@hublo/sentinel 1.4.0-alpha.47 → 1.4.0-alpha.49

package/dist/{chunk-VR67JXVN.js → chunk-GJ6MNAWG.js}

@@ -5,13 +5,14 @@ import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
 import {
+  DEFAULT_MAX_DIAGNOSTICS,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   moduleName,
   readNxProjectName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-NW6UHNYX.js";
+} from "./chunk-KMKQDGI6.js";
 
 // src/core/base-adapter.ts
 var BaseAdapter = class {
@@ -367,9 +368,9 @@ function binFromOwnInstall(packageName, binName) {
   try {
     const manifest = require2.resolve(`${packageName}/package.json`);
     const bin = require2(manifest).bin;
-    const relative7 = typeof bin === "string" ? bin : bin?.[binName];
-    if (!relative7) return void 0;
-    const executable = join5(dirname(manifest), relative7);
+    const relative8 = typeof bin === "string" ? bin : bin?.[binName];
+    if (!relative8) return void 0;
+    const executable = join5(dirname(manifest), relative8);
     return existsSync4(executable) ? executable : void 0;
   } catch {
     return void 0;
@@ -747,8 +748,9 @@ function resolveVitest(cwd) {
 
 // src/roles/test/adapters/vitest/vitest.adapter.ts
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join30, relative as relative6, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync25, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync2 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join31, relative as relative7, resolve as resolve10 } from "node:path";
 
 // src/core/config/tool-args.ts
 import { existsSync as existsSync6 } from "node:fs";
@@ -920,14 +922,14 @@ function rewriteToolchainImports(toolchain, source, fileName) {
 }
 
 // src/roles/test/jest-migration.ts
-import { existsSync as existsSync19, readFileSync as readFileSync20, readdirSync as readdirSync6 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync21, readdirSync as readdirSync6 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
-import { dirname as dirname11, join as join24, relative as relative5 } from "node:path";
+import { dirname as dirname12, join as join25, relative as relative6 } from "node:path";
 
 // src/roles/test/codemod/migrate-module.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, statSync as statSync4 } from "node:fs";
-import { join as join17 } from "node:path";
-import { parseSync as parseSync8 } from "oxc-parser";
+import { readdirSync as readdirSync4, readFileSync as readFileSync16, statSync as statSync5 } from "node:fs";
+import { join as join18 } from "node:path";
+import { parseSync as parseSync9 } from "oxc-parser";
 
 // src/roles/test/msw-lifecycle.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
@@ -950,11 +952,11 @@ function ownsMswLifecycle(cwd, setupFiles) {
 // src/roles/test/support-file-name.ts
 var JEST_PREFIX = "jest.";
 var VITEST_PREFIX = "vitest.";
-function vitestSupportName(relative7) {
-  const cut = relative7.lastIndexOf("/");
-  const directory = cut === -1 ? "" : relative7.slice(0, cut + 1);
-  const base = relative7.slice(cut + 1);
-  if (!base.startsWith(JEST_PREFIX)) return relative7;
+function vitestSupportName(relative8) {
+  const cut = relative8.lastIndexOf("/");
+  const directory = cut === -1 ? "" : relative8.slice(0, cut + 1);
+  const base = relative8.slice(cut + 1);
+  if (!base.startsWith(JEST_PREFIX)) return relative8;
   return `${directory}${VITEST_PREFIX}${base.slice(JEST_PREFIX.length)}`;
 }
 
@@ -1007,7 +1009,7 @@ function bareModuleMocks(program) {
   });
   return found;
 }
-function inheritedAutomocks(cwd, setupFiles, parse4) {
+function inheritedAutomocks(cwd, setupFiles, parse5) {
   const found = /* @__PURE__ */ new Set();
   for (const named of setupFiles) {
     const path = resolve3(cwd, named.replace("<rootDir>/", "./"));
@@ -1019,7 +1021,7 @@ function inheritedAutomocks(cwd, setupFiles, parse4) {
     } catch {
       continue;
     }
-    const program = parse4(path, source);
+    const program = parse5(path, source);
     if (program === void 0) continue;
     for (const specifier of bareModuleMocks(program)) found.add(specifier);
   }
@@ -1243,8 +1245,8 @@ ${source}`;
 }
 
 // src/roles/test/codemod/migrate-file.ts
-import { dirname as dirname7 } from "node:path";
-import { parseSync as parseSync7 } from "oxc-parser";
+import { dirname as dirname8 } from "node:path";
+import { parseSync as parseSync8 } from "oxc-parser";
 
 // src/roles/test/codemod/assertion-return-value.ts
 function rootedAtExpect(node) {
@@ -1856,9 +1858,9 @@ function hoistable(name, bindings, imported, seen = /* @__PURE__ */ new Set()) {
   seen.add(name);
   const init = bindings.get(name);
   if (init === void 0) return false;
-  for (const read3 of readIdentifiers(init)) {
-    if (imported.has(read3)) return false;
-    if (bindings.has(read3) && !hoistable(read3, bindings, imported, seen)) return false;
+  for (const read4 of readIdentifiers(init)) {
+    if (imported.has(read4)) return false;
+    if (bindings.has(read4) && !hoistable(read4, bindings, imported, seen)) return false;
   }
   return true;
 }
@@ -1885,8 +1887,8 @@ function simpleDeclarations(program) {
 }
 function interdependent(names, bindings) {
   for (const name of names) {
-    for (const read3 of readIdentifiers(bindings.get(name))) {
-      if (read3 !== name && names.includes(read3)) return `${name} reads ${read3}`;
+    for (const read4 of readIdentifiers(bindings.get(name))) {
+      if (read4 !== name && names.includes(read4)) return `${name} reads ${read4}`;
     }
   }
   return void 0;
@@ -2140,8 +2142,8 @@ function reachesBack(fromFile, specifier) {
     } catch {
       continue;
     }
-    for (const relative7 of relativeSpecifiers(source)) {
-      const next = resolveRelative(file, relative7);
+    for (const relative8 of relativeSpecifiers(source)) {
+      const next = resolveRelative(file, relative8);
       if (next !== void 0) stack.push(next);
     }
   }
@@ -2151,9 +2153,9 @@ function namedRequireDeclarations(program) {
   const found = /* @__PURE__ */ new Map();
   walk(program, (node) => {
     if (node.type !== "VariableDeclaration") return;
-    const declarators = node.declarations ?? [];
-    if (declarators.length !== 1) return;
-    const declarator = declarators[0];
+    const declarators2 = node.declarations ?? [];
+    if (declarators2.length !== 1) return;
+    const declarator = declarators2[0];
     const init = declarator.init;
     if (init?.type !== "CallExpression") return;
     const callee = init.callee;
@@ -2446,9 +2448,9 @@ function applyNamedRules(source, program, fileName = "") {
   const refusals = [];
   const staticImports = [];
   const namespaces = namespaceBindings(program);
-  const castIfTestOnly = (specifier, read3) => {
+  const castIfTestOnly = (specifier, read4) => {
     const keys = testOnly.get(specifier);
-    return keys === void 0 ? read3 : `(${read3}${testOnlyExportCast(keys)})`;
+    return keys === void 0 ? read4 : `(${read4}${testOnlyExportCast(keys)})`;
   };
   const mocked = mockedSpecifiers(program);
   const testOnly = testOnlyExports(program);
@@ -3625,6 +3627,367 @@ function rewriteMockFactoryGenerics(source, program) {
   return { source: result, rewritten: edits.length, typeImports: [] };
 }
 
+// src/roles/test/codemod/spy-on-internal-call.ts
+import { readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
+import { dirname as dirname7, join as join16, relative as relative3, resolve as resolve8 } from "node:path";
+import { parseSync as parseSync7 } from "oxc-parser";
+var EXTENSIONS3 = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+function resolveRelative2(fromFile, specifier) {
+  if (!specifier.startsWith(".")) return void 0;
+  const base = resolve8(dirname7(fromFile), specifier);
+  const candidates = [
+    base,
+    ...EXTENSIONS3.map((extension) => `${base}${extension}`),
+    ...EXTENSIONS3.map((extension) => join16(base, `index${extension}`))
+  ];
+  for (const candidate of candidates) {
+    try {
+      if (statSync3(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function read(path) {
+  try {
+    return readFileSync14(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function parse2(fileName, source) {
+  const { program, errors } = parseSync7(fileName, source, { sourceType: "module" });
+  return errors.length > 0 ? void 0 : program;
+}
+function unwrap(node) {
+  let current = node;
+  while (current?.type === "ParenthesizedExpression") current = current.expression;
+  return current;
+}
+function usesSemicolons2(source) {
+  const first = /^import\s[^\n]*$/m.exec(source);
+  return first !== null && first[0].trimEnd().endsWith(";");
+}
+function lineOf2(source, offset) {
+  let line = 1;
+  for (let index = 0; index < offset && index < source.length; index += 1) {
+    if (source[index] === "\n") line += 1;
+  }
+  return line;
+}
+function namespaceImports(program) {
+  const found = /* @__PURE__ */ new Map();
+  for (const statement2 of program.body ?? []) {
+    if (statement2.type !== "ImportDeclaration") continue;
+    const source = statement2.source;
+    if (source === void 0) continue;
+    for (const clause of statement2.specifiers ?? []) {
+      if (clause.type !== "ImportNamespaceSpecifier") continue;
+      const local = clause.local;
+      if (local?.type === "Identifier") found.set(local.name, String(source.value));
+    }
+  }
+  return found;
+}
+function stringValue(node) {
+  if (node?.type !== "Literal" && node?.type !== "StringLiteral") return void 0;
+  return typeof node.value === "string" ? node.value : void 0;
+}
+function namespacedCall(node, member) {
+  if (node.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee === void 0 || !MEMBER_TYPES.has(callee.type)) return void 0;
+  const object = callee.object;
+  const property = callee.property;
+  if (object?.type !== "Identifier" || object.name !== "vi" && object.name !== "jest") {
+    return void 0;
+  }
+  if (property?.type !== "Identifier" || property.name !== member) return void 0;
+  return node.arguments ?? [];
+}
+function declarationOf(program, exported) {
+  const body = program.body ?? [];
+  const direct = (declaration, name) => {
+    if (declaration === void 0) return void 0;
+    if (declaration.type === "VariableDeclaration") {
+      for (const declarator of declaration.declarations ?? []) {
+        const id2 = declarator.id;
+        if (id2?.type === "Identifier" && id2.name === name) return declarator;
+      }
+      return void 0;
+    }
+    const id = declaration.id;
+    return id?.type === "Identifier" && id.name === name ? declaration : void 0;
+  };
+  for (const statement2 of body) {
+    if (statement2.type !== "ExportNamedDeclaration") continue;
+    const found = direct(statement2.declaration, exported);
+    if (found !== void 0) return { node: found, local: exported };
+  }
+  for (const statement2 of body) {
+    if (statement2.type !== "ExportNamedDeclaration") continue;
+    if (statement2.source !== void 0 && statement2.source !== null) continue;
+    for (const clause of statement2.specifiers ?? []) {
+      const outward = clause.exported;
+      const local = clause.local;
+      const outwardName = outward?.type === "Identifier" ? outward.name : void 0;
+      if (outwardName !== exported || local?.type !== "Identifier") continue;
+      const localName = local.name;
+      for (const candidate of body) {
+        const declaration = candidate.type === "ExportNamedDeclaration" ? candidate.declaration : candidate;
+        const found = direct(declaration, localName);
+        if (found !== void 0) return { node: found, local: localName };
+      }
+    }
+  }
+  return void 0;
+}
+function internalCallLines(source, program, local) {
+  const lines = [];
+  walk(program, (node) => {
+    if (node.type !== "CallExpression") return;
+    const callee = node.callee;
+    if (callee?.type !== "Identifier" || callee.name !== local) return;
+    lines.push(lineOf2(source, node.start));
+  });
+  return [...new Set(lines)].sort((left, right) => left - right);
+}
+function importOf(program, local) {
+  for (const statement2 of program.body ?? []) {
+    if (statement2.type !== "ImportDeclaration") continue;
+    if (statement2.importKind === "type") continue;
+    const source = statement2.source;
+    if (source === void 0) continue;
+    for (const clause of statement2.specifiers ?? []) {
+      const bound = clause.local;
+      if (bound?.type !== "Identifier" || bound.name !== local) continue;
+      if (clause.type !== "ImportSpecifier" || clause.importKind === "type") return void 0;
+      const imported = clause.imported;
+      const name = imported?.type === "Identifier" ? imported.name : stringValue(imported);
+      if (name === void 0) return void 0;
+      return { imported: name, from: String(source.value) };
+    }
+  }
+  return void 0;
+}
+function respell(fromFile, target) {
+  const path = relative3(dirname7(fromFile), target).replaceAll("\\", "/").replace(/\.(?:m|c)?[jt]sx?$/, "").replace(/\/index$/, "");
+  return path.startsWith(".") ? path : `./${path}`;
+}
+function namesInUse2(program) {
+  const used = /* @__PURE__ */ new Set();
+  walk(program, (node) => {
+    if (node.type === "Identifier") used.add(node.name);
+  });
+  return used;
+}
+function declarators(program) {
+  const found = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type !== "VariableDeclaration") return;
+    const declaration = node.declarations ?? [];
+    if (declaration.length !== 1) return;
+    const declarator = declaration[0];
+    const id = declarator.id;
+    const init = unwrap(declarator.init);
+    if (id?.type !== "Identifier" || init === void 0) return;
+    found.set(init, { name: id.name, id, statement: node });
+  });
+  return found;
+}
+function statementSpan2(source, statement2) {
+  let end = statement2.end;
+  if (source[end] === "\r") end++;
+  if (source[end] === "\n") end++;
+  return { start: statement2.start, end };
+}
+function existingMocks(program) {
+  const found = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    const args = namespacedCall(node, "mock");
+    if (args === void 0) return;
+    const specifier = stringValue(args[0]);
+    if (specifier === void 0) return;
+    const getters = found.get(specifier) ?? /* @__PURE__ */ new Set();
+    walk(args[1], (inner) => {
+      if (inner.type !== "Property" && inner.type !== "ObjectProperty") return;
+      if (inner.kind !== "get") return;
+      const key = inner.key;
+      if (key?.type === "Identifier") getters.add(key.name);
+    });
+    found.set(specifier, getters);
+  });
+  return found;
+}
+function drivenValues(source, program, binding) {
+  const statementOf = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    if (node.type !== "ExpressionStatement") return;
+    const expression = unwrap(node.expression);
+    if (expression !== void 0) statementOf.set(expression, node);
+  });
+  const values = [];
+  const used = /* @__PURE__ */ new Set();
+  let chained = false;
+  walk(program, (node) => {
+    if (node.type !== "CallExpression") return;
+    const callee = node.callee;
+    if (callee === void 0 || !MEMBER_TYPES.has(callee.type)) return;
+    const object = unwrap(callee.object);
+    const property = callee.property;
+    if (object?.type !== "Identifier" || object.name !== binding) return;
+    if (property?.type !== "Identifier" || property.name !== "mockReturnValue") return;
+    const args = node.arguments ?? [];
+    const statement2 = statementOf.get(node);
+    if (args.length !== 1 || statement2 === void 0) {
+      chained = true;
+      return;
+    }
+    const argument = args[0];
+    values.push({
+      start: statement2.start,
+      end: statement2.end,
+      value: source.slice(argument.start, argument.end)
+    });
+    used.add(object);
+  });
+  return { values, chained, used };
+}
+function remainingUses(program, binding, spent) {
+  let count = 0;
+  walk(program, (node) => {
+    if (node.type !== "Identifier" || node.name !== binding) return;
+    if (spent.has(node)) return;
+    count += 1;
+  });
+  return count;
+}
+function rewriteInternalCallSpies(fileName, source, program) {
+  const unchanged = { source, rewritten: [], refusals: [] };
+  if (!source.includes("spyOn")) return unchanged;
+  const namespaces = namespaceImports(program);
+  if (namespaces.size === 0) return unchanged;
+  const bindings = declarators(program);
+  const mocked = existingMocks(program);
+  const taken = namesInUse2(program);
+  const refusals = [];
+  const rewritten = [];
+  const edits = [];
+  const flagLines = [];
+  const getters = /* @__PURE__ */ new Map();
+  walk(program, (node) => {
+    const args = namespacedCall(node, "spyOn");
+    if (args === void 0) return;
+    const target = unwrap(args[0]);
+    const exported = stringValue(args[1]);
+    if (target?.type !== "Identifier" || exported === void 0) return;
+    const specifier = namespaces.get(target.name);
+    if (specifier === void 0) return;
+    const modulePath = resolveRelative2(fileName, specifier);
+    if (modulePath === void 0) return;
+    const moduleSource = read(modulePath);
+    if (moduleSource === void 0) return;
+    const moduleProgram = parse2(modulePath, moduleSource);
+    if (moduleProgram === void 0) return;
+    const declared = declarationOf(moduleProgram, exported);
+    if (declared === void 0) return;
+    const internal = internalCallLines(moduleSource, moduleProgram, declared.local);
+    if (internal.length === 0) return;
+    const where = `\`${target.name}.${exported}\`, spied in this file, is called ${internal.length} time(s) by \`${respell(fileName, modulePath)}\` itself (line${internal.length > 1 ? "s" : ""} ${internal.join(", ")}). Under ESM a spy on the namespace does not reach those calls`;
+    const refuse = (because) => {
+      refusals.push({ binding: exported, reason: `${where}, and ${because}` });
+    };
+    const derived = deriveRemedy(fileName, modulePath, moduleProgram, declared);
+    if (typeof derived === "string") return refuse(derived);
+    if (mocked.get(derived.specifier)?.has(derived.imported) === true) return;
+    if (mocked.has(derived.specifier)) {
+      return refuse(
+        `this file already mocks \`${derived.specifier}\`. Merging a getter into a factory somebody wrote is guessing at what it is for: add \`get ${derived.imported}()\` to it by hand, or drive the spy from there`
+      );
+    }
+    const declaration = bindings.get(node);
+    if (declaration === void 0) {
+      return refuse(
+        `the spy is not bound to a variable here, so there is nothing whose \`mockReturnValue\` can be transposed onto the value \`${exported}\` reads`
+      );
+    }
+    const driven = drivenValues(source, program, declaration.name);
+    if (driven.chained) {
+      return refuse(
+        `\`${declaration.name}.mockReturnValue(...)\` is used as an expression rather than as a statement of its own, and an assignment cannot be chained onto`
+      );
+    }
+    let flag = `${exported}Flag`;
+    for (let suffix = 2; taken.has(flag); suffix += 1) flag = `${exported}Flag${suffix}`;
+    taken.add(flag);
+    flagLines.push(
+      `const { ${flag} } = vi.hoisted(() => ({
+  ${flag}: { value: undefined as ReturnType<typeof ${target.name}.${exported}> | undefined },
+}))`
+    );
+    getters.set(derived.specifier, [
+      ...getters.get(derived.specifier) ?? [],
+      { imported: derived.imported, flag }
+    ]);
+    for (const value of driven.values) {
+      edits.push({ start: value.start, end: value.end, text: `${flag}.value = ${value.value}` });
+    }
+    const spent = /* @__PURE__ */ new Set([...driven.used, declaration.id]);
+    if (remainingUses(program, declaration.name, spent) === 0) {
+      edits.push({ ...statementSpan2(source, declaration.statement), text: "" });
+    }
+    rewritten.push(exported);
+  });
+  if (flagLines.length === 0) return { source, rewritten: [], refusals };
+  const semi = usesSemicolons2(source) ? ";" : "";
+  const blocks = [
+    ...flagLines.map((line) => `${line}${semi}`),
+    ...[...getters].map(([specifier, entries]) => renderMock(specifier, entries, semi))
+  ].join("\n\n");
+  const imports = (program.body ?? []).filter(
+    (statement2) => statement2.type === "ImportDeclaration"
+  );
+  const at = imports[imports.length - 1].end;
+  edits.push({ start: at, end: at, text: `
+
+${blocks}` });
+  return { source: applyEdits(source, edits), rewritten, refusals };
+}
+function deriveRemedy(fileName, modulePath, moduleProgram, declared) {
+  if (declared.node.type !== "VariableDeclarator") {
+    return `\`${declared.local}\` is declared as a \`${declared.node.type}\`, not as \`export const ${declared.local} = () => IDENT\`, so there is no single value behind it to drive instead`;
+  }
+  const init = unwrap(declared.node.init);
+  const body = unwrap(init?.body);
+  const parameters = init?.params ?? [];
+  if (init?.type !== "ArrowFunctionExpression" || init.async === true || parameters.length > 0 || body?.type !== "Identifier") {
+    return `\`${declared.local}\` is not \`export const ${declared.local} = () => IDENT\`: only a parameterless arrow whose whole body is one identifier has a value underneath it that a mock can drive`;
+  }
+  const read4 = importOf(moduleProgram, body.name);
+  if (read4 === void 0) {
+    return `\`${declared.local}\` returns \`${body.name}\`, which that module does not import as a named value, so there is no other module to mock in its place`;
+  }
+  const target = resolveRelative2(modulePath, read4.from);
+  if (target === void 0) {
+    return `\`${body.name}\` comes from \`${read4.from}\`, which is not a relative module of that project. Mocking it from the spec would reach past this module, so this one needs a person`;
+  }
+  return { specifier: respell(fileName, target), imported: read4.imported };
+}
+function renderMock(specifier, entries, semi) {
+  const body = entries.map(
+    ({ imported, flag }) => `    get ${imported}() {
+      return ${flag}.value ?? actual.${imported}
+    },
+`
+  ).join("");
+  return `vi.mock('${specifier}', async () => {
+  const actual = await vi.importActual<Record<string, unknown>>('${specifier}')${semi}
+  return {
+    ...actual,
+${body}  }${semi}
+})${semi}`;
+}
+
 // src/roles/test/codemod/typed-matcher.ts
 var SINGLE_VALUE_MATCHERS = /* @__PURE__ */ new Set([
   "toBe",
@@ -3690,8 +4053,8 @@ function mockFactories(program) {
   });
   return factories;
 }
-function parse2(fileName, source) {
-  const { program, errors } = parseSync7(fileName, source, { sourceType: "module" });
+function parse3(fileName, source) {
+  const { program, errors } = parseSync8(fileName, source, { sourceType: "module" });
   return errors.length > 0 ? void 0 : program;
 }
 function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new Set(), asyncHelpers = /* @__PURE__ */ new Set(), modulesOwnMsw = false) {
@@ -3715,72 +4078,72 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
       }
     ]
   });
-  const beforeStatic = parse2(fileName, source);
+  const beforeStatic = parse3(fileName, source);
   if (beforeStatic === void 0) return unparsable("reading the file");
   const statics = rewriteSetupStaticImports(
     fileName,
     source,
     beforeStatic,
-    findWorkspaceRoot(dirname7(fileName))
+    findWorkspaceRoot(dirname8(fileName))
   );
   source = statics.source;
-  const original = statics.rewritten === 0 ? beforeStatic : parse2(fileName, source);
+  const original = statics.rewritten === 0 ? beforeStatic : parse3(fileName, source);
   if (original === void 0) return unparsable("hoisting the setup requires");
   const titles = rewriteEachTitles(source, original);
   const tables = rewriteEachTableRows(titles.source, original);
-  const afterTables = parse2(fileName, tables.source);
+  const afterTables = parse3(fileName, tables.source);
   if (afterTables === void 0) return unparsable("each table rows");
   const spyTypes = rewriteSpyInstanceType(tables.source, afterTables);
-  const afterSpyTypes = parse2(fileName, spyTypes.source);
+  const afterSpyTypes = parse3(fileName, spyTypes.source);
   if (afterSpyTypes === void 0) return unparsable("SpyInstance types");
   const factoryGenerics = rewriteMockFactoryGenerics(spyTypes.source, afterSpyTypes);
-  const afterFactoryGenerics = parse2(fileName, factoryGenerics.source);
+  const afterFactoryGenerics = parse3(fileName, factoryGenerics.source);
   if (afterFactoryGenerics === void 0) return unparsable("mock factory generics");
   const artefacts = rewriteRunnerArtefactNames(factoryGenerics.source, afterFactoryGenerics);
-  const afterArtefacts = parse2(fileName, artefacts);
+  const afterArtefacts = parse3(fileName, artefacts);
   if (afterArtefacts === void 0) return unparsable("runner artefact names");
   const matchers = rewriteTypedMatchers(artefacts, afterArtefacts);
-  const afterMatchers = parse2(fileName, matchers.source);
+  const afterMatchers = parse3(fileName, matchers.source);
   if (afterMatchers === void 0) return unparsable("matcher type arguments");
   const ruled = applyNamedRules(matchers.source, afterMatchers, fileName);
   const renamed = renameJestToVitest(fileName, ruled.source);
-  const afterRename = parse2(fileName, renamed.source);
+  const afterRename = parse3(fileName, renamed.source);
   if (afterRename === void 0) return unparsable("jest to vi rename");
   const fakeTimers = rewriteFakeTimerOptions(renamed.source, afterRename);
-  const afterFakeTimers = parse2(fileName, fakeTimers.source);
+  const afterFakeTimers = parse3(fileName, fakeTimers.source);
   if (afterFakeTimers === void 0) return unparsable("fake timer options");
   const mocks = rewriteMockAsValue(fakeTimers.source, afterFakeTimers);
-  const afterMocks = parse2(fileName, mocks.source);
+  const afterMocks = parse3(fileName, mocks.source);
   if (afterMocks === void 0) return unparsable("mock as a value");
   const constructible = rewriteConstructibleMocks(
     mocks.source,
     afterMocks,
     mockFactories(afterMocks)
   );
-  const afterConstructible = parse2(fileName, constructible.source);
+  const afterConstructible = parse3(fileName, constructible.source);
   if (afterConstructible === void 0) return unparsable("constructible mocks");
   const factoryDefault = rewriteMockFactoryDefault(
     constructible.source,
     afterConstructible,
     defaultImported
   );
-  const beforeReturnValue = parse2(fileName, factoryDefault.source);
+  const beforeReturnValue = parse3(fileName, factoryDefault.source);
   if (beforeReturnValue === void 0) return unparsable("mock factory default");
   const returnValue = rewriteAssertionReturnValue(factoryDefault.source, beforeReturnValue);
-  const afterReturnValue = parse2(fileName, returnValue.source);
+  const afterReturnValue = parse3(fileName, returnValue.source);
   if (afterReturnValue === void 0) return unparsable("assertion return value");
   const isolated = rewriteIsolateModules(returnValue.source, afterReturnValue);
-  const afterIsolate = parse2(fileName, isolated.source);
+  const afterIsolate = parse3(fileName, isolated.source);
   if (afterIsolate === void 0) return unparsable("isolate modules");
   const emptyImplementations = rewriteEmptyMockImplementation(isolated.source, afterIsolate);
-  const afterEmpty = parse2(fileName, emptyImplementations.source);
+  const afterEmpty = parse3(fileName, emptyImplementations.source);
   if (afterEmpty === void 0) return unparsable("empty mock implementation");
   const hooks = rewriteHookReturnValue(emptyImplementations.source, afterEmpty);
-  const afterHooks = parse2(fileName, hooks.source);
+  const afterHooks = parse3(fileName, hooks.source);
   if (afterHooks === void 0) return unparsable("hook return value");
   const promises = rewriteMockPromiseResolve(hooks.source, afterHooks);
   const awaited = propagateAwait(fileName, promises.source, original, asyncHelpers);
-  const program = parse2(fileName, awaited.source);
+  const program = parse3(fileName, awaited.source);
   if (program === void 0) return unparsable("hook body");
   const hoist = hoistCapturedBindings(
     awaited.source,
@@ -3789,10 +4152,10 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
     moduleBindings(program),
     importedNames(program)
   );
-  const afterHoist = parse2(fileName, hoist.source);
+  const afterHoist = parse3(fileName, hoist.source);
   if (afterHoist === void 0) return unparsable("hoisting captured bindings");
   const mockedBindings = annotateMockedBindings(hoist.source, afterHoist);
-  const afterBindings = parse2(fileName, mockedBindings.source);
+  const afterBindings = parse3(fileName, mockedBindings.source);
   if (afterBindings === void 0) return unparsable("mocked module bindings");
   const bareFactories = invokeBareMockFactories(mockedBindings.source, afterBindings);
   const withImport = injectTypeImport(fileName, bareFactories.source, [
@@ -3802,12 +4165,15 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
   ]);
   const deep = normaliseDeepImports(withImport);
   const repointed = modulesOwnMsw ? { source: deep.source, repointed: false } : repointMswServer(fileName, deep.source);
-  const finalProgram = parse2(fileName, repointed.source);
+  const finalProgram = parse3(fileName, repointed.source);
   if (finalProgram === void 0) return unparsable("msw server import");
   const barrels = rewriteReexportBarrelMocks(fileName, repointed.source, finalProgram);
+  const afterBarrels = parse3(fileName, barrels.source);
+  if (afterBarrels === void 0) return unparsable("re-export barrel mocks");
+  const internalSpies = rewriteInternalCallSpies(fileName, barrels.source, afterBarrels);
   return {
-    source: barrels.source,
-    changed: barrels.source !== source,
+    source: internalSpies.source,
+    changed: internalSpies.source !== source,
     renamed: renamed.rewritten,
     hoisted: hoist.hoisted,
     unhandled: renamed.unhandled,
@@ -3825,6 +4191,9 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
       ...bareFactories.rewritten > 0 ? ["vi.fn passed as a value, invoked"] : [],
       ...awaited.rewritten > 0 ? ["await propagated to a helper that became async"] : [],
       ...barrels.added.map((alias) => `mock carried to ${alias}, which re-exports the mocked file`),
+      ...internalSpies.rewritten.map(
+        (name) => `spy on ${name}, replaced by the value its own module reads`
+      ),
       ...fakeTimers.translated
     ].sort(),
     refusals: [
@@ -3844,7 +4213,8 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
       ...constructible.refusals,
       ...isolated.refusals,
       ...matchers.refusals,
-      ...ruled.refusals
+      ...ruled.refusals,
+      ...internalSpies.refusals
     ],
     warnings: fakeTimers.warnings,
     mswRepointed: repointed.repointed
@@ -3852,13 +4222,13 @@ function migrateTestFile(fileName, source, defaultImported = /* @__PURE__ */ new
 }
 
 // src/roles/test/codemod/test-support-files.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
-import { dirname as dirname8, join as join16, relative as relative3, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync15, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import { dirname as dirname9, join as join17, relative as relative4, resolve as resolve9 } from "node:path";
 var THE_SHIM_CANNOT_ANSWER = [/\brequire\s*\(/, /\bjest\.(?:fn|Mock|SpyInstance)\s*</];
 var SKIPPED = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".git", ".vite"]);
 var TEST_FILE2 = /[.-](spec|test)\.[cm]?[jt]sx?$/;
 var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-var EXTENSIONS3 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
+var EXTENSIONS4 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
 function relativeSpecifiers2(source) {
   const found = [];
   const patterns = [
@@ -3873,13 +4243,13 @@ function relativeSpecifiers2(source) {
   return found;
 }
 function resolveSpecifier(fromFile, specifier) {
-  const base = resolve8(dirname8(fromFile), specifier);
-  if (existsSync14(base) && statSync3(base).isFile()) return base;
-  for (const extension of EXTENSIONS3) {
+  const base = resolve9(dirname9(fromFile), specifier);
+  if (existsSync14(base) && statSync4(base).isFile()) return base;
+  for (const extension of EXTENSIONS4) {
     if (existsSync14(`${base}${extension}`)) return `${base}${extension}`;
   }
-  for (const extension of EXTENSIONS3) {
-    const index = join16(base, `index${extension}`);
+  for (const extension of EXTENSIONS4) {
+    const index = join17(base, `index${extension}`);
     if (existsSync14(index)) return index;
   }
   return void 0;
@@ -3897,17 +4267,17 @@ function moduleSources(cwd) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIPPED.has(entry.name)) stack.push(join16(dir, entry.name));
+        if (!SKIPPED.has(entry.name)) stack.push(join17(dir, entry.name));
       } else if (SOURCE_FILE.test(entry.name)) {
-        found.push(join16(dir, entry.name));
+        found.push(join17(dir, entry.name));
       }
     }
   }
   return found;
 }
-function read(path) {
+function read2(path) {
   try {
-    return readFileSync14(path, "utf8");
+    return readFileSync15(path, "utf8");
   } catch {
     return void 0;
   }
@@ -3916,8 +4286,8 @@ function setupFilesInside(cwd, named) {
   const kept = [];
   for (const raw of named) {
     const withoutToken = raw.replaceAll("<rootDir>/", "").replaceAll("<rootDir>", ".");
-    const full = resolve8(cwd, withoutToken);
-    const inside = relative3(cwd, full);
+    const full = resolve9(cwd, withoutToken);
+    const inside = relative4(cwd, full);
     if (inside.startsWith("..") || inside === "") continue;
     if (!existsSync14(full)) continue;
     kept.push(inside.replaceAll("\\", "/"));
@@ -3928,7 +4298,7 @@ function listTestSupportFiles(cwd, setupFiles = []) {
   const sources = moduleSources(cwd);
   const contents = /* @__PURE__ */ new Map();
   for (const file of sources) {
-    const source = read(file);
+    const source = read2(file);
     if (source !== void 0) contents.set(file, source);
   }
   const importedBy = /* @__PURE__ */ new Map();
@@ -3954,18 +4324,18 @@ function listTestSupportFiles(cwd, setupFiles = []) {
       queue.push(target);
     }
   }
-  const reachable = [...testOnly].filter((file) => THE_SHIM_CANNOT_ANSWER.some((it) => it.test(contents.get(file) ?? ""))).map((file) => relative3(cwd, file).replaceAll("\\", "/"));
+  const reachable = [...testOnly].filter((file) => THE_SHIM_CANNOT_ANSWER.some((it) => it.test(contents.get(file) ?? ""))).map((file) => relative4(cwd, file).replaceAll("\\", "/"));
   return [.../* @__PURE__ */ new Set([...reachable, ...setupFilesInside(cwd, setupFiles)])].sort();
 }
 
 // src/roles/test/codemod/migrate-module.ts
-function parse3(fileName, source) {
-  const { program, errors } = parseSync8(fileName, source, { sourceType: "module" });
+function parse4(fileName, source) {
+  const { program, errors } = parseSync9(fileName, source, { sourceType: "module" });
   return errors.length > 0 ? void 0 : program;
 }
-function read2(path) {
+function read3(path) {
   try {
-    return readFileSync15(path, "utf8");
+    return readFileSync16(path, "utf8");
   } catch {
     return void 0;
   }
@@ -3983,10 +4353,10 @@ function defaultImportedSpecifiers(cwd) {
     }
     for (const entry of entries) {
       if (SKIPPED2.has(entry)) continue;
-      const path = join17(dir, entry);
+      const path = join18(dir, entry);
       let directory;
       try {
-        directory = statSync4(path).isDirectory();
+        directory = statSync5(path).isDirectory();
       } catch {
         continue;
       }
@@ -3995,7 +4365,7 @@ function defaultImportedSpecifiers(cwd) {
         continue;
       }
       if (!/\.tsx?$/.test(entry)) continue;
-      const source = read2(path);
+      const source = read3(path);
       if (source === void 0) continue;
       for (const match of source.matchAll(pattern)) found.add(match[1]);
     }
@@ -4005,12 +4375,12 @@ function defaultImportedSpecifiers(cwd) {
 }
 function declaredInheritedMocks(fileName, source, inherited) {
   if (inherited.length === 0) return source;
-  const program = parse3(fileName, source);
+  const program = parse4(fileName, source);
   return program === void 0 ? source : declareInheritedAutomocks(source, program, inherited);
 }
 function migrateModuleTests(cwd, setupFiles = []) {
   const modulesOwnMsw = ownsMswLifecycle(cwd, setupFiles);
-  const inherited = inheritedAutomocks(cwd, setupFiles, parse3);
+  const inherited = inheritedAutomocks(cwd, setupFiles, parse4);
   const operations = [];
   const blockers = [];
   const collected = [];
@@ -4019,14 +4389,14 @@ function migrateModuleTests(cwd, setupFiles = []) {
   let hoisted = 0;
   const defaultImported = defaultImportedSpecifiers(cwd);
   const asyncHelpers = /* @__PURE__ */ new Set();
-  for (const relative7 of listTestSupportFiles(cwd, setupFiles)) {
-    const source = read2(join17(cwd, relative7));
+  for (const relative8 of listTestSupportFiles(cwd, setupFiles)) {
+    const source = read3(join18(cwd, relative8));
     if (source === void 0) {
-      blockers.push({ file: relative7, reason: "this file could not be read" });
+      blockers.push({ file: relative8, reason: "this file could not be read" });
       continue;
     }
     const migrated = migrateTestFile(
-      join17(cwd, relative7),
+      join18(cwd, relative8),
       source,
       defaultImported,
       /* @__PURE__ */ new Set(),
@@ -4034,19 +4404,19 @@ function migrateModuleTests(cwd, setupFiles = []) {
     );
     for (const member of migrated.unhandled) {
       blockers.push({
-        file: `${relative7}:${member.line}`,
+        file: `${relative8}:${member.line}`,
         reason: member.rule === void 0 ? `${member.member} has no rule, and guessing one is how a suite goes green for the wrong reason` : `${member.member} needs ${member.rule}`
       });
     }
     for (const refusal of migrated.refusals) {
-      blockers.push({ file: relative7, reason: refusal.reason });
+      blockers.push({ file: relative8, reason: refusal.reason });
     }
     collected.push(...migrated.warnings);
-    const renamedTo = vitestSupportName(relative7);
-    if (!migrated.changed && renamedTo === relative7) continue;
-    if (renamedTo !== relative7) operations.push({ kind: "delete", path: relative7 });
-    const before = parse3(join17(cwd, relative7), source);
-    const after = parse3(join17(cwd, relative7), migrated.source);
+    const renamedTo = vitestSupportName(relative8);
+    if (!migrated.changed && renamedTo === relative8) continue;
+    if (renamedTo !== relative8) operations.push({ kind: "delete", path: relative8 });
+    const before = parse4(join18(cwd, relative8), source);
+    const after = parse4(join18(cwd, relative8), migrated.source);
     if (before !== void 0 && after !== void 0) {
       const wasAsync = asyncFunctionNames(before);
       for (const name of asyncFunctionNames(after)) {
@@ -4055,17 +4425,17 @@ function migrateModuleTests(cwd, setupFiles = []) {
     }
     files++;
     renamed += migrated.renamed;
-    const contents = /\bvi\./.test(migrated.source) ? injectViImport(join17(cwd, renamedTo), migrated.source) : migrated.source;
+    const contents = /\bvi\./.test(migrated.source) ? injectViImport(join18(cwd, renamedTo), migrated.source) : migrated.source;
     operations.push({ kind: "write", path: renamedTo, contents });
   }
-  for (const relative7 of listTestFiles(cwd)) {
-    const source = read2(join17(cwd, relative7));
+  for (const relative8 of listTestFiles(cwd)) {
+    const source = read3(join18(cwd, relative8));
     if (source === void 0) {
-      blockers.push({ file: relative7, reason: "this file could not be read" });
+      blockers.push({ file: relative8, reason: "this file could not be read" });
       continue;
     }
     const migrated = migrateTestFile(
-      join17(cwd, relative7),
+      join18(cwd, relative8),
       source,
       defaultImported,
       asyncHelpers,
@@ -4073,32 +4443,32 @@ function migrateModuleTests(cwd, setupFiles = []) {
     );
     for (const member of migrated.unhandled) {
       blockers.push({
-        file: `${relative7}:${member.line}`,
+        file: `${relative8}:${member.line}`,
         reason: member.rule === void 0 ? `${member.member} has no rule, and guessing one is how a suite goes green for the wrong reason` : `${member.member} needs ${member.rule}`
       });
     }
     collected.push(...migrated.warnings);
     for (const refusal of migrated.refusals) {
-      blockers.push({ file: relative7, reason: refusal.reason });
+      blockers.push({ file: relative8, reason: refusal.reason });
     }
     if (!migrated.changed) continue;
     files++;
     renamed += migrated.renamed;
     if (migrated.hoisted.length > 0) hoisted++;
     const withInheritedMocks = declaredInheritedMocks(
-      join17(cwd, relative7),
+      join18(cwd, relative8),
       migrated.source,
       inherited
     );
-    operations.push({ kind: "write", path: relative7, contents: withInheritedMocks });
+    operations.push({ kind: "write", path: relative8, contents: withInheritedMocks });
   }
   const warnings = [...new Set(collected)];
   return blockers.length > 0 ? { operations: [], files, renamed, hoisted, blockers, warnings } : { operations, files, renamed, hoisted, blockers: [], warnings };
 }
 
 // src/roles/test/nest/generate-config.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync16, statSync as statSync5 } from "node:fs";
-import { join as join18, relative as relative4 } from "node:path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync17, statSync as statSync6 } from "node:fs";
+import { join as join19, relative as relative5 } from "node:path";
 var NEST_TEST_PRESET_SPECIFIER = "@hublo/sentinel/test/nest";
 var REACT_TEST_PRESET_SPECIFIER = "@hublo/sentinel/test/react";
 function flavourOf(reading) {
@@ -4110,7 +4480,7 @@ var SENTINEL_WORKSPACE_SETUP = "@hublo/sentinel/test/setup/workspace";
 var SENTINEL_A11Y_SETUP = "@hublo/sentinel/test/setup/a11y";
 var SENTINEL_W3C_SETUP = "@hublo/sentinel/test/setup/w3c";
 function hopsToRoot(cwd, workspaceRoot) {
-  const up = relative4(cwd, workspaceRoot).replaceAll("\\", "/");
+  const up = relative5(cwd, workspaceRoot).replaceAll("\\", "/");
   return up === "" ? "." : up;
 }
 function inlineBlock(packages) {
@@ -4144,10 +4514,10 @@ function readModuleTraits(cwd) {
     }
     for (const entry of entries) {
       if (SKIPPED3.has(entry)) continue;
-      const path = join18(dir, entry);
+      const path = join19(dir, entry);
       let directory;
       try {
-        directory = statSync5(path).isDirectory();
+        directory = statSync6(path).isDirectory();
       } catch {
         continue;
       }
@@ -4158,7 +4528,7 @@ function readModuleTraits(cwd) {
       if (!/\.tsx?$/.test(entry)) continue;
       let source;
       try {
-        source = readFileSync16(path, "utf8");
+        source = readFileSync17(path, "utf8");
       } catch {
         continue;
       }
@@ -4293,8 +4663,8 @@ ${overrides.join("\n")}
 }
 
 // src/roles/test/nest/read-jest-config.ts
-import { existsSync as existsSync15, readFileSync as readFileSync17 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync18 } from "node:fs";
+import { join as join20 } from "node:path";
 var CARRIED = [
   "testEnvironment",
   "coverageDirectory",
@@ -4484,7 +4854,7 @@ function extendedConfig(source, cwd) {
       (name) => name.replace(/^\.\//, "")
     );
     const file = candidates.find(
-      (name) => /^jest[\w.-]*\.(ts|js)$/.test(name) && existsSync15(join19(cwd, name))
+      (name) => /^jest[\w.-]*\.(ts|js)$/.test(name) && existsSync15(join20(cwd, name))
     );
     if (file === void 0) continue;
     if (!new RegExp(String.raw`\{\s*\.\.\.${binding}\b`).test(source)) continue;
@@ -4511,11 +4881,11 @@ function sideEffects(source, extended) {
   return found;
 }
 function readJestConfig(cwd, named) {
-  const file = named ?? JEST_CONFIG_FILES.find((name) => existsSync15(join19(cwd, name)));
-  if (file === void 0 || !existsSync15(join19(cwd, file))) return void 0;
+  const file = named ?? JEST_CONFIG_FILES.find((name) => existsSync15(join20(cwd, name)));
+  if (file === void 0 || !existsSync15(join20(cwd, file))) return void 0;
   let source;
   try {
-    source = readFileSync17(join19(cwd, file), "utf8");
+    source = readFileSync18(join20(cwd, file), "utf8");
   } catch {
     return { file, refusals: [`${file} could not be read`], notes: [] };
   }
@@ -4597,7 +4967,7 @@ function readJestConfig(cwd, named) {
 
 // src/roles/test/nest/run-modes.ts
 import { existsSync as existsSync16 } from "node:fs";
-import { basename as basename2, join as join20 } from "node:path";
+import { basename as basename2, join as join21 } from "node:path";
 var JEST_EXECUTOR = "@nx/jest:jest";
 var PRIMARY_CONFIG_FILE = "vitest.config.mts";
 var PRIMARY_TARGET = "test";
@@ -4618,7 +4988,7 @@ function runModes(cwd, fallback) {
     const jestConfig = entry.options?.jestConfig;
     if (jestConfig === void 0) continue;
     const name = configName(jestConfig);
-    if (!existsSync16(join20(cwd, name))) continue;
+    if (!existsSync16(join21(cwd, name))) continue;
     declared.push({
       target,
       jestConfig: name,
@@ -4644,11 +5014,11 @@ function runModes(cwd, fallback) {
 
 // src/roles/test/written-file-formatter.ts
 import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname10, join as join23 } from "node:path";
+import { dirname as dirname11, join as join24 } from "node:path";
 
 // src/roles/format/read-adoption.ts
-import { existsSync as existsSync17, readFileSync as readFileSync18 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync19 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // src/roles/format/config-policy.ts
 var FORMAT_CONFIG_FILE = ".oxfmtrc.json";
@@ -4754,11 +5124,11 @@ function sameValue(a, b) {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 function readFormatAdoption(cwd) {
-  const path = join21(cwd, FORMAT_CONFIG_FILE);
+  const path = join22(cwd, FORMAT_CONFIG_FILE);
   if (!existsSync17(path)) return NOT_ADOPTED(null);
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync18(path, "utf8"), FORMAT_CONFIG_FILE);
+    parsed = parseJsonc(readFileSync19(path, "utf8"), FORMAT_CONFIG_FILE);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED(FORMAT_CONFIG_FILE, `${FORMAT_CONFIG_FILE} could not be parsed (${reason})`);
@@ -4802,9 +5172,9 @@ function readFormatAdoption(cwd) {
 }
 
 // src/roles/format/resolve-oxfmt.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { dirname as dirname9, join as join22 } from "node:path";
+import { dirname as dirname10, join as join23 } from "node:path";
 function resolveOxfmt(cwd) {
   return resolveBin(cwd, "oxfmt") ?? binFromOwnInstall("oxfmt", "oxfmt");
 }
@@ -4833,8 +5203,8 @@ function configSchema() {
 function readConfigSchema() {
   try {
     const manifest = createRequire4(import.meta.url).resolve("oxfmt/package.json");
-    const schemaPath = join22(dirname9(manifest), "configuration_schema.json");
-    return JSON.parse(readFileSync19(schemaPath, "utf8"));
+    const schemaPath = join23(dirname10(manifest), "configuration_schema.json");
+    return JSON.parse(readFileSync20(schemaPath, "utf8"));
   } catch {
     return void 0;
   }
@@ -4859,9 +5229,9 @@ function prettierConfigFrom(cwd) {
   let dir = cwd;
   for (; ; ) {
     for (const name of PRETTIER_CONFIGS) {
-      if (existsSync18(join23(dir, name))) return join23(dir, name);
+      if (existsSync18(join24(dir, name))) return join24(dir, name);
     }
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -4889,12 +5259,12 @@ function writtenFileFormatter(cwd) {
 var SPEC_TSCONFIG = "tsconfig.spec.json";
 var VITEST_GLOBAL_TYPES = "vitest/globals";
 function specTypesOperation(cwd) {
-  const path = join24(cwd, SPEC_TSCONFIG);
+  const path = join25(cwd, SPEC_TSCONFIG);
   if (!existsSync19(path)) return void 0;
   let config;
   try {
     config = parseJsonc(
-      readFileSync20(path, "utf8"),
+      readFileSync21(path, "utf8"),
       SPEC_TSCONFIG
     );
   } catch {
@@ -4914,10 +5284,10 @@ function specTypesOperation(cwd) {
 }
 function shippedTypesPath(cwd, declaration) {
   try {
-    const manifest = createRequire5(join24(cwd, "noop.cjs")).resolve("@hublo/sentinel/package.json");
-    const file = join24(dirname11(manifest), declaration);
+    const manifest = createRequire5(join25(cwd, "noop.cjs")).resolve("@hublo/sentinel/package.json");
+    const file = join25(dirname12(manifest), declaration);
     if (existsSync19(file)) {
-      const path = relative5(cwd, file);
+      const path = relative6(cwd, file);
       return path.startsWith(".") ? path : `./${path}`;
     }
   } catch {
@@ -4935,7 +5305,7 @@ function helpersStillCallingJest(cwd) {
       return;
     }
     for (const entry of entries) {
-      const path = join24(dir, entry.name);
+      const path = join25(dir, entry.name);
       if (entry.isDirectory()) {
         if (!skip.has(entry.name)) walk2(path);
         continue;
@@ -4945,12 +5315,12 @@ function helpersStillCallingJest(cwd) {
       if (/^(jest|vitest)\./.test(entry.name)) continue;
       let source;
       try {
-        source = readFileSync20(path, "utf8");
+        source = readFileSync21(path, "utf8");
       } catch {
         continue;
       }
       if (/\bjest\./.test(source)) {
-        found.push(relative5(cwd, path).replaceAll("\\", "/"));
+        found.push(relative6(cwd, path).replaceAll("\\", "/"));
       }
     }
   };
@@ -4982,7 +5352,7 @@ function tsconfigFileListOperations(cwd) {
     let config;
     try {
       config = parseJsonc(
-        readFileSync20(join24(cwd, name), "utf8"),
+        readFileSync21(join25(cwd, name), "utf8"),
         name
       );
     } catch {
@@ -5285,11 +5655,11 @@ function plan(context) {
 
 // src/roles/test/written-file-linter.ts
 import { existsSync as existsSync24 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 
 // src/roles/lint/module-baseline.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync22 } from "node:fs";
+import { join as join26 } from "node:path";
 var LINT_BASELINE_FILE = ".oxlintrc.baseline.json";
 var LINT_MEASURE_FILE = ".oxlintrc.measure.json";
 var LINT_BASELINE_SPECIFIER = `./${LINT_BASELINE_FILE}`;
@@ -5333,11 +5703,11 @@ function describeHolds(holds) {
   return `held ${holds.length} rule(s) at \`warn\` for this module, covering ${total} violation(s) that were already there: ${listed}${rest}. They are written to ${LINT_BASELINE_FILE}, they still report, and they return to \`error\` once fixed and re-initialized`;
 }
 function heldRules(cwd) {
-  const path = join25(cwd, LINT_BASELINE_FILE);
+  const path = join26(cwd, LINT_BASELINE_FILE);
   if (!existsSync20(path)) return [];
   try {
     const parsed = parseJsonc(
-      readFileSync21(path, "utf8"),
+      readFileSync22(path, "utf8"),
       LINT_BASELINE_FILE
     );
     return Object.keys(parsed.rules ?? {});
@@ -5386,8 +5756,8 @@ function lintTarget() {
 }
 
 // src/core/config/read-adoption.ts
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync24 } from "node:fs";
+import { join as join28 } from "node:path";
 
 // src/core/config/owned-keys.ts
 function presetOwnedKeys(config, permitted, presetSets) {
@@ -5402,12 +5772,12 @@ function localOnlyKeys(config, permitted, presetSets) {
 }
 
 // src/core/config/resolve-config-target.ts
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "node:fs";
+import { join as join27 } from "node:path";
 function readExtends(absolutePath) {
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync22(absolutePath, "utf8"), absolutePath);
+    parsed = parseJsonc(readFileSync23(absolutePath, "utf8"), absolutePath);
   } catch {
     return [];
   }
@@ -5421,7 +5791,7 @@ function resolveConfigTarget(moduleDir, { candidates, markers, fallback }) {
   let existing;
   let existingExtendsSomething = false;
   for (const candidate of candidates) {
-    const absolutePath = join26(moduleDir, candidate);
+    const absolutePath = join27(moduleDir, candidate);
     if (!existsSync21(absolutePath)) continue;
     const chain = readExtends(absolutePath);
     if (existing === void 0) {
@@ -5455,12 +5825,12 @@ var NOT_ADOPTED2 = (configFile, unreadable = null) => ({
 });
 function readAdoption(cwd, options) {
   const target = resolveConfigTarget(cwd, options);
-  if (target.reason === "none" || !existsSync22(join27(cwd, target.path))) {
+  if (target.reason === "none" || !existsSync22(join28(cwd, target.path))) {
     return NOT_ADOPTED2(target.reason === "none" ? null : target.path);
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync23(join27(cwd, target.path), "utf8"), target.path);
+    parsed = parseJsonc(readFileSync24(join28(cwd, target.path), "utf8"), target.path);
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return NOT_ADOPTED2(target.path, `${target.path} could not be parsed (${reason})`);
@@ -5496,7 +5866,7 @@ function readLintAdoption(cwd) {
 // src/roles/lint/resolve-oxlint.ts
 import { existsSync as existsSync23 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { delimiter as delimiter2, dirname as dirname12, join as join28 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname13, join as join29 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -5512,7 +5882,7 @@ function canRunTypeAware(cwd) {
 function oxlintPath(cwd, env) {
   const shim = tsgolintShim(cwd);
   if (!shim) return env.PATH;
-  return [dirname12(shim), env.PATH].filter(Boolean).join(delimiter2);
+  return [dirname13(shim), env.PATH].filter(Boolean).join(delimiter2);
 }
 function tsgolintShim(cwd) {
   const fromModule = resolveBin(cwd, "tsgolint");
@@ -5520,17 +5890,17 @@ function tsgolintShim(cwd) {
   const candidates = [];
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
-      const packageDir = dirname12(require3.resolve(`${owner}/package.json`));
-      candidates.push(join28(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join28(packageDir, "..", ".bin", "tsgolint"));
+      const packageDir = dirname13(require3.resolve(`${owner}/package.json`));
+      candidates.push(join29(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join29(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
-    const ownRoot = dirname12(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join28(ownRoot, "node_modules", ".bin", "tsgolint"));
+    const ownRoot = dirname13(require3.resolve("@hublo/sentinel/package.json"));
+    candidates.push(join29(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
-    candidates.push(resolveBin(dirname12(fileURLToPath(import.meta.url)), "tsgolint") ?? "");
+    candidates.push(resolveBin(dirname13(fileURLToPath(import.meta.url)), "tsgolint") ?? "");
   }
   return candidates.find((candidate) => candidate !== "" && existsSync23(candidate));
 }
@@ -5546,7 +5916,7 @@ function writtenFileLinter(cwd) {
       return { bin: oxlint, args: ["--fix"], origin: "this module's own oxlint config" };
     }
   }
-  const config = ESLINT_CONFIG_FILES.map((name) => join29(cwd, name)).find((path) => existsSync24(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join30(cwd, name)).find((path) => existsSync24(path));
   const eslint = resolveBin(cwd, "eslint");
   if (config !== void 0 && eslint !== void 0) {
     return {
@@ -5563,16 +5933,17 @@ function writtenFileLinter(cwd) {
 }
 
 // src/roles/test/adapters/vitest/vitest.adapter.ts
+var REPORT_MAX_BUFFER = 1 << 28;
 var FORMATTABLE = /\.(m|c)?(j|t)sx?$|\.json$/;
 var FORMAT_BATCH = 25;
 function readIfPossible(path) {
   try {
-    return readFileSync24(path, "utf8");
+    return readFileSync25(path, "utf8");
   } catch {
     return void 0;
   }
 }
-var VitestAdapter = class extends BaseAdapter {
+var VitestAdapter = class _VitestAdapter extends BaseAdapter {
   target = "test";
   runner = "vitest";
   appliesTo(_preset) {
@@ -5693,12 +6064,12 @@ var VitestAdapter = class extends BaseAdapter {
     const linter = writtenFileLinter(ctx.cwd);
     if (linter === void 0) return;
     const workspaceRoot = findWorkspaceRoot(ctx.cwd) ?? ctx.cwd;
-    const fromRoot = (file) => relative6(workspaceRoot, join30(ctx.cwd, file));
+    const fromRoot = (file) => relative7(workspaceRoot, join31(ctx.cwd, file));
     let unsettled = 0;
     const reverted = [];
     for (let at = 0; at < written.length; at += FORMAT_BATCH) {
       const batch = written.slice(at, at + FORMAT_BATCH);
-      const before = new Map(batch.map((file) => [file, readIfPossible(join30(ctx.cwd, file))]));
+      const before = new Map(batch.map((file) => [file, readIfPossible(join31(ctx.cwd, file))]));
       const pass = spawnSync(linter.bin, [...linter.args, ...batch.map(fromRoot)], {
         cwd: workspaceRoot,
         encoding: "utf8"
@@ -5707,11 +6078,11 @@ var VitestAdapter = class extends BaseAdapter {
       for (const file of batch) {
         const was = before.get(file);
         if (was === void 0) continue;
-        const now = readIfPossible(join30(ctx.cwd, file));
+        const now = readIfPossible(join31(ctx.cwd, file));
         if (now === void 0 || now === was) continue;
         const lost = lineLostByTheFixer(was, now);
         if (lost === void 0) continue;
-        writeFileSync2(join30(ctx.cwd, file), was);
+        writeFileSync2(join31(ctx.cwd, file), was);
         reverted.push(`${file}: \`${lost.slice(0, 80)}\``);
       }
     }
@@ -5743,6 +6114,105 @@ var VitestAdapter = class extends BaseAdapter {
       unreadable: adoption.unreadable
     });
   }
+  /**
+   * The metrics for a module this role has nothing to say about.
+   *
+   * Every KEY the full path emits, so a consumer never sees a row whose shape depends on whether
+   * the module adopted. The same stance, and the same reason, as `tsc.adapter.ts`.
+   */
+  static NOTHING_TO_REPORT = {
+    suite: null,
+    files: 0,
+    tests: 0,
+    passed: 0,
+    failed: 0,
+    skipped: 0,
+    unloadable: 0,
+    failures: [],
+    failuresTruncated: false
+  };
+  /**
+   * The counts, for `--run --test --json`.
+   *
+   * ⚠️ Until this existed, `--run --test --json` returned a WELL FORMED envelope saying the run
+   * had failed, because `run-verb.ts` shapes `run + json` into a `report` and this adapter
+   * implemented none while the other four roles do. A consumer reading `results[].ok` saw a
+   * failed suite that had never run, which is the worst shape a gap can take.
+   *
+   * It reports the suite `run()` runs, and names it. A module can carry two (an integration or
+   * prisma run mode beside the main one), each with its own nx target, and summing them would
+   * invent a number no target produces. `suite` says which one this row is about.
+   *
+   * `readSnapshot` is reused rather than re-parsed: it is the same reader the migration proof
+   * uses on both runners, so a count here and a count there cannot disagree about what a test is.
+   * `fromWorkspaceRoot` likewise, cwd and `INIT_CWD` together, because a report that launches the
+   * suite differently is reporting on something else.
+   */
+  async report(ctx) {
+    const adoption = readTestAdoption(ctx.cwd);
+    if (!adoption.adopted || adoption.configFile === null) {
+      return { ok: true, code: 0, metrics: _VitestAdapter.NOTHING_TO_REPORT };
+    }
+    const { bin } = resolveVitest(ctx.cwd);
+    if (bin === void 0) {
+      return {
+        ok: false,
+        code: 1,
+        metrics: { ..._VitestAdapter.NOTHING_TO_REPORT, error: "vitest not available" }
+      };
+    }
+    const out = join31(mkdtempSync3(join31(tmpdir3(), "sentinel-test-report-")), "vitest.json");
+    const { cwd: runFrom, options, env } = fromWorkspaceRoot(ctx.cwd, [], []);
+    const result = spawnSync(bin, ["run", ...options, "--reporter=json", `--outputFile=${out}`], {
+      cwd: runFrom,
+      env: { ...process.env, ...env },
+      encoding: "utf8",
+      maxBuffer: REPORT_MAX_BUFFER
+    });
+    if (result.error) {
+      return {
+        ok: false,
+        code: 1,
+        metrics: { ..._VitestAdapter.NOTHING_TO_REPORT, error: result.error.message }
+      };
+    }
+    if (!existsSync25(out)) {
+      return {
+        ok: false,
+        code: 1,
+        metrics: { ..._VitestAdapter.NOTHING_TO_REPORT, error: "vitest produced no report" }
+      };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync25(out, "utf8"));
+    } catch {
+      return {
+        ok: false,
+        code: 1,
+        metrics: { ..._VitestAdapter.NOTHING_TO_REPORT, error: "vitest report is not readable" }
+      };
+    }
+    const snapshot = readSnapshot(parsed);
+    const skipped = snapshot.skipped ?? [];
+    const cap = ctx.maxDiagnostics === 0 ? Infinity : ctx.maxDiagnostics ?? DEFAULT_MAX_DIAGNOSTICS;
+    const failures = Number.isFinite(cap) ? snapshot.failing.slice(0, cap) : snapshot.failing;
+    return {
+      ok: snapshot.failing.length === 0 && snapshot.unloadable.length === 0,
+      code: result.status ?? 0,
+      metrics: {
+        suite: suiteOf(adoption.configFile),
+        files: snapshot.files,
+        tests: snapshot.passing.length + snapshot.failing.length + skipped.length,
+        passed: snapshot.passing.length,
+        failed: snapshot.failing.length,
+        skipped: skipped.length,
+        unloadable: snapshot.unloadable.length,
+        failures,
+        failuresTruncated: failures.length < snapshot.failing.length
+      }
+    };
+  }
   /**
    * Run the module's tests.
    *
@@ -5801,7 +6271,7 @@ function fromWorkspaceRoot(moduleDir, options, paths) {
   if (root === void 0 || root === moduleDir) {
     return { cwd: moduleDir, options: [...options], paths: [...paths], env: {} };
   }
-  const absolute = (value) => isAbsolute2(value) ? value : resolve9(moduleDir, value);
+  const absolute = (value) => isAbsolute2(value) ? value : resolve10(moduleDir, value);
   const moved = [];
   let previousWasConfig = false;
   for (const option of options) {