@hublo/sentinel 1.4.0-alpha.36 → 1.4.0-alpha.37

package/dist/bin/sentinel.js

@@ -15,10 +15,10 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-ZMUTKBZ2.js";
+} from "../chunk-2N5D63HC.js";
 import {
   resolveContext
-} from "../chunk-OORAEYSU.js";
+} from "../chunk-YMSI5ZCB.js";
 import "../chunk-O7REVMOC.js";
 import "../chunk-QXFCZON7.js";
 import {
@@ -145,7 +145,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-2RTPM5EB.js");
+  const { validateModuleTests } = await import("../validate-MTAEHEMX.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/{chunk-ZMUTKBZ2.js → chunk-2N5D63HC.js}

@@ -1,9 +1,15 @@
 import {
   ALWAYS_LOCAL_KEYS,
   BaseAdapter,
+  ESLINT_CONFIG_FILES,
   FORMAT_CONFIG_FILE,
   FORMAT_DEFAULT_IGNORES,
   FORMAT_SCRIPT_NAME,
+  LINT_BASELINE_FILE,
+  LINT_BASELINE_SPECIFIER,
+  LINT_CONFIG_FILE,
+  LINT_MEASURE_FILE,
+  LINT_SCRIPT_NAME,
   PERMITTED_LOCAL_KEYS,
   PRETTIER_CONFIG_FILES,
   PROVENANCE_KEY,
@@ -11,22 +17,43 @@ import {
   adoptedPackageName,
   binFromOwnInstall,
   binSearchPath,
+  canRunTypeAware,
+  describeHolds,
+  extendsWithBaseline,
+  extendsWithPreset,
   formatPresetFor,
   formatPresetName,
   formatTargets,
+  heldRules,
+  holdsFrom,
+  isSentinelPreset,
+  lintTarget,
+  localOnlyKeys,
   manifestOperation,
   moduleScripts,
   nxTargetOperations,
   oxfmtRejects,
+  oxlintPath,
+  oxlintSearchPath,
+  presetNameFromPath,
+  presetOfVariant,
+  presetOwnedKeys,
+  presetPath,
+  presetVariant,
   projectTargets,
+  readAdoption,
   readFormatAdoption,
+  readLintAdoption,
+  renderBaseline,
   resolveBin,
+  resolveConfigTarget,
   resolveOxfmt,
+  resolveOxlint,
   rewriteToolchainImports,
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-OORAEYSU.js";
+} from "./chunk-YMSI5ZCB.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -1897,8 +1924,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -1957,104 +1984,6 @@ function describeFixOutcome(outcome, toolLabel) {
   return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
 }
 
-// src/roles/lint/module-baseline.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
-import { join as join12 } from "node:path";
-var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
-var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
-var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
-function holdsFrom(errorCounts) {
-  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
-}
-function renderBaseline(holds, version) {
-  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
-  return [
-    "{",
-    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
-    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
-    "  // and returns to `error` on its own.",
-    "  //",
-    "  // These rules are held at `warn` because this module ALREADY violated them when it",
-    "  // adopted. They still run and still report, so the build cannot fail on them.",
-    "  //",
-    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
-    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
-    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
-    "  // file rather than live with it.",
-    "  //",
-    "  // `sentinel --inspect --lint` lists what is held; `sentinel --run --lint --json` counts",
-    "  // what is left, per rule. Fix them and re-run `--init --lint` to get the severity back.",
-    '  "rules": {',
-    entries,
-    "  }",
-    "}",
-    ""
-  ].join("\n");
-}
-function extendsWithBaseline(current, hasHolds) {
-  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
-  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
-}
-function describeHolds(holds) {
-  if (holds.length === 0) return "";
-  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
-  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
-  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
-  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
-}
-function heldRules(cwd) {
-  const path = join12(cwd, LINT_BASELINE_FILE);
-  if (!existsSync9(path)) return [];
-  try {
-    const parsed = parseJsonc(
-      readFileSync9(path, "utf8"),
-      LINT_BASELINE_FILE
-    );
-    return Object.keys(parsed.rules ?? {});
-  } catch {
-    return [];
-  }
-}
-
-// src/roles/lint/config-policy.ts
-var LINT_CONFIG_FILE = ".oxlintrc.json";
-var LINT_SCRIPT_NAME = "lint";
-var PRESET_DIR = "./node_modules/@hublo/sentinel/lint";
-function presetPath(preset) {
-  return `${PRESET_DIR}/${preset}.json`;
-}
-function isSentinelPreset(entry) {
-  return /@hublo\/sentinel\/(lint|oxlint)\//.test(entry);
-}
-function extendsWithPreset(current, variant) {
-  const own = presetPath(variant);
-  const others = [...new Set(current.filter((entry) => entry !== own && !isSentinelPreset(entry)))];
-  const baseline = others.filter((entry) => entry === LINT_BASELINE_SPECIFIER);
-  const rest = others.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
-  return [own, ...rest, ...baseline];
-}
-function presetVariant(preset, cwd) {
-  const normalised = cwd.replaceAll("\\", "/");
-  return preset === "react" && /(^|\/)libs\//.test(normalised) ? "react-lib" : preset;
-}
-function presetOfVariant(variant) {
-  return variant === "react-lib" ? "react" : variant;
-}
-var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/(?:lint|oxlint)\/([a-z-]+)\.json$/;
-function presetNameFromPath(preset) {
-  return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
-}
-var PERMITTED_LOCAL_KEYS2 = ["extends", "ignorePatterns"];
-var ESLINT_CONFIG_FILES = [
-  "eslint.config.js",
-  "eslint.config.mjs",
-  "eslint.config.cjs",
-  "eslint.config.ts"
-];
-function lintTarget() {
-  return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
-}
-
 // src/roles/lint/presets/nest.json
 var nest_default = {
   plugins: ["typescript", "jest", "import", "unicorn", "oxc", "node"],
@@ -3833,14 +3762,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
-import { isAbsolute, join as join13, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { isAbsolute, join as join12, resolve as resolve2 } from "node:path";
 function ruleCount(cwd, specifier) {
   const path = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
-  if (!existsSync10(path)) return void 0;
+  if (!existsSync9(path)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync10(path, "utf8"),
+      readFileSync9(path, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -3860,7 +3789,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync10(join13(cwd, configFile), "utf8"),
+      readFileSync9(join12(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -3918,166 +3847,13 @@ function errorCountsByConfigRule(stdout) {
   return counts;
 }
 
-// src/core/config/read-adoption.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
-import { join as join15 } from "node:path";
-
-// src/core/config/owned-keys.ts
-function presetOwnedKeys(config, permitted, presetSets) {
-  if (!config) return [];
-  return Object.keys(config).filter(
-    (key) => !permitted.includes(key) && (presetSets === void 0 || presetSets.includes(key))
-  );
-}
-function localOnlyKeys(config, permitted, presetSets) {
-  if (!config) return [];
-  return Object.keys(config).filter((key) => !permitted.includes(key) && !presetSets.includes(key));
-}
-
-// src/core/config/resolve-config-target.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "node:fs";
-import { join as join14 } from "node:path";
-function readExtends(absolutePath) {
-  let parsed;
-  try {
-    parsed = parseJsonc(readFileSync11(absolutePath, "utf8"), absolutePath);
-  } catch {
-    return [];
-  }
-  if (typeof parsed.extends === "string") return [parsed.extends];
-  if (Array.isArray(parsed.extends)) {
-    return parsed.extends.filter((entry) => typeof entry === "string");
-  }
-  return [];
-}
-function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
-  let existing;
-  let existingExtendsSomething = false;
-  for (const candidate of candidates) {
-    const absolutePath = join14(moduleDir, candidate);
-    if (!existsSync11(absolutePath)) continue;
-    const chain = readExtends(absolutePath);
-    if (existing === void 0) {
-      existing = candidate;
-      existingExtendsSomething = chain.length > 0;
-    }
-    const extendsBase = chain.some((value) => markers.some((marker) => value.includes(marker)));
-    if (extendsBase) return { path: candidate, reason: "extends-base" };
-  }
-  if (existing) {
-    return { path: existing, reason: existingExtendsSomething ? "other-chain" : "no-extends" };
-  }
-  return { path: fallback, reason: "none" };
-}
-
-// src/core/config/read-adoption.ts
-function normaliseExtends(value) {
-  if (typeof value === "string") return [value];
-  if (Array.isArray(value)) {
-    return value.filter((entry) => typeof entry === "string");
-  }
-  return [];
-}
-var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
-  configFile,
-  preset: null,
-  adopted: false,
-  conformant: false,
-  drift: [],
-  unreadable
-});
-function readAdoption(cwd, options) {
-  const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync12(join15(cwd, target.path))) {
-    return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
-  }
-  let parsed;
-  try {
-    parsed = parseJsonc(readFileSync12(join15(cwd, target.path), "utf8"), target.path);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
-  }
-  const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
-  if (preset === null) return NOT_ADOPTED2(target.path);
-  const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
-  const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
-  return {
-    configFile: target.path,
-    preset,
-    adopted: true,
-    conformant: drift.length === 0,
-    drift,
-    unreadable: null
-  };
-}
-
-// src/roles/lint/read-adoption.ts
-function readLintAdoption(cwd) {
-  return readAdoption(cwd, {
-    candidates: [LINT_CONFIG_FILE],
-    markers: ["@hublo/sentinel/oxlint/"],
-    fallback: LINT_CONFIG_FILE,
-    presetPattern: SENTINEL_LINT_PRESET,
-    // Drift for lint is any TOP-LEVEL key beyond `extends`, so the settings the shared
-    // reader inspects are the config's own root rather than a nested options object.
-    settingsKey: null,
-    permitted: PERMITTED_LOCAL_KEYS2
-  });
-}
-
-// src/roles/lint/resolve-oxlint.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { createRequire } from "node:module";
-import { delimiter, dirname, join as join16 } from "node:path";
-import { fileURLToPath } from "node:url";
-var PACKAGE_OF = {
-  oxlint: "oxlint",
-  tsgolint: "oxlint-tsgolint"
-};
-var require2 = createRequire(import.meta.url);
-function resolveOxlint(cwd, name = "oxlint") {
-  return resolveBin(cwd, name) ?? binFromOwnInstall(PACKAGE_OF[name], name);
-}
-function canRunTypeAware(cwd) {
-  return tsgolintShim(cwd) !== void 0;
-}
-function oxlintPath(cwd, env) {
-  const shim = tsgolintShim(cwd);
-  if (!shim) return env.PATH;
-  return [dirname(shim), env.PATH].filter(Boolean).join(delimiter);
-}
-function tsgolintShim(cwd) {
-  const fromModule = resolveBin(cwd, "tsgolint");
-  if (fromModule) return fromModule;
-  const candidates = [];
-  for (const owner of ["oxlint-tsgolint", "oxlint"]) {
-    try {
-      const packageDir = dirname(require2.resolve(`${owner}/package.json`));
-      candidates.push(join16(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join16(packageDir, "..", ".bin", "tsgolint"));
-    } catch {
-    }
-  }
-  try {
-    const ownRoot = dirname(require2.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join16(ownRoot, "node_modules", ".bin", "tsgolint"));
-  } catch {
-    candidates.push(resolveBin(dirname(fileURLToPath(import.meta.url)), "tsgolint") ?? "");
-  }
-  return candidates.find((candidate) => candidate !== "" && existsSync13(candidate));
-}
-function oxlintSearchPath(cwd) {
-  return binSearchPath(cwd);
-}
-
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
+import { join as join13 } from "node:path";
 import { parseSync } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
@@ -4089,11 +3865,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join17(cwd, name)).find((path) => existsSync14(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path) => existsSync10(path));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync13(config, "utf8");
+    source = readFileSync10(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4184,8 +3960,8 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
-import { join as join18, relative as relative3 } from "node:path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
+import { join as join14, relative as relative3 } from "node:path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4232,7 +4008,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join18(dir, entry);
+    const full = join14(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync3(full).isDirectory();
@@ -4252,7 +4028,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync14(file, "utf8");
+      content = readFileSync11(file, "utf8");
     } catch {
       continue;
     }
@@ -4380,7 +4156,7 @@ function plan2(context) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync15(join19(context.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join15(context.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4478,7 +4254,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync12(join15(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4489,7 +4265,7 @@ function committedExtends(cwd) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync15(join19(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync12(join15(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4501,7 +4277,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync15(join19(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -4635,20 +4411,20 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join20(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join20(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync16(configPath)) return;
+    const configPath = join16(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join16(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync12(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync16(configPath, "utf8"),
+        readFileSync13(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join20(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join16(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
       writeFileSync2(
@@ -4696,7 +4472,7 @@ ${result.stderr ?? ""}`);
     }
   }
   async run(ctx) {
-    if (!existsSync16(join20(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync12(join16(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -4844,7 +4620,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -4854,7 +4630,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync16(join20(cwd, entry), "utf8"),
+          readFileSync13(join16(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
@@ -4924,14 +4700,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync16(join20(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync16(join20(cwd, target)));
+    return targets.find((target) => !existsSync12(join16(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4969,9 +4745,9 @@ function registerTest() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync18 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
+import { createRequire } from "node:module";
+import { join as join18 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -5152,8 +4928,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5246,7 +5022,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync17(join21(context.cwd, target.path), "utf8"),
+    readFileSync14(join17(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5384,7 +5160,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync18(join22(cwd, target.path), "utf8"),
+        readFileSync15(join18(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5397,7 +5173,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire2(join22(cwd, "noop.js")).resolve(preset);
+      createRequire(join18(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5493,7 +5269,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync18(join22(cwd, config), "utf8"),
+        readFileSync15(join18(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5509,7 +5285,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync17(join22(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync13(join18(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5714,7 +5490,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync18, readFileSync as readFileSync19, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync16, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve3, sep } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 
@@ -5733,7 +5509,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync18(absolutePath) ? readFileSync19(absolutePath, "utf8") : void 0;
+  return existsSync14(absolutePath) ? readFileSync16(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5851,8 +5627,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync19, readdirSync as readdirSync3, readFileSync as readFileSync20 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync17 } from "node:fs";
+import { join as join19 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5886,12 +5662,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join23(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join19(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync20(join23(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync17(join19(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -5900,11 +5676,11 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path = join23(cwd, "package.json");
-  if (!existsSync19(path)) return [];
+  const path = join19(cwd, "package.json");
+  if (!existsSync15(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync20(path, "utf8"),
+      readFileSync17(path, "utf8"),
       path
     );
     return [
@@ -5927,7 +5703,7 @@ function declaresJsx(cwd) {
   for (const name of entries) {
     try {
       const config = parseJsonc(
-        readFileSync20(join23(cwd, name), "utf8"),
+        readFileSync17(join19(cwd, name), "utf8"),
         name
       );
       if (config.compilerOptions?.jsx !== void 0) return true;

package/dist/{chunk-OORAEYSU.js → chunk-YMSI5ZCB.js}

@@ -4705,7 +4705,7 @@ function planJestMigration(context, adoption) {
   const formatter = writtenFileFormatter(context.cwd);
   if (formatter !== void 0) {
     notes.push(
-      `the files this rewrote were run through ${formatter.origin} afterwards. Two things needed it: the Vitest type imports land beside the existing ones, and a rewritten call is often SHORTER than the one it replaced, so the line breaks around it are no longer the ones your config would pick. Neither is a defect, and both would have failed your format check. What no formatter does is ORDER imports, so if your lint enforces \`import/order\`, run its fixer too.`
+      `the files this rewrote were run through ${formatter.origin} afterwards. Two things needed it: the Vitest type imports land beside the existing ones, and a rewritten call is often SHORTER than the one it replaced, so the line breaks around it are no longer the ones your config would pick. Neither is a defect, and both would have failed your format check. Ordering those imports is a LINT rule and no formatter does it, so this run also puts your own fixer over the same files: measured across the whole repository, \`import/order\` alone would otherwise have put 19 modules in the red.`
     );
   } else {
     notes.push(
@@ -4864,6 +4864,285 @@ function plan(context) {
   return { operations, notes };
 }
 
+// src/roles/test/written-file-linter.ts
+import { existsSync as existsSync23 } from "node:fs";
+import { join as join29 } from "node:path";
+
+// src/roles/lint/module-baseline.ts
+import { existsSync as existsSync19, readFileSync as readFileSync20 } from "node:fs";
+import { join as join25 } from "node:path";
+var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
+var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
+var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
+function holdsFrom(errorCounts) {
+  return [...errorCounts].map(([rule, count]) => ({ rule, count })).sort((left, right) => right.count - left.count || left.rule.localeCompare(right.rule));
+}
+function renderBaseline(holds, version) {
+  const entries = holds.map(({ rule }) => `    ${JSON.stringify(rule)}: "warn"`).join(",\n");
+  return [
+    "{",
+    `  // Written by @hublo/sentinel@${version}. Do not edit by hand: \`sentinel --init --lint\``,
+    "  // regenerates it from a fresh measurement, and a rule you have since fixed drops out",
+    "  // and returns to `error` on its own.",
+    "  //",
+    "  // These rules are held at `warn` because this module ALREADY violated them when it",
+    "  // adopted. They still run and still report, so the build cannot fail on them.",
+    "  //",
+    "  // The hold is per RULE, not per occurrence: oxlint cannot freeze a specific list of",
+    "  // violations, so a NEW violation of one of these rules is covered too, and will only",
+    "  // warn. That is the cost of adopting without a red build, and the reason to clear this",
+    "  // file rather than live with it.",
+    "  //",
+    "  // `sentinel --inspect --lint` lists what is held; `sentinel --run --lint --json` counts",
+    "  // what is left, per rule. Fix them and re-run `--init --lint` to get the severity back.",
+    '  "rules": {',
+    entries,
+    "  }",
+    "}",
+    ""
+  ].join("\n");
+}
+function extendsWithBaseline(current, hasHolds) {
+  const withoutBaseline = current.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return hasHolds ? [...withoutBaseline, LINT_BASELINE_SPECIFIER] : withoutBaseline;
+}
+function describeHolds(holds) {
+  if (holds.length === 0) return "";
+  const total = holds.reduce((sum, hold) => sum + hold.count, 0);
+  const listed = holds.slice(0, 5).map(({ rule, count }) => `${rule} (${count})`).join(", ");
+  const rest = holds.length > 5 ? `, and ${holds.length - 5} more` : "";
+  return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
+}
+function heldRules(cwd) {
+  const path = join25(cwd, LINT_BASELINE_FILE);
+  if (!existsSync19(path)) return [];
+  try {
+    const parsed = parseJsonc(
+      readFileSync20(path, "utf8"),
+      LINT_BASELINE_FILE
+    );
+    return Object.keys(parsed.rules ?? {});
+  } catch {
+    return [];
+  }
+}
+
+// src/roles/lint/config-policy.ts
+var LINT_CONFIG_FILE = ".oxlintrc.json";
+var LINT_SCRIPT_NAME = "lint";
+var PRESET_DIR = "./node_modules/@hublo/sentinel/lint";
+function presetPath(preset) {
+  return `${PRESET_DIR}/${preset}.json`;
+}
+function isSentinelPreset(entry) {
+  return /@hublo\/sentinel\/(lint|oxlint)\//.test(entry);
+}
+function extendsWithPreset(current, variant) {
+  const own = presetPath(variant);
+  const others = [...new Set(current.filter((entry) => entry !== own && !isSentinelPreset(entry)))];
+  const baseline = others.filter((entry) => entry === LINT_BASELINE_SPECIFIER);
+  const rest = others.filter((entry) => entry !== LINT_BASELINE_SPECIFIER);
+  return [own, ...rest, ...baseline];
+}
+function presetVariant(preset, cwd) {
+  const normalised = cwd.replaceAll("\\", "/");
+  return preset === "react" && /(^|\/)libs\//.test(normalised) ? "react-lib" : preset;
+}
+function presetOfVariant(variant) {
+  return variant === "react-lib" ? "react" : variant;
+}
+var SENTINEL_LINT_PRESET = /@hublo\/sentinel\/(?:lint|oxlint)\/([a-z-]+)\.json$/;
+function presetNameFromPath(preset) {
+  return preset ? SENTINEL_LINT_PRESET.exec(preset)?.[1] ?? void 0 : void 0;
+}
+var PERMITTED_LOCAL_KEYS2 = ["extends", "ignorePatterns"];
+var ESLINT_CONFIG_FILES = [
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts"
+];
+function lintTarget() {
+  return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
+}
+
+// src/core/config/read-adoption.ts
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "node:fs";
+import { join as join27 } from "node:path";
+
+// src/core/config/owned-keys.ts
+function presetOwnedKeys(config, permitted, presetSets) {
+  if (!config) return [];
+  return Object.keys(config).filter(
+    (key) => !permitted.includes(key) && (presetSets === void 0 || presetSets.includes(key))
+  );
+}
+function localOnlyKeys(config, permitted, presetSets) {
+  if (!config) return [];
+  return Object.keys(config).filter((key) => !permitted.includes(key) && !presetSets.includes(key));
+}
+
+// src/core/config/resolve-config-target.ts
+import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
+import { join as join26 } from "node:path";
+function readExtends(absolutePath) {
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync21(absolutePath, "utf8"), absolutePath);
+  } catch {
+    return [];
+  }
+  if (typeof parsed.extends === "string") return [parsed.extends];
+  if (Array.isArray(parsed.extends)) {
+    return parsed.extends.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
+  let existing;
+  let existingExtendsSomething = false;
+  for (const candidate of candidates) {
+    const absolutePath = join26(moduleDir, candidate);
+    if (!existsSync20(absolutePath)) continue;
+    const chain = readExtends(absolutePath);
+    if (existing === void 0) {
+      existing = candidate;
+      existingExtendsSomething = chain.length > 0;
+    }
+    const extendsBase = chain.some((value) => markers.some((marker) => value.includes(marker)));
+    if (extendsBase) return { path: candidate, reason: "extends-base" };
+  }
+  if (existing) {
+    return { path: existing, reason: existingExtendsSomething ? "other-chain" : "no-extends" };
+  }
+  return { path: fallback, reason: "none" };
+}
+
+// src/core/config/read-adoption.ts
+function normaliseExtends(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
+  configFile,
+  preset: null,
+  adopted: false,
+  conformant: false,
+  drift: [],
+  unreadable
+});
+function readAdoption(cwd, options) {
+  const target = resolveConfigTarget(cwd, options);
+  if (target.reason === "none" || !existsSync21(join27(cwd, target.path))) {
+    return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(readFileSync22(join27(cwd, target.path), "utf8"), target.path);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
+  }
+  const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
+  if (preset === null) return NOT_ADOPTED2(target.path);
+  const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
+  const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
+  return {
+    configFile: target.path,
+    preset,
+    adopted: true,
+    conformant: drift.length === 0,
+    drift,
+    unreadable: null
+  };
+}
+
+// src/roles/lint/read-adoption.ts
+function readLintAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: [LINT_CONFIG_FILE],
+    markers: ["@hublo/sentinel/oxlint/"],
+    fallback: LINT_CONFIG_FILE,
+    presetPattern: SENTINEL_LINT_PRESET,
+    // Drift for lint is any TOP-LEVEL key beyond `extends`, so the settings the shared
+    // reader inspects are the config's own root rather than a nested options object.
+    settingsKey: null,
+    permitted: PERMITTED_LOCAL_KEYS2
+  });
+}
+
+// src/roles/lint/resolve-oxlint.ts
+import { existsSync as existsSync22 } from "node:fs";
+import { createRequire as createRequire6 } from "node:module";
+import { delimiter as delimiter2, dirname as dirname12, join as join28 } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_OF = {
+  oxlint: "oxlint",
+  tsgolint: "oxlint-tsgolint"
+};
+var require3 = createRequire6(import.meta.url);
+function resolveOxlint(cwd, name = "oxlint") {
+  return resolveBin(cwd, name) ?? binFromOwnInstall(PACKAGE_OF[name], name);
+}
+function canRunTypeAware(cwd) {
+  return tsgolintShim(cwd) !== void 0;
+}
+function oxlintPath(cwd, env) {
+  const shim = tsgolintShim(cwd);
+  if (!shim) return env.PATH;
+  return [dirname12(shim), env.PATH].filter(Boolean).join(delimiter2);
+}
+function tsgolintShim(cwd) {
+  const fromModule = resolveBin(cwd, "tsgolint");
+  if (fromModule) return fromModule;
+  const candidates = [];
+  for (const owner of ["oxlint-tsgolint", "oxlint"]) {
+    try {
+      const packageDir = dirname12(require3.resolve(`${owner}/package.json`));
+      candidates.push(join28(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join28(packageDir, "..", ".bin", "tsgolint"));
+    } catch {
+    }
+  }
+  try {
+    const ownRoot = dirname12(require3.resolve("@hublo/sentinel/package.json"));
+    candidates.push(join28(ownRoot, "node_modules", ".bin", "tsgolint"));
+  } catch {
+    candidates.push(resolveBin(dirname12(fileURLToPath(import.meta.url)), "tsgolint") ?? "");
+  }
+  return candidates.find((candidate) => candidate !== "" && existsSync22(candidate));
+}
+function oxlintSearchPath(cwd) {
+  return binSearchPath(cwd);
+}
+
+// src/roles/test/written-file-linter.ts
+function writtenFileLinter(cwd) {
+  if (readLintAdoption(cwd).configFile !== null) {
+    const oxlint = resolveOxlint(cwd);
+    if (oxlint !== void 0) {
+      return { bin: oxlint, args: ["--fix"], origin: "this module's own oxlint config" };
+    }
+  }
+  const config = ESLINT_CONFIG_FILES.map((name) => join29(cwd, name)).find((path) => existsSync23(path));
+  const eslint = resolveBin(cwd, "eslint");
+  if (config !== void 0 && eslint !== void 0) {
+    return {
+      bin: eslint,
+      /*
+       * `--no-error-on-unmatched-pattern` because the batch is a list of files this run wrote, and
+       * one of them may sit under an ignore. That is not an error worth a message.
+       */
+      args: ["--fix", "--no-error-on-unmatched-pattern", "-c", config],
+      origin: "this module's own ESLint"
+    };
+  }
+  return void 0;
+}
+
 // src/roles/test/adapters/vitest/vitest.adapter.ts
 var FORMATTABLE = /\.(m|c)?(j|t)sx?$|\.json$/;
 var FORMAT_BATCH = 25;
@@ -4945,6 +5224,7 @@ var VitestAdapter = class extends BaseAdapter {
   async afterInit(ctx) {
     const written = (ctx.written ?? []).filter((file) => FORMATTABLE.test(file));
     if (written.length === 0) return Promise.resolve();
+    this.fixWithTheModulesLinter(ctx, written);
     const formatter = writtenFileFormatter(ctx.cwd);
     if (formatter === void 0) {
       this.say(
@@ -4970,6 +5250,35 @@ var VitestAdapter = class extends BaseAdapter {
     );
     return Promise.resolve();
   }
+  /**
+   * The module's own fixer, over the files this run wrote, BEFORE the formatter.
+   *
+   * Measured across all 107 modules of the monorepo: of 1373 lint errors the migration caused,
+   * 1369 were `import/order`. The migration adds an `import type ... from 'vitest'` beside the
+   * imports a file already has, and no formatter moves it, because ordering imports is a lint rule
+   * and not a style. Nineteen modules went red on a target the migration never touched.
+   *
+   * Never fatal, for the same reason the formatter is not: adoption succeeded, and reverting a
+   * migration over a tidy-up would be the wrong trade. A non-zero exit here usually means problems
+   * the fixer could not fix, which belong to the module and not to this run, so it is reported as
+   * what it is rather than as a failure.
+   */
+  fixWithTheModulesLinter(ctx, written) {
+    const linter = writtenFileLinter(ctx.cwd);
+    if (linter === void 0) return;
+    let unfixed = 0;
+    for (let at = 0; at < written.length; at += FORMAT_BATCH) {
+      const batch = written.slice(at, at + FORMAT_BATCH);
+      const pass = spawnSync(linter.bin, [...linter.args, ...batch], {
+        cwd: ctx.cwd,
+        encoding: "utf8"
+      });
+      if (pass.status !== 0) unfixed += batch.length;
+    }
+    this.say(
+      unfixed === 0 ? `ran ${linter.origin} with its fixer over the ${written.length} file(s) this wrote, so the import this migration adds is ordered the way your rules ask. Without it, \`import/order\` alone put 19 modules of this repository in the red.` : `${linter.origin} still reports problems on ${unfixed} of the ${written.length} file(s) this wrote, after its fixer ran. Adoption itself is applied; those are rules its fixer cannot settle on its own, so read them before committing.`
+    );
+  }
   plan(context) {
     return plan(context);
   }
@@ -5085,6 +5394,33 @@ export {
   rewriteToolchainImports,
   resolveOxfmt,
   oxfmtRejects,
+  LINT_BASELINE_FILE,
+  LINT_MEASURE_FILE,
+  LINT_BASELINE_SPECIFIER,
+  holdsFrom,
+  renderBaseline,
+  extendsWithBaseline,
+  describeHolds,
+  heldRules,
+  LINT_CONFIG_FILE,
+  LINT_SCRIPT_NAME,
+  presetPath,
+  isSentinelPreset,
+  extendsWithPreset,
+  presetVariant,
+  presetOfVariant,
+  presetNameFromPath,
+  ESLINT_CONFIG_FILES,
+  lintTarget,
+  presetOwnedKeys,
+  localOnlyKeys,
+  resolveConfigTarget,
+  readAdoption,
+  readLintAdoption,
+  resolveOxlint,
+  canRunTypeAware,
+  oxlintPath,
+  oxlintSearchPath,
   walk,
   readTestAdoption,
   resolveContext,

package/dist/index.js

@@ -6,10 +6,10 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-ZMUTKBZ2.js";
+} from "./chunk-2N5D63HC.js";
 import {
   BaseAdapter
-} from "./chunk-OORAEYSU.js";
+} from "./chunk-YMSI5ZCB.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 import "./chunk-NW6UHNYX.js";

package/dist/{validate-2RTPM5EB.js → validate-MTAEHEMX.js}

@@ -7,7 +7,7 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-OORAEYSU.js";
+} from "./chunk-YMSI5ZCB.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 import "./chunk-NW6UHNYX.js";
@@ -17,19 +17,23 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-function runVitest(cwd, config) {
+function runVitest(cwd, config, extra = []) {
   const { bin } = resolveVitest(cwd);
   if (bin === void 0) return void 0;
   const relocated = fromWorkspaceRoot(cwd, ["--config", config], []);
   const out = join(mkdtempSync(join(tmpdir(), "sentinel-validate-")), "vitest.json");
   try {
-    execFileSync(bin, ["run", ...relocated.options, "--reporter=json", `--outputFile=${out}`], {
-      cwd: relocated.cwd,
-      // The SAME environment the reference was taken in, or the two sides are two programs.
-      env: moduleEnvironment(cwd).env,
-      stdio: ["ignore", "ignore", "ignore"],
-      maxBuffer: 1 << 28
-    });
+    execFileSync(
+      bin,
+      ["run", ...relocated.options, ...extra, "--reporter=json", `--outputFile=${out}`],
+      {
+        cwd: relocated.cwd,
+        // The SAME environment the reference was taken in, or the two sides are two programs.
+        env: moduleEnvironment(cwd).env,
+        stdio: ["ignore", "ignore", "ignore"],
+        maxBuffer: 1 << 28
+      }
+    );
   } catch {
   }
   if (!existsSync(out)) return void 0;
@@ -48,6 +52,31 @@ function vitestConfigFor(cwd, suite) {
   }
   return void 0;
 }
+function sharesAWorker(cwd, config) {
+  try {
+    return /\bisolate\s*:\s*false\b/.test(readFileSync(join(cwd, config), "utf8"));
+  } catch {
+    return false;
+  }
+}
+function shuffledPassMatches(root, suite, config) {
+  const seed = Math.floor(Math.random() * 1e6);
+  const report = runVitest(root, config, ["--sequence.shuffle.files", `--sequence.seed=${seed}`]);
+  if (report === void 0) {
+    return {
+      ok: false,
+      message: `the shuffled pass (seed ${seed}) produced no report, so order independence is unproven.`
+    };
+  }
+  const comparison = compareAgainstReference(root, suite, report);
+  if (comparison.ok) {
+    return { ok: true, message: `and again in a random file order (seed ${seed}).` };
+  }
+  return {
+    ok: false,
+    message: `this suite shares a worker, and it depends on the ORDER of its files: in a random order (seed ${seed}) it no longer matches. ${comparison.message} Reproduce with \`--sequence.shuffle.files --sequence.seed=${seed}\`. Something a file does outlives it; until that is found, the suite is not safe without isolation.`
+  };
+}
 var KNOWN_SUITES = ["main", "prisma", "integration", "functional"];
 function suitesOf(cwd, adoption) {
   const declared = adoption.state === "jest" ? adoption.jestConfigs.map(suiteOf) : KNOWN_SUITES.filter((suite) => vitestConfigFor(cwd, suite) !== void 0);
@@ -103,7 +132,16 @@ function validateSuite(name, root, adoption, suite) {
       };
     }
     const comparison = compareAgainstReference(root, suite, report);
-    return { module: name, suite, ok: comparison.ok, message: comparison.message };
+    if (!comparison.ok || !sharesAWorker(root, config2)) {
+      return { module: name, suite, ok: comparison.ok, message: comparison.message };
+    }
+    const shuffled = shuffledPassMatches(root, suite, config2);
+    return {
+      module: name,
+      suite,
+      ok: shuffled.ok,
+      message: shuffled.ok ? `${comparison.message} ${shuffled.message}` : shuffled.message
+    };
   }
   if (adoption.state !== "jest") {
     return {
@@ -126,5 +164,6 @@ function validateSuite(name, root, adoption, suite) {
   return { module: name, suite, ok: capture.captured, message: capture.message };
 }
 export {
+  sharesAWorker,
   validateModuleTests
 };

package/docs/test-adoption.md

@@ -290,6 +290,103 @@ as `Mocked<typeof import(...)>` is worse: it demands the real return type and tu
 `Record<string, Mock>` describes what the factory on the line above actually built. It gives up the
 member NAMES, which `any` gave up too. Applied only when the SAME file mocks that specifier.
 
+## Going faster than jest ever was, if your module can
+
+Vitest gives every test file its own module registry and its own environment, so nothing one file
+does can reach the next. That is what makes a run expensive: the whole import graph is re-evaluated
+once per file. Measured on `libs/front/components`, 230 files and 1418 tests, same machine and
+session:
+
+|                                    | wall       |
+| ---------------------------------- | ---------- |
+| jest, files in parallel            | 15.9 s     |
+| vitest, isolated (the default)     | 44.6 s     |
+| **vitest, files sharing a worker** | **13.0 s** |
+
+On a real CI agent, same module: jest 158.7 s, isolated vitest 352.5 s, shared worker **92.7 s**.
+
+You ask for it with one line:
+
+```ts
+reactTestConfig({
+  root: import.meta.dirname,
+  workspaceRoot: path.resolve(import.meta.dirname, '../../..'),
+  isolate: false,
+  overrides: { ... },
+})
+```
+
+### What sentinel does so that this is safe
+
+Two things travel with the option, and neither is optional.
+
+**A file boundary.** A setup file is re-executed for every test file even when the registry is
+shared, so `afterAll` in a setup file IS the end of a file. Sentinel puts one there and gives back,
+per file, what isolation used to reset for free: Testing Library's cleanup (it registers itself at
+IMPORT time, so without this it arms for one file and 342 of 1418 tests fail with
+`Found multiple elements`), an empty `document`, every spy, real timers, and the file's own mock
+register.
+
+That last one is worth knowing about. Measured on plain vitest, `vi.resetAllMocks()` DESTROYS a
+mock's implementation while `clearAllMocks` and `restoreAllMocks` keep it. Under jest that could not
+outlive the file. Sharing a worker it reaches every later file, so one `vi.resetAllMocks()` in one
+hook leaves a shared fixture returning `undefined` for the rest of the run. Sentinel scopes those
+three calls back to the file, and never touches what a setup file built.
+
+**A split.** `vi.mock` has to be in place before the module it replaces is imported, and a module
+already evaluated cannot be un-evaluated. So the files that declare a module mock keep their
+isolation, in a second vitest project, and the rest share. The list is read from your sources on
+every run, so adding a test never puts it in the wrong project. On `libs/front/components` that is
+13 files of 230.
+
+### What you may have to change
+
+**One line, if your suite closes msw itself.** `server.close()` disposes the interceptors msw
+installed and leaves a dead registry behind, so the next `listen()` finds it and interception
+silently stops. Its boundary is the worker, not the file. If your setup has
+`afterAll(() => server.close())`, remove it; if you use `@hublo/sentinel/test/setup/msw-lifecycle`,
+this is already handled.
+
+**Anything else `--validate` names.** A mutable singleton at module scope in product code, a test
+writing to `globalThis` without cleaning up: these were forgiven by isolation and are not any more.
+
+### Nest does not get this, and the refusal says why
+
+Measured on `apps/nest/microservices/agency`: 43 s to 40 s, seven percent, where a jsdom module
+goes from 44.6 s to 13 s. A Nest suite's cost is its test bodies; a React suite's is re-evaluating
+its import graph. Against that seven percent, Nest registers its metadata as an import SIDE EFFECT,
+so a shared registry lets one suite see what another registered. The flavour refuses the option
+rather than ignoring it.
+
+### The order is the proof, and `--validate` takes it
+
+Isolation's whole product is that the order of your files cannot change the result. So when your
+config says `isolate: false`, `--validate` runs the suite a SECOND time in a random file order and
+compares that run against the same reference. One call, both claims: nothing was lost, and nothing
+depends on the order.
+
+This is not ceremony. Three runs of an identical configuration once gave three different failure
+lists, because vitest's default sequencer puts previously-failed files first, and each new order
+exposed a different leak. A single green run says very little.
+
+```console
+✗ front-components (main) — this suite shares a worker, and it depends on the ORDER of its files:
+  in a random order (seed 418293) it no longer matches. ... Reproduce with
+  `--sequence.shuffle.files --sequence.seed=418293`. Something a file does outlives it; until that
+  is found, the suite is not safe without isolation.
+```
+
+### Whether it is worth it for your module
+
+Ask how many of your test files declare a module mock, since those keep their isolation:
+
+```console
+$ rg -l 'vi\.mock\(|vi\.doMock\(' src --glob '*.{test,spec}.{ts,tsx}' | wc -l
+```
+
+`libs/front/components` has 13 of 230 and gains 3.4x. `apps/front/host-admin` has 603 of 1463, so
+most of its files would keep isolating and most of the cost would stay.
+
 ## The check that decides whether you are done
 
 Not "the suite is green". **The suite runs the same tests as before**. You do not have to arrange

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.4.0-alpha.36",
+  "version": "1.4.0-alpha.37",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",