@hublo/sentinel 1.4.0-alpha.31 → 1.4.0-alpha.33

package/README.md

@@ -24,6 +24,7 @@ A large monorepo accumulates:
 - **One source of truth for config** — every project just `extends @hublo/sentinel/...`; the actual rules live in one versioned place. Change a rule once, everyone gets it on the next version bump.
 - **One source of truth for tooling dependencies** — a project depends on `@hublo/sentinel`, not on a scattered pile of eslint / vitest / plugin devDeps. Bump one version and the whole toolchain moves, atomically, tested in isolation first.
 - **`--init` sets a module up** — the one command generates the stubs the first time (**adopt**), regenerates them after a change like a runner swap (**refresh**), and applies the workspace prep the module needs. Run it module by module to roll out gradually. (`--migrate`, for changing an already-initialized setup, is a reserved future verb.)
+- **`--validate` proves the move did not change anything** — a verb of its own, because what separates it from `--init` is what SURVIVES the run: `--init` and `--migrate` write state that REMAINS, `--validate` may instrument the module it is proving provided nothing it writes stays. Run before a migration it records what the module does today; run after, it compares and refuses a run that lost a test or invented one. It composes with every type, and answers "not available yet" for the ones without a proof rather than calling a valid command wrong.
 - **Move one module at a time** — installed per module, so you adopt at your pace; a module can adopt sentinel while its neighbour keeps the old setup. No big-bang.
 - **Swap tools without touching projects** — change eslint → biome (or benchmark them) in one place; `--init` regenerates the stubs.
 - **No silent drift** — the guard keeps every project's config converged on the source of truth.

package/dist/bin/sentinel.js

@@ -15,10 +15,10 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-QYIF3HXC.js";
+} from "../chunk-63NQP75B.js";
 import {
   resolveContext
-} from "../chunk-XM65P73B.js";
+} from "../chunk-UBXL567Z.js";
 import "../chunk-O7REVMOC.js";
 import {
   ensureWorkspacePrep,
@@ -144,7 +144,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-YRLGMILJ.js");
+  const { validateModuleTests } = await import("../validate-JUNITP37.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/{chunk-QYIF3HXC.js → chunk-63NQP75B.js}

@@ -27,7 +27,7 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-XM65P73B.js";
+} from "./chunk-UBXL567Z.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   findWorkspaceRoot,

package/dist/{chunk-XM65P73B.js → chunk-UBXL567Z.js}

@@ -723,7 +723,7 @@ function resolveVitest(cwd) {
 
 // src/roles/test/adapters/vitest/vitest.adapter.ts
 import { spawnSync } from "node:child_process";
-import { isAbsolute as isAbsolute2, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve8 } from "node:path";
 
 // src/core/config/tool-args.ts
 import { existsSync as existsSync6 } from "node:fs";
@@ -873,9 +873,9 @@ function rewriteToolchainImports(toolchain, source, fileName) {
 }
 
 // src/roles/test/jest-migration.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, readdirSync as readdirSync6 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync18, readdirSync as readdirSync6 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname10, join as join22, relative as relative5 } from "node:path";
+import { dirname as dirname11, join as join23, relative as relative5 } from "node:path";
 
 // src/shared/jsonc.ts
 import { parse as parse2, printParseErrorCode } from "jsonc-parser";
@@ -890,9 +890,9 @@ function parseJsonc(text, source = "config") {
 }
 
 // src/roles/test/codemod/migrate-module.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "node:fs";
-import { join as join15 } from "node:path";
-import { parseSync as parseSync7 } from "oxc-parser";
+import { readdirSync as readdirSync4, readFileSync as readFileSync13, statSync as statSync4 } from "node:fs";
+import { join as join16 } from "node:path";
+import { parseSync as parseSync8 } from "oxc-parser";
 
 // src/roles/test/msw-lifecycle.ts
 import { existsSync as existsSync9, readFileSync as readFileSync6 } from "node:fs";
@@ -1121,8 +1121,8 @@ ${source}`;
 }
 
 // src/roles/test/codemod/migrate-file.ts
-import { dirname as dirname6 } from "node:path";
-import { parseSync as parseSync6 } from "oxc-parser";
+import { dirname as dirname7 } from "node:path";
+import { parseSync as parseSync7 } from "oxc-parser";
 
 // src/roles/test/codemod/assertion-return-value.ts
 var MEMBER_TYPES = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
@@ -1295,6 +1295,20 @@ function assertedMockedClass(source, node) {
   if (object === void 0) return false;
   return /\bMockedClass\b/.test(source.slice(object.start, object.end));
 }
+function classValuedProperties(factories) {
+  const found = [];
+  for (const factory of factories) {
+    walk(factory, (node) => {
+      if (node.type !== "Property" && node.type !== "ObjectProperty") return;
+      const key = node.key;
+      const name = key?.type === "Identifier" ? key.name : key?.type === "StringLiteral" || key?.type === "Literal" ? String(key.value) : void 0;
+      if (name === void 0 || !/^[A-Z]/.test(name)) return;
+      const value = node.value;
+      if (value !== void 0) found.push(value);
+    });
+  }
+  return found;
+}
 function readsThis(node) {
   let found = false;
   walk(node, (inner) => {
@@ -1307,7 +1321,7 @@ function rewriteConstructibleMocks(source, program, factories) {
   const refusals = [];
   let rewritten = 0;
   const seen = /* @__PURE__ */ new Set();
-  const subtrees = [...factories];
+  const subtrees = [...classValuedProperties(factories)];
   walk(program, (node) => {
     if (assertedMockedClass(source, node)) subtrees.push(node);
   });
@@ -1867,9 +1881,165 @@ function rewriteHookReturnValue(source, program) {
 }
 
 // src/roles/test/codemod/named-rules.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname2, join as join9 } from "node:path";
+import { dirname as dirname3, join as join10 } from "node:path";
+
+// src/roles/test/codemod/static-import-for-require.ts
+import { existsSync as existsSync10, readFileSync as readFileSync7, statSync } from "node:fs";
+import { dirname as dirname2, join as join9, resolve as resolve3 } from "node:path";
+import { parseSync as parseSync4 } from "oxc-parser";
+var EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+function resolveRelative(fromFile, specifier) {
+  const base = resolve3(dirname2(fromFile), specifier);
+  const candidates = [
+    base,
+    ...EXTENSIONS.map((extension) => `${base}${extension}`),
+    ...EXTENSIONS.map((extension) => join9(base, `index${extension}`))
+  ];
+  for (const candidate of candidates) {
+    try {
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function relativeSpecifiers(source) {
+  const found = [];
+  const patterns = [
+    /\bfrom\s+['"](\.[^'"]*)['"]/g,
+    /\bimport\s+['"](\.[^'"]*)['"]/g,
+    /\bimport\s*\(\s*['"](\.[^'"]*)['"]\s*\)/g,
+    /\brequire\s*\(\s*['"](\.[^'"]*)['"]\s*\)/g
+  ];
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) found.push(match[1]);
+  }
+  return found;
+}
+function reachesBack(fromFile, specifier) {
+  const entry = resolveRelative(fromFile, specifier);
+  if (entry === void 0) return true;
+  const target = resolve3(fromFile);
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [entry];
+  while (stack.length > 0 && seen.size < 200) {
+    const file = stack.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    if (resolve3(file) === target) return true;
+    let source;
+    try {
+      source = readFileSync7(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const relative6 of relativeSpecifiers(source)) {
+      const next = resolveRelative(file, relative6);
+      if (next !== void 0) stack.push(next);
+    }
+  }
+  return seen.size >= 200;
+}
+function namedRequireDeclarations(program) {
+  const found = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type !== "VariableDeclaration") return;
+    const declarators = node.declarations ?? [];
+    if (declarators.length !== 1) return;
+    const declarator = declarators[0];
+    const init = declarator.init;
+    if (init?.type !== "CallExpression") return;
+    const callee = init.callee;
+    if (callee?.type !== "Identifier" || callee.name !== "require") return;
+    const [argument] = init.arguments ?? [];
+    if (argument?.type !== "StringLiteral" && argument?.type !== "Literal") return;
+    const specifier = String(argument.value);
+    if (!specifier.startsWith(".")) return;
+    const id = declarator.id;
+    if (id?.type !== "ObjectPattern") return;
+    const names = [];
+    for (const property of id.properties ?? []) {
+      if (property.type !== "Property" && property.type !== "ObjectProperty") return;
+      if (property.computed === true || property.shorthand !== true) return;
+      const key = property.key;
+      const value = property.value;
+      if (key?.type !== "Identifier" || value?.type !== "Identifier") return;
+      if (key.name !== value.name) return;
+      names.push(key.name);
+    }
+    if (names.length === 0) return;
+    found.set(init, { names, specifier, start: node.start, end: node.end });
+  });
+  return found;
+}
+function topLevelNames(program) {
+  const names = /* @__PURE__ */ new Set();
+  for (const node of program.body ?? []) {
+    if (node.type === "ImportDeclaration") {
+      for (const specifier of node.specifiers ?? []) {
+        const local = specifier.local;
+        if (local?.type === "Identifier") names.add(local.name);
+      }
+      continue;
+    }
+    if (node.type === "VariableDeclaration") {
+      for (const declarator of node.declarations ?? []) {
+        const id = declarator.id;
+        if (id?.type === "Identifier") names.add(id.name);
+      }
+      continue;
+    }
+    if ((node.type === "FunctionDeclaration" || node.type === "ClassDeclaration") && node.id?.type === "Identifier") {
+      names.add(node.id.name);
+    }
+  }
+  return names;
+}
+function withLeadingComments(source, comments, start) {
+  let from = start;
+  for (; ; ) {
+    const before = source.slice(0, from);
+    const blank = before.length - before.trimEnd().length;
+    const candidate = comments.find((comment) => comment.end === from - blank);
+    if (candidate === void 0) break;
+    const lineStart = source.lastIndexOf("\n", candidate.start) + 1;
+    if (source.slice(lineStart, candidate.start).trim() !== "") break;
+    from = lineStart;
+  }
+  return from;
+}
+function planStaticImport(fileName, source, program, requireCall2, semi) {
+  const declaration = namedRequireDeclarations(program).get(requireCall2);
+  if (declaration === void 0) return void 0;
+  const bound = topLevelNames(program);
+  if (declaration.names.some((name) => bound.has(name))) return void 0;
+  if (reachesBack(fileName, declaration.specifier)) return void 0;
+  const { comments } = parseSync4(fileName, source, { sourceType: "module" });
+  const lineStart = source.lastIndexOf("\n", declaration.start - 1) + 1;
+  const ownsItsLine = source.slice(lineStart, declaration.start).trim() === "";
+  const start = withLeadingComments(
+    source,
+    comments,
+    ownsItsLine ? lineStart : declaration.start
+  );
+  return {
+    line: `import { ${declaration.names.join(", ")} } from '${declaration.specifier}'${semi ? ";" : ""}`,
+    // To the end of the line, so the statement does not leave an empty one behind.
+    remove: { start, end: endOfLine(source, declaration.end) }
+  };
+}
+function endOfLine(source, end) {
+  let at = end;
+  if (source[at] === ";") at += 1;
+  while (source[at] === " " || source[at] === "	") at += 1;
+  if (source[at] === "\r") at += 1;
+  if (source[at] === "\n") at += 1;
+  return at;
+}
+
+// src/roles/test/codemod/named-rules.ts
 function isCommonJsPackage(fromFile, specifier) {
   if (specifier.startsWith(".") || specifier.startsWith("/")) return false;
   let resolved;
@@ -1881,23 +2051,27 @@ function isCommonJsPackage(fromFile, specifier) {
   if (!resolved.includes(`${"/"}node_modules${"/"}`)) return false;
   if (resolved.endsWith(".mjs")) return false;
   if (resolved.endsWith(".cjs")) return true;
-  let dir = dirname2(resolved);
+  let dir = dirname3(resolved);
   for (let depth = 0; depth < 12; depth += 1) {
-    const manifest = join9(dir, "package.json");
-    if (existsSync10(manifest)) {
+    const manifest = join10(dir, "package.json");
+    if (existsSync11(manifest)) {
       try {
-        return JSON.parse(readFileSync7(manifest, "utf8")).type !== "module";
+        return JSON.parse(readFileSync8(manifest, "utf8")).type !== "module";
       } catch {
         return false;
       }
     }
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return false;
 }
 var MEMBER_TYPES9 = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
+function fileUsesSemicolons(source) {
+  const first = /^import\s[^\n]*$/m.exec(source);
+  return first !== null && first[0].trimEnd().endsWith(";");
+}
 var ASYNC_REPLACEMENTS = {
   requireActual: "importActual",
   requireMock: "importMock"
@@ -1920,6 +2094,16 @@ function mockedSpecifiers(program) {
   });
   return found;
 }
+function methodValues(program) {
+  const found = /* @__PURE__ */ new Set();
+  walk(program, (node) => {
+    const isMethod = node.type === "MethodDefinition" || node.type === "ClassMethod" || node.type === "ObjectMethod" || (node.type === "Property" || node.type === "ObjectProperty") && (node.kind === "get" || node.kind === "set" || node.method === true);
+    if (!isMethod) return;
+    const value = node.value ?? node.body;
+    if (value !== void 0) found.add(value);
+  });
+  return found;
+}
 var FUNCTIONS = /* @__PURE__ */ new Set(["ArrowFunctionExpression", "FunctionExpression", "FunctionDeclaration"]);
 function walkWithEnclosingFunction(node, enclosing, visit) {
   if (node === null || typeof node !== "object") return;
@@ -2002,7 +2186,25 @@ function applyNamedRules(source, program, fileName = "") {
   const edits = [];
   const applied = /* @__PURE__ */ new Set();
   const asyncify = /* @__PURE__ */ new Set();
+  const refusals = [];
+  const staticImports = [];
   const mocked = mockedSpecifiers(program);
+  const methods = methodValues(program);
+  const cannotAwaitHere = (enclosing, what, call) => {
+    if (enclosing === void 0 || !methods.has(enclosing)) return false;
+    const plan2 = planStaticImport(fileName, source, program, call, fileUsesSemicolons(source));
+    if (plan2 !== void 0) {
+      edits.push({ start: plan2.remove.start, end: plan2.remove.end, text: "" });
+      staticImports.push(plan2.line);
+      applied.add(`${what} as a static import`);
+      return true;
+    }
+    refusals.push({
+      binding: what,
+      reason: `\`${what}\` sits inside a class or object METHOD, which cannot become async here: \`async get\` is not valid, and making a method that returns void return a promise changes what every caller gets. Left as it was. Under Vitest \`require\` is Node's own resolver, which knows nothing of \`.ts\`, so this one needs a person: a static import, or the dynamic one kept on purpose.`
+    });
+    return true;
+  };
   const wholeStatement = /* @__PURE__ */ new Map();
   walk(program, (node) => {
     if (node.type !== "ExpressionStatement") return;
@@ -2070,6 +2272,7 @@ function applyNamedRules(source, program, fileName = "") {
       const [specifier] = node.arguments ?? [];
       const literal = specifier?.type === "StringLiteral" || specifier?.type === "Literal" ? String(specifier.value) : void 0;
       if (literal !== void 0 && mocked.has(literal)) {
+        if (cannotAwaitHere(enclosing, "jest.requireMock", node)) return;
         edits.push({
           start: node.start,
           end: node.end,
@@ -2082,6 +2285,7 @@ function applyNamedRules(source, program, fileName = "") {
     }
     const asyncReplacement = member === void 0 ? void 0 : ASYNC_REPLACEMENTS[member];
     if (asyncReplacement !== void 0) {
+      if (cannotAwaitHere(enclosing, `jest.${member}`, node)) return;
       edits.push({
         start: node.start,
         end: node.end,
@@ -2095,6 +2299,7 @@ function applyNamedRules(source, program, fileName = "") {
       return;
     }
     if (bareRequire(node)) {
+      if (cannotAwaitHere(enclosing, "require", node)) return;
       const [specifier] = node.arguments ?? [];
       const literal = specifier?.type === "StringLiteral" || specifier?.type === "Literal" ? String(specifier.value) : void 0;
       const interop = literal !== void 0 && !readsANameOffIt.has(node) && !handedToTheRunnerAsAModule.has(node) && !wholeStatement.has(node) && isCommonJsPackage(fileName, literal) ? ".default" : "";
@@ -2129,7 +2334,27 @@ function applyNamedRules(source, program, fileName = "") {
   for (const fn of asyncify) {
     edits.push({ start: fn.start, end: fn.start, text: "async " });
   }
-  return { source: applyEdits(source, edits), applied: [...applied].sort() };
+  if (staticImports.length > 0) {
+    const first = (program.body ?? []).find(
+      (node) => node.type === "ImportDeclaration"
+    );
+    const byModule = /* @__PURE__ */ new Map();
+    for (const line of staticImports) {
+      const parsed = /^import \{ (.+) \} from '(.+)'(;?)$/.exec(line);
+      if (parsed === null) continue;
+      const names = byModule.get(parsed[2]) ?? /* @__PURE__ */ new Set();
+      for (const name of parsed[1].split(", ")) names.add(name);
+      byModule.set(parsed[2], names);
+    }
+    const semi = staticImports[0]?.endsWith(";") === true ? ";" : "";
+    const block = `${[...byModule].map(([specifier, names]) => `import { ${[...names].join(", ")} } from '${specifier}'${semi}`).join("\n")}
+`;
+    edits.push(
+      first === void 0 ? { start: 0, end: 0, text: `${block}
+` } : { start: first.start, end: first.start, text: block }
+    );
+  }
+  return { source: applyEdits(source, edits), applied: [...applied].sort(), refusals };
 }
 
 // src/roles/test/codemod/isolate-modules.ts
@@ -2525,7 +2750,7 @@ function annotateMockedBindings(source, program) {
 }
 
 // src/roles/test/codemod/propagate-await.ts
-import { parseSync as parseSync4 } from "oxc-parser";
+import { parseSync as parseSync5 } from "oxc-parser";
 var FUNCTIONS3 = /* @__PURE__ */ new Set(["ArrowFunctionExpression", "FunctionExpression", "FunctionDeclaration"]);
 var MEMBER_TYPES14 = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
 var ALREADY_A_PROMISE = /* @__PURE__ */ new Set(["then", "catch", "finally"]);
@@ -2621,7 +2846,7 @@ function propagateAwait(fileName, source, original, elsewhere = /* @__PURE__ */
   for (let round = 0; round < 12; round += 1) {
     let parsed;
     try {
-      parsed = parseSync4(fileName, current);
+      parsed = parseSync5(fileName, current);
     } catch {
       return { source: current, rewritten };
     }
@@ -2651,9 +2876,9 @@ function propagateAwait(fileName, source, original, elsewhere = /* @__PURE__ */
 }
 
 // src/roles/test/codemod/reexport-barrel-mock.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync2, statSync } from "node:fs";
+import { readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname3, join as join10 } from "node:path";
+import { dirname as dirname4, join as join11 } from "node:path";
 var MEMBER_TYPES15 = /* @__PURE__ */ new Set(["MemberExpression", "StaticMemberExpression"]);
 var PACKAGE_SUBPATH = /^(@[^/]+\/[^/]+|[^@.][^/]*)\/(.+)$/;
 var PURE_REEXPORT = /^module\.exports\s*=\s*require\(\s*(['"])([^'"]+)\1\s*\)\s*;?$/;
@@ -2682,7 +2907,7 @@ function mockCalls(program) {
 }
 function packageRoot(fromFile, name) {
   try {
-    return dirname3(createRequire3(fromFile).resolve(`${name}/package.json`));
+    return dirname4(createRequire3(fromFile).resolve(`${name}/package.json`));
   } catch {
     return void 0;
   }
@@ -2706,11 +2931,11 @@ function barrelsFor(fromFile, name, target) {
   const aliases = [];
   for (const entry of entries) {
     if (!entry.endsWith(".js")) continue;
-    const path = join10(root, entry);
+    const path = join11(root, entry);
     let body;
     try {
-      if (!statSync(path).isFile()) continue;
-      body = readFileSync8(path, "utf8");
+      if (!statSync2(path).isFile()) continue;
+      body = readFileSync9(path, "utf8");
     } catch {
       continue;
     }
@@ -2750,7 +2975,7 @@ ${text}` });
 }
 
 // src/roles/test/codemod/repoint-msw.ts
-import { parseSync as parseSync5 } from "oxc-parser";
+import { parseSync as parseSync6 } from "oxc-parser";
 var SENTINEL_MSW_SERVER = "@hublo/sentinel/test/msw";
 var SENTINEL_MSW_API = "@hublo/sentinel/test/tools/msw";
 var MSW_PACKAGE = /^msw$/;
@@ -2763,7 +2988,7 @@ function importsServer(declaration) {
   });
 }
 function repointMswServer(fileName, source) {
-  const { program, errors } = parseSync5(fileName, source, { sourceType: "module" });
+  const { program, errors } = parseSync6(fileName, source, { sourceType: "module" });
   if (errors.length > 0) return { source, repointed: false };
   const edits = [];
   walk(program, (node) => {
@@ -2789,17 +3014,17 @@ function repointMswServer(fileName, source) {
 }
 
 // src/roles/test/codemod/setup-static-imports.ts
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
 
 // src/core/context.ts
-import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname4, join as join12, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname5, join as join13, resolve as resolve4 } from "node:path";
 
 // src/core/discover-modules.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync2 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync10, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function runNx(cwd, args) {
   const nx = resolveBin(cwd, "nx") ?? "nx";
   try {
@@ -2817,11 +3042,11 @@ function runNx(cwd, args) {
   }
 }
 function readGraph(cwd) {
-  const dir = mkdtempSync2(join11(tmpdir2(), "sentinel-nx-"));
-  const file = join11(dir, "graph.json");
+  const dir = mkdtempSync2(join12(tmpdir2(), "sentinel-nx-"));
+  const file = join12(dir, "graph.json");
   try {
     runNx(cwd, ["graph", "--file", file]);
-    const parsed = JSON.parse(readFileSync9(file, "utf8"));
+    const parsed = JSON.parse(readFileSync10(file, "utf8"));
     const nodes = parsed.graph?.nodes;
     if (!nodes || typeof nodes !== "object") {
       throw new Error(
@@ -2830,7 +3055,7 @@ function readGraph(cwd) {
     }
     return Object.entries(nodes).map(([name, node]) => ({
       name,
-      root: join11(cwd, node.data.root)
+      root: join12(cwd, node.data.root)
     }));
   } finally {
     rmSync2(dir, { recursive: true, force: true });
@@ -2848,20 +3073,20 @@ function discoverModules(cwd, options = {}) {
 // src/core/context.ts
 var MODULE_MARKERS = ["package.json", "project.json"];
 function isModuleDir(cwd) {
-  return MODULE_MARKERS.some((marker) => existsSync11(join12(cwd, marker)));
+  return MODULE_MARKERS.some((marker) => existsSync12(join13(cwd, marker)));
 }
 function findModuleRoot(startDir, workspaceRoot) {
-  let dir = resolve3(startDir);
+  let dir = resolve4(startDir);
   for (; ; ) {
-    if (workspaceRoot !== void 0 && dir === resolve3(workspaceRoot)) return void 0;
+    if (workspaceRoot !== void 0 && dir === resolve4(workspaceRoot)) return void 0;
     if (isModuleDir(dir)) return dir;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveContext(cwd, opts) {
-  const atRoot = existsSync11(join12(cwd, WORKSPACE_ROOT_MARKER));
+  const atRoot = existsSync12(join13(cwd, WORKSPACE_ROOT_MARKER));
   if (!atRoot && isModuleDir(cwd)) {
     if (opts.module) {
       throw new Error(
@@ -2889,16 +3114,16 @@ function resolveContext(cwd, opts) {
 }
 
 // src/roles/test/codemod/workspace-specifier.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import { join as join13, relative as relative2, resolve as resolve4 } from "node:path";
-var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", "/index.ts", "/index.js"];
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
+import { join as join14, relative as relative2, resolve as resolve5 } from "node:path";
+var EXTENSIONS2 = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", "/index.ts", "/index.js"];
 function pathEntries(workspaceRoot) {
-  const file = join13(workspaceRoot, "tsconfig.base.json");
-  if (!existsSync12(file)) return [];
+  const file = join14(workspaceRoot, "tsconfig.base.json");
+  if (!existsSync13(file)) return [];
   let paths;
   try {
     paths = parseJsonc(
-      readFileSync10(file, "utf8"),
+      readFileSync11(file, "utf8"),
       "tsconfig.base.json"
     )?.compilerOptions?.paths;
   } catch {
@@ -2911,17 +3136,17 @@ function pathEntries(workspaceRoot) {
     const wildcard = key.endsWith("/*") && target.endsWith("/*");
     entries.push({
       key: wildcard ? key.slice(0, -2) : key,
-      target: resolve4(workspaceRoot, wildcard ? target.slice(0, -2) : target),
+      target: resolve5(workspaceRoot, wildcard ? target.slice(0, -2) : target),
       wildcard
     });
   }
   return entries.sort((left, right) => right.target.length - left.target.length);
 }
 function workspaceSpecifier(workspaceRoot, file) {
-  const absolute = resolve4(file);
+  const absolute = resolve5(file);
   for (const entry of pathEntries(workspaceRoot)) {
     if (!entry.wildcard) {
-      if (EXTENSIONS.some((extension) => `${entry.target}${extension}` === absolute)) {
+      if (EXTENSIONS2.some((extension) => `${entry.target}${extension}` === absolute)) {
         return entry.key;
       }
       continue;
@@ -2947,9 +3172,9 @@ function requireCall(source, node) {
 }
 function importable(written, fileName, workspaceRoot) {
   if (!written.startsWith(".")) return written;
-  const fileDir = dirname5(fileName);
+  const fileDir = dirname6(fileName);
   const moduleRoot = findModuleRoot(fileDir, workspaceRoot) ?? fileDir;
-  const target = resolve5(fileDir, written);
+  const target = resolve6(fileDir, written);
   if (target.startsWith(`${moduleRoot}/`)) return written;
   if (workspaceRoot === void 0) return void 0;
   return workspaceSpecifier(workspaceRoot, target);
@@ -3090,7 +3315,7 @@ function mockFactories(program) {
   return factories;
 }
 function parse3(fileName, source) {
-  const { program, errors } = parseSync6(fileName, source, { sourceType: "module" });
+  const { program, errors } = parseSync7(fileName, source, { sourceType: "module" });
   return errors.length > 0 ? void 0 : program;
 }
 function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new Set(), asyncHelpers = /* @__PURE__ */ new Set(), modulesOwnMsw = false) {
@@ -3120,7 +3345,7 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
     fileName,
     source,
     beforeStatic,
-    findWorkspaceRoot(dirname6(fileName))
+    findWorkspaceRoot(dirname7(fileName))
   );
   source = statics.source;
   const original = statics.rewritten === 0 ? beforeStatic : parse3(fileName, source);
@@ -3235,7 +3460,8 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
       ...hoist.refusals,
       ...mocks.refusals.map((refusal) => ({ binding: refusal.binding, reason: refusal.reason })),
       ...constructible.refusals,
-      ...isolated.refusals
+      ...isolated.refusals,
+      ...ruled.refusals
     ],
     warnings: fakeTimers.warnings,
     mswRepointed: repointed.repointed
@@ -3243,13 +3469,13 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
 }
 
 // src/roles/test/codemod/test-support-files.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname7, join as join14, relative as relative3, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync12, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { dirname as dirname8, join as join15, relative as relative3, resolve as resolve7 } from "node:path";
 var SKIPPED = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".git", ".vite"]);
 var TEST_FILE2 = /\.(spec|test)\.[cm]?[jt]sx?$/;
 var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-var EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
-function relativeSpecifiers(source) {
+var EXTENSIONS3 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
+function relativeSpecifiers2(source) {
   const found = [];
   const patterns = [
     /\bfrom\s+['"](\.[^'"]*)['"]/g,
@@ -3263,14 +3489,14 @@ function relativeSpecifiers(source) {
   return found;
 }
 function resolveSpecifier(fromFile, specifier) {
-  const base = resolve6(dirname7(fromFile), specifier);
-  if (existsSync13(base) && statSync2(base).isFile()) return base;
-  for (const extension of EXTENSIONS2) {
-    if (existsSync13(`${base}${extension}`)) return `${base}${extension}`;
+  const base = resolve7(dirname8(fromFile), specifier);
+  if (existsSync14(base) && statSync3(base).isFile()) return base;
+  for (const extension of EXTENSIONS3) {
+    if (existsSync14(`${base}${extension}`)) return `${base}${extension}`;
   }
-  for (const extension of EXTENSIONS2) {
-    const index = join14(base, `index${extension}`);
-    if (existsSync13(index)) return index;
+  for (const extension of EXTENSIONS3) {
+    const index = join15(base, `index${extension}`);
+    if (existsSync14(index)) return index;
   }
   return void 0;
 }
@@ -3287,9 +3513,9 @@ function moduleSources(cwd) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIPPED.has(entry.name)) stack.push(join14(dir, entry.name));
+        if (!SKIPPED.has(entry.name)) stack.push(join15(dir, entry.name));
       } else if (SOURCE_FILE.test(entry.name)) {
-        found.push(join14(dir, entry.name));
+        found.push(join15(dir, entry.name));
       }
     }
   }
@@ -3297,7 +3523,7 @@ function moduleSources(cwd) {
 }
 function read(path) {
   try {
-    return readFileSync11(path, "utf8");
+    return readFileSync12(path, "utf8");
   } catch {
     return void 0;
   }
@@ -3306,10 +3532,10 @@ function setupFilesInside(cwd, named) {
   const kept = [];
   for (const raw of named) {
     const withoutToken = raw.replaceAll("<rootDir>/", "").replaceAll("<rootDir>", ".");
-    const full = resolve6(cwd, withoutToken);
+    const full = resolve7(cwd, withoutToken);
     const inside = relative3(cwd, full);
     if (inside.startsWith("..") || inside === "") continue;
-    if (!existsSync13(full)) continue;
+    if (!existsSync14(full)) continue;
     kept.push(inside.replaceAll("\\", "/"));
   }
   return kept;
@@ -3323,7 +3549,7 @@ function listTestSupportFiles(cwd, setupFiles = []) {
   }
   const importedBy = /* @__PURE__ */ new Map();
   for (const [file, source] of contents) {
-    for (const specifier of relativeSpecifiers(source)) {
+    for (const specifier of relativeSpecifiers2(source)) {
       const target = resolveSpecifier(file, specifier);
       if (target === void 0 || !contents.has(target)) continue;
       importedBy.set(target, [...importedBy.get(target) ?? [], file]);
@@ -3336,7 +3562,7 @@ function listTestSupportFiles(cwd, setupFiles = []) {
   );
   while (queue.length > 0) {
     const file = queue.shift();
-    for (const specifier of relativeSpecifiers(contents.get(file) ?? "")) {
+    for (const specifier of relativeSpecifiers2(contents.get(file) ?? "")) {
       const target = resolveSpecifier(file, specifier);
       if (target === void 0 || TEST_FILE2.test(target) || testOnly.has(target)) continue;
       if (!isTestOnly(target)) continue;
@@ -3350,12 +3576,12 @@ function listTestSupportFiles(cwd, setupFiles = []) {
 
 // src/roles/test/codemod/migrate-module.ts
 function parse4(source) {
-  const { program, errors } = parseSync7("file.ts", source, { sourceType: "module" });
+  const { program, errors } = parseSync8("file.ts", source, { sourceType: "module" });
   return errors.length > 0 ? void 0 : program;
 }
 function read2(path) {
   try {
-    return readFileSync12(path, "utf8");
+    return readFileSync13(path, "utf8");
   } catch {
     return void 0;
   }
@@ -3373,10 +3599,10 @@ function defaultImportedSpecifiers(cwd) {
     }
     for (const entry of entries) {
       if (SKIPPED2.has(entry)) continue;
-      const path = join15(dir, entry);
+      const path = join16(dir, entry);
       let directory;
       try {
-        directory = statSync3(path).isDirectory();
+        directory = statSync4(path).isDirectory();
       } catch {
         continue;
       }
@@ -3404,18 +3630,28 @@ function migrateModuleTests(cwd, setupFiles = []) {
   const defaultImported = defaultImportedSpecifiers(cwd);
   const asyncHelpers = /* @__PURE__ */ new Set();
   for (const relative6 of listTestSupportFiles(cwd, setupFiles)) {
-    const source = read2(join15(cwd, relative6));
+    const source = read2(join16(cwd, relative6));
     if (source === void 0) {
       blockers.push({ file: relative6, reason: "this file could not be read" });
       continue;
     }
     const migrated = migrateTestFile(
-      join15(cwd, relative6),
+      join16(cwd, relative6),
       source,
       defaultImported,
       /* @__PURE__ */ new Set(),
       modulesOwnMsw
     );
+    for (const member of migrated.unhandled) {
+      blockers.push({
+        file: `${relative6}:${member.line}`,
+        reason: member.rule === void 0 ? `${member.member} has no rule, and guessing one is how a suite goes green for the wrong reason` : `${member.member} needs ${member.rule}`
+      });
+    }
+    for (const refusal of migrated.refusals) {
+      blockers.push({ file: relative6, reason: refusal.reason });
+    }
+    collected.push(...migrated.warnings);
     const renamedTo = vitestSupportName(relative6);
     if (!migrated.changed && renamedTo === relative6) continue;
     if (renamedTo !== relative6) operations.push({ kind: "delete", path: relative6 });
@@ -3429,17 +3665,17 @@ function migrateModuleTests(cwd, setupFiles = []) {
     }
     files++;
     renamed += migrated.renamed;
-    const contents = /\bvi\./.test(migrated.source) ? injectViImport(join15(cwd, renamedTo), migrated.source) : migrated.source;
+    const contents = /\bvi\./.test(migrated.source) ? injectViImport(join16(cwd, renamedTo), migrated.source) : migrated.source;
     operations.push({ kind: "write", path: renamedTo, contents });
   }
   for (const relative6 of listTestFiles(cwd)) {
-    const source = read2(join15(cwd, relative6));
+    const source = read2(join16(cwd, relative6));
     if (source === void 0) {
       blockers.push({ file: relative6, reason: "this file could not be read" });
       continue;
     }
     const migrated = migrateTestFile(
-      join15(cwd, relative6),
+      join16(cwd, relative6),
       source,
       defaultImported,
       asyncHelpers,
@@ -3466,8 +3702,8 @@ function migrateModuleTests(cwd, setupFiles = []) {
 }
 
 // src/roles/test/nest/generate-config.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync13, statSync as statSync4 } from "node:fs";
-import { join as join16, relative as relative4 } from "node:path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync14, statSync as statSync5 } from "node:fs";
+import { join as join17, relative as relative4 } from "node:path";
 var NEST_TEST_PRESET_SPECIFIER = "@hublo/sentinel/test/nest";
 var REACT_TEST_PRESET_SPECIFIER = "@hublo/sentinel/test/react";
 function flavourOf(reading) {
@@ -3513,10 +3749,10 @@ function readModuleTraits(cwd) {
     }
     for (const entry of entries) {
       if (SKIPPED3.has(entry)) continue;
-      const path = join16(dir, entry);
+      const path = join17(dir, entry);
       let directory;
       try {
-        directory = statSync4(path).isDirectory();
+        directory = statSync5(path).isDirectory();
       } catch {
         continue;
       }
@@ -3527,7 +3763,7 @@ function readModuleTraits(cwd) {
       if (!/\.tsx?$/.test(entry)) continue;
       let source;
       try {
-        source = readFileSync13(path, "utf8");
+        source = readFileSync14(path, "utf8");
       } catch {
         continue;
       }
@@ -3660,8 +3896,8 @@ ${overrides.join("\n")}
 }
 
 // src/roles/test/nest/read-jest-config.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
+import { join as join18 } from "node:path";
 var CARRIED = [
   "testEnvironment",
   "coverageDirectory",
@@ -3851,7 +4087,7 @@ function extendedConfig(source, cwd) {
       (name) => name.replace(/^\.\//, "")
     );
     const file = candidates.find(
-      (name) => /^jest[\w.-]*\.(ts|js)$/.test(name) && existsSync14(join17(cwd, name))
+      (name) => /^jest[\w.-]*\.(ts|js)$/.test(name) && existsSync15(join18(cwd, name))
     );
     if (file === void 0) continue;
     if (!new RegExp(String.raw`\{\s*\.\.\.${binding}\b`).test(source)) continue;
@@ -3878,11 +4114,11 @@ function sideEffects(source, extended) {
   return found;
 }
 function readJestConfig(cwd, named) {
-  const file = named ?? JEST_CONFIG_FILES.find((name) => existsSync14(join17(cwd, name)));
-  if (file === void 0 || !existsSync14(join17(cwd, file))) return void 0;
+  const file = named ?? JEST_CONFIG_FILES.find((name) => existsSync15(join18(cwd, name)));
+  if (file === void 0 || !existsSync15(join18(cwd, file))) return void 0;
   let source;
   try {
-    source = readFileSync14(join17(cwd, file), "utf8");
+    source = readFileSync15(join18(cwd, file), "utf8");
   } catch {
     return { file, refusals: [`${file} could not be read`], notes: [] };
   }
@@ -3963,8 +4199,8 @@ function readJestConfig(cwd, named) {
 }
 
 // src/roles/test/nest/run-modes.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { basename as basename2, join as join18 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { basename as basename2, join as join19 } from "node:path";
 var JEST_EXECUTOR = "@nx/jest:jest";
 var PRIMARY_CONFIG_FILE = "vitest.config.mts";
 var PRIMARY_TARGET = "test";
@@ -3985,7 +4221,7 @@ function runModes(cwd, fallback) {
     const jestConfig = entry.options?.jestConfig;
     if (jestConfig === void 0) continue;
     const name = configName(jestConfig);
-    if (!existsSync15(join18(cwd, name))) continue;
+    if (!existsSync16(join19(cwd, name))) continue;
     declared.push({
       target,
       jestConfig: name,
@@ -4010,12 +4246,12 @@ function runModes(cwd, fallback) {
 }
 
 // src/roles/test/written-file-formatter.ts
-import { existsSync as existsSync17 } from "node:fs";
-import { dirname as dirname9, join as join21 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname10, join as join22 } from "node:path";
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/roles/format/config-policy.ts
 var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
@@ -4121,11 +4357,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join19(cwd, FORMAT_CONFIG_FILE);
-  if (!existsSync16(path)) return NOT_ADOPTED(null);
+  const path = join20(cwd, FORMAT_CONFIG_FILE);
+  if (!existsSync17(path)) return NOT_ADOPTED(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync15(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync16(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -4169,9 +4405,9 @@ function readFormatAdoption(cwd) {
 }
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname8, join as join20 } from "node:path";
+import { dirname as dirname9, join as join21 } from "node:path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -4200,8 +4436,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire4(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join20(dirname8(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync16(schemaPath, "utf8"));
+    const schemaPath = join21(dirname9(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync17(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -4226,9 +4462,9 @@ function prettierConfigFrom(cwd) {
   let dir = cwd;
   for (; ; ) {
     for (const name of PRETTIER_CONFIGS) {
-      if (existsSync17(join21(dir, name))) return join21(dir, name);
+      if (existsSync18(join22(dir, name))) return join22(dir, name);
     }
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -4256,12 +4492,12 @@ function writtenFileFormatter(cwd) {
 var SPEC_TSCONFIG = "tsconfig.spec.json";
 var VITEST_GLOBAL_TYPES = "vitest/globals";
 function specTypesOperation(cwd) {
-  const path = join22(cwd, SPEC_TSCONFIG);
-  if (!existsSync18(path)) return void 0;
+  const path = join23(cwd, SPEC_TSCONFIG);
+  if (!existsSync19(path)) return void 0;
   let config;
   try {
     config = parseJsonc(
-      readFileSync17(path, "utf8"),
+      readFileSync18(path, "utf8"),
       SPEC_TSCONFIG
     );
   } catch {
@@ -4281,9 +4517,9 @@ function specTypesOperation(cwd) {
 }
 function shippedTypesPath(cwd, declaration) {
   try {
-    const manifest = createRequire5(join22(cwd, "noop.cjs")).resolve("@hublo/sentinel/package.json");
-    const file = join22(dirname10(manifest), declaration);
-    if (existsSync18(file)) {
+    const manifest = createRequire5(join23(cwd, "noop.cjs")).resolve("@hublo/sentinel/package.json");
+    const file = join23(dirname11(manifest), declaration);
+    if (existsSync19(file)) {
       const path = relative5(cwd, file);
       return path.startsWith(".") ? path : `./${path}`;
     }
@@ -4302,7 +4538,7 @@ function helpersStillCallingJest(cwd) {
       return;
     }
     for (const entry of entries) {
-      const path = join22(dir, entry.name);
+      const path = join23(dir, entry.name);
       if (entry.isDirectory()) {
         if (!skip.has(entry.name)) walk2(path);
         continue;
@@ -4312,7 +4548,7 @@ function helpersStillCallingJest(cwd) {
       if (/^(jest|vitest)\./.test(entry.name)) continue;
       let source;
       try {
-        source = readFileSync17(path, "utf8");
+        source = readFileSync18(path, "utf8");
       } catch {
         continue;
       }
@@ -4348,7 +4584,7 @@ function tsconfigFileListOperations(cwd) {
     let config;
     try {
       config = parseJsonc(
-        readFileSync17(join22(cwd, name), "utf8"),
+        readFileSync18(join23(cwd, name), "utf8"),
         name
       );
     } catch {
@@ -4816,7 +5052,7 @@ function fromWorkspaceRoot(moduleDir, options, paths) {
   if (root === void 0 || root === moduleDir) {
     return { cwd: moduleDir, options: [...options], paths: [...paths] };
   }
-  const absolute = (value) => isAbsolute2(value) ? value : resolve7(moduleDir, value);
+  const absolute = (value) => isAbsolute2(value) ? value : resolve8(moduleDir, value);
   const moved = [];
   let previousWasConfig = false;
   for (const option of options) {

package/dist/index.js

@@ -6,10 +6,10 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-QYIF3HXC.js";
+} from "./chunk-63NQP75B.js";
 import {
   BaseAdapter
-} from "./chunk-XM65P73B.js";
+} from "./chunk-UBXL567Z.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-NW6UHNYX.js";
 export {

package/dist/{validate-YRLGMILJ.js → validate-JUNITP37.js}

@@ -7,7 +7,7 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-XM65P73B.js";
+} from "./chunk-UBXL567Z.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-NW6UHNYX.js";
 

package/docs/test-adoption.md

@@ -10,6 +10,7 @@ that decided a design choice say which choice.
 - [The one line that makes a per-module migration possible](#the-one-line-that-makes-a-per-module-migration-possible)
 - [What `--init --test` rewrites, and what it refuses](#what---init---test-rewrites-and-what-it-refuses)
 - [Nest services](#nest-services)
+- [The two DOM matchers, which a react module gets without asking](#the-two-dom-matchers-which-a-react-module-gets-without-asking)
 - [The check that decides whether you are done](#the-check-that-decides-whether-you-are-done)
 
 ## What the ground actually looks like
@@ -292,16 +293,36 @@ member NAMES, which `any` gave up too. Applied only when the SAME file mocks tha
 ## The check that decides whether you are done
 
 Not "the suite is green". **The suite runs the same tests as before**. You do not have to arrange
-that comparison; the two commands do it between them:
+that comparison; `--validate` does it, on either side of the migration:
 
 ```console
-$ sentinel --init --test    # runs jest ONCE first, records every test name, then migrates
-$ pnpm install              # the module's dependencies changed
-$ sentinel --run --test     # runs vitest, compares against that recording, then spends it
+$ sentinel --validate --test   # on the JEST state: records every passing test name
+$ sentinel --init --test       # migrates
+$ pnpm install                 # the module's dependencies changed
+$ sentinel --validate --test   # runs vitest, compares against that recording, then spends it
 ```
 
 A codemod touching thousands of files cannot be reviewed by hand. This comparison is the review.
 
+⚠️ **The first command comes first, and the tool enforces it.** Start with `--init` and the jest
+config is already gone, so there is nothing left to record and nothing to compare against:
+
+```console
+✗ recruitment — already migrated, and no reference was recorded before it was, so there is
+  nothing to compare against. A proof has to be started BEFORE the migration:
+  `sentinel --validate --test` on the jest state, then `--init --test`, then this again.
+```
+
+### Why the proof is its own verb
+
+Because of what SURVIVES a run. `--init` and `--migrate` write state that stays, which is their
+whole purpose and why they are strict about what they touch. `--validate` may instrument the module
+it is proving, provided nothing it writes remains. Those are different contracts, so they are
+different verbs, and the proof can grow without touching a migration that is already proven.
+
+It answers every type, too: `sentinel --validate --lint` is a well-formed command, so it says "not
+available yet" rather than calling your sentence wrong.
+
 ### Why it cannot be one command
 
 The reference only exists BEFORE the migration, and the thing that produces it, the jest config, is
@@ -321,7 +342,7 @@ shorter.
 So the gate refuses a run that lost a name or invented one, and says which:
 
 ```console
-$ sentinel --run --test
+$ sentinel --validate --test
   1 test(s) no longer exist: useHublerNetworkProfilesQuery builds the URL with employment
   statuses only. (reference: jest.config.ts, 2026-09-23T21:10:00.000Z) The reference is KEPT
   until a run passes it, so this does not go green by running again. Fix the suite and re-run,
@@ -356,6 +377,7 @@ have read that improvement as a regression.
 ```console
 $ nx run <module>:typecheck            # BEFORE, and write that down too
 $ sentinel --init --test
+$ pnpm install
 $ nx run <module>:typecheck            # after
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.4.0-alpha.31",
+  "version": "1.4.0-alpha.33",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",