@hublo/sentinel 1.4.3 → 1.5.0-alpha.2

package/dist/{chunk-DYK6UEMO.js → chunk-AHA7LGGA.js}

@@ -53,10 +53,7 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-TDNPPNGK.js";
-import {
-  parseJsonc
-} from "./chunk-QXFCZON7.js";
+} from "./chunk-E3MYVYEZ.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   findWorkspaceRoot,
@@ -64,6 +61,14 @@ import {
   readOwnPackage,
   readProjectPackageJson
 } from "./chunk-KMKQDGI6.js";
+import {
+  REPORT_DIR,
+  defineStaticAnalysis,
+  isPlainObject
+} from "./chunk-GJGZRXM3.js";
+import {
+  parseJsonc
+} from "./chunk-QXFCZON7.js";
 
 // src/core/registry.ts
 var adapters = [];
@@ -760,7 +765,7 @@ function invokesVite(segment) {
 }
 function buildScripts(cwd) {
   const own = selfCommand(cwd, "--run --build");
-  const scripts = {
+  const scripts2 = {
     [BUILD_SCRIPT_NAME]: composeToolScript(existingCommand(cwd, BUILD_SCRIPT_NAME), {
       command: own ?? SENTINEL_BUILD_COMMAND,
       replaces: invokesVite,
@@ -772,14 +777,14 @@ function buildScripts(cwd) {
   const existingDev = existingCommand(cwd, DEV_SCRIPT_NAME);
   if (existingDev !== void 0) {
     const own2 = moduleName(cwd);
-    scripts[DEV_SCRIPT_NAME] = composeDevScript(
+    scripts2[DEV_SCRIPT_NAME] = composeDevScript(
       existingDev,
       // No trailing `--` here: `composeDevScript` owns the separator, and adding one on both
       // sides produced `-- --`, handing Vite an argument nobody wrote.
       `${selfCommand(cwd, "--run --dev") ?? SENTINEL_DEV_COMMAND} --module ${own2}`
     );
   }
-  return scripts;
+  return scripts2;
 }
 function plan(context) {
   const manifest = readProjectPackageJson(context.cwd);
@@ -843,8 +848,8 @@ function planReactApp(context, configFile) {
       `${configFile} now imports ${rewrite.moved.join(", ")} from \`${BUILD_PRESET_SPECIFIER}\`. Only the import lines changed: every attribute, alias and path is untouched, so this build produces what it produced before.`
     );
   }
-  const scripts = buildScripts(context.cwd);
-  operations.push(manifestOperation(context.cwd, scripts));
+  const scripts2 = buildScripts(context.cwd);
+  operations.push(manifestOperation(context.cwd, scripts2));
   operations.push(
     ...nxTargetOperations({
       cwd: context.cwd,
@@ -854,7 +859,7 @@ function planReactApp(context, configFile) {
       })
     })
   );
-  const dev = devTargetOperations(context.cwd, scripts[DEV_SCRIPT_NAME]);
+  const dev = devTargetOperations(context.cwd, scripts2[DEV_SCRIPT_NAME]);
   operations.push(...dev.operations);
   if (dev.note !== void 0) notes.push(dev.note);
   const owned = ownedBuildDependencies(context.cwd);
@@ -1148,8 +1153,8 @@ function insideBuildScript(env = process.env) {
   return env.npm_lifecycle_event === BUILD_SCRIPT_NAME;
 }
 function runPrerequisite(cwd, env = process.env) {
-  const scripts = moduleScripts(cwd);
-  const script = scripts[PREBUILD_SCRIPT_NAME];
+  const scripts2 = moduleScripts(cwd);
+  const script = scripts2[PREBUILD_SCRIPT_NAME];
   if (script === void 0 || script.trim() === "") return { kind: "none" };
   if (insideBuildScript(env)) return { kind: "already-run" };
   const result = spawnSync2("pnpm", ["run", PREBUILD_SCRIPT_NAME], { cwd, stdio: "inherit" });
@@ -1861,16 +1866,16 @@ var OxfmtAdapter = class extends BaseAdapter {
    * (`svelte-kit sync && <format> && eslint .`).
    */
   formatScripts(cwd) {
-    const scripts = moduleScripts(cwd);
+    const scripts2 = moduleScripts(cwd);
     const ownCommand = selfCommand(cwd, "--run --format");
     const compose = (existing, keepFix) => composeFormatScript(existing, { keepFix, command: ownCommand });
     const rewritten = {
       // `existingCommand` for the role's own script: the command can live in an
       // `nx:run-commands` target that adoption deletes, taking anything else it ran with it.
       [FORMAT_SCRIPT_NAME]: compose(existingCommand(cwd, FORMAT_SCRIPT_NAME), false),
-      [`${FORMAT_SCRIPT_NAME}:fix`]: compose(scripts[`${FORMAT_SCRIPT_NAME}:fix`], true)
+      [`${FORMAT_SCRIPT_NAME}:fix`]: compose(scripts2[`${FORMAT_SCRIPT_NAME}:fix`], true)
     };
-    for (const [name, command] of Object.entries(scripts)) {
+    for (const [name, command] of Object.entries(scripts2)) {
       if (name in rewritten) continue;
       const needsRewrite = /\bprettier\b/.test(command) || // ...and, for a self-adopting package, a script already running sentinel FOR FORMAT.
       // The `--format` check is load-bearing: without it this matched the module's `lint`
@@ -1879,7 +1884,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       if (!needsRewrite) continue;
       rewritten[name] = compose(command, writesWhenRewritten(name, command));
     }
-    return this.joinFormatIntoLint(scripts, rewritten, ownCommand);
+    return this.joinFormatIntoLint(scripts2, rewritten, ownCommand);
   }
   /**
    * Make `pnpm run lint` check formatting too, the way it did before the migration.
@@ -4067,7 +4072,15 @@ function findSuppressionRenames(cwd, renames) {
 var DEFAULT_IGNORE_PATTERNS = [
   "**/dist/**",
   "**/node_modules/**",
-  "**/coverage/**",
+  // Anchored, unlike the two above: this one names a word a domain can legitimately use.
+  // `**/coverage/**` also swallowed `planning-requirement/src/coverage`, the RequirementResult
+  // coverage feature, whose 48 TypeScript files were then linted by nothing at all — neither
+  // the preset nor the module's own planning layer said a word about them. `dist` and
+  // `node_modules` are tool output wherever they sit, so they stay unanchored; a folder called
+  // `coverage` is only output at the module root. Measured on the monorepo before changing:
+  // of the 55 modules carrying the unanchored entry, planning-requirement is the ONLY one with
+  // a source folder of that name, so this narrows nothing anywhere else.
+  "coverage/**",
   // `**/*.mock.ts` used to sit here and has been removed. It was the only entry in this list
   // with no reason written next to it, and it does not meet the bar the paragraph above sets:
   // a mock is not build output, not vendored and not generated. It is hand-written TypeScript
@@ -4230,7 +4243,7 @@ function plan2(context) {
   return { operations, notes };
 }
 function lintScripts(cwd) {
-  const scripts = moduleScripts(cwd);
+  const scripts2 = moduleScripts(cwd);
   const rewritten = {
     // `existingCommand`, not `scripts[...]`: the command can live in an `nx:run-commands`
     // target instead of a script, and adoption deletes that target. Composing against only
@@ -4240,7 +4253,7 @@ function lintScripts(cwd) {
     })
   };
   const ownCommand = selfCommand(cwd, "--run --lint");
-  for (const [name, command] of Object.entries(scripts)) {
+  for (const [name, command] of Object.entries(scripts2)) {
     if (name === LINT_SCRIPT_NAME) continue;
     const needsRewrite = /\beslint\b/.test(command) || // ...and, for a self-adopting package, a script already running sentinel FOR LINT.
     // The `--lint` check is load-bearing: without it this matched the module's `format`
@@ -4516,11 +4529,11 @@ ${result.stderr ?? ""}`);
     const { options: passedOptions, paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, {
       valueFlags: OXLINT_VALUE_FLAGS
     });
-    const targets = paths.length > 0 ? paths : ["."];
+    const targets2 = paths.length > 0 ? paths : ["."];
     const emptyScope = scopeFlags(paths, passedOptions);
     const lint = (extra) => {
       const passed = [...extra, ...emptyScope, ...passedOptions];
-      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets], {
+      const result = spawnSync4(oxlint, ["-c", LINT_CONFIG_FILE, ...passed, ...targets2], {
         cwd: ctx.cwd,
         stdio: "inherit",
         env
@@ -4706,8 +4719,8 @@ ${result.stderr ?? ""}`);
     } catch {
       return void 0;
     }
-    const targets = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets.find((target) => !existsSync12(join16(cwd, target)));
+    const targets2 = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
+    return targets2.find((target) => !existsSync12(join16(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -4737,6 +4750,439 @@ function registerLint() {
   setDefaultRunner("lint", "oxlint");
 }
 
+// src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join19 } from "node:path";
+
+// src/roles/static-analysis/configs/resolve.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join17 } from "node:path";
+import { pathToFileURL } from "node:url";
+var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
+async function loadStaticConfig(cwd) {
+  const path = join17(cwd, STATIC_CONFIG_FILE);
+  if (!existsSync13(path)) {
+    return { config: defineStaticAnalysis(), from: null, unreadable: null };
+  }
+  try {
+    const loaded = await import(pathToFileURL(path).href);
+    return { config: adopt(loaded.default), from: STATIC_CONFIG_FILE, unreadable: null };
+  } catch (error) {
+    return {
+      config: defineStaticAnalysis(),
+      from: null,
+      unreadable: `${STATIC_CONFIG_FILE}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+function adopt(exported) {
+  if (exported === null || typeof exported !== "object") return defineStaticAnalysis();
+  if (Array.isArray(exported.moved)) {
+    return exported;
+  }
+  return defineStaticAnalysis(exported);
+}
+
+// src/roles/static-analysis/help/metrics.ts
+var metricsHelp = {
+  duplicatedLinesPercent: {
+    label: "Duplicated lines",
+    what: "The share of lines jscpd found in at least one clone, over the lines it scanned.",
+    read: "Higher is worse. It is computed per module, so two modules compare directly; the repository-wide figure is not the average of theirs, because modules differ in size.",
+    caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs.",
+    source: "jscpd, over the token stream rather than the text: for JavaScript and TypeScript the tokens come from the oxc parser, which emits neither whitespace nor comments, so reindenting a block is not a clone and `--mode` measured identical on all three values. Rule of Three: Fowler, Refactoring, crediting Don Roberts."
+  },
+  clones: {
+    label: "Clones",
+    what: "How many duplicated fragments jscpd reported, each entry linking two places that match.",
+    read: "A count, so it grows with the size of the module. Read it next to the duplicated-line share rather than on its own, and treat it as the number of places to go and look at.",
+    caveat: "Not a count of duplicated places, and the gap is measured, not theoretical: five identical files produce four entries, all of them naming one file in common, so n copies give n-1 entries, neither n nor the n(n-1)/2 pairs. Worse for reading occurrences, jscpd keeps only the longest match per pair of files, so when a third file shares just part of a block, that block is reported under two different fragments and its real number of occurrences cannot be recovered from the report. Size is invisible too: one clone of sixty lines and one of six both count as one.",
+    source: "jscpd report statistics. Counting behaviour measured on fixtures with jscpd 5.4.0; the shared file is not the same one across major versions, so only the count is relied on."
+  }
+};
+function helpFor(key) {
+  return metricsHelp[key];
+}
+
+// src/roles/static-analysis/report.ts
+function hasFinding(report) {
+  return report.rows.some((row) => row.over);
+}
+function renderConsole(report) {
+  const lines = [];
+  const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
+  const label = (row) => helpFor(row.metric)?.label ?? row.metric;
+  const value = (row) => `${row.value} ${row.unit}`;
+  const limit = (row) => row.threshold === null ? "no threshold" : `max ${row.threshold}${row.moved ? " (module)" : ""}`;
+  const labelWidth = width(label);
+  const valueWidth = width(value);
+  lines.push(`sentinel static-analysis: ${report.module}`);
+  for (const row of report.rows) {
+    lines.push(
+      `  ${row.over ? "!" : " "} ${label(row).padEnd(labelWidth)}  ${value(row).padStart(valueWidth)}  ${limit(row)}`
+    );
+  }
+  if (report.byLanguage && Object.keys(report.byLanguage).length > 0) {
+    lines.push("", "  per language, where a clone was found");
+    for (const [language, stats] of Object.entries(report.byLanguage)) {
+      lines.push(
+        `    ${language.padEnd(12)} ${stats.percentage.toFixed(2)}% (${stats.duplicatedLines} lines over ${stats.files} files)`
+      );
+    }
+    lines.push("    a language with no clone is not listed");
+  }
+  const caveats = report.rows.map((row) => ({ row, help: helpFor(row.metric) })).filter(
+    (entry) => Boolean(entry.help)
+  );
+  if (caveats.length > 0) {
+    lines.push("", "  what these numbers do not say");
+    for (const { row, help } of caveats) {
+      lines.push(`    ${help.label}: ${help.caveat}`, `      source: ${help.source}`);
+      void row;
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function renderJson(report) {
+  const rows = report.rows.map((row) => ({ ...row, help: helpFor(row.metric) ?? null }));
+  return `${JSON.stringify({ ...report, rows }, null, 2)}
+`;
+}
+function escape(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderHtml(report) {
+  const rows = report.rows.map((row) => {
+    const help = helpFor(row.metric);
+    return `      <tr class="${row.over ? "over" : ""}">
+        <th scope="row">${escape(help?.label ?? row.metric)}</th>
+        <td class="num">${escape(String(row.value))} <span class="unit">${escape(row.unit)}</span></td>
+        <td class="num">${row.threshold === null ? '<span class="unit">none</span>' : escape(String(row.threshold))}${row.moved ? ' <span class="moved">module</span>' : ""}</td>
+        <td class="caveat">${escape(help?.caveat ?? "")}</td>
+      </tr>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Static analysis: ${escape(report.module)}</title>
+<style>
+  :root { color-scheme: light dark; --ink: #1a1a1a; --bg: #fdfdfc; --rule: #e2e0da; --warn: #9a3412; --dim: #6b6b6b; }
+  @media (prefers-color-scheme: dark) {
+    :root { --ink: #e8e6e1; --bg: #1b1b1a; --rule: #35332e; --warn: #fb923c; --dim: #9b9892; }
+  }
+  body { margin: 0; padding: 2rem 1rem; background: var(--bg); color: var(--ink);
+         font: 15px/1.55 ui-sans-serif, system-ui, sans-serif; }
+  main { max-width: 60rem; margin: 0 auto; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.25rem; }
+  p.sub { color: var(--dim); margin: 0 0 1.5rem; }
+  table { width: 100%; border-collapse: collapse; }
+  th, td { text-align: left; padding: 0.6rem 0.75rem; border-bottom: 1px solid var(--rule);
+           vertical-align: top; }
+  thead th { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--dim); }
+  td.num { font-variant-numeric: tabular-nums; white-space: nowrap; }
+  .unit, .moved { color: var(--dim); font-size: 0.85em; }
+  .caveat { color: var(--dim); font-size: 0.9em; }
+  tr.over th, tr.over td.num { color: var(--warn); font-weight: 600; }
+</style>
+</head>
+<body>
+<main>
+  <h1>Static analysis: ${escape(report.module)}</h1>
+  <p class="sub">Passes: ${escape(report.passes.join(", "))}</p>
+  <table>
+    <thead>
+      <tr><th scope="col">Metric</th><th scope="col">Value</th><th scope="col">Threshold</th><th scope="col">What it does not say</th></tr>
+    </thead>
+    <tbody>
+${rows}
+    </tbody>
+  </table>
+</main>
+</body>
+</html>
+`;
+}
+
+// src/roles/static-analysis/adapters/jscpd/config.ts
+import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join18 } from "node:path";
+function fileSettings(config) {
+  return {
+    // The detection window. Stated rather than defaulted, because it decides what is invisible.
+    minTokens: config.duplication.minTokens,
+    minLines: config.duplication.minLines,
+    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
+    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
+    format: config.languages,
+    ignore: config.ignore,
+    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
+    failOnEmpty: true,
+    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
+    // explicit that the top-level one is about clones and is never carried into a dead-code run.
+    deadCode: {
+      entry: config.entry,
+      minConfidence: config.deadCode.minConfidence,
+      categories: config.deadCode.categories
+    },
+    // The escape hatch, last so it wins, and empty unless a module asked for it.
+    ...config.tools.jscpd
+  };
+}
+function duplicationRun(config, reportDir, paths) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config), null, 2)}
+`, "utf8");
+  const args = [
+    "--config",
+    configPath,
+    // Always json, and only json, whatever shape the caller asked for. The three shapes are
+    // rendered by this role from the figures, not by the tool: one report lives under
+    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
+    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
+    // output DIRECTORY, not our `--output` shape.
+    "--reporters",
+    "json",
+    "--output",
+    reportDir,
+    "--no-tips",
+    ...paths
+  ];
+  return { args, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+}
+
+// src/roles/static-analysis/adapters/jscpd/resolve.ts
+function resolveJscpd(cwd) {
+  return resolveBin(cwd, "jscpd") ?? binFromOwnInstall("jscpd", "jscpd");
+}
+
+// src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css", ".scss"];
+var SCRIPT = "static-analysis";
+var SHAPES = ["console", "json", "html"];
+var scripts = () => ({
+  [SCRIPT]: `sentinel --run --${SCRIPT}`,
+  [`${SCRIPT}:json`]: `sentinel --run --${SCRIPT} --output json`,
+  [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
+});
+var targets = () => ({
+  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] },
+  [`${SCRIPT}:json`]: { cache: false },
+  [`${SCRIPT}:html`]: { cache: false }
+});
+var CONFIG_STUB = `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+
+export default defineStaticAnalysis({
+  root: import.meta.dirname,
+
+  // Files that RUN although nothing imports them: they are where reachability starts. Added to
+  // the patterns sentinel ships, never replacing them.
+  entry: [],
+
+  // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
+  // relative to this module, because one run measures one module.
+  journeys: {},
+})
+`;
+var JscpdAdapter = class extends BaseAdapter {
+  target = "static-analysis";
+  runner = "jscpd";
+  /** Every preset: duplication, dead code and complexity are not stack-specific. */
+  appliesTo(_preset) {
+    return true;
+  }
+  plan(context) {
+    if (!hasSourceFiles(context.cwd, EXTENSIONS)) {
+      return {
+        operations: [],
+        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS.join(", ")}).`
+      };
+    }
+    return {
+      operations: [
+        // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
+        // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
+        ...existsSync14(join19(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: CONFIG_STUB }],
+        manifestOperation(context.cwd, scripts()),
+        ...nxTargetOperations({ cwd: context.cwd, targets: targets() }),
+        // The reports are build output. Without this every adopting module grows an untracked
+        // directory nobody can explain, which is exactly what the format role's `lint/` did.
+        { kind: "ensure-lines", path: ".gitignore", lines: [`/${REPORT_DIR}/`] }
+      ],
+      notes: [
+        `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
+      ]
+    };
+  }
+  async run(ctx) {
+    const shape = ctx.output ?? "console";
+    if (!SHAPES.includes(shape)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): unknown --output "${ctx.output}" (known: ${SHAPES.join(", ")}).
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    if (!hasSourceFiles(ctx.cwd, EXTENSIONS)) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS.join(", ")}).
+`
+      );
+      return { ok: true, code: 0 };
+    }
+    const { config, unreadable } = await loadStaticConfig(ctx.cwd);
+    if (unreadable) {
+      process.stderr.write(`sentinel static-analysis(jscpd): ${unreadable}
+`);
+      return { ok: false, code: 1 };
+    }
+    const kinds = config.duplication.kinds;
+    if (kinds.length !== 1 || kinds[0] !== "exact") {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): duplication.kinds is ${JSON.stringify(kinds)}, and only ["exact"] is supported. Any other kind overlaps the first, and the duplicated-line share then counts the same lines twice.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const jscpd = resolveJscpd(ctx.cwd);
+    if (!jscpd) {
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): could not find the jscpd binary (looked in ${binSearchPath(ctx.cwd)}). Run \`pnpm install\` in the module.
+`
+      );
+      return { ok: false, code: 1 };
+    }
+    const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
+    const reportDir = join19(ctx.cwd, REPORT_DIR);
+    mkdirSync(reportDir, { recursive: true });
+    const { args, dispose } = duplicationRun(config, reportDir, paths.length > 0 ? paths : ["."]);
+    try {
+      const result = spawnSync5(jscpd, args, { cwd: ctx.cwd, encoding: "utf8" });
+      if (result.error) {
+        process.stderr.write(
+          `sentinel static-analysis(jscpd): could not run jscpd (${result.error.message})
+`
+        );
+        return { ok: false, code: 1 };
+      }
+      if (result.status !== 0) {
+        process.stderr.write(
+          `sentinel static-analysis(jscpd): jscpd exited ${result.status}
+${result.stderr ?? ""}`
+        );
+        return { ok: false, code: result.status ?? 1 };
+      }
+      const report = buildReport(ctx, reportDir, config);
+      if (!report) {
+        process.stderr.write(
+          `sentinel static-analysis(jscpd): jscpd wrote no report in ${REPORT_DIR}
+`
+        );
+        return { ok: false, code: 1 };
+      }
+      emit(report, shape, reportDir);
+      return { ok: true, code: 0, metrics: metricsOf(report) };
+    } finally {
+      dispose();
+    }
+  }
+  /**
+   * Adoption, from the COMMITTED manifest only, so a workspace-wide sweep stays cheap and needs no
+   * install. The script is the marker, which is also how the migration page follows this role.
+   */
+  async status(ctx) {
+    const declared = moduleScripts(ctx.cwd);
+    const missing = Object.keys(scripts()).filter((name) => !(name in declared));
+    const adopted = missing.length < Object.keys(scripts()).length;
+    const hasConfig = existsSync14(join19(ctx.cwd, STATIC_CONFIG_FILE));
+    return {
+      adopted,
+      preset: adopted ? ctx.preset : null,
+      conformant: adopted && missing.length === 0 && hasConfig,
+      drift: [
+        ...missing.map((name) => `missing script: ${name}`),
+        ...adopted && !hasConfig ? [`missing ${STATIC_CONFIG_FILE}`] : []
+      ]
+    };
+  }
+};
+function buildReport(ctx, reportDir, config) {
+  const path = join19(reportDir, "jscpd-report.json");
+  if (!existsSync14(path)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync14(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const total = parsed.statistics?.total;
+  if (!total) return void 0;
+  const limit = config.thresholds.duplicatedLinesPercent;
+  const moved = config.moved.includes("thresholds.duplicatedLinesPercent");
+  const percent = Number((total.percentage ?? 0).toFixed(2));
+  const rows = [
+    {
+      metric: "duplicatedLinesPercent",
+      value: percent,
+      unit: "%",
+      threshold: limit,
+      over: percent > limit,
+      moved
+    },
+    {
+      metric: "clones",
+      value: total.clones ?? 0,
+      unit: "entries",
+      threshold: null,
+      over: false,
+      moved: false
+    }
+  ];
+  const formats = parsed.statistics?.formats ?? {};
+  const byLanguage = Object.fromEntries(
+    Object.entries(formats).map(([language, stats]) => [
+      language,
+      {
+        files: stats.sources ?? 0,
+        duplicatedLines: stats.duplicatedLines ?? 0,
+        percentage: Number((stats.percentage ?? 0).toFixed(2))
+      }
+    ])
+  );
+  return { module: ctx.module, passes: ["duplication"], rows, byLanguage };
+}
+function emit(report, shape, reportDir) {
+  if (shape === "console") {
+    process.stdout.write(renderConsole(report));
+    return;
+  }
+  const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
+  const body = shape === "json" ? renderJson(report) : renderHtml(report);
+  const path = join19(reportDir, name);
+  writeFileSync4(path, body, "utf8");
+  process.stdout.write(`${renderConsole(report)}
+  written: ${REPORT_DIR}/${name}
+`);
+}
+function metricsOf(report) {
+  return {
+    passes: report.passes,
+    finding: hasFinding(report),
+    ...Object.fromEntries(report.rows.map((row) => [row.metric, row.value])),
+    byLanguage: report.byLanguage
+  };
+}
+
+// src/roles/static-analysis/register.ts
+function registerStaticAnalysis() {
+  register(new JscpdAdapter());
+  setDefaultRunner("static-analysis", "jscpd");
+}
+
 // src/roles/test/register.ts
 function registerTest() {
   register(new VitestAdapter());
@@ -4744,10 +5190,10 @@ function registerTest() {
 }
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -4900,7 +5346,11 @@ function localOnlyCompilerOptions(compilerOptions, preset) {
 
 // src/roles/typescript/resolve-tsconfig-target.ts
 var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
-var TSCONFIG_MARKERS = ["tsconfig.base.json", "@hublo/sentinel/tsconfig/"];
+var TSCONFIG_MARKERS = [
+  "tsconfig.base.json",
+  "@hublo/sentinel/typescript/",
+  "@hublo/sentinel/tsconfig/"
+];
 var TSCONFIG_FALLBACK = "tsconfig.json";
 function resolveTsconfigTarget(moduleDir) {
   return resolveConfigTarget(moduleDir, {
@@ -4928,8 +5378,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -5022,7 +5472,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync14(join17(context.cwd, target.path), "utf8"),
+    readFileSync15(join20(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -5160,7 +5610,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync15(join18(cwd, target.path), "utf8"),
+        readFileSync16(join21(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -5173,7 +5623,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join18(cwd, "noop.js")).resolve(preset);
+      createRequire(join21(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -5214,7 +5664,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     if (options.length > 0) return this.runWithOptions(ctx, tsc, config);
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, stdio: "inherit" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5249,7 +5699,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let worst = 0;
     for (const project of this.referencedProjects(ctx.cwd, config)) {
       const args = ["-p", project, "--noEmit", "--composite", "false", ...ctx.toolArgs ?? []];
-      const result = spawnSync5(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
+      const result = spawnSync6(tsc, args, { cwd: ctx.cwd, stdio: "inherit" });
       if (result.error) {
         process.stderr.write(
           `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5269,7 +5719,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync15(join18(cwd, config), "utf8"),
+        readFileSync16(join21(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -5285,7 +5735,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync13(join18(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync15(join21(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -5338,7 +5788,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
       return { ok: true, code: 0, metrics: _TscAdapter.NOTHING_TO_REPORT };
     }
     const tsc = resolveBin(ctx.cwd, "tsc") ?? "tsc";
-    const result = spawnSync5(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
+    const result = spawnSync6(tsc, ["-b", config], { cwd: ctx.cwd, encoding: "utf8" });
     if (result.error) {
       process.stderr.write(
         `sentinel typescript(tsc): could not run tsc (${result.error.message}); is TypeScript installed in the module?
@@ -5381,7 +5831,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown = spawnSync5(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
     if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
@@ -5409,6 +5859,7 @@ function registerAdapters() {
   registerFormat();
   registerBuild();
   registerTest();
+  registerStaticAnalysis();
 }
 
 // src/core/detect-framework.ts
@@ -5490,16 +5941,9 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync17, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve3, sep } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
-
-// src/shared/deep-merge.ts
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/core/apply-plan.ts
 function resolveWithinRoot(cwd, relativePath) {
   const root = resolve3(cwd);
   const absolutePath = resolve3(root, relativePath);
@@ -5509,7 +5953,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync14(absolutePath) ? readFileSync16(absolutePath, "utf8") : void 0;
+  return existsSync16(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -5611,14 +6055,14 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync3(tempPath, contents);
+  writeFileSync5(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
   const changed = preparePlan(cwd, plan3).filter((file) => file.before !== file.after);
   for (const file of changed) {
     if (file.deleted) {
-      rmSync3(file.absolutePath, { force: true });
+      rmSync4(file.absolutePath, { force: true });
       continue;
     }
     writeFileAtomic(file.absolutePath, file.after);
@@ -5627,8 +6071,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync17 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "node:fs";
+import { join as join22 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -5662,12 +6106,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join19(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join22(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync17(join19(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync18(join22(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -5676,11 +6120,11 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path = join19(cwd, "package.json");
-  if (!existsSync15(path)) return [];
+  const path = join22(cwd, "package.json");
+  if (!existsSync17(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync17(path, "utf8"),
+      readFileSync18(path, "utf8"),
       path
     );
     return [
@@ -5703,7 +6147,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync17(join19(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync18(join22(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {