@hublo/sentinel 1.4.3 → 1.5.0-alpha.10

package/dist/{chunk-DYK6UEMO.js → chunk-FWGU7QLH.js}

@@ -53,17 +53,24 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-TDNPPNGK.js";
-import {
-  parseJsonc
-} from "./chunk-QXFCZON7.js";
+} from "./chunk-KLEXJFJ6.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   findWorkspaceRoot,
   moduleName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-YQRDKWSH.js";
+import {
+  REPORT_DIR,
+  defaults,
+  defineStaticAnalysis,
+  isPlainObject,
+  overridableSettings
+} from "./chunk-KH2DCVC6.js";
+import {
+  parseJsonc
+} from "./chunk-QXFCZON7.js";
 
 // src/core/registry.ts
 var adapters = [];
@@ -760,7 +767,7 @@ function invokesVite(segment) {
 }
 function buildScripts(cwd) {
   const own = selfCommand(cwd, "--run --build");
-  const scripts = {
+  const scripts2 = {
     [BUILD_SCRIPT_NAME]: composeToolScript(existingCommand(cwd, BUILD_SCRIPT_NAME), {
       command: own ?? SENTINEL_BUILD_COMMAND,
       replaces: invokesVite,
@@ -772,14 +779,14 @@ function buildScripts(cwd) {
   const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
   if (existingDev !== void 0) {
     const own2 = moduleName(cwd);
-    scripts[DEV_SCRIPT_NAME] = composeDevScript(
+    scripts2[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
       // No trailing `--` here: `composeDevScript` owns the separator, and adding one on both
       // sides produced `-- --`, handing Vite an argument nobody wrote.
       `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
     );
   }
-  return scripts;
+  return scripts2;
 }
 function plan(context) {
   const manifest = readProjectPackageJson(context.cwd);
@@ -843,8 +850,8 @@ function planReactApp(context, configFile) {
       `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
     );
   }
-  const scripts = buildScripts(context.cwd);
-  operations.push(manifestOperation(context.cwd, scripts));
+  const scripts2 = buildScripts(context.cwd);
+  operations.push(manifestOperation(context.cwd, scripts2));
   operations.push(
     ...nxTargetOperations({
       cwd: context.cwd,
@@ -854,7 +861,7 @@ function planReactApp(context, configFile) {
       })
     })
   );
-  const dev = devTargetOperations(context.cwd, scripts[DEV_SCRIPT_NAME]);
+  const dev = devTargetOperations(context.cwd, scripts2[DEV_SCRIPT_NAME]);
   operations.push(...dev.operations);
   if (dev.note !== void 0) notes.push(dev.note);
   const owned = ownedBuildDependencies(context.cwd);
@@ -1148,8 +1155,8 @@ function insideBuildScript(env = process.env) {
   return env.npm_lifecycle_event === BUILD_SCRIPT_NAME;
 }
 function runPrerequisite(cwd, env = process.env) {
-  const scripts = moduleScripts(cwd);
-  const script = scripts[PREBUILD_SCRIPT_NAME];
+  const scripts2 = moduleScripts(cwd);
+  const script = scripts2[PREBUILD_SCRIPT_NAME];
   if (script === void 0 || script.trim() === "") return { kind: "none" };
   if (insideBuildScript(env)) return { kind: "already-run" };
   const result = spawnSync2("pnpm", ["run", PREBUILD_SCRIPT_NAME], { cwd, stdio: "inherit" });
@@ -1861,16 +1868,16 @@ var OxfmtAdapter = class extends BaseAdapter {
    * (`svelte-kit sync && <format> && eslint .`).
    */
   formatScripts(cwd) {
-    const scripts = moduleScripts(cwd);
+    const scripts2 = moduleScripts(cwd);
     const ownCommand = selfCommand(cwd, "--run --format");
     const compose = (existing, keepFix) => composeFormatScript(existing, { keepFix, command: ownCommand });
     const rewritten = {
       // `existingCommand` for the role's own script: the command can live in an
       // `nx:run-commands` target that adoption deletes, taking anything else it ran with it.
       [FORMAT_SCRIPT_NAME]: compose(existingCommand(cwd, FORMAT_SCRIPT_NAME), false),
-      [`${FORMAT_SCRIPT_NAME}:fix`]: compose(scripts[`${FORMAT_SCRIPT_NAME}:fix`], true)
+      [`${FORMAT_SCRIPT_NAME}:fix`]: compose(scripts2[`${FORMAT_SCRIPT_NAME}:fix`], true)
     };
-    for (const [name, command] of Object.entries(scripts)) {
+    for (const [name, command] of Object.entries(scripts2)) {
       if (name in rewritten) continue;
       const needsRewrite = /\bprettier\b/.test(command) || // ...and, for a self-adopting package, a script already running sentinel FOR FORMAT.
       // The `--format` check is load-bearing: without it this matched the module's `lint`
@@ -1879,7 +1886,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       if (!needsRewrite) continue;
       rewritten[name] = compose(command, writesWhenRewritten(name, command));
     }
-    return this.joinFormatIntoLint(scripts, rewritten, ownCommand);
+    return this.joinFormatIntoLint(scripts2, rewritten, ownCommand);
   }
   /**
    * Make `pnpm run lint` check formatting too, the way it did before the migration.
@@ -4067,7 +4074,15 @@ function findSuppressionRenames(cwd, renames) {
 var DEFAULT_IGNORE_PATTERNS = [
   "**/dist/**",
   "**/node_modules/**",
-  "**/coverage/**",
+  // Anchored, unlike the two above: this one names a word a domain can legitimately use.
+  // `**/coverage/**` also swallowed `planning-requirement/src/coverage`, the RequirementResult
+  // coverage feature, whose 48 TypeScript files were then linted by nothing at all — neither
+  // the preset nor the module's own planning layer said a word about them. `dist` and
+  // `node_modules` are tool output wherever they sit, so they stay unanchored; a folder called
+  // `coverage` is only output at the module root. Measured on the monorepo before changing:
+  // of the 55 modules carrying the unanchored entry, planning-requirement is the ONLY one with
+  // a source folder of that name, so this narrows nothing anywhere else.
+  "coverage/**",
   // `**/*.mock.ts` used to sit here and has been removed. It was the only entry in this list
   // with no reason written next to it, and it does not meet the bar the paragraph above sets:
   // a mock is not build output, not vendored and not generated. It is hand-written TypeScript
@@ -4133,12 +4148,12 @@ function plan2(context) {
   const ignores = readEslintIgnores(context.cwd);
   const rootIgnores = readRootEslintIgnores(findWorkspaceRoot(context.cwd));
   const bare = (pattern) => pattern.replace(/^\*\*\//, "").replace(/\/\*\*$/, "");
-  const defaults = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
+  const defaults2 = new Set(DEFAULT_IGNORE_PATTERNS.map(bare));
   const moduleOwn = [
     ...committedIgnorePatterns(context.cwd),
     ...ignores.patterns,
     ...rootIgnores.patterns
-  ].filter((pattern) => !defaults.has(bare(pattern)));
+  ].filter((pattern) => !defaults2.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const stub = {
     extends: extendsWithPreset(committedExtends(context.cwd), variant),
@@ -4230,7 +4245,7 @@ function plan2(context) {
   return { operations, notes };
 }
 function lintScripts(cwd) {
-  const scripts = moduleScripts(cwd);
+  const scripts2 = moduleScripts(cwd);
   const rewritten = {
     // `existingCommand`, not `scripts[...]`: the command can live in an `nx:run-commands`
     // target instead of a script, and adoption deletes that target. Composing against only
@@ -4240,7 +4255,7 @@ function lintScripts(cwd) {
     })
   };
   const ownCommand = selfCommand(cwd, "--run --lint");
-  for (const [name, command] of Object.entries(scripts)) {
+  for (const [name, command] of Object.entries(scripts2)) {
     if (name === LINT_SCRIPT_NAME) continue;
     const needsRewrite = /\beslint\b/.test(command) || // ...and, for a self-adopting package, a script already running sentinel FOR LINT.
     // The `--lint` check is load-bearing: without it this matched the module's `format`
@@ -4516,11 +4531,11 @@ ${result.stderr ?? ""}`);
     const { options: passedOptions, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXLINT_VALUE_FLAGS
     });
-    const targets = paths.length > 0 ? paths : ["."];
+    const targets2 = paths.length > 0 ? paths : ["."];
     const emptyScope = scopeFlags(paths, passedOptions);
     const lint = (extra) => {
       const passed = [...extra, ...emptyScope, ...passedOptions];
-      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets2], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -4706,8 +4721,8 @@ ${result.stderr ?? ""}`);
     } catch {
       return void 0;
     }
-    const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync12(join16(cwd, target)));
+    const targets2 = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
+    return targets2.find((target) => !existsSync12(join16(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4737,6 +4752,800 @@ function registerLint() {
   setDefaultRunner("lint", "oxlint");
 }
 
+// src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join19 } from "node:path";
+
+// src/roles/static-analysis/configs/resolve.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join17 } from "node:path";
+import { pathToFileURL } from "node:url";
+var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
+async function loadStaticConfig(cwd) {
+  const path = join17(cwd, STATIC_CONFIG_FILE);
+  if (!existsSync13(path)) {
+    return { config: defineStaticAnalysis(), from: null, unreadable: null };
+  }
+  try {
+    const loaded = await import(pathToFileURL(path).href);
+    return { config: adopt(loaded.default), from: STATIC_CONFIG_FILE, unreadable: null };
+  } catch (error) {
+    return {
+      config: defineStaticAnalysis(),
+      from: null,
+      unreadable: `${STATIC_CONFIG_FILE}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+function adopt(exported) {
+  if (exported === null || typeof exported !== "object") return defineStaticAnalysis();
+  if (Array.isArray(exported.moved)) {
+    return exported;
+  }
+  return defineStaticAnalysis(exported);
+}
+
+// src/roles/static-analysis/help/metrics.ts
+var metricsHelp = {
+  duplicatedLinesPercent: {
+    label: "Duplicated lines",
+    what: "The share of lines jscpd found in at least one clone, over the lines of the files it was able to scan.",
+    read: "Higher is worse. It is computed per module, so two modules compare directly as long as they measured with the same settings, which is what the settings printed under the figures are for; the repository-wide figure is not the average of theirs, because modules differ in size.",
+    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs. The denominator is also narrower than the module: a file shorter than the detection window cannot contain a clone, so the tool leaves it out of both counts, which on one front app is 31 files of 596, or 5%.",
+    source: "jscpd, over the token stream rather than the text: for JavaScript and TypeScript the tokens come from the oxc parser, which emits neither whitespace nor comments, so reindenting a block is not a clone and `--mode` measured identical on all three values. Rule of Three: Fowler, Refactoring, crediting Don Roberts."
+  },
+  entryPoints: {
+    label: "Entry points",
+    what: "How many files the reachability walk started from, against how many it scanned.",
+    read: "Read it FIRST, before the dead-code share below, because it says whether that share can mean anything. The further it is from the file count, the more the walk had to prove; when the two are equal, nothing could have been found unreachable.",
+    caveat: "This is the figure that tells you the dead-code share is unreadable, and it is measured: on `libs/nest/auth` the walk starts from 138 of 138 files, because the workspace declares `@hublo/auth/*` as a path alias onto its whole `src`, so every file is a public entry and the share is 0.00% by construction rather than by cleanliness. `libs/front/shared` is 26 of 26. An application is the opposite case, 39 of 594 on `apps/front/console`, and its share is worth acting on. A count close to the file count is not a good sign and not a bad one: it means this pass had nothing to decide.",
+    source: "jscpd's dead-code statistics, `entryPoints` against `files`. Entry points come from the module's own manifest, about fifty framework conventions, and the patterns this role declares; the report does not list WHICH files they are, only how many."
+  },
+  deadLinesPercent: {
+    label: "Unreachable lines",
+    what: "The share of scanned lines the reachability walk never reached from an entry point.",
+    read: "Higher is worse, and only once the entry-point count above says the question was decidable. Read it next to the four counts below rather than alone: one number covering files, exports, symbols and imports hides four different kinds of work.",
+    caveat: "Unreachable here means unreachable WITHIN this module, and that is a measured limitation rather than a theoretical one. A library is consumed from outside the scan, so its files look unreachable: on a sample of 12 files reported dead, 9 of `libs/front/components` and 7 of `libs/nest/auth` are cited elsewhere in the repository, one of them in 356 files. Test, fixture and story files are also outside the reachability graph, verified on a fixture, so a file reached only by a story is reported unreachable; it is true of the product and false of the repository, and `libs/front/components` has one such file of 915 lines.",
+    source: "jscpd's dead-code engine, `deadLines` over `totalLines`. The library figures were measured per module with the workspace's own path aliases, and the story case was isolated on a four-file fixture where the only importer was a `.stories.tsx`."
+  },
+  unusedFiles: {
+    label: "Unreachable files",
+    what: "Files no entry point reaches, each with a confidence the tool assigns.",
+    read: "The most actionable of the four, and the one to start from: a whole file nothing reaches is a decision, not a cleanup. Open the ones with the highest confidence first.",
+    caveat: "Three classes hide in this count and only the first is a deletion. Genuinely unreachable product code; files reached only by tests, stories or helpers, which are alive and would break if removed; and entry points of a framework this role has not declared, which is why the front bootstrap files are in the shipped `entry` list. Measured on one nest module, 10 of 42 findings were `*.test-helper.ts` or `*.mock.ts` cited only by tests.",
+    source: "jscpd dead-code findings of category `unused-file`. The three classes were separated by hand on `apps/front/console`, `apps/nest/microservices/contract` and `apps/nest/backends-for-frontends/admin`."
+  },
+  unusedExports: {
+    label: "Unused exports",
+    what: "Exported names nothing in this module imports.",
+    read: "Low on an application, where an export with no local consumer is usually a leftover. On a library it says almost nothing, for the reason the share above gives.",
+    caveat: "Exports of a file the tool treats as an entry point are NOT counted, deliberately: the tool's own words are that they are usually a public API. So this number is about internal exports, and a module whose every file is an entry point reports zero of them whatever its state.",
+    source: "jscpd dead-code findings of category `unused-export`."
+  },
+  unusedSymbols: {
+    label: "Unused symbols",
+    what: "Declared names, not exported, that nothing in their own file uses.",
+    read: "A local cleanup rather than a design signal, and usually a small count.",
+    caveat: "The tool scores every finding and names what lowered the score, a file calling `eval`, an unrecognised decorator, a name that appears inside a string literal. Measured on sentinel itself, a confidence floor of 60 yields 22 symbols, 90 yields none, so this count moves with that floor and is printed with it.",
+    source: "jscpd dead-code findings of category `unused-symbol`, above the confidence floor."
+  },
+  unusedImports: {
+    label: "Unused imports",
+    what: "Imported names the importing file never uses.",
+    read: "Mostly a lint concern, and it is here because for front applications the linter is not asking. Treat a high count as a lint gap rather than as dead code.",
+    caveat: "\u26A0\uFE0F 85% of these findings, measured over every module scanned on this pass, are `import React from 'react'`, which the modern JSX transform makes unnecessary and the classic one requires, so whether it is removable depends on the module's `jsx` setting and not on this count. Worse for acting on it line by line: `import React, { useState } from 'react'` is reported with the name `React`, and deleting the line takes `useState` with it. It overlaps `typescript/no-unused-vars`, which this repository's `nest`, `react-lib`, `svelte` and `tools` lint presets enable and its `react` preset turns off, which is the only reason the figure is not redundant for front applications.",
+    source: "jscpd dead-code findings of category `unused-import`; the 85% and the preset states were measured on this repository's lint presets and the day's scans."
+  },
+  duplicatedLinesPercentTests: {
+    label: "Duplicated lines (tests)",
+    what: "The same share, measured over this module's test files alone.",
+    read: "Read it DIFFERENTLY from the figure above rather than as a worse version of it. Repetition in a spec is often deliberate: a test that spells out its own setup can be read on its own, and factoring that setup into a helper is what makes a failing test hard to diagnose. The figure is here because its size is a fact about the specs, not because it is a debt to pay down.",
+    caveat: "It says nothing about whether the tests are good, and a high value is not automatically a problem: the two common causes are a deliberately explicit setup, which is a defensible style, and a suite copied file by file as the module grew, which is not, and this number cannot tell them apart. The split is also why it exists at all: measured across 8 modules of the three families, 71% of all duplicated lines are between two test files, so a single blended figure was mostly this one wearing the name of the module.",
+    source: "Same tool and same detection window as the figure above, over the files matching this role's test glob, which is printed under the figures. The 71% was measured on apps/front/console, host-admin, hr-management, libs/front/components, libs/front/shared, apps/nest/microservices/contract, apps/nest/microservices/agency and libs/nest/auth."
+  },
+  clonesTests: {
+    label: "Clones (tests)",
+    what: "How many duplicated fragments the test pass reported.",
+    read: "A count, with the same reserves as the product one above.",
+    caveat: "Everything the product clone count does not say applies here unchanged. One more thing is specific to the split: the two passes partition the files, so a fragment shared between a test and a product file has a partner in NEITHER pass and is counted in neither number. Measured on the same 8 modules, that is 42 entries of 5117, 0.8%, and 650 lines.",
+    source: "jscpd report statistics for the test pass. The partition and its loss were verified on apps/front/console: 478 product files plus 87 test files are the 565 of a blended scan, and 32 plus 40 are its 72 entries."
+  },
+  clones: {
+    label: "Clones",
+    what: "How many duplicated fragments jscpd reported, each entry linking two places that match.",
+    read: "A count, so it grows with the size of the module. Read it next to the duplicated-line share rather than on its own, and treat it as the number of places to go and look at.",
+    caveat: "Not a count of duplicated places, and the gap is measured, not theoretical: five identical files produce four entries, all of them naming one file in common, so n copies give n-1 entries, neither n nor the n(n-1)/2 pairs. Worse for reading occurrences, jscpd keeps only the longest match per pair of files, so when a third file shares just part of a block, that block is reported under two different fragments and its real number of occurrences cannot be recovered from the report. Size is invisible too: one clone of sixty lines and one of six both count as one.",
+    source: "jscpd report statistics. Counting behaviour measured on fixtures with jscpd 5.4.0; the shared file is not the same one across major versions, so only the count is relied on."
+  }
+};
+function helpFor(key) {
+  return metricsHelp[key];
+}
+
+// src/roles/static-analysis/report.ts
+function shown(row) {
+  return row.unit === "%" && typeof row.value === "number" ? row.value.toFixed(2) : String(row.value);
+}
+function renderConsole(report) {
+  const lines = [];
+  const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
+  const label = (row) => helpFor(row.metric)?.label ?? row.metric;
+  const value = (row) => `${shown(row)} ${row.unit}`;
+  const labelWidth = width(label);
+  const valueWidth = width(value);
+  lines.push(`sentinel static-analysis: ${report.module}`);
+  for (const row of report.rows) {
+    lines.push(`    ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}`);
+  }
+  for (const note of report.notes) lines.push(`    (${note})`);
+  if (report.settings.length > 0) {
+    const keyWidth = Math.max(...report.settings.map((setting) => setting.key.length));
+    lines.push("", "  measured with");
+    for (const setting of report.settings) {
+      lines.push(
+        `    ${setting.key.padEnd(keyWidth)}  ${setting.value}${setting.moved ? "  (module)" : ""}`
+      );
+    }
+    if (report.settings.some((setting) => setting.moved)) {
+      lines.push(`    (module) = overridden in ${report.module}'s static-analysis.config.mjs`);
+    }
+  }
+  if (report.byLanguage && Object.keys(report.byLanguage).length > 0) {
+    lines.push("", "  per language, where a clone was found in the product code");
+    for (const [language, stats] of Object.entries(report.byLanguage)) {
+      lines.push(
+        `    ${language.padEnd(12)} ${stats.percentage.toFixed(2)}% (${stats.duplicatedLines} lines over ${stats.files} files)`
+      );
+    }
+    lines.push("    a language is absent when no file of it was long enough to scan");
+  }
+  const caveats = report.rows.map((row) => ({ row, help: helpFor(row.metric) })).filter(
+    (entry) => Boolean(entry.help)
+  );
+  if (caveats.length > 0) {
+    lines.push("", "  what these numbers do not say");
+    for (const { row, help } of caveats) {
+      lines.push(`    ${help.label}: ${help.caveat}`, `      source: ${help.source}`);
+      void row;
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderJson(report) {
+  const rows = report.rows.map((row) => ({ ...row, help: helpFor(row.metric) ?? null }));
+  return `${JSON.stringify({ ...report, rows }, null, 2)}
+`;
+}
+function escape(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderHtml(report) {
+  const rows = report.rows.map((row) => {
+    const help = helpFor(row.metric);
+    return `      <tr>
+        <th scope="row">${escape(help?.label ?? row.metric)}</th>
+        <td class="num">${escape(shown(row))} <span class="unit">${escape(row.unit)}</span></td>
+        <td class="caveat">${escape(help?.caveat ?? "")}</td>
+      </tr>`;
+  }).join("\n");
+  const settings = report.settings.map(
+    (setting) => `      <tr>
+        <th scope="row"><code>${escape(setting.key)}</code></th>
+        <td class="num">${escape(setting.value)}</td>
+        <td>${setting.moved ? '<span class="moved">overridden in this module</span>' : ""}</td>
+      </tr>`
+  ).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Static analysis: ${escape(report.module)}</title>
+<style>
+  :root { color-scheme: light dark; --ink: #1a1a1a; --bg: #fdfdfc; --rule: #e2e0da; --warn: #9a3412; --dim: #6b6b6b; }
+  @media (prefers-color-scheme: dark) {
+    :root { --ink: #e8e6e1; --bg: #1b1b1a; --rule: #35332e; --warn: #fb923c; --dim: #9b9892; }
+  }
+  body { margin: 0; padding: 2rem 1rem; background: var(--bg); color: var(--ink);
+         font: 15px/1.55 ui-sans-serif, system-ui, sans-serif; }
+  main { max-width: 60rem; margin: 0 auto; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.25rem; }
+  p.sub { color: var(--dim); margin: 0 0 1.5rem; }
+  h2 { font-size: 0.95rem; margin: 2.5rem 0 0.5rem; }
+  table { width: 100%; border-collapse: collapse; }
+  th, td { text-align: left; padding: 0.6rem 0.75rem; border-bottom: 1px solid var(--rule);
+           vertical-align: top; }
+  thead th { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--dim); }
+  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; }
+  code { font: 0.9em ui-monospace, SFMono-Regular, Menlo, monospace; }
+  .unit { color: var(--dim); font-size: 0.85em; }
+  .moved { color: var(--warn); font-size: 0.85em; }
+  .caveat { color: var(--dim); font-size: 0.9em; }
+</style>
+</head>
+<body>
+<main>
+  <h1>Static analysis: ${escape(report.module)}</h1>
+  <p class="sub">Passes: ${escape(report.passes.join(", "))}</p>
+  <table>
+    <thead>
+      <tr><th scope="col">Metric</th><th scope="col">Value</th><th scope="col">What it does not say</th></tr>
+    </thead>
+    <tbody>
+${rows}
+    </tbody>
+  </table>
+  <h2>Measured with</h2>
+  <table>
+    <thead>
+      <tr><th scope="col">Setting</th><th scope="col">Value</th><th scope="col">Origin</th></tr>
+    </thead>
+    <tbody>
+${settings}
+    </tbody>
+  </table>
+</main>
+</body>
+</html>
+`;
+}
+
+// src/roles/static-analysis/adapters/jscpd/config.ts
+import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join18 } from "node:path";
+var OWN_ARTEFACTS = [`**/${STATIC_CONFIG_FILE}`, `**/${REPORT_DIR}/**`];
+function testGlobs(config) {
+  const relative4 = config.duplication.tests;
+  return {
+    ignore: relative4.map((glob) => `**/${glob}`),
+    // A one-item brace group is avoided rather than trusted: nothing guarantees `{x}` expands.
+    pattern: relative4.length === 1 ? `**/${relative4[0]}` : `**/{${relative4.join(",")}}`
+  };
+}
+function exclusions(config, scope = "tests") {
+  const tests = scope === "product" ? testGlobs(config).ignore : [];
+  return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
+}
+function fileSettings(config, scope) {
+  return {
+    // The detection window. Stated rather than defaulted, because it decides what is invisible.
+    minTokens: config.duplication.minTokens,
+    minLines: config.duplication.minLines,
+    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
+    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
+    format: config.languages,
+    ignore: exclusions(config, scope),
+    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
+    failOnEmpty: true,
+    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
+    // explicit that the top-level one is about clones and is never carried into a dead-code run.
+    deadCode: {
+      entry: config.entry,
+      minConfidence: config.deadCode.minConfidence,
+      categories: config.deadCode.categories
+    },
+    // The escape hatch, last so it wins, and empty unless a module asked for it.
+    ...config.tools.jscpd
+  };
+}
+function duplicationRun(config, paths, scope) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+`, "utf8");
+  const args = [
+    "--config",
+    configPath,
+    // The test pass SELECTS its files; the product pass excludes them through `ignore` above. A
+    // flag and not a config key, because `--pattern` is the only documented way in and it takes
+    // exactly one glob, braces expanded. Verified: 478 product files + 87 test files = the 565 of
+    // a blended scan on `apps/front/console`.
+    ...scope === "tests" ? ["--pattern", testGlobs(config).pattern] : [],
+    // Always json, and only json, whatever shape the caller asked for. The three shapes are
+    // rendered by this role from the figures, not by the tool: one report lives under
+    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
+    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
+    // output DIRECTORY, not our `--output` shape.
+    "--reporters",
+    "json",
+    "--output",
+    dir,
+    "--no-tips",
+    ...paths
+  ];
+  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+}
+function deadCodeRun(config, paths) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(
+    configPath,
+    `${JSON.stringify(fileSettings(config, "dead-code"), null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    args: [
+      "--config",
+      configPath,
+      "--dead-code",
+      "--reporters",
+      "json",
+      "--output",
+      dir,
+      "--no-tips",
+      ...paths
+    ],
+    rawReportDir: dir,
+    dispose: () => rmSync3(dir, { force: true, recursive: true })
+  };
+}
+var RAW_REPORT = {
+  duplication: "jscpd-report.json",
+  "dead-code": "basta-report.json"
+};
+
+// src/roles/static-analysis/adapters/jscpd/resolve.ts
+function resolveJscpd(cwd) {
+  return resolveBin(cwd, "jscpd") ?? binFromOwnInstall("jscpd", "jscpd");
+}
+
+// src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css", ".scss"];
+var SCRIPT = "static-analysis";
+var SHAPES = ["console", "json", "html"];
+var scripts = () => ({
+  [SCRIPT]: `sentinel --run --${SCRIPT}`,
+  [`${SCRIPT}:json`]: `sentinel --run --${SCRIPT} --output json`,
+  [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
+});
+var targets = () => ({
+  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
+});
+function configStub() {
+  const rows = overridableSettings();
+  const pad = Math.max(...rows.map((row) => row.key.length));
+  const show = (row) => `  //   ${row.key.padEnd(pad)}  ${row.value}`;
+  const movable = rows.filter((row) => row.where === "overrides").map(show);
+  const refused = rows.filter((row) => row.where === "refused").map((row) => `  //   ${row.key}: ${row.note}`);
+  return `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+
+export default defineStaticAnalysis({
+  root: import.meta.dirname,
+
+  // Files that RUN although nothing imports them: they are where reachability starts. Added to
+  // the patterns sentinel ships, never replacing them.
+  entry: [],
+
+  // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
+  // relative to this module, because one run measures one module.
+  journeys: {},
+
+  // ---------------------------------------------------------------------------------------------
+  // What this module can move, with the role's value today. A setting you leave out keeps that
+  // value; a setting you write REPLACES it, including inside a list. Anything you set is printed
+  // under "measured with" in the report and marked \`(module)\`, because two modules measured with
+  // different settings can no longer be compared.
+  //
+${movable.join("\n")}
+  //
+  // A list shown as a count is not copyable, and replacing one means writing back what you keep,
+  // so read the values in full with:
+  //
+  //   pnpm exec sentinel --inspect --${SCRIPT} --json
+  //
+${refused.join("\n")}
+  //
+  // overrides: {
+  //   duplication: { minTokens: 100 },
+  // },
+})
+`;
+}
+function configValue(config, path) {
+  return path.split(".").reduce(
+    (node, key) => node && typeof node === "object" ? node[key] : void 0,
+    config
+  );
+}
+var JscpdAdapter = class extends BaseAdapter {
+  target = "static-analysis";
+  runner = "jscpd";
+  /** Every preset: duplication, dead code and complexity are not stack-specific. */
+  appliesTo(_preset) {
+    return true;
+  }
+  plan(context) {
+    if (!hasSourceFiles(context.cwd, EXTENSIONS)) {
+      return {
+        operations: [],
+        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS.join(", ")}).`
+      };
+    }
+    return {
+      operations: [
+        // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
+        // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
+        ...existsSync14(join19(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
+        manifestOperation(context.cwd, scripts()),
+        ...nxTargetOperations({ cwd: context.cwd, targets: targets() })
+        // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
+        // and not here: a per-module rule creates a `.gitignore` in modules that had none and
+        // repeats the same line in every adopting module.
+      ],
+      notes: [
+        `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
+      ]
+    };
+  }
+  /**
+   * Measure, and emit only when asked to.
+   *
+   * `--run` prints and may write a file; `--report` answers a machine and must do neither, which is
+   * the only difference between the two verbs here. Shared rather than duplicated because the
+   * measurement is where every reserve lives: two copies would drift, and the one that drifted
+   * would be the one nobody reads.
+   */
+  async measure(ctx, emitting) {
+    const shape = ctx.output ?? "console";
+    if (!SHAPES.includes(shape)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): unknown --output "${ctx.output}" (known: ${SHAPES.join(", ")}).
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    if (!hasSourceFiles(ctx.cwd, EXTENSIONS)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS.join(", ")}).
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const { config, unreadable } = await loadStaticConfig(ctx.cwd);
+    if (unreadable) {
+      process.stderr.write(`sentinel static-analysis(jscpd): ${unreadable}
+`);
+      return { ok: false, code: 1 };
+    }
+    const kinds = config.duplication.kinds;
+    if (kinds.length !== 1 || kinds[0] !== "exact") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): duplication.kinds is ${JSON.stringify(kinds)}, and only ["exact"] is supported. Any other kind overlaps the first, and the duplicated-line share then counts the same lines twice.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const jscpd = resolveJscpd(ctx.cwd);
+    if (!jscpd) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): could not find the jscpd binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
+    const scanned = paths.length > 0 ? paths : ["."];
+    const product = runPass(jscpd, config, scanned, "product", ctx.cwd);
+    if (product.kind === "failed") return { ok: false, code: product.code };
+    if (product.kind === "empty") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): nothing left to measure in this module once the exclusions applied, so no figure is reported (a figure of 0% would be a different claim).
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const tests = runPass(jscpd, config, scanned, "tests", ctx.cwd);
+    if (tests.kind === "failed") return { ok: false, code: tests.code };
+    const dead = runDeadCode(jscpd, config, scanned, ctx.cwd);
+    if (dead.kind === "failed") return { ok: false, code: dead.code };
+    if (dead.kind === "no-entry-point") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): no entry point found in this module, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned). Declare what runs here in \`entry\` inside ${STATIC_CONFIG_FILE}: a lambda handler, a framework bootstrap, a script. A figure of 100% would describe the walk, not the code.
+`
+      );
+    }
+    const report = assemble(ctx, config, product, tests, dead);
+    if (emitting) emit(report, shape, ctx.cwd);
+    return { ok: true, code: 0, metrics: metricsOf(report) };
+  }
+  /** `--run`: measure and show it. */
+  async run(ctx) {
+    return this.measure(ctx, true);
+  }
+  /**
+   * `--inspect`: the settings that apply here, IN FULL.
+   *
+   * It exists because of the other half of documenting an override. The config stub lists what a
+   * module can move, but a list it summarises as "19 patterns" cannot be copied from, and
+   * `overrides` REPLACES a list rather than extending it: a developer who wants one more exclusion
+   * has to write the current ones back, so they need to read them. This is where.
+   *
+   * ⚠️ `--run` answers a narrower question, on purpose. The report prints the settings its FIGURES
+   * came from, which is what makes two modules comparable; this prints everything that applies,
+   * including what no pass has used yet. The two are not interchangeable.
+   */
+  async inspect(ctx) {
+    const { config, from, unreadable } = await loadStaticConfig(ctx.cwd);
+    const roleValue = (path) => path.split(".").reduce(
+      (node, key) => node && typeof node === "object" ? node[key] : void 0,
+      defaults
+    );
+    return {
+      runner: this.runner,
+      configFile: from,
+      ...unreadable ? { unreadable } : {},
+      reportDir: REPORT_DIR,
+      // The resolved values, not the role's: what this module measures with.
+      settings: {
+        entry: config.entry,
+        ignore: config.ignore,
+        languages: config.languages,
+        journeys: config.journeys,
+        duplication: config.duplication,
+        deadCode: config.deadCode
+      },
+      // What this module moved, with the role's value beside it, so the difference is readable
+      // without opening the package.
+      overrides: config.moved.map((path) => ({
+        setting: path,
+        module: roleValue(path) === void 0 ? "set" : JSON.stringify(configValue(config, path)),
+        role: JSON.stringify(roleValue(path))
+      })),
+      // What the two passes will actually do with the globs, which is where a mistaken override
+      // shows up first: a product pass excluding nothing, or a test pass selecting nothing.
+      passes: {
+        product: { excludes: exclusions(config, "product").length },
+        tests: { excludes: exclusions(config, "tests").length, selects: config.duplication.tests }
+      }
+    };
+  }
+  /**
+   * `--report`: the same figures, for a machine.
+   *
+   * It writes nothing and prints nothing: the caller is the `--json` envelope or the CI comment,
+   * and a role that also printed its table would make the same numbers arrive twice in two shapes.
+   */
+  async report(ctx) {
+    return this.measure(ctx, false);
+  }
+  /**
+   * Adoption, from the COMMITTED manifest only, so a workspace-wide sweep stays cheap and needs no
+   * install. The script is the marker, which is also how the migration page follows this role.
+   */
+  async status(ctx) {
+    const declared = moduleScripts(ctx.cwd);
+    const missing = Object.keys(scripts()).filter((name) => !(name in declared));
+    const adopted = missing.length < Object.keys(scripts()).length;
+    const hasConfig = existsSync14(join19(ctx.cwd, STATIC_CONFIG_FILE));
+    return {
+      adopted,
+      preset: adopted ? ctx.preset : null,
+      conformant: adopted && missing.length === 0 && hasConfig,
+      drift: [
+        ...missing.map((name) => `missing script: ${name}`),
+        ...adopted && !hasConfig ? [`missing ${STATIC_CONFIG_FILE}`] : []
+      ]
+    };
+  }
+};
+function analysedNothing(stderr) {
+  return typeof stderr === "string" && stderr.includes("--fail-on-empty");
+}
+function duplicationSettings(config) {
+  const moved = (key) => config.moved.some((path) => path === key || path.startsWith(`${key}.`));
+  const row = (key, value) => ({ key, value, moved: moved(key) });
+  return [
+    row("duplication.minTokens", String(config.duplication.minTokens)),
+    row("duplication.minLines", String(config.duplication.minLines)),
+    row("duplication.kinds", config.duplication.kinds.join(", ")),
+    row("languages", `${config.languages.length}: ${config.languages.join(", ")}`),
+    // The count the SCAN received, not the module's list: the role unions its own artefacts in,
+    // and printing 20 while measuring with 22 is the kind of small lie that costs an afternoon.
+    // The product pass, which is the one the headline figure comes from.
+    row("ignore", `${exclusions(config, "product").length} patterns`),
+    row("duplication.tests", config.duplication.tests.join("  ")),
+    // The dead-code pass's own two, and the reason they are in the same block: a reader comparing
+    // two modules' unreachable share needs the confidence floor as much as the detection window.
+    row("deadCode.minConfidence", String(config.deadCode.minConfidence)),
+    row("deadCode.categories", config.deadCode.categories.join(", ")),
+    row("entry", `${config.entry.length} patterns`)
+  ];
+}
+function runDeadCode(jscpd, config, paths, cwd) {
+  const { args, rawReportDir, dispose } = deadCodeRun(config, paths);
+  try {
+    const result = spawnSync5(jscpd, args, { cwd, encoding: "utf8" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): could not run the dead-code pass (${result.error.message})
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    if (result.status !== 0) {
+      if (analysedNothing(result.stderr)) return { kind: "empty" };
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code pass exited ${result.status}
+${result.stderr ?? ""}`
+      );
+      return { kind: "failed", code: result.status ?? 1 };
+    }
+    const path = join19(rawReportDir, RAW_REPORT["dead-code"]);
+    if (!existsSync14(path)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code pass wrote no ${RAW_REPORT["dead-code"]}
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync14(path, "utf8"));
+    } catch {
+      process.stderr.write(`sentinel static-analysis(jscpd): the dead-code report does not parse
+`);
+      return { kind: "failed", code: 1 };
+    }
+    const statistics = parsed.statistics;
+    if (!statistics) {
+      process.stderr.write(`sentinel static-analysis(jscpd): the dead-code report has no figures
+`);
+      return { kind: "failed", code: 1 };
+    }
+    if ((statistics.entryPoints ?? 0) === 0) {
+      return { kind: "no-entry-point", files: statistics.files ?? 0 };
+    }
+    const byCategory = {};
+    for (const finding of parsed.findings ?? []) {
+      const category = finding.category ?? "unknown";
+      byCategory[category] = (byCategory[category] ?? 0) + 1;
+    }
+    return { kind: "figures", statistics, byCategory };
+  } finally {
+    dispose();
+  }
+}
+function runPass(jscpd, config, paths, scope, cwd) {
+  const { args, rawReportDir, dispose } = duplicationRun(config, paths, scope);
+  try {
+    const result = spawnSync5(jscpd, args, { cwd, encoding: "utf8" });
+    if (result.error) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): could not run the ${scope} pass (${result.error.message})
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    if (result.status !== 0) {
+      if (analysedNothing(result.stderr)) return { kind: "empty" };
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the ${scope} pass exited ${result.status}
+${result.stderr ?? ""}`
+      );
+      return { kind: "failed", code: result.status ?? 1 };
+    }
+    const path = join19(rawReportDir, RAW_REPORT.duplication);
+    const parsed = existsSync14(path) ? safeParse(readFileSync14(path, "utf8")) : void 0;
+    const total = parsed?.statistics?.total;
+    if (!total) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the ${scope} pass wrote no readable report
+`
+      );
+      return { kind: "failed", code: 1 };
+    }
+    return { kind: "figures", total, formats: parsed?.statistics?.formats ?? {} };
+  } finally {
+    dispose();
+  }
+}
+function safeParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function assemble(ctx, config, product, tests, dead) {
+  const share = (total) => Number((total.percentage ?? 0).toFixed(2));
+  const rows = [
+    { metric: "duplicatedLinesPercent", value: share(product.total), unit: "%" },
+    { metric: "clones", value: product.total.clones ?? 0, unit: "entries" }
+  ];
+  const notes = [];
+  if (tests.kind !== "figures") {
+    notes.push("no test file to measure, so no test duplication figure is reported");
+  }
+  if (dead.kind === "no-entry-point") {
+    notes.push(
+      `no entry point found, so nothing could be reached and no dead-code figure is reported (${dead.files} file(s) scanned): declare what RUNS here in \`entry\``
+    );
+  }
+  if (dead.kind === "empty") {
+    notes.push("the dead-code pass had nothing left to analyse, so no figure is reported");
+  }
+  if (tests.kind === "figures") {
+    rows.push(
+      { metric: "duplicatedLinesPercentTests", value: share(tests.total), unit: "%" },
+      { metric: "clonesTests", value: tests.total.clones ?? 0, unit: "entries" }
+    );
+  }
+  if (dead.kind === "figures") {
+    const stats = dead.statistics;
+    rows.push(
+      {
+        metric: "entryPoints",
+        value: stats.entryPoints ?? 0,
+        unit: `of ${stats.files ?? 0} files`
+      },
+      { metric: "deadLinesPercent", value: share(stats), unit: "%" },
+      { metric: "unusedFiles", value: dead.byCategory["unused-file"] ?? 0, unit: "files" },
+      { metric: "unusedExports", value: dead.byCategory["unused-export"] ?? 0, unit: "exports" },
+      { metric: "unusedSymbols", value: dead.byCategory["unused-symbol"] ?? 0, unit: "symbols" },
+      { metric: "unusedImports", value: dead.byCategory["unused-import"] ?? 0, unit: "imports" }
+    );
+  }
+  const byLanguage = Object.fromEntries(
+    Object.entries(product.formats).map(([language, stats]) => [
+      language,
+      {
+        files: stats.sources ?? 0,
+        duplicatedLines: stats.duplicatedLines ?? 0,
+        percentage: Number((stats.percentage ?? 0).toFixed(2))
+      }
+    ])
+  );
+  return {
+    module: ctx.module,
+    passes: [
+      "duplication",
+      ...tests.kind === "figures" ? ["duplication (tests)"] : [],
+      ...dead.kind === "figures" ? ["dead code"] : []
+    ],
+    rows,
+    notes,
+    settings: duplicationSettings(config),
+    byLanguage
+  };
+}
+function emit(report, shape, cwd) {
+  if (shape === "console") {
+    process.stdout.write(renderConsole(report));
+    return;
+  }
+  const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
+  const body = shape === "json" ? renderJson(report) : renderHtml(report);
+  mkdirSync(join19(cwd, REPORT_DIR), { recursive: true });
+  writeFileSync4(join19(cwd, REPORT_DIR, name), body, "utf8");
+  process.stdout.write(`${renderConsole(report)}
+  written: ${REPORT_DIR}/${name}
+`);
+}
+function metricsOf(report) {
+  return {
+    passes: report.passes,
+    // Carried for the same reason they are printed: a consumer reading an absent figure needs to
+    // know whether it is clean or unmeasurable.
+    notes: report.notes,
+    ...Object.fromEntries(report.rows.map((row) => [row.metric, row.value])),
+    // Carried into `--json` and the CI comment for the same reason the console prints them: a
+    // figure whose settings are unknown cannot be compared with the next module's.
+    settings: Object.fromEntries(
+      report.settings.map((s) => [s.key, { value: s.value, moved: s.moved }])
+    ),
+    byLanguage: report.byLanguage
+  };
+}
+
+// src/roles/static-analysis/register.ts
+function registerStaticAnalysis() {
+  register(new JscpdAdapter());
+  setDefaultRunner("static-analysis", "jscpd");
+}
+
 // src/roles/test/register.ts
 function registerTest() {
   register(new VitestAdapter());
@@ -4744,10 +5553,10 @@ function registerTest() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -4900,7 +5709,11 @@ function localOnlyCompilerOptions(compilerOptions, preset) {
 
 // src/roles/typescript/resolve-tsconfig-target.ts
 var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
-var TSCONFIG_MARKERS = ["tsconfig.base.json", "@hublo/sentinel/tsconfig/"];
+var TSCONFIG_MARKERS = [
+  "tsconfig.base.json",
+  "@hublo/sentinel/typescript/",
+  "@hublo/sentinel/tsconfig/"
+];
 var TSCONFIG_FALLBACK = "tsconfig.json";
 function resolveTsconfigTarget(moduleDir) {
   return resolveConfigTarget(moduleDir, {
@@ -4928,8 +5741,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5022,7 +5835,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync14(join17(context.cwd, target.path), "utf8"),
+    readFileSync15(join20(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5160,7 +5973,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync15(join18(cwd, target.path), "utf8"),
+        readFileSync16(join21(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5173,7 +5986,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join18(cwd, "noop.js")).resolve(preset);
+      createRequire(join21(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5214,7 +6027,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5249,7 +6062,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5269,7 +6082,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync15(join18(cwd, config), "utf8"),
+        readFileSync16(join21(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5285,7 +6098,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync13(join18(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync15(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5338,7 +6151,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5381,11 +6194,11 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
-    if (shown.status === 0 && shown.stdout) {
+    const shown2 = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    if (shown2.status === 0 && shown2.stdout) {
       try {
         const co = parseJsonc(
-          shown.stdout,
+          shown2.stdout,
           "tsconfig(--showConfig)"
         ).compilerOptions;
         if (co) return co.noImplicitAny ?? co.strict === true;
@@ -5409,6 +6222,7 @@ function registerAdapters() {
   registerFormat();
   registerBuild();
   registerTest();
+  registerStaticAnalysis();
 }
 
 // src/core/detect-framework.ts
@@ -5490,16 +6304,9 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync17, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve3, sep } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve3(cwd);
   const absolutePath = resolve3(root, relativePath);
@@ -5509,7 +6316,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync14(absolutePath) ? readFileSync16(absolutePath, "utf8") : void 0;
+  return existsSync16(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5611,14 +6418,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync3(tempPath, contents);
+  writeFileSync5(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync3(file.absolutePath, { force: true });
+      rmSync4(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -5627,8 +6434,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync17 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "node:fs";
+import { join as join22 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5662,12 +6469,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join19(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join22(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync17(join19(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync18(join22(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -5676,11 +6483,11 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path = join19(cwd, "package.json");
-  if (!existsSync15(path)) return [];
+  const path = join22(cwd, "package.json");
+  if (!existsSync17(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync17(path, "utf8"),
+      readFileSync18(path, "utf8"),
       path
     );
     return [
@@ -5703,7 +6510,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync17(join19(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync18(join22(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {