettier.config.js",
-  "prettier.config.cjs",
-  "prettier.config.mjs"
-];
-function formatTargets() {
-  return {
-    [FORMAT_SCRIPT_NAME]: {
-      cache: true,
-      inputs: ["default", `{projectRoot}/${FORMAT_CONFIG_FILE}`]
-    },
-    [`${FORMAT_SCRIPT_NAME}:fix`]: { cache: false }
-  };
+// src/core/named-scope.ts
+var TOLERATE_EMPTY_FLAG = "--no-error-on-unmatched-pattern";
+function scopeFlags(paths, options = []) {
+  if (paths.length === 0 || options.includes(TOLERATE_EMPTY_FLAG)) return [];
+  return [TOLERATE_EMPTY_FLAG];
 }
 
 // src/roles/format/format-script.ts
@@ -1556,8 +1984,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1567,16 +1995,17 @@ function toModulePattern(pattern) {
   const trimmed = pattern.trim();
   if (trimmed.startsWith("!")) return void 0;
   if (trimmed.startsWith("/**/")) return trimmed.slice(1);
+  if (trimmed.startsWith("**/")) return trimmed;
   if (trimmed.startsWith("/")) return void 0;
   return trimmed.replace(/\/$/, "").includes("/") ? void 0 : trimmed;
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path = join11(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync10(path)) return [];
+  const path = join15(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync14(path)) return [];
   let contents;
   try {
-    contents = readFileSync8(path, "utf8");
+    contents = readFileSync11(path, "utf8");
   } catch {
     return [];
   }
@@ -1620,56 +2049,14 @@ function needsSvelteCompiler(output) {
   return /svelte\/compiler/.test(output);
 }
 
-// src/roles/format/presets/base.json
-var base_default = {
-  printWidth: 80,
-  semi: false,
-  singleQuote: true,
-  trailingComma: "all",
-  sortPackageJson: false,
-  sortImports: false
-};
-
-// src/roles/format/presets/nest-imports.json
-var nest_imports_default = {
-  customGroups: [
-    {
-      groupName: "workspace",
-      elementNamePattern: ["@hublo/**", "@shared/**", "@front/**", "@network/**"]
-    }
-  ],
-  groups: ["builtin", "external", "workspace", ["parent", "index"], "sibling"],
-  newlinesBetween: true,
-  order: "asc",
-  ignoreCase: false
-};
-
-// src/roles/format/preset-data.ts
-var FORMAT_PRESETS = ["base", "svelte", "nest"];
-function hasFormatPreset(name) {
-  return FORMAT_PRESETS.includes(name);
-}
-function formatPresetName(declared) {
-  if (declared === "svelte") return "svelte";
-  if (declared === "nest") return "nest";
-  return "base";
-}
-function formatPresetFor(preset) {
-  const base = base_default;
-  const name = formatPresetName(preset);
-  if (name === "svelte") return { ...base, svelte: true };
-  if (name === "nest") return { ...base, sortImports: nest_imports_default };
-  return base;
-}
-
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { join as join17 } from "path";
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname4, join as join16 } from "path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -1698,8 +2085,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire2(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join12(dirname4(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync9(schemaPath, "utf8"));
+    const schemaPath = join16(dirname4(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync12(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -1730,14 +2117,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync11(join13(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync15(join17(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync10(join13(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync13(join17(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1766,71 +2153,6 @@ function readPrettierSettings(cwd) {
   return { options, file, unresolved };
 }
 
-// src/roles/format/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
-var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
-  configFile,
-  preset: null,
-  adopted: false,
-  conformant: false,
-  drift: [],
-  local: {},
-  presetVersion: null,
-  effective: {},
-  unreadable
-});
-function sameValue(a, b) {
-  return JSON.stringify(a) === JSON.stringify(b);
-}
-function readFormatAdoption(cwd) {
-  const path = join14(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync12(path)) return NOT_ADOPTED2(null);
-  let parsed;
-  try {
-    parsed = parseJsonc(readFileSync11(path, "utf8"), FORMAT_CONFIG_FILE);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED2(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
-  }
-  const provenance = parsed[PROVENANCE_KEY];
-  if (!provenance || typeof provenance.preset !== "string") return NOT_ADOPTED2(FORMAT_CONFIG_FILE);
-  if (!hasFormatPreset(provenance.preset)) {
-    return NOT_ADOPTED2(
-      FORMAT_CONFIG_FILE,
-      `${FORMAT_CONFIG_FILE} declares the format preset "${provenance.preset}", which sentinel does not ship (shipped: ${FORMAT_PRESETS.join(", ")}). Re-run \`sentinel --init --format\`.`
-    );
-  }
-  const declaredLocal = Array.isArray(provenance.local) ? provenance.local : [];
-  const preset = formatPresetFor(provenance.preset);
-  const drift = [];
-  const local = {};
-  for (const [key, expected] of Object.entries(preset)) {
-    if (declaredLocal.includes(key)) {
-      local[key] = parsed[key];
-      continue;
-    }
-    if (!(key in parsed) || !sameValue(parsed[key], expected)) drift.push(key);
-  }
-  for (const key of declaredLocal) {
-    if (!(key in preset)) local[key] = parsed[key];
-  }
-  for (const key of ALWAYS_LOCAL_KEYS) {
-    if (key in parsed) local[key] = parsed[key];
-  }
-  return {
-    configFile: FORMAT_CONFIG_FILE,
-    preset: provenance.preset,
-    adopted: true,
-    conformant: drift.length === 0,
-    drift,
-    local,
-    presetVersion: typeof provenance.version === "string" ? provenance.version : null,
-    effective: parsed,
-    unreadable: null
-  };
-}
-
 // src/roles/format/unenforced.ts
 function unenforcedFormatOptions(options) {
   const gaps = [];
@@ -1913,7 +2235,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context.cwd, this.formatScripts(context.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync13(join15(context.cwd, name))
+      (name) => existsSync16(join18(context.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context.cwd);
@@ -2153,7 +2475,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync14(join18(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -2235,8 +2557,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync20, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync22, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join28 } from "path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2244,8 +2566,8 @@ function deferredRuleNames(rules) {
 }
 
 // src/core/fix-report.ts
-import { statSync } from "fs";
-import { join as join16 } from "path";
+import { statSync as statSync2 } from "fs";
+import { join as join19 } from "path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -2256,7 +2578,7 @@ function readFailure(output) {
 }
 function fingerprint(path) {
   try {
-    const stat = statSync(path);
+    const stat = statSync2(path);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -2265,7 +2587,7 @@ function fingerprint(path) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join16(cwd, file));
+    const mark = fingerprint(join19(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -2273,7 +2595,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join16(cwd, file));
+    const now = fingerprint(join19(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -2292,8 +2614,8 @@ function describeFixOutcome(outcome, toolLabel) {
 }
 
 // src/roles/lint/module-baseline.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join20 } from "path";
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
 var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
@@ -2337,11 +2659,11 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 function heldRules(cwd) {
-  const path = join17(cwd, LINT_BASELINE_FILE);
-  if (!existsSync14(path)) return [];
+  const path = join20(cwd, LINT_BASELINE_FILE);
+  if (!existsSync17(path)) return [];
   try {
     const parsed = parseJsonc(
-      readFileSync13(path, "utf8"),
+      readFileSync15(path, "utf8"),
       LINT_BASELINE_FILE
     );
     return Object.keys(parsed.rules ?? {});
@@ -2772,7 +3094,8 @@ var react_lib_default = {
     {
       name: "storybook",
       specifier: "eslint-plugin-storybook"
-    }
+    },
+    "../plugins/hublo.js"
   ],
   settings: null,
   renames: {
@@ -2781,6 +3104,7 @@ var react_lib_default = {
   rules: {
     curly: ["error", "all"],
     "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
     "jest-dom/prefer-checked": "error",
     "jest-dom/prefer-empty": "error",
     "jest-dom/prefer-enabled-disabled": "error",
@@ -3132,7 +3456,7 @@ var react_lib_default = {
   ],
   uncovered: {
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, which is why the app tier hosts `../plugins/hublo.js`. The library tier enforces none of those rules today, so it hosts nothing.",
+    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, so this tier hosts `../plugins/hublo.js` too. It enforces exactly one of them: `hublo/no-regex-lookbehind`, because a library is where that bug is WRITTEN and it reaches an app tier only by being imported (HUB-43431 shipped from libs/front/components into the worker app). The palette selectors stay app-tier only.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -3196,6 +3520,7 @@ var react_default = {
       severity: "off",
       reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
     },
+    "hublo/no-regex-lookbehind": "error",
     "jest/expect-expect": {
       severity: "off",
       reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
@@ -3682,7 +4007,7 @@ var react_default = {
   uncovered: {
     "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
     "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent as configuration, so the eight AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Two are hosted today: the eight palette selectors as `hublo/no-palette-common`, and the lookbehind selector as `hublo/no-regex-lookbehind`. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
     semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
   }
 };
@@ -4164,14 +4489,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { isAbsolute as isAbsolute2, join as join18, resolve as resolve3 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { isAbsolute as isAbsolute2, join as join21, resolve as resolve3 } from "path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute2(specifier) ? specifier : resolve3(cwd, specifier);
-  if (!existsSync15(path)) return void 0;
+  if (!existsSync18(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync14(path, "utf8"),
+      readFileSync16(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -4191,7 +4516,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync14(join18(cwd, configFile), "utf8"),
+      readFileSync16(join21(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4250,8 +4575,8 @@ function errorCountsByConfigRule(stdout) {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -4266,12 +4591,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
+import { join as join22 } from "path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync15(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync17(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -4285,8 +4610,8 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join19(moduleDir, candidate);
-    if (!existsSync16(absolutePath)) continue;
+    const absolutePath = join22(moduleDir, candidate);
+    if (!existsSync19(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
       existing = candidate;
@@ -4319,12 +4644,12 @@ var NOT_ADOPTED3 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync17(join20(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync20(join23(cwd, target.path))) {
     return NOT_ADOPTED3(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync16(join20(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync18(join23(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED3(target.path, `${target.path} could not be parsed (${reason})`);
@@ -4358,9 +4683,9 @@ function readLintAdoption(cwd) {
 }
 
 // src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { delimiter as delimiter2, dirname as dirname5, join as join21 } from "path";
+import { delimiter as delimiter2, dirname as dirname5, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -4385,30 +4710,30 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname5(require3.resolve(`${owner}/package.json`));
-      candidates.push(join21(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join21(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join24(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join24(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname5(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join21(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join24(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname5(fileURLToPath2(import.meta.url)), "tsgolint") ?? "");
   }
-  return candidates.find((candidate) => candidate !== "" && existsSync18(candidate));
+  return candidates.find((candidate) => candidate !== "" && existsSync21(candidate));
 }
 function oxlintSearchPath(cwd) {
   return binSearchPath(cwd);
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
+import { join as join27 } from "path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
+import { join as join25 } from "path";
 import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
@@ -4420,11 +4745,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join22(cwd, name)).find((path) => existsSync19(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join25(cwd, name)).find((path) => existsSync22(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync17(config, "utf8");
+    source = readFileSync19(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4525,8 +4850,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync18, statSync as statSync2 } from "fs";
-import { join as join23, relative as relative5 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync20, statSync as statSync3 } from "fs";
+import { join as join26, relative as relative4 } from "path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4573,10 +4898,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join23(dir, entry);
+    const full = join26(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync2(full).isDirectory();
+      isDirectory = statSync3(full).isDirectory();
     } catch {
       continue;
     }
@@ -4593,7 +4918,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync18(file, "utf8");
+      content = readFileSync20(file, "utf8");
     } catch {
       continue;
     }
@@ -4617,7 +4942,7 @@ function findSuppressionRenames(cwd, renames) {
       }
       if (hits.length === 0) return;
       found.push({
-        file: relative5(cwd, file),
+        file: relative4(cwd, file),
         line: index + 1,
         from: line,
         to: line.replace(rules, renamed.join(", ")),
@@ -4721,7 +5046,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync20(join24(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync23(join27(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4819,7 +5144,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4830,7 +5155,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync19(join24(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync21(join27(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4842,7 +5167,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync19(join24(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync21(join27(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4976,23 +5301,23 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join25(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join25(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync21(configPath)) return;
+    const configPath = join28(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join28(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync24(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync20(configPath, "utf8"),
+        readFileSync22(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join25(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join28(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
-      writeFileSync2(
+      writeFileSync3(
         measurePath,
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
@@ -5010,7 +5335,7 @@ ${result.stderr ?? ""}`);
         { cwd: ctx.cwd, encoding: "utf8", env, maxBuffer: CAPTURE_MAX_BUFFER }
       );
     } finally {
-      rmSync(measurePath, { force: true });
+      rmSync2(measurePath, { force: true });
     }
     if (measured.error || !(measured.stdout ?? "").includes('"diagnostics"')) {
       process.stderr.write(
@@ -5024,20 +5349,20 @@ ${result.stderr ?? ""}`);
     const holds = holdsFrom(errorCountsByConfigRule(measured.stdout ?? ""));
     const next = extendsWithBaseline(current, holds.length > 0);
     if (holds.length > 0) {
-      writeFileSync2(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      writeFileSync3(baselinePath, renderBaseline(holds, readOwnPackage().version));
       process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
 `);
     } else {
-      rmSync(baselinePath, { force: true });
+      rmSync2(baselinePath, { force: true });
     }
     if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
-      writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
+      writeFileSync3(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync21(join25(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync24(join28(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -5185,7 +5510,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync22(join28(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -5195,7 +5520,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync20(join25(cwd, entry), "utf8"),
+          readFileSync22(join28(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -5265,14 +5590,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync20(join25(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync22(join28(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync21(join25(cwd, target)));
+    return targets.find((target) => !existsSync24(join28(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5304,9 +5629,9 @@ function registerLint() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync24 } from "fs";
 import { createRequire as createRequire4 } from "module";
-import { join as join27 } from "path";
+import { join as join30 } from "path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5487,8 +5812,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync21 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync23 } from "fs";
+import { join as join29 } from "path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5581,7 +5906,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync21(join26(context.cwd, target.path), "utf8"),
+    readFileSync23(join29(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5719,7 +6044,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync22(join27(cwd, target.path), "utf8"),
+        readFileSync24(join30(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5732,7 +6057,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire4(join27(cwd, "noop.js")).resolve(preset);
+      createRequire4(join30(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5828,7 +6153,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync22(join27(cwd, config), "utf8"),
+        readFileSync24(join30(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5844,7 +6169,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync22(join27(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync25(join30(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -6048,7 +6373,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync23, readFileSync as readFileSync23, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync25, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve4, sep } from "path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -6067,7 +6392,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync23(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
+  return existsSync26(absolutePath) ? readFileSync25(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -6169,14 +6494,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync3(tempPath, contents);
+  writeFileSync4(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync2(file.absolutePath, { force: true });
+      rmSync3(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -6185,8 +6510,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync24, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync3, readFileSync as readFileSync26 } from "fs";
+import { join as join31 } from "path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -6195,16 +6520,20 @@ var PATH_SIGNALS = [
   }
 ];
 var DEPENDENCY_SIGNALS = [
-  { preset: "react", pattern: /^(react|react-dom|@types\/react)$|^eslint-plugin-react/ },
+  // Runtime dependencies only. `eslint-plugin-react*` used to count here, but a lint plugin is
+  // TOOLING: this very repo depends on `eslint-plugin-react-refresh` to ship React rules to
+  // other projects, and was therefore read as a React app itself. No module in the monorepo
+  // carries an `eslint-plugin-react*` without also carrying react, so nothing loses detection.
+  { preset: "react", pattern: /^(react|react-dom|@types\/react)$/ },
   { preset: "svelte", pattern: /^svelte$|^@sveltejs\// },
   { preset: "nest", pattern: /^@nestjs\// }
 ];
 function dependencyNames(cwd) {
-  const path = join28(cwd, "package.json");
-  if (!existsSync24(path)) return [];
+  const path = join31(cwd, "package.json");
+  if (!existsSync27(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync24(path, "utf8"),
+      readFileSync26(path, "utf8"),
       path
     );
     return [
@@ -6227,7 +6556,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync24(join28(cwd, name), "utf8"),
+        readFileSync26(join31(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;
@@ -6254,6 +6583,10 @@ function presetSignals(cwd) {
   }
   return signals;
 }
+function correctingSignal(detected, cwd) {
+  const [signal] = presetSignals(cwd);
+  return signal !== void 0 && signal.preset !== detected ? signal : void 0;
+}
 function presetContradiction(declared, cwd) {
   const signals = presetSignals(cwd);
   if (signals.length === 0) return void 0;
@@ -6334,8 +6667,8 @@ async function dispatch(opts) {
   }
   let effective = preset;
   if (opts.preset === void 0 && adapter.declaredPreset?.(opts.cwd) === void 0) {
-    const [signal] = presetSignals(opts.cwd);
-    if (signal !== void 0 && signal.preset !== preset) {
+    const signal = correctingSignal(preset, opts.cwd);
+    if (signal !== void 0) {
       effective = signal.preset;
       process.stderr.write(
         `  detected "${preset}" from dependencies, but ${signal.evidence}, so adopting as "${signal.preset}". Pass --preset to override.
@@ -6386,25 +6719,26 @@ export {
   declaredPresetFor,
   availableTargets,
   resolve,
-  BaseAdapter,
-  resolveBin,
   readOwnVersion,
   readProjectPackageJson,
   moduleName,
   buildConfigFile,
+  BaseAdapter,
+  resolveBin,
+  WORKSPACE_ROOT_MARKER,
+  findWorkspaceRoot,
+  ensureWorkspacePrep,
+  inspectWorkspacePrep,
   VERBS,
   TARGETS,
   LONG_RUNNING_TARGETS,
   SWEEPABLE_TARGETS,
   PRESET_NAMES,
-  WORKSPACE_ROOT_MARKER,
-  findWorkspaceRoot,
-  ensureWorkspacePrep,
-  inspectWorkspacePrep,
   palette,
   registerAdapters,
+  correctingSignal,
   describeFramework,
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-6RH3LZQZ.js.map
+//# sourceMappingURL=chunk-676GBPMS.js.map