@hublo/sentinel 1.5.0-alpha.13 → 1.5.0-alpha.14

package/dist/bin/sentinel.js

@@ -15,7 +15,7 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-JXI6UJ5I.js";
+} from "../chunk-5EXXX2US.js";
 import {
   resolveContext
 } from "../chunk-KLEXJFJ6.js";
@@ -26,7 +26,7 @@ import {
   readOwnVersion,
   readProjectPackageJson
 } from "../chunk-YQRDKWSH.js";
-import "../chunk-KH2DCVC6.js";
+import "../chunk-HO2C5D57.js";
 import "../chunk-O7REVMOC.js";
 import "../chunk-QXFCZON7.js";
 

package/dist/{chunk-JXI6UJ5I.js → chunk-5EXXX2US.js}

@@ -63,11 +63,15 @@ import {
 } from "./chunk-YQRDKWSH.js";
 import {
   REPORT_DIR,
+  SCRIPTS,
+  SHAPES,
+  TARGET,
   defaults,
   defineStaticAnalysis,
+  extensionsOf,
   isPlainObject,
   overridableSettings
-} from "./chunk-KH2DCVC6.js";
+} from "./chunk-HO2C5D57.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -4754,9 +4758,18 @@ function registerLint() {
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync15, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join19 } from "node:path";
 
+// src/roles/static-analysis/complexity/scan.ts
+import { readFileSync as readFileSync14 } from "node:fs";
+import { globSync } from "tinyglobby";
+
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join18 } from "node:path";
+
 // src/roles/static-analysis/configs/resolve.ts
 import { existsSync as existsSync13 } from "node:fs";
 import { join as join17 } from "node:path";
@@ -4786,6 +4799,255 @@ function adopt(exported) {
   return defineStaticAnalysis(exported);
 }
 
+// src/roles/static-analysis/adapters/jscpd/tool-config.ts
+var OWN_ARTEFACTS = [`**/${STATIC_CONFIG_FILE}`, `**/${REPORT_DIR}/**`];
+function testGlobs(config) {
+  const relative4 = config.duplication.tests;
+  return {
+    ignore: relative4.map((glob) => `**/${glob}`),
+    // A one-item brace group is avoided rather than trusted: nothing guarantees `{x}` expands.
+    pattern: relative4.length === 1 ? `**/${relative4[0]}` : `**/{${relative4.join(",")}}`
+  };
+}
+function exclusions(config, scope = "tests") {
+  const tests = scope === "product" ? testGlobs(config).ignore : [];
+  return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
+}
+function fileSettings(config, scope) {
+  return {
+    // The detection window. Stated rather than defaulted, because it decides what is invisible.
+    minTokens: config.duplication.minTokens,
+    minLines: config.duplication.minLines,
+    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
+    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
+    format: config.languages,
+    ignore: exclusions(config, scope),
+    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
+    failOnEmpty: true,
+    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
+    // explicit that the top-level one is about clones and is never carried into a dead-code run.
+    deadCode: {
+      entry: config.entry,
+      minConfidence: config.deadCode.minConfidence,
+      categories: config.deadCode.categories
+    },
+    // The escape hatch, last so it wins, and empty unless a module asked for it.
+    ...config.tools.jscpd
+  };
+}
+function duplicationRun(config, paths, scope) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+`, "utf8");
+  const args = [
+    "--config",
+    configPath,
+    // The test pass SELECTS its files; the product pass excludes them through `ignore` above. A
+    // flag and not a config key, because `--pattern` is the only documented way in and it takes
+    // exactly one glob, braces expanded. Verified: 478 product files + 87 test files = the 565 of
+    // a blended scan on `apps/front/console`.
+    ...scope === "tests" ? ["--pattern", testGlobs(config).pattern] : [],
+    // Always json, and only json, whatever shape the caller asked for. The three shapes are
+    // rendered by this role from the figures, not by the tool: one report lives under
+    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
+    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
+    // output DIRECTORY, not our `--output` shape.
+    "--reporters",
+    "json",
+    "--output",
+    dir,
+    "--no-tips",
+    ...paths
+  ];
+  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+}
+function deadCodeRun(config, paths) {
+  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
+  const configPath = join18(dir, "jscpd.json");
+  writeFileSync3(
+    configPath,
+    `${JSON.stringify(fileSettings(config, "dead-code"), null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    args: [
+      "--config",
+      configPath,
+      "--dead-code",
+      "--reporters",
+      "json",
+      "--output",
+      dir,
+      "--no-tips",
+      ...paths
+    ],
+    rawReportDir: dir,
+    dispose: () => rmSync3(dir, { force: true, recursive: true })
+  };
+}
+var RAW_REPORT = {
+  duplication: "jscpd-report.json",
+  "dead-code": "basta-report.json"
+};
+
+// src/roles/static-analysis/complexity/cyclomatic.ts
+import { parseSync as parseSync2 } from "oxc-parser";
+var FUNCTION_NODES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression"
+]);
+var DECISION_NODES = /* @__PURE__ */ new Set([
+  "IfStatement",
+  "ForStatement",
+  "ForInStatement",
+  "ForOfStatement",
+  "WhileStatement",
+  "DoWhileStatement",
+  "CatchClause",
+  "ConditionalExpression"
+]);
+var DECISION_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", "??"]);
+var DECISION_ASSIGNMENTS = /* @__PURE__ */ new Set(["&&=", "||=", "??="]);
+function walk2(node, visit, stopAt) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk2(child, visit, stopAt);
+    return;
+  }
+  const current = node;
+  if (typeof current.type === "string") {
+    if (stopAt(current)) return;
+    visit(current);
+  }
+  for (const [field, value] of Object.entries(current)) {
+    if (field === "type" || field === "start" || field === "end") continue;
+    walk2(value, visit, stopAt);
+  }
+}
+function complexityOf(fn) {
+  let count = 1;
+  for (const parameter of Array.isArray(fn.params) ? fn.params : []) {
+    walk2(
+      parameter,
+      (node) => {
+        if (node.type === "AssignmentPattern") count += 1;
+      },
+      (node) => FUNCTION_NODES.has(node.type ?? "")
+    );
+  }
+  const body = fn.body ?? fn;
+  let root = true;
+  walk2(
+    body,
+    (node) => {
+      if (DECISION_NODES.has(node.type ?? "")) count += 1;
+      if (node.type === "SwitchCase" && node.test !== null && node.test !== void 0) count += 1;
+      if (node.type === "LogicalExpression" && DECISION_OPERATORS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if (node.type === "AssignmentExpression" && DECISION_ASSIGNMENTS.has(String(node.operator ?? ""))) {
+        count += 1;
+      }
+      if ((node.type === "MemberExpression" || node.type === "CallExpression") && node.optional === true) {
+        count += 1;
+      }
+    },
+    (node) => {
+      if (root) {
+        root = false;
+        return false;
+      }
+      return FUNCTION_NODES.has(node.type ?? "");
+    }
+  );
+  return count;
+}
+function nameOf(fn, parent) {
+  const own = fn.id?.name;
+  if (own) return own;
+  const key = parent?.id?.name ?? parent?.key?.name;
+  if (key) return key;
+  return "(anonymous)";
+}
+function lineAt(source, offset) {
+  if (offset === void 0) return 1;
+  let line = 1;
+  for (let index = 0; index < offset && index < source.length; index += 1) {
+    if (source[index] === "\n") line += 1;
+  }
+  return line;
+}
+function complexityOfFile(path, source) {
+  const parsed = parseSync2(path, source);
+  if (parsed.errors.length > 0) return [];
+  const found = [];
+  const parents = /* @__PURE__ */ new Map();
+  walk2(
+    parsed.program,
+    (node) => {
+      for (const value of Object.values(node)) {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          parents.set(value, node);
+        }
+      }
+      if (!FUNCTION_NODES.has(node.type ?? "")) return;
+      found.push({
+        name: nameOf(node, parents.get(node)),
+        line: lineAt(source, node.start),
+        complexity: complexityOf(node)
+      });
+    },
+    () => false
+  );
+  return found;
+}
+
+// src/roles/static-analysis/complexity/scan.ts
+var RISK_BANDS = [
+  { metric: "complexityModerate", from: 11, to: 20, label: "moderate risk" },
+  { metric: "complexityHigh", from: 21, to: 50, label: "high risk" },
+  { metric: "complexityUntestable", from: 51, to: Infinity, label: "untestable" }
+];
+var MCCABE_REFERENCE = RISK_BANDS[0].from;
+function productFiles(cwd, config) {
+  const extensions = extensionsOf(config.languages).map((extension) => extension.slice(1)).join(",");
+  return globSync([`**/*.{${extensions}}`], {
+    cwd,
+    ignore: exclusions(config, "product"),
+    dot: false
+  });
+}
+function scanComplexity(cwd, config) {
+  const files = productFiles(cwd, config);
+  const all2 = [];
+  for (const path of files) {
+    let source;
+    try {
+      source = readFileSync14(`${cwd}/${path}`, "utf8");
+    } catch {
+      continue;
+    }
+    for (const fn of complexityOfFile(path, source)) all2.push({ ...fn, path });
+  }
+  all2.sort((left, right) => right.complexity - left.complexity);
+  const bands = {};
+  for (const band of RISK_BANDS) {
+    bands[band.metric] = all2.filter(
+      (fn) => fn.complexity >= band.from && fn.complexity <= band.to
+    ).length;
+  }
+  return {
+    files: files.length,
+    functions: all2.length,
+    max: all2[0]?.complexity ?? 0,
+    complex: all2.filter((fn) => fn.complexity >= MCCABE_REFERENCE),
+    bands
+  };
+}
+
 // src/roles/static-analysis/help/metrics.ts
 var metricsHelp = {
   duplicatedLinesPercent: {
@@ -4795,6 +5057,34 @@ var metricsHelp = {
     caveat: "A clone is not automatically a defect. Two screens that genuinely do the same thing are supposed to look alike, and extracting them can couple two features that have no reason to change together. The usual reading is the Rule of Three: a second occurrence is tolerable, a third is the signal to refactor. This share cannot apply that rule for you, because it counts lines, not how many times one fragment occurs. The denominator is also narrower than the module: a file shorter than the detection window cannot contain a clone, so the tool leaves it out of both counts, which on one front app is 31 files of 596, or 5%.",
     source: "jscpd, over the token stream rather than the text: for JavaScript and TypeScript the tokens come from the oxc parser, which emits neither whitespace nor comments, so reindenting a block is not a clone and `--mode` measured identical on all three values. Rule of Three: Fowler, Refactoring, crediting Don Roberts."
   },
+  complexityMax: {
+    label: "Complexity, worst function",
+    what: "McCabe's number for the single hardest function of the module's product code.",
+    read: "One number for the module, and the only one of the pair that names a place to go: the function itself is in the list below. Read it against the two published references, 10 and 30, rather than against another module, because a module of 200 functions and one of 2 000 are not comparable on a maximum.",
+    caveat: "It says nothing about how MANY functions are hard, which is what the count beside it is for, and nothing about whether the hardest one is wrong: a parser or a state machine legitimately branches. It is also not what the linter refuses. The `nest` lint preset already fails a build at 30 per function, and the five other presets carry no complexity rule at all, so this figure is the only visibility a React or a tooling module has today.",
+    source: "Computed over the oxc tree by this role, because no tool we have gives it per function: jscpd sums it per FILE, verified on fixtures where ten trivial functions score the same as one function of 10, and escomplex fails to parse 32.6% of one nest service. The counting rule is the common one, ESLint's set of decision points, held against values computed by hand in `tests/static-analysis-cyclomatic.test.ts`."
+  },
+  complexityModerate: {
+    label: "Complexity 11-20, moderate risk",
+    what: "How many functions sit in McCabe's second band, out of how many were measured.",
+    read: "The ordinary band to find something in. A function here is readable and worth a second look when it changes often, not a defect.",
+    caveat: 'A band is a statement about testing effort, not about correctness: McCabe proposed them as the number of independent paths a test suite would have to cover. A parser or a state machine legitimately sits here. \u26D4 Nothing in this role fails on a band, and the line this repository actually refuses is elsewhere: `complexity: ["error", 30]` per function in the `nest` lint preset, which sits inside the NEXT band, and the five other presets carry no complexity rule at all.',
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's `complexity` rule function by function on this package: 137 functions, 137 identical values, no disagreement either way."
+  },
+  complexityHigh: {
+    label: "Complexity 21-50, high risk",
+    what: "How many functions sit in McCabe's third band.",
+    read: "The band worth acting on, and the one the `nest` lint preset cuts through at 30. A function here needs either a split or a very good reason, and the list below names each one with its line.",
+    caveat: "Same reserve as the band below: it measures paths, not defects. What makes this band different is that it brackets the only complexity line this repository enforces, so a function at 25 is high risk by the published scale and perfectly acceptable to the build, while one at 35 fails a nest build and passes everywhere else.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's `complexity` rule function by function on this package: 137 functions, 137 identical values, no disagreement either way."
+  },
+  complexityUntestable: {
+    label: "Complexity over 50, untestable",
+    what: "How many functions sit in McCabe's top band, the one he called untestable.",
+    read: "Read it as a count of places no test suite can cover exhaustively, and expect it to be zero. Any value here is the first thing to look at in the module.",
+    caveat: "The word is McCabe's and it is about path coverage, not about whether the function works: a 60-path function can be correct and well tested in practice. What it does say is that nobody can enumerate its behaviour, which is what makes a change to it expensive.",
+    source: "McCabe, \"A Complexity Measure\", IEEE TSE SE-2(4), 1976, for the count and for the bands, as published by SonarSource and summarised by Sourcegraph. The counting rule is this role's own, over the oxc tree, and it was held against oxlint's `complexity` rule function by function on this package: 137 functions, 137 identical values, no disagreement either way."
+  },
   entryPoints: {
     label: "Entry points",
     what: "How many files the reachability walk started from, against how many it scanned.",
@@ -4813,8 +5103,8 @@ var metricsHelp = {
     label: "Unreachable files",
     what: "Files no entry point reaches, each with a confidence the tool assigns.",
     read: "The most actionable of the four, and the one to start from: a whole file nothing reaches is a decision, not a cleanup. Open the ones with the highest confidence first.",
-    caveat: "Three classes hide in this count and only the first is a deletion. Genuinely unreachable product code; files reached only by tests, stories or helpers, which are alive and would break if removed; and entry points of a framework this role has not declared, which is why the front bootstrap files are in the shipped `entry` list. Measured on one nest module, 10 of 42 findings were `*.test-helper.ts` or `*.mock.ts` cited only by tests.",
-    source: "jscpd dead-code findings of category `unused-file`. The three classes were separated by hand on `apps/front/console`, `apps/nest/microservices/contract` and `apps/nest/backends-for-frontends/admin`."
+    caveat: "Three classes hide in this count and only one of them is a deletion, so read the reason the tool gives before acting: a file nothing reaches at all, a file only a spec or a story reaches, which is alive and breaks if removed, and an entry point of a framework this role has not declared. The tool labels the second itself as `used-only-by-tests`, and that is not a corner: measured over 1 231 findings on this repository, 659 of them carry it, 53.5%. A finding with no reason given is the one to open first.",
+    source: "jscpd dead-code findings of category `unused-file`, with the engine's own `reasons` and `message` carried through. The 53.5% was counted over every dead-code report produced on this repository; the third class was separated by hand on `apps/front/console`, where three of five findings were its TanStack bootstrap."
   },
   unusedExports: {
     label: "Unused exports",
@@ -4864,7 +5154,6 @@ function helpFor(key) {
 }
 
 // src/roles/static-analysis/report.ts
-var SCRIPTS = { json: "static-analysis:json", html: "static-analysis:html" };
 function secondSide(finding) {
   if (!finding.other) return "";
   const file = (at) => at.split(":")[0] ?? at;
@@ -4874,14 +5163,14 @@ function secondSide(finding) {
   return ` <span class="unit">${label}</span> <code>${escape(shownSide)}</code>`;
 }
 var HTML_GROUP_LIMIT = 50;
-function shown(row) {
+function figure(row) {
   return row.unit === "%" && typeof row.value === "number" ? row.value.toFixed(2) : String(row.value);
 }
 function renderConsole(report) {
   const lines = [];
   const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
   const label = (row) => helpFor(row.metric)?.label ?? row.metric;
-  const value = (row) => `${shown(row)} ${row.unit}`;
+  const value = (row) => `${figure(row)} ${row.unit}`;
   const labelWidth = width(label);
   const valueWidth = width(value);
   lines.push(`sentinel static-analysis: ${report.module}`);
@@ -4945,7 +5234,7 @@ function renderHtml(report) {
     const help = helpFor(row.metric);
     return `      <tr>
         <th scope="row">${escape(help?.label ?? row.metric)}</th>
-        <td class="num">${escape(shown(row))} <span class="unit">${escape(row.unit)}</span></td>
+        <td class="num">${escape(figure(row))} <span class="unit">${escape(row.unit)}</span></td>
       </tr>`;
   }).join("\n");
   const reserves = report.rows.map((row) => ({ row, help: helpFor(row.metric) })).filter((entry) => entry.help).map(
@@ -4971,15 +5260,18 @@ function renderHtml(report) {
   }
   const findings = [...groups.entries()].map(([metric, all2]) => {
     const label = helpFor(metric)?.label ?? metric;
-    const sorted = [...all2].sort((a, b) => (b.lines ?? 0) - (a.lines ?? 0));
-    const shown2 = sorted.slice(0, HTML_GROUP_LIMIT);
-    const rest = sorted.length - shown2.length;
-    const rows2 = shown2.map(
+    const weight = (finding) => finding.value ?? finding.lines ?? 0;
+    const sorted = [...all2].sort((left, right) => weight(right) - weight(left));
+    const listed = sorted.slice(0, HTML_GROUP_LIMIT);
+    const rest = sorted.length - listed.length;
+    const rows2 = listed.map(
       (finding) => `      <tr>
         <td><code>${escape(finding.path)}</code>${secondSide(finding)}</td>
         <td>${finding.name ? `<code>${escape(finding.name)}</code>` : ""}</td>
+        <td class="num">${finding.value ?? ""}</td>
         <td class="num">${finding.lines ?? ""}</td>
         <td class="num">${finding.confidence ?? ""}</td>
+        <td class="read">${finding.reason ? `<span class="reason">${escape(finding.reason)}</span>` : ""}</td>
       </tr>`
     ).join("\n");
     return `
@@ -4987,7 +5279,7 @@ function renderHtml(report) {
   <section>
     <table class="places">
       <thead>
-        <tr><th scope="col">File</th><th scope="col">Name</th><th scope="col">Lines</th><th scope="col">Confidence</th></tr>
+        <tr><th scope="col">File</th><th scope="col">Name</th><th scope="col">Value</th><th scope="col">Lines</th><th scope="col">Confidence</th><th scope="col">Why the tool is unsure</th></tr>
       </thead>
       <tbody>
 ${rows2}
@@ -5073,6 +5365,11 @@ ${rest > 0 ? `    <p class="sub">The ${HTML_GROUP_LIMIT} longest are listed; ${r
   tbody th { color: var(--ink); }
   code { font: 0.86em ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--ink-soft); }
   .unit { color: var(--label); font-size: 0.82em; font-weight: 400; }
+  .reason {
+    font: 0.74rem ui-monospace, SFMono-Regular, Menlo, monospace;
+    background: var(--brand-bg); color: var(--brand);
+    padding: 0.1rem 0.4rem; border-radius: 4px; white-space: nowrap;
+  }
   .moved {
     color: var(--moved); font-size: 0.78rem; font-weight: 500;
     white-space: nowrap;
@@ -5167,118 +5464,20 @@ ${findings}
 `;
 }
 
-// src/roles/static-analysis/adapters/jscpd/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join18 } from "node:path";
-var OWN_ARTEFACTS = [`**/${STATIC_CONFIG_FILE}`, `**/${REPORT_DIR}/**`];
-function testGlobs(config) {
-  const relative4 = config.duplication.tests;
-  return {
-    ignore: relative4.map((glob) => `**/${glob}`),
-    // A one-item brace group is avoided rather than trusted: nothing guarantees `{x}` expands.
-    pattern: relative4.length === 1 ? `**/${relative4[0]}` : `**/{${relative4.join(",")}}`
-  };
-}
-function exclusions(config, scope = "tests") {
-  const tests = scope === "product" ? testGlobs(config).ignore : [];
-  return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
-}
-function fileSettings(config, scope) {
-  return {
-    // The detection window. Stated rather than defaulted, because it decides what is invisible.
-    minTokens: config.duplication.minTokens,
-    minLines: config.duplication.minLines,
-    // `format` is jscpd's name for what we call `languages`. Naming `typescript` alone would
-    // leave out `.tsx`, which is a separate language to it: 300 files of 523 on front/console.
-    format: config.languages,
-    ignore: exclusions(config, scope),
-    // A scan that analyses nothing otherwise exits 0 with only a warning, which reads as a pass.
-    failOnEmpty: true,
-    // The dead-code engine keeps its own section, and its own `minLines`: jscpd's documentation is
-    // explicit that the top-level one is about clones and is never carried into a dead-code run.
-    deadCode: {
-      entry: config.entry,
-      minConfidence: config.deadCode.minConfidence,
-      categories: config.deadCode.categories
-    },
-    // The escape hatch, last so it wins, and empty unless a module asked for it.
-    ...config.tools.jscpd
-  };
-}
-function duplicationRun(config, paths, scope) {
-  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
-  const configPath = join18(dir, "jscpd.json");
-  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
-`, "utf8");
-  const args = [
-    "--config",
-    configPath,
-    // The test pass SELECTS its files; the product pass excludes them through `ignore` above. A
-    // flag and not a config key, because `--pattern` is the only documented way in and it takes
-    // exactly one glob, braces expanded. Verified: 478 product files + 87 test files = the 565 of
-    // a blended scan on `apps/front/console`.
-    ...scope === "tests" ? ["--pattern", testGlobs(config).pattern] : [],
-    // Always json, and only json, whatever shape the caller asked for. The three shapes are
-    // rendered by this role from the figures, not by the tool: one report lives under
-    // `static-analysis`, assembled from several passes, so a per-pass console table from the tool
-    // would be a fourth voice saying the same numbers differently. `--output` below is jscpd's
-    // output DIRECTORY, not our `--output` shape.
-    "--reporters",
-    "json",
-    "--output",
-    dir,
-    "--no-tips",
-    ...paths
-  ];
-  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
-}
-function deadCodeRun(config, paths) {
-  const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
-  const configPath = join18(dir, "jscpd.json");
-  writeFileSync3(
-    configPath,
-    `${JSON.stringify(fileSettings(config, "dead-code"), null, 2)}
-`,
-    "utf8"
-  );
-  return {
-    args: [
-      "--config",
-      configPath,
-      "--dead-code",
-      "--reporters",
-      "json",
-      "--output",
-      dir,
-      "--no-tips",
-      ...paths
-    ],
-    rawReportDir: dir,
-    dispose: () => rmSync3(dir, { force: true, recursive: true })
-  };
-}
-var RAW_REPORT = {
-  duplication: "jscpd-report.json",
-  "dead-code": "basta-report.json"
-};
-
-// src/roles/static-analysis/adapters/jscpd/resolve.ts
+// src/roles/static-analysis/adapters/jscpd/resolve-binary.ts
 function resolveJscpd(cwd) {
   return resolveBin(cwd, "jscpd") ?? binFromOwnInstall("jscpd", "jscpd");
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css", ".scss"];
-var SCRIPT = "static-analysis";
-var SHAPES = ["console", "json", "html"];
+var EXTENSIONS = extensionsOf(defaults.languages);
 var scripts = () => ({
-  [SCRIPT]: `sentinel --run --${SCRIPT}`,
-  [`${SCRIPT}:json`]: `sentinel --run --${SCRIPT} --output json`,
-  [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
+  [SCRIPTS.console]: `sentinel --run --${TARGET}`,
+  [SCRIPTS.json]: `sentinel --run --${TARGET} --output json`,
+  [SCRIPTS.html]: `sentinel --run --${TARGET} --output html`
 });
 var targets = () => ({
-  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
+  [TARGET]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
 });
 function configStub() {
   const rows = overridableSettings();
@@ -5310,7 +5509,7 @@ ${movable.join("\n")}
   // A list shown as a count is not copyable, and replacing one means writing back what you keep,
   // so read the values in full with:
   //
-  //   pnpm exec sentinel --inspect --${SCRIPT} --json
+  //   pnpm exec sentinel --inspect --${TARGET} --json
   //
 ${refused.join("\n")}
   //
@@ -5327,7 +5526,7 @@ function configValue(config, path) {
   );
 }
 var JscpdAdapter = class extends BaseAdapter {
-  target = "static-analysis";
+  target = TARGET;
   runner = "jscpd";
   /** Every preset: duplication, dead code and complexity are not stack-specific. */
   appliesTo(_preset) {
@@ -5352,7 +5551,7 @@ var JscpdAdapter = class extends BaseAdapter {
         // repeats the same line in every adopting module.
       ],
       notes: [
-        `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
+        `added the three \`${TARGET}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
       ]
     };
   }
@@ -5404,7 +5603,7 @@ var JscpdAdapter = class extends BaseAdapter {
     }
     const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
     const scanned = paths.length > 0 ? paths : ["."];
-    const product = runPass(jscpd, config, scanned, "product", ctx.cwd);
+    const product = runDuplication(jscpd, config, scanned, "product", ctx.cwd);
     if (product.kind === "failed") return { ok: false, code: product.code };
     if (product.kind === "empty") {
       process.stderr.write(
@@ -5413,7 +5612,7 @@ var JscpdAdapter = class extends BaseAdapter {
       );
       return { ok: true, code: 0 };
     }
-    const tests = runPass(jscpd, config, scanned, "tests", ctx.cwd);
+    const tests = runDuplication(jscpd, config, scanned, "tests", ctx.cwd);
     if (tests.kind === "failed") return { ok: false, code: tests.code };
     const dead = runDeadCode(jscpd, config, scanned, ctx.cwd);
     if (dead.kind === "failed") return { ok: false, code: dead.code };
@@ -5423,7 +5622,8 @@ var JscpdAdapter = class extends BaseAdapter {
 `
       );
     }
-    const report = assemble(ctx, config, product, tests, dead);
+    const complexity = scanComplexity(ctx.cwd, config);
+    const report = assembleReport(ctx, config, product, tests, dead, complexity);
     if (emitting) emit(report, shape, ctx.cwd);
     return { ok: true, code: 0, metrics: metricsOf(report) };
   }
@@ -5510,7 +5710,7 @@ var JscpdAdapter = class extends BaseAdapter {
 function analysedNothing(stderr) {
   return typeof stderr === "string" && stderr.includes("--fail-on-empty");
 }
-function duplicationSettings(config) {
+function measuredWith(config) {
   const moved = (key) => config.moved.some((path) => path === key || path.startsWith(`${key}.`));
   const row = (key, value) => ({ key, value, moved: moved(key) });
   return [
@@ -5527,28 +5727,42 @@ function duplicationSettings(config) {
     // two modules' unreachable share needs the confidence floor as much as the detection window.
     row("deadCode.minConfidence", String(config.deadCode.minConfidence)),
     row("deadCode.categories", config.deadCode.categories.join(", ")),
-    row("entry", `${config.entry.length} patterns`)
+    row("entry", `${config.entry.length} patterns`),
+    // Not a setting a module can move: it is McCabe's own published figure, and the row says so
+    // rather than letting a reader take it for one of ours.
+    {
+      key: "complexity bands",
+      value: RISK_BANDS.map(
+        (band) => `${band.from}${band.to === Infinity ? "+" : `-${band.to}`}`
+      ).join(" / "),
+      moved: false
+    }
   ];
 }
+function runTool(jscpd, args, cwd, pass) {
+  const result = spawnSync5(jscpd, args, { cwd, encoding: "utf8" });
+  if (result.error) {
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): could not run the ${pass} pass (${result.error.message})
+`
+    );
+    return { kind: "failed", code: 1 };
+  }
+  if (result.status !== 0) {
+    if (analysedNothing(result.stderr)) return { kind: "empty" };
+    process.stderr.write(
+      `sentinel static-analysis(jscpd): the ${pass} pass exited ${result.status}
+${result.stderr ?? ""}`
+    );
+    return { kind: "failed", code: result.status ?? 1 };
+  }
+  return { kind: "ran" };
+}
 function runDeadCode(jscpd, config, paths, cwd) {
   const { args, rawReportDir, dispose } = deadCodeRun(config, paths);
   try {
-    const result = spawnSync5(jscpd, args, { cwd, encoding: "utf8" });
-    if (result.error) {
-      process.stderr.write(
-        `sentinel static-analysis(jscpd): could not run the dead-code pass (${result.error.message})
-`
-      );
-      return { kind: "failed", code: 1 };
-    }
-    if (result.status !== 0) {
-      if (analysedNothing(result.stderr)) return { kind: "empty" };
-      process.stderr.write(
-        `sentinel static-analysis(jscpd): the dead-code pass exited ${result.status}
-${result.stderr ?? ""}`
-      );
-      return { kind: "failed", code: result.status ?? 1 };
-    }
+    const ran = runTool(jscpd, args, cwd, "dead-code");
+    if (ran.kind !== "ran") return ran;
     const path = join19(rawReportDir, RAW_REPORT["dead-code"]);
     if (!existsSync14(path)) {
       process.stderr.write(
@@ -5557,54 +5771,35 @@ ${result.stderr ?? ""}`
       );
       return { kind: "failed", code: 1 };
     }
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync14(path, "utf8"));
-    } catch {
-      process.stderr.write(`sentinel static-analysis(jscpd): the dead-code report does not parse
-`);
-      return { kind: "failed", code: 1 };
-    }
-    const statistics = parsed.statistics;
+    const parsed = safeParseDeadCode(readFileSync15(path, "utf8"));
+    const statistics = parsed?.statistics;
     if (!statistics) {
-      process.stderr.write(`sentinel static-analysis(jscpd): the dead-code report has no figures
-`);
+      process.stderr.write(
+        `sentinel static-analysis(jscpd): the dead-code report has no readable figures
+`
+      );
       return { kind: "failed", code: 1 };
     }
     if ((statistics.entryPoints ?? 0) === 0) {
       return { kind: "no-entry-point", files: statistics.files ?? 0 };
     }
     const byCategory = {};
-    for (const finding of parsed.findings ?? []) {
+    for (const finding of parsed?.findings ?? []) {
       const category = finding.category ?? "unknown";
       byCategory[category] = (byCategory[category] ?? 0) + 1;
     }
-    return { kind: "figures", statistics, byCategory, findings: parsed.findings ?? [] };
+    return { kind: "figures", statistics, byCategory, findings: parsed?.findings ?? [] };
   } finally {
     dispose();
   }
 }
-function runPass(jscpd, config, paths, scope, cwd) {
+function runDuplication(jscpd, config, paths, scope, cwd) {
   const { args, rawReportDir, dispose } = duplicationRun(config, paths, scope);
   try {
-    const result = spawnSync5(jscpd, args, { cwd, encoding: "utf8" });
-    if (result.error) {
-      process.stderr.write(
-        `sentinel static-analysis(jscpd): could not run the ${scope} pass (${result.error.message})
-`
-      );
-      return { kind: "failed", code: 1 };
-    }
-    if (result.status !== 0) {
-      if (analysedNothing(result.stderr)) return { kind: "empty" };
-      process.stderr.write(
-        `sentinel static-analysis(jscpd): the ${scope} pass exited ${result.status}
-${result.stderr ?? ""}`
-      );
-      return { kind: "failed", code: result.status ?? 1 };
-    }
+    const ran = runTool(jscpd, args, cwd, scope);
+    if (ran.kind !== "ran") return ran;
     const path = join19(rawReportDir, RAW_REPORT.duplication);
-    const parsed = existsSync14(path) ? safeParse(readFileSync14(path, "utf8")) : void 0;
+    const parsed = existsSync14(path) ? safeParse(readFileSync15(path, "utf8")) : void 0;
     const total = parsed?.statistics?.total;
     if (!total) {
       process.stderr.write(
@@ -5630,7 +5825,14 @@ function safeParse(text) {
     return void 0;
   }
 }
-function placesToLook(product, tests, dead) {
+function safeParseDeadCode(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function placesToLook(product, tests, dead, complexity) {
   const at = (side) => `${side?.name ?? "(unknown)"}${side?.start === void 0 ? "" : `:${side.start}`}`;
   const clones = (outcome, metric) => outcome.kind === "figures" ? outcome.duplicates.map((entry) => ({
     metric,
@@ -5647,16 +5849,25 @@ function placesToLook(product, tests, dead) {
   return [
     ...clones(product, "clones"),
     ...clones(tests, "clonesTests"),
+    // Each one under the band it falls in, so it sits beside the caveat that applies to it.
+    ...complexity.complex.map((fn) => ({
+      metric: RISK_BANDS.find((band) => fn.complexity >= band.from && fn.complexity <= band.to)?.metric ?? "complexityMax",
+      path: `${fn.path}:${fn.line}`,
+      name: fn.name,
+      value: fn.complexity
+    })),
     ...dead.kind === "figures" ? dead.findings.map((finding) => ({
       metric: deadMetric[finding.category ?? ""] ?? "deadLinesPercent",
       path: finding.path ?? "(unknown)",
       ...finding.name ? { name: finding.name } : {},
       ...finding.lines === void 0 ? {} : { lines: finding.lines },
-      ...finding.confidence === void 0 ? {} : { confidence: finding.confidence }
+      ...finding.confidence === void 0 ? {} : { confidence: finding.confidence },
+      ...finding.reasons?.length ? { reason: finding.reasons.join(", ") } : {},
+      ...finding.message ? { message: finding.message } : {}
     })) : []
   ];
 }
-function assemble(ctx, config, product, tests, dead) {
+function assembleReport(ctx, config, product, tests, dead, complexity) {
   const share = (total) => Number((total.percentage ?? 0).toFixed(2));
   const rows = [
     { metric: "duplicatedLinesPercent", value: share(product.total), unit: "%" },
@@ -5695,6 +5906,20 @@ function assemble(ctx, config, product, tests, dead) {
       { metric: "unusedImports", value: dead.byCategory["unused-import"] ?? 0, unit: "imports" }
     );
   }
+  if (complexity.functions > 0) {
+    rows.push({ metric: "complexityMax", value: complexity.max, unit: "max per function" });
+    for (const band of RISK_BANDS) {
+      const count = complexity.bands[band.metric] ?? 0;
+      if (count === 0) continue;
+      rows.push({
+        metric: band.metric,
+        value: count,
+        unit: `of ${complexity.functions} functions`
+      });
+    }
+  } else {
+    notes.push("no function to measure, so no complexity figure is reported");
+  }
   const byLanguage = Object.fromEntries(
     Object.entries(product.formats).map(([language, stats]) => [
       language,
@@ -5710,12 +5935,13 @@ function assemble(ctx, config, product, tests, dead) {
     passes: [
       "duplication",
       ...tests.kind === "figures" ? ["duplication (tests)"] : [],
-      ...dead.kind === "figures" ? ["dead code"] : []
+      ...dead.kind === "figures" ? ["dead code"] : [],
+      ...complexity.functions > 0 ? ["complexity"] : []
     ],
     rows,
     notes,
-    settings: duplicationSettings(config),
-    findings: placesToLook(product, tests, dead),
+    settings: measuredWith(config),
+    findings: placesToLook(product, tests, dead, complexity),
     byLanguage
   };
 }
@@ -5762,7 +5988,7 @@ function registerTest() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync17 } from "node:fs";
 import { createRequire } from "node:module";
 import { join as join21 } from "node:path";
 
@@ -5949,7 +6175,7 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { join as join20 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
@@ -6043,7 +6269,7 @@ function planAdoption(context) {
     };
   }
   const existing = parseJsonc(
-    readFileSync15(join20(context.cwd, target.path), "utf8"),
+    readFileSync16(join20(context.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -6181,7 +6407,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, target.path), "utf8"),
+        readFileSync17(join21(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -6290,7 +6516,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync16(join21(cwd, config), "utf8"),
+        readFileSync17(join21(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path) => typeof path === "string" && path.length > 0);
@@ -6402,11 +6628,11 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * errors in the output mean the rule must be on.
    */
   noImplicitAnyEnabled(cwd, tsc, config, mainOutput) {
-    const shown2 = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
-    if (shown2.status === 0 && shown2.stdout) {
+    const shown = spawnSync6(tsc, ["-p", config, "--showConfig"], { cwd, encoding: "utf8" });
+    if (shown.status === 0 && shown.stdout) {
       try {
         const co = parseJsonc(
-          shown2.stdout,
+          shown.stdout,
           "tsconfig(--showConfig)"
         ).compilerOptions;
         if (co) return co.noImplicitAny ?? co.strict === true;
@@ -6512,7 +6738,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync16, readFileSync as readFileSync17, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync18, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve3, sep } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
@@ -6524,7 +6750,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync16(absolutePath) ? readFileSync17(absolutePath, "utf8") : void 0;
+  return existsSync16(absolutePath) ? readFileSync18(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -6642,7 +6868,7 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync19 } from "node:fs";
 import { join as join22 } from "node:path";
 var PATH_SIGNALS = [
   {
@@ -6682,7 +6908,7 @@ function sourceImports(cwd, pattern) {
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync18(join22(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync19(join22(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -6695,7 +6921,7 @@ function dependencyNames(cwd) {
   if (!existsSync17(path)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync18(path, "utf8"),
+      readFileSync19(path, "utf8"),
       path
     );
     return [
@@ -6718,7 +6944,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync18(join22(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync19(join22(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {

package/dist/{chunk-KH2DCVC6.js → chunk-HO2C5D57.js}

@@ -15,17 +15,17 @@ var shared_default = {
   ],
   ignore: [
     "**/node_modules/**",
-    "**/dist/**",
-    "**/build/**",
-    "**/coverage/**",
-    "**/.next/**",
+    "dist/**",
+    "build/**",
+    "coverage/**",
+    ".next/**",
     "**/__mocks__/**",
     "**/mocks/**",
     "**/_mock_/**",
     "**/**Mock**/**",
     "**/__fixtures__/**",
     "**/fixtures/**",
-    "**/public/**",
+    "public/**",
     "**/.husky/**",
     "**/.vscode/**",
     "**/.idea/**",
@@ -56,6 +56,25 @@ var shared_default = {
 
 // src/roles/static-analysis/preset-data.ts
 var REPORT_DIR = "static-analysis-report";
+var TARGET = "static-analysis";
+var SHAPES = ["console", "json", "html"];
+var SCRIPTS = {
+  console: TARGET,
+  json: `${TARGET}:json`,
+  html: `${TARGET}:html`
+};
+var EXTENSIONS_BY_LANGUAGE = {
+  javascript: [".js", ".mjs", ".cjs"],
+  typescript: [".ts"],
+  jsx: [".jsx"],
+  tsx: [".tsx"],
+  css: [".css"],
+  scss: [".scss"]
+};
+function extensionsOf(languages) {
+  return [...new Set(languages.flatMap((language) => EXTENSIONS_BY_LANGUAGE[language] ?? []))];
+}
+var MAPPED_LANGUAGES = Object.keys(EXTENSIONS_BY_LANGUAGE);
 var defaults = shared_default;
 var DECLARED = {
   entry: "added to the patterns the role ships, never replacing them",
@@ -135,8 +154,12 @@ function defineStaticAnalysis(input = {}) {
 export {
   isPlainObject,
   REPORT_DIR,
+  TARGET,
+  SHAPES,
+  SCRIPTS,
+  extensionsOf,
   defaults,
   overridableSettings,
   defineStaticAnalysis
 };
-//# sourceMappingURL=chunk-KH2DCVC6.js.map
+//# sourceMappingURL=chunk-HO2C5D57.js.map

package/dist/chunk-HO2C5D57.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/deep-merge.ts","../src/roles/static-analysis/presets/shared.json","../src/roles/static-analysis/preset-data.ts","../src/roles/static-analysis/configs/define.ts"],"sourcesContent":["/**\n * Is this a plain JSON object?\n *\n * The file is named for a `deepMerge` that no longer exists. It was written when the engine\n * merged JSON in memory and wrote the result; that approach was replaced by editing the\n * document IN PLACE with jsonc-parser, so a project's comments, key order and formatting\n * survive a `merge-json` op. Nothing has called `deepMerge` since, except its own recursion,\n * so it went.\n *\n * What remains is the predicate the in-place merge still needs, to decide whether a value is\n * a branch to walk into or a leaf to set.\n */\n\n/** True for a mergeable plain object (not null, not an array). */\nexport function isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n","{\n  \"entry\": [\n    \"**/*.integration-spec.ts\",\n    \"**/*.steps.ts\",\n    \"src/client.tsx\",\n    \"src/start.ts\",\n    \"src/router.tsx\",\n    \"src/RouterContext.tsx\"\n  ],\n  \"ignore\": [\n    \"**/node_modules/**\",\n    \"dist/**\",\n    \"build/**\",\n    \"coverage/**\",\n    \".next/**\",\n    \"**/__mocks__/**\",\n    \"**/mocks/**\",\n    \"**/_mock_/**\",\n    \"**/**Mock**/**\",\n    \"**/__fixtures__/**\",\n    \"**/fixtures/**\",\n    \"public/**\",\n    \"**/.husky/**\",\n    \"**/.vscode/**\",\n    \"**/.idea/**\",\n    \"**/.github/**\",\n    \"**/*.d.ts\",\n    \"**/*.gen.ts\",\n    \"**/*.generated.ts\"\n  ],\n  \"languages\": [\"javascript\", \"typescript\", \"jsx\", \"tsx\", \"css\", \"scss\"],\n  \"journeys\": {},\n  \"duplication\": {\n    \"minTokens\": 50,\n    \"minLines\": 5,\n    \"kinds\": [\"exact\"],\n    \"tests\": [\n      \"*.{test,spec,steps,e2e-spec,integration-spec}.{ts,tsx,js,jsx}\",\n      \"{tests,__tests__}/**/*.{ts,tsx,js,jsx}\"\n    ]\n  },\n  \"deadCode\": {\n    \"minConfidence\": 60,\n    \"categories\": [\"unused-file\", \"unused-export\", \"unused-symbol\", \"unused-import\"]\n  },\n  \"tools\": {\n    \"jscpd\": {}\n  }\n}\n","/**\n * The static analysis preset: the role's settings, as data.\n *\n * One shared layer and no per-stack preset yet, because nothing measured so far varies by stack:\n * duplication, dead code and complexity are the same questions in Nest and in React. The split\n * that is already foreseen is `LCOM4`, which is meaningless on a functional front end and real on\n * nest's 16 568 classes; when it arrives it becomes `nest.json` beside this layer, which is why\n * the values live here as JSON rather than inline in the code.\n *\n * ## Why these values are the role's and not the module's\n *\n * A team declares FACTS about its own domain (which journeys exist, which files are entry points);\n * it does not declare the values a number is judged by. Two files with the same measurement\n * getting different verdicts in two modules would make every figure incomparable, and the first\n * thing this role has to be able to say is that a number means the same thing everywhere.\n *\n * That is a default, not a wall: a module CAN move any of them (see `configs/define.ts`), and when\n * it does the report prints `(module)` next to the value. The seam exists from the first commit\n * because retrofitting one later means rewriting every module's file.\n *\n * ⛔ There are no thresholds here, and their absence is a decision rather than an omission.\n *\n * A threshold was written first, at 5% of duplicated lines, and then removed. Measured over all 228\n * nx projects: 5% flags 65 of the 201 measurable modules, a third of the repository, and moving the\n * figure until the count felt manageable is not calibration, it is fitting the instrument to the\n * answer. Calibration is legitimate when a bench is polluted and the noise is removed, or when the\n * reference frame changes; neither applies to a share of duplicated lines.\n *\n * And there is nothing to calibrate AGAINST: of the sources in `docs/static-analysis-study.md`\n * section 5, NDepend, Lattix, ArchUnit, CodeScene and Arcan, none publishes a threshold for\n * duplicated lines. One invented here would travel as if it were published.\n *\n * So the role reports the measurement. What makes a single figure readable is the distribution it\n * sits in, which only a workspace-wide run can know, so that belongs to the sweep and to the\n * migration page, not to a module's own report. The first defensible warning will not be an absolute\n * number either: a module that got WORSE than its own previous measurement is a signal that needs no\n * invented bar, which is what a baseline gives, and that was already deferred for its own reasons.\n *\n * ## Where each value comes from, so nobody has to guess later\n *\n *  - `entry` is the single most consequential line in the file. Measured on\n *    `apps/nest/microservices/network` with jscpd 5.4.0: with nothing declared the dead-code pass\n *    reports **33.4%** of lines dead (79 657 lines, 232 files, 13 entry points); with these two\n *    patterns declared it reports **1.0%** (2 462 lines, 207 entry points). The cause is a naming\n *    convention and not a bug: our integration tests are `foo.integration-spec.ts` with a HYPHEN,\n *    so they do not end in `.spec.ts` and the tool's own test-file detection never sees them, and\n *    the 115 `.steps.ts` BDD definitions are tests by no convention it knows. A module ADDS to\n *    this list rather than replacing it, precisely so no team can lose these two by declaring a\n *    third.\n *\n *    ⭐ The four `src/` files are the FRONT bootstrap, and they are the most consequential thing\n *    measured on this pass. The tool recognises around fifty frameworks and TanStack Start is not\n *    one of them, so nothing in the repository imports these files: the framework finds them by\n *    convention at build time. Measured without them declared, `apps/front/console` reports\n *    `src/client.tsx`, `src/router.tsx` and `src/start.ts` among its 5 dead files, which are its\n *    hydration entry, its router factory and its Start config. `host-admin` reports `client.tsx`\n *    too and `career` reports `router.tsx` and `RouterContext.tsx`. Three of console's five\n *    findings were its own bootstrap, and the first team to see that stops trusting the tool on\n *    the spot. They exist in 2 to 3 front apps each.\n *\n *    ⛔ `scripts/**` is deliberately NOT here, although 8 modules have one and\n *    `apps/nest/microservices/contract` reports two `scripts/e2e-*.ts` as dead. No `package.json`\n *    script invokes them, so whether they run at all is a fact only the team holds. Declaring them\n *    would hide a finding that may well be true, and that is the opposite of this role's job.\n *\n *  - `languages` is this role's name for what the tool calls `format`, a word that already names\n *    another sentinel role and means something else there. Stating it has a measured cost either\n *    way: on `apps/front/console`, naming `typescript` alone scans 300 of 523 files because `.tsx`\n *    is a SEPARATE language to the tool, naming all four scans 522 (the one left out being\n *    `styles.css`), and naming nothing scans every one of its 224 languages, json and markdown\n *    included. Stylesheets are in deliberately: measured on `libs/front` they duplicate at 9.64%\n *    against 3.50% for the code, a signal that only survives because the report is broken down per\n *    language.\n *\n *  - `duplication.minTokens` and `minLines` are the detection window, and the window decides what\n *    is INVISIBLE: a fragment shorter than it is not reported at all, so a reader comparing two\n *    runs has to know both values. They are the tool's own defaults, written out rather than\n *    inherited for that reason.\n *\n *  - `duplication.kinds` is `exact` alone, and that is a correctness constraint rather than\n *    caution. Measured: with a second kind enabled, `duplicatedLines` adds up overlapping clones.\n *    Two 9-line files reported 13 duplicated lines out of 18, 72%, because an `exact` clone of\n *    lines 1-4 and a `similar` clone of lines 1-9 containing it were both counted; the real extent\n *    is 9 of 18, 50%. The tool's own answer is to cap the display at 100%, which does not make a\n *    threshold meaningful. Opening another kind therefore requires computing the share ourselves\n *    from the UNION of the line ranges.\n *\n *  - `duplication.tests` is the glob that splits the pass in two, and the split is the finding that\n *    forced it. Measured across 8 modules of the three families, **71% of all duplicated lines are\n *    between two test files**: `libs/nest/auth` reports 35.77% and its product code is at 5.96%,\n *    `apps/front/host-admin` 7.91% against 3.59%. A single blended figure is therefore mostly a\n *    measure of spec duplication wearing the name of the module's duplication, and the number\n *    travels while that nuance does not. So the role reports the two side by side, the way it\n *    already refuses to blend languages, and neither is hidden: a module whose specs carry 93% of\n *    its clones is saying something about its specs that excluding them would erase.\n *\n *    ⚠️ The two passes PARTITION the files and therefore lose a clone that spans them: a fragment\n *    shared between a test and a product file has no partner in either scan. Measured on the same\n *    8 modules, that is 42 entries of 5117, 0.8%, 650 lines. Stated in the caveat rather than\n *    silently accepted, and it is the price of the split.\n *\n *    Two patterns and not one, because a suffix convention does not cover a DIRECTORY convention,\n *    and the directory one is not a quirk: 635 files across 26 modules live under `tests/` or\n *    `__tests__/` without a name this role's suffixes recognise, `apps/nest/microservices/recruitment`\n *    alone holding 160. They are step definitions, in-memory doubles and stubs, which is test-side\n *    code by any reading. A role default rather than 26 identical overrides.\n *\n *    ⚠️ The patterns are RELATIVE here, and the adapter prefixes and composes them, because the\n *    tool's `--pattern` takes exactly one glob. Verified on four modules that the two passes\n *    partition exactly: console 479 + 87 = 566, contract 399 + 151 = 550, backends-for-frontends/admin\n *    2062 + 773 = 2835, recruitment 936 + 621 = 1557.\n *\n *    ⚠️ And a trap that cost a wrong table before it was caught: these globs contain commas, so they\n *    survive the config FILE and are destroyed by the `-i` command-line flag, which splits on\n *    commas and cuts `{test,spec}` in half. The adapter writes a file, which is one more reason it\n *    does.\n *\n *  - `deadCode.minConfidence` is the tool's own default of 60. It scores every finding and names\n *    what lowered it (a file calling `eval`, an unrecognised decorator, a name appearing in a\n *    string literal, a file in the scan that did not parse). Measured on sentinel: 60 yields 20\n *    files, 10 exports and 22 symbols; 90 yields 18 files; 100 yields nothing.\n *\n *  - `deadCode.categories` leaves out `unused-member` deliberately: without type information\n *    `x.render()` could reach any `render` in the project, which the tool itself calls its least\n *    certain rule.\n *\n *  - `ignore` excludes generated, vendored and fixture code, which duplicates by nature and buries\n *    the clones a developer can act on. It is load-bearing rather than tidy: measured on this\n *    package, scanning the module root with no ignore list reports 18 186 files and 32 153 clones,\n *    **31 969** of them touching `node_modules`; with the list, 408 files and zero.\n *\n *  - `tools.jscpd` is passed to the tool verbatim, and it is **sentinel's own** escape hatch, not a\n *    module's: `defineStaticAnalysis` excludes it from what a module can override. Everything above\n *    uses OUR key names, translated on the way out, so that replacing the tool one day does not\n *    oblige a single module to edit its config file, and a module only ever knows the ROLE. This\n *    block is where that guarantee stops, which is why it stays on this side and why it is empty:\n *    the first thing to put in it would be an option a single preset needs, not a workaround.\n */\nimport sharedData from './presets/shared.json'\n\n/**\n * Where the json and html reports are written, relative to the module.\n *\n * Named for the role rather than left on the tool's default `report/`, and added to `.gitignore`\n * by `--init`. Both halves matter: the format role once shipped a `lint/` directory that nothing\n * ignored, and every adopting module grew an untracked directory nobody could explain.\n */\nexport const REPORT_DIR = 'static-analysis-report'\n\n/** The target this role serves, which is also the npm script a module runs and the nx target. */\nexport const TARGET = 'static-analysis'\n\n/** The output shapes `--run` can produce. `console` writes nothing to disk. */\nexport const SHAPES = ['console', 'json', 'html'] as const\n\n/**\n * The npm scripts a module gets, one per shape.\n *\n * Here rather than in the adapter because the REPORT needs them too, to tell a reader of the\n * console summary where the detail is, and two spellings of one script name is drift nobody\n * notices until a developer types the one that does not exist.\n */\nexport const SCRIPTS = {\n  console: TARGET,\n  json: `${TARGET}:json`,\n  html: `${TARGET}:html`,\n} as const\n\n/**\n * What each language the role scans is called on disk.\n *\n * ⚠️ Two lists that MUST agree, and they were maintained separately: the role declares the\n * languages it asks the tool to scan, and the adapter declared the extensions it looks for when\n * deciding whether a module has anything to measure at all. A module that narrowed `languages`\n * would still be probed for the extensions it had removed, and a language added to the preset\n * would never reach the probe. Derived from one source now, with a test that every language maps.\n */\nconst EXTENSIONS_BY_LANGUAGE: Record<string, string[]> = {\n  javascript: ['.js', '.mjs', '.cjs'],\n  typescript: ['.ts'],\n  jsx: ['.jsx'],\n  tsx: ['.tsx'],\n  css: ['.css'],\n  scss: ['.scss'],\n}\n\n/** The file extensions of the languages given, for deciding whether a module has anything to read. */\nexport function extensionsOf(languages: readonly string[]): string[] {\n  return [...new Set(languages.flatMap((language) => EXTENSIONS_BY_LANGUAGE[language] ?? []))]\n}\n\n/** Every language the mapping knows, so a test can hold it against the preset. */\nexport const MAPPED_LANGUAGES = Object.keys(EXTENSIONS_BY_LANGUAGE)\n\nexport type StaticDefaults = {\n  entry: string[]\n  ignore: string[]\n  languages: string[]\n  journeys: Record<string, string[]>\n  duplication: { minTokens: number; minLines: number; kinds: string[]; tests: string[] }\n  deadCode: { minConfidence: number; categories: string[] }\n  tools: { jscpd: Record<string, unknown> }\n}\n\n/** The role's settings. Read-only here; `defineStaticAnalysis` resolves a module against them. */\nexport const defaults: StaticDefaults = sharedData as StaticDefaults\n\n/**\n * Keys a module declares DIRECTLY rather than through `overrides`, and how each one combines.\n *\n * They are apart because the verb differs: these two are added to and merged, so a team cannot\n * lose what the role ships by declaring its own. Everything else replaces.\n */\nconst DECLARED: Record<string, string> = {\n  entry: 'added to the patterns the role ships, never replacing them',\n  journeys: \"merged by name with the role's\",\n}\n\n/**\n * ⛔ Not a module's to set, and the catalogue says so rather than leaving it absent: a key that is\n * simply missing from a list reads as an oversight, and someone will try it. Passing it is dropped\n * with a message, see `configs/define.ts`.\n */\nconst NOT_YOURS: Record<string, string> = {\n  tools: \"sentinel's own passthrough to the tool underneath; a module never names the vendor\",\n}\n\n/** A value as a reader compares it: short lists in full, long ones as a count. */\nfunction render(value: unknown): string {\n  if (Array.isArray(value)) {\n    const joined = value.join(', ')\n    return value.length <= 6 && joined.length <= 72 ? joined : `${value.length} patterns`\n  }\n  if (value && typeof value === 'object') return `${Object.keys(value).length} entries`\n  return String(value)\n}\n\n/** One documented key: its path, the role's value, and the note a reader needs. */\nexport interface OverridableSetting {\n  /** The dotted path a module writes, e.g. `duplication.minTokens`. */\n  key: string\n  /** The role's current value, rendered. */\n  value: string\n  /** How it combines, or why it is not available. */\n  note: string\n  /** Where it goes: directly in the config, inside `overrides`, or nowhere. */\n  where: 'declared' | 'overrides' | 'refused'\n}\n\n/**\n * Every setting a module can touch, DERIVED from the values rather than written beside them.\n *\n * Héla's ask, and the reason it is generated: a hand-written list is a second copy of the preset,\n * and the first setting somebody adds makes it a lie that nobody notices, because a stale comment\n * fails no test. Here a new key appears in the next module's config file on its own, with its real\n * value, and `tests/role-layout.test.ts` refuses a key that reaches none of the three groups.\n *\n * It is a snapshot: `--init` leaves an EXISTING config alone, by design, so a module that adopted\n * earlier keeps the catalogue of that day. The report is the live answer, since it prints the value\n * every figure was produced with.\n */\nexport function overridableSettings(from: StaticDefaults = defaults): OverridableSetting[] {\n  const rows: OverridableSetting[] = []\n\n  for (const [key, value] of Object.entries(from)) {\n    if (key in NOT_YOURS) {\n      rows.push({ key, value: render(value), note: NOT_YOURS[key] ?? '', where: 'refused' })\n      continue\n    }\n    if (key in DECLARED) {\n      rows.push({ key, value: render(value), note: DECLARED[key] ?? '', where: 'declared' })\n      continue\n    }\n    // A group is documented by its leaves, because `duplication` whole is not what anyone writes.\n    const leaves =\n      value && typeof value === 'object' && !Array.isArray(value)\n        ? Object.entries(value).map(([leaf, own]) => ({ key: `${key}.${leaf}`, own }))\n        : [{ key, own: value }]\n    for (const leaf of leaves) {\n      rows.push({ key: leaf.key, value: render(leaf.own), note: 'replaced', where: 'overrides' })\n    }\n  }\n\n  return rows\n}\n","/**\n * `defineStaticAnalysis`: what a module imports to declare its own static analysis settings.\n *\n * ```js\n * // static-analysis.config.mjs\n * import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'\n *\n * export default defineStaticAnalysis({\n *   root: import.meta.dirname,\n *   entry: ['**\\/*.steps.ts'],\n *   journeys: { planning: ['src/planning/**'] },\n * })\n * ```\n *\n * ## Why a function and not `{ ...baseConfig, ... }`\n *\n * A spread is SHALLOW, so a module writing `deadCode: { minConfidence: 80 }` would replace the\n * whole block and silently lose `categories`. And the flattening happens in the module's file,\n * before this package ever sees the object, so nothing here could tell \"set one key, keep the\n * rest\" from \"set one key, drop the rest\". A function receives the module's INTENT, the keys it\n * actually passed, and merges them here. Second reason: the defaults are never copied into a\n * module, so changing one reaches every module at the next release instead of leaving 108 stale\n * copies behind.\n *\n * Same shape as `reactTestConfig` in the test role, for the same reasons.\n *\n * ## Two semantics, one obvious and one deliberate\n *\n * `entry` and `journeys` are FACTS a team declares, and they ADD to what this role ships: no\n * module can lose `**\\/*.integration-spec.ts` by declaring a third pattern, which matters\n * because that one pattern is the difference between 33.4% and 1.0% of dead code on a real\n * service (see `defaults.ts`).\n *\n * `overrides` REPLACES, including those lists. It is the seam for the day a team has a real\n * reason, it is not documented anywhere a developer would meet it, and every path it sets is\n * recorded in `moved` so the report can print `(module)` next to the value. Without that trace\n * two modules stop being comparable and nobody knows. It reaches every setting EXCEPT the vendor\n * passthrough, for the reason stated on the field itself.\n */\nimport { isPlainObject } from '../../../shared/deep-merge.js'\nimport { defaults, type StaticDefaults } from '../preset-data.js'\n\ntype DeepPartial<T> = { [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K] }\n\n/** What a module's config file passes. Everything is optional, including the file itself. */\nexport interface StaticAnalysisInput {\n  /** The module's own directory, normally `import.meta.dirname`. */\n  root?: string\n  /** Files that run although nothing imports them. ADDED to the shipped patterns. */\n  entry?: string[]\n  /** Named journeys, as `{ name: [globs] }`. MERGED by name with any shipped ones. */\n  journeys?: Record<string, string[]>\n  /**\n   * The seam. Replaces whatever it names, and every path it sets lands in `moved`.\n   *\n   * ⛔ `tools` is excluded, and the reason is the whole point of translating the vocabulary: a\n   * module knows the ROLE, not the tool underneath it. A key named after the vendor would mean\n   * nothing to the person reading their own config file, and showing it would invite them to learn\n   * a name we are working to keep out of their world. The passthrough still exists, on sentinel's\n   * side, for a preset that needs a vendor option; a module that genuinely needs one gets a key in\n   * OUR vocabulary, which is the right friction because it goes through a review instead of\n   * spreading silently.\n   */\n  overrides?: DeepPartial<Omit<StaticDefaults, 'tools'>>\n}\n\nexport interface ResolvedStaticConfig extends StaticDefaults {\n  /** The module's directory, or null when its config file did not say. */\n  root: string | null\n  /**\n   * Dotted paths the module set through `overrides`, so the report can mark them. Sorted, so\n   * two runs on the same config produce the same report.\n   */\n  moved: string[]\n}\n\n/**\n * Merge `patch` into `base`, recursively, patch winning.\n *\n * Not the `deepMerge` this repo once had: that one existed for WRITING a module's json and was\n * replaced by an in-place jsonc edit, which is why only `isPlainObject` survived. This is the\n * read side, which has no file to preserve and only has to resolve two objects into one.\n *\n * Arrays are replaced, never concatenated. Additive behaviour is a decision about a specific\n * key, which `defineStaticAnalysis` makes explicitly for `entry`, rather than a property of the\n * merge: a merge that silently concatenates cannot express \"replace this list\", and a team\n * reaching for `overrides` is asking for exactly that.\n */\nfunction mergeInto<T>(base: T, patch: unknown): T {\n  if (!isPlainObject(patch)) return base\n  if (!isPlainObject(base)) return patch as T\n  const out: Record<string, unknown> = { ...base }\n  for (const [key, value] of Object.entries(patch)) {\n    out[key] = isPlainObject(value) ? mergeInto(out[key], value) : value\n  }\n  return out as T\n}\n\n/** Every leaf path in `patch`, dotted, so a reader can be told what the module decided. */\nfunction leafPaths(patch: unknown, prefix = ''): string[] {\n  if (!isPlainObject(patch)) return prefix ? [prefix] : []\n  return Object.entries(patch).flatMap(([key, value]) =>\n    leafPaths(value, prefix ? `${prefix}.${key}` : key),\n  )\n}\n\n/** The same list with duplicates dropped, keeping the first occurrence's order. */\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)]\n}\n\n/**\n * Drop the vendor passthrough from what a module sent.\n *\n * ⚠️ Enforced here and not by the type, because the type cannot: a module's config file is `.mjs`,\n * so nothing type-checks it, and `Omit` on the input would be documentation that compiles away. A\n * `tools` key written there is dropped and NAMED on stderr rather than ignored, so a developer who\n * found the key somewhere learns why it did nothing instead of concluding the role is broken.\n */\nfunction withoutVendorKeys(overrides: unknown): unknown {\n  if (!isPlainObject(overrides) || !('tools' in overrides)) return overrides\n  const { tools: _vendor, ...rest } = overrides\n  process.stderr.write(\n    'sentinel static-analysis: ignoring `overrides.tools` from this module. The tool underneath ' +\n      \"the role is not part of a module's surface; if a setting is missing, it needs a key of \" +\n      'its own.\\n',\n  )\n  return rest\n}\n\n/** Resolve a module's declaration against this role's defaults. */\nexport function defineStaticAnalysis(input: StaticAnalysisInput = {}): ResolvedStaticConfig {\n  const declared: StaticDefaults = {\n    ...defaults,\n    entry: unique([...defaults.entry, ...(input.entry ?? [])]),\n    journeys: { ...defaults.journeys, ...(input.journeys ?? {}) },\n  }\n  const overrides = withoutVendorKeys(input.overrides)\n\n  return {\n    ...mergeInto(declared, overrides),\n    root: input.root ?? null,\n    moved: leafPaths(overrides).sort(),\n  }\n}\n"],"mappings":";AAcO,SAAS,cAAc,OAAkD;AAC9E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AChBA;AAAA,EACE,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAa,CAAC,cAAc,cAAc,OAAO,OAAO,OAAO,MAAM;AAAA,EACrE,UAAY,CAAC;AAAA,EACb,aAAe;AAAA,IACb,WAAa;AAAA,IACb,UAAY;AAAA,IACZ,OAAS,CAAC,OAAO;AAAA,IACjB,OAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAY;AAAA,IACV,eAAiB;AAAA,IACjB,YAAc,CAAC,eAAe,iBAAiB,iBAAiB,eAAe;AAAA,EACjF;AAAA,EACA,OAAS;AAAA,IACP,OAAS,CAAC;AAAA,EACZ;AACF;;;ACmGO,IAAM,aAAa;AAGnB,IAAM,SAAS;AAGf,IAAM,SAAS,CAAC,WAAW,QAAQ,MAAM;AASzC,IAAM,UAAU;AAAA,EACrB,SAAS;AAAA,EACT,MAAM,GAAG,MAAM;AAAA,EACf,MAAM,GAAG,MAAM;AACjB;AAWA,IAAM,yBAAmD;AAAA,EACvD,YAAY,CAAC,OAAO,QAAQ,MAAM;AAAA,EAClC,YAAY,CAAC,KAAK;AAAA,EAClB,KAAK,CAAC,MAAM;AAAA,EACZ,KAAK,CAAC,MAAM;AAAA,EACZ,KAAK,CAAC,MAAM;AAAA,EACZ,MAAM,CAAC,OAAO;AAChB;AAGO,SAAS,aAAa,WAAwC;AACnE,SAAO,CAAC,GAAG,IAAI,IAAI,UAAU,QAAQ,CAAC,aAAa,uBAAuB,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7F;AAGO,IAAM,mBAAmB,OAAO,KAAK,sBAAsB;AAa3D,IAAM,WAA2B;AAQxC,IAAM,WAAmC;AAAA,EACvC,OAAO;AAAA,EACP,UAAU;AACZ;AAOA,IAAM,YAAoC;AAAA,EACxC,OAAO;AACT;AAGA,SAAS,OAAO,OAAwB;AACtC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,WAAO,MAAM,UAAU,KAAK,OAAO,UAAU,KAAK,SAAS,GAAG,MAAM,MAAM;AAAA,EAC5E;AACA,MAAI,SAAS,OAAO,UAAU,SAAU,QAAO,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM;AAC3E,SAAO,OAAO,KAAK;AACrB;AA0BO,SAAS,oBAAoB,OAAuB,UAAgC;AACzF,QAAM,OAA6B,CAAC;AAEpC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,OAAO,WAAW;AACpB,WAAK,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,UAAU,CAAC;AACrF;AAAA,IACF;AACA,QAAI,OAAO,UAAU;AACnB,WAAK,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,SAAS,GAAG,KAAK,IAAI,OAAO,WAAW,CAAC;AACrF;AAAA,IACF;AAEA,UAAM,SACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACtD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,IAC3E,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC;AAC1B,eAAW,QAAQ,QAAQ;AACzB,WAAK,KAAK,EAAE,KAAK,KAAK,KAAK,OAAO,OAAO,KAAK,GAAG,GAAG,MAAM,YAAY,OAAO,YAAY,CAAC;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO;AACT;;;ACpMA,SAAS,UAAa,MAAS,OAAmB;AAChD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,IAAI,EAAG,QAAO;AACjC,QAAM,MAA+B,EAAE,GAAG,KAAK;AAC/C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI,cAAc,KAAK,IAAI,UAAU,IAAI,GAAG,GAAG,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAgB,SAAS,IAAc;AACxD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AACvD,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAQ,CAAC,CAAC,KAAK,KAAK,MAC/C,UAAU,OAAO,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK,GAAG;AAAA,EACpD;AACF;AAGA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAUA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,CAAC,cAAc,SAAS,KAAK,EAAE,WAAW,WAAY,QAAO;AACjE,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AACpC,UAAQ,OAAO;AAAA,IACb;AAAA,EAGF;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,QAA6B,CAAC,GAAyB;AAC1F,QAAM,WAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,GAAI,MAAM,SAAS,CAAC,CAAE,CAAC;AAAA,IACzD,UAAU,EAAE,GAAG,SAAS,UAAU,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC9D;AACA,QAAM,YAAY,kBAAkB,MAAM,SAAS;AAEnD,SAAO;AAAA,IACL,GAAG,UAAU,UAAU,SAAS;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,UAAU,SAAS,EAAE,KAAK;AAAA,EACnC;AACF;","names":[]}

package/dist/index.js

@@ -6,12 +6,12 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-JXI6UJ5I.js";
+} from "./chunk-5EXXX2US.js";
 import {
   BaseAdapter
 } from "./chunk-KLEXJFJ6.js";
 import "./chunk-YQRDKWSH.js";
-import "./chunk-KH2DCVC6.js";
+import "./chunk-HO2C5D57.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 export {

package/dist/roles/static-analysis/config.js

@@ -1,6 +1,6 @@
 import {
   defineStaticAnalysis
-} from "../../chunk-KH2DCVC6.js";
+} from "../../chunk-HO2C5D57.js";
 export {
   defineStaticAnalysis
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.13",
+  "version": "1.5.0-alpha.14",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -160,6 +160,13 @@
       },
       "format:fix": {
         "cache": false
+      },
+      "static-analysis": {
+        "cache": true,
+        "inputs": [
+          "default",
+          "{projectRoot}/static-analysis.config.mjs"
+        ]
       }
     }
   },
@@ -190,6 +197,9 @@
     "docs:traces": "pnpm build && bash scripts/gen-traces.sh",
     "docs:traces:check": "pnpm build && bash scripts/gen-traces.sh --check",
     "format:fix": "node dist/bin/sentinel.js --run --format --fix",
-    "bench": "node scripts/bench.mjs"
+    "bench": "node scripts/bench.mjs",
+    "static-analysis": "sentinel --run --static-analysis",
+    "static-analysis:json": "sentinel --run --static-analysis --output json",
+    "static-analysis:html": "sentinel --run --static-analysis --output html"
   }
 }

package/dist/chunk-KH2DCVC6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/deep-merge.ts","../src/roles/static-analysis/presets/shared.json","../src/roles/static-analysis/preset-data.ts","../src/roles/static-analysis/configs/define.ts"],"sourcesContent":["/**\n * Is this a plain JSON object?\n *\n * The file is named for a `deepMerge` that no longer exists. It was written when the engine\n * merged JSON in memory and wrote the result; that approach was replaced by editing the\n * document IN PLACE with jsonc-parser, so a project's comments, key order and formatting\n * survive a `merge-json` op. Nothing has called `deepMerge` since, except its own recursion,\n * so it went.\n *\n * What remains is the predicate the in-place merge still needs, to decide whether a value is\n * a branch to walk into or a leaf to set.\n */\n\n/** True for a mergeable plain object (not null, not an array). */\nexport function isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n","{\n  \"entry\": [\n    \"**/*.integration-spec.ts\",\n    \"**/*.steps.ts\",\n    \"src/client.tsx\",\n    \"src/start.ts\",\n    \"src/router.tsx\",\n    \"src/RouterContext.tsx\"\n  ],\n  \"ignore\": [\n    \"**/node_modules/**\",\n    \"**/dist/**\",\n    \"**/build/**\",\n    \"**/coverage/**\",\n    \"**/.next/**\",\n    \"**/__mocks__/**\",\n    \"**/mocks/**\",\n    \"**/_mock_/**\",\n    \"**/**Mock**/**\",\n    \"**/__fixtures__/**\",\n    \"**/fixtures/**\",\n    \"**/public/**\",\n    \"**/.husky/**\",\n    \"**/.vscode/**\",\n    \"**/.idea/**\",\n    \"**/.github/**\",\n    \"**/*.d.ts\",\n    \"**/*.gen.ts\",\n    \"**/*.generated.ts\"\n  ],\n  \"languages\": [\"javascript\", \"typescript\", \"jsx\", \"tsx\", \"css\", \"scss\"],\n  \"journeys\": {},\n  \"duplication\": {\n    \"minTokens\": 50,\n    \"minLines\": 5,\n    \"kinds\": [\"exact\"],\n    \"tests\": [\n      \"*.{test,spec,steps,e2e-spec,integration-spec}.{ts,tsx,js,jsx}\",\n      \"{tests,__tests__}/**/*.{ts,tsx,js,jsx}\"\n    ]\n  },\n  \"deadCode\": {\n    \"minConfidence\": 60,\n    \"categories\": [\"unused-file\", \"unused-export\", \"unused-symbol\", \"unused-import\"]\n  },\n  \"tools\": {\n    \"jscpd\": {}\n  }\n}\n","/**\n * The static analysis preset: the role's settings, as data.\n *\n * One shared layer and no per-stack preset yet, because nothing measured so far varies by stack:\n * duplication, dead code and complexity are the same questions in Nest and in React. The split\n * that is already foreseen is `LCOM4`, which is meaningless on a functional front end and real on\n * nest's 16 568 classes; when it arrives it becomes `nest.json` beside this layer, which is why\n * the values live here as JSON rather than inline in the code.\n *\n * ## Why these values are the role's and not the module's\n *\n * A team declares FACTS about its own domain (which journeys exist, which files are entry points);\n * it does not declare the values a number is judged by. Two files with the same measurement\n * getting different verdicts in two modules would make every figure incomparable, and the first\n * thing this role has to be able to say is that a number means the same thing everywhere.\n *\n * That is a default, not a wall: a module CAN move any of them (see `configs/define.ts`), and when\n * it does the report prints `(module)` next to the value. The seam exists from the first commit\n * because retrofitting one later means rewriting every module's file.\n *\n * ⛔ There are no thresholds here, and their absence is a decision rather than an omission.\n *\n * A threshold was written first, at 5% of duplicated lines, and then removed. Measured over all 228\n * nx projects: 5% flags 65 of the 201 measurable modules, a third of the repository, and moving the\n * figure until the count felt manageable is not calibration, it is fitting the instrument to the\n * answer. Calibration is legitimate when a bench is polluted and the noise is removed, or when the\n * reference frame changes; neither applies to a share of duplicated lines.\n *\n * And there is nothing to calibrate AGAINST: of the sources in `docs/static-analysis-study.md`\n * section 5, NDepend, Lattix, ArchUnit, CodeScene and Arcan, none publishes a threshold for\n * duplicated lines. One invented here would travel as if it were published.\n *\n * So the role reports the measurement. What makes a single figure readable is the distribution it\n * sits in, which only a workspace-wide run can know, so that belongs to the sweep and to the\n * migration page, not to a module's own report. The first defensible warning will not be an absolute\n * number either: a module that got WORSE than its own previous measurement is a signal that needs no\n * invented bar, which is what a baseline gives, and that was already deferred for its own reasons.\n *\n * ## Where each value comes from, so nobody has to guess later\n *\n *  - `entry` is the single most consequential line in the file. Measured on\n *    `apps/nest/microservices/network` with jscpd 5.4.0: with nothing declared the dead-code pass\n *    reports **33.4%** of lines dead (79 657 lines, 232 files, 13 entry points); with these two\n *    patterns declared it reports **1.0%** (2 462 lines, 207 entry points). The cause is a naming\n *    convention and not a bug: our integration tests are `foo.integration-spec.ts` with a HYPHEN,\n *    so they do not end in `.spec.ts` and the tool's own test-file detection never sees them, and\n *    the 115 `.steps.ts` BDD definitions are tests by no convention it knows. A module ADDS to\n *    this list rather than replacing it, precisely so no team can lose these two by declaring a\n *    third.\n *\n *    ⭐ The four `src/` files are the FRONT bootstrap, and they are the most consequential thing\n *    measured on this pass. The tool recognises around fifty frameworks and TanStack Start is not\n *    one of them, so nothing in the repository imports these files: the framework finds them by\n *    convention at build time. Measured without them declared, `apps/front/console` reports\n *    `src/client.tsx`, `src/router.tsx` and `src/start.ts` among its 5 dead files, which are its\n *    hydration entry, its router factory and its Start config. `host-admin` reports `client.tsx`\n *    too and `career` reports `router.tsx` and `RouterContext.tsx`. Three of console's five\n *    findings were its own bootstrap, and the first team to see that stops trusting the tool on\n *    the spot. They exist in 2 to 3 front apps each.\n *\n *    ⛔ `scripts/**` is deliberately NOT here, although 8 modules have one and\n *    `apps/nest/microservices/contract` reports two `scripts/e2e-*.ts` as dead. No `package.json`\n *    script invokes them, so whether they run at all is a fact only the team holds. Declaring them\n *    would hide a finding that may well be true, and that is the opposite of this role's job.\n *\n *  - `languages` is this role's name for what the tool calls `format`, a word that already names\n *    another sentinel role and means something else there. Stating it has a measured cost either\n *    way: on `apps/front/console`, naming `typescript` alone scans 300 of 523 files because `.tsx`\n *    is a SEPARATE language to the tool, naming all four scans 522 (the one left out being\n *    `styles.css`), and naming nothing scans every one of its 224 languages, json and markdown\n *    included. Stylesheets are in deliberately: measured on `libs/front` they duplicate at 9.64%\n *    against 3.50% for the code, a signal that only survives because the report is broken down per\n *    language.\n *\n *  - `duplication.minTokens` and `minLines` are the detection window, and the window decides what\n *    is INVISIBLE: a fragment shorter than it is not reported at all, so a reader comparing two\n *    runs has to know both values. They are the tool's own defaults, written out rather than\n *    inherited for that reason.\n *\n *  - `duplication.kinds` is `exact` alone, and that is a correctness constraint rather than\n *    caution. Measured: with a second kind enabled, `duplicatedLines` adds up overlapping clones.\n *    Two 9-line files reported 13 duplicated lines out of 18, 72%, because an `exact` clone of\n *    lines 1-4 and a `similar` clone of lines 1-9 containing it were both counted; the real extent\n *    is 9 of 18, 50%. The tool's own answer is to cap the display at 100%, which does not make a\n *    threshold meaningful. Opening another kind therefore requires computing the share ourselves\n *    from the UNION of the line ranges.\n *\n *  - `duplication.tests` is the glob that splits the pass in two, and the split is the finding that\n *    forced it. Measured across 8 modules of the three families, **71% of all duplicated lines are\n *    between two test files**: `libs/nest/auth` reports 35.77% and its product code is at 5.96%,\n *    `apps/front/host-admin` 7.91% against 3.59%. A single blended figure is therefore mostly a\n *    measure of spec duplication wearing the name of the module's duplication, and the number\n *    travels while that nuance does not. So the role reports the two side by side, the way it\n *    already refuses to blend languages, and neither is hidden: a module whose specs carry 93% of\n *    its clones is saying something about its specs that excluding them would erase.\n *\n *    ⚠️ The two passes PARTITION the files and therefore lose a clone that spans them: a fragment\n *    shared between a test and a product file has no partner in either scan. Measured on the same\n *    8 modules, that is 42 entries of 5117, 0.8%, 650 lines. Stated in the caveat rather than\n *    silently accepted, and it is the price of the split.\n *\n *    Two patterns and not one, because a suffix convention does not cover a DIRECTORY convention,\n *    and the directory one is not a quirk: 635 files across 26 modules live under `tests/` or\n *    `__tests__/` without a name this role's suffixes recognise, `apps/nest/microservices/recruitment`\n *    alone holding 160. They are step definitions, in-memory doubles and stubs, which is test-side\n *    code by any reading. A role default rather than 26 identical overrides.\n *\n *    ⚠️ The patterns are RELATIVE here, and the adapter prefixes and composes them, because the\n *    tool's `--pattern` takes exactly one glob. Verified on four modules that the two passes\n *    partition exactly: console 479 + 87 = 566, contract 399 + 151 = 550, backends-for-frontends/admin\n *    2062 + 773 = 2835, recruitment 936 + 621 = 1557.\n *\n *    ⚠️ And a trap that cost a wrong table before it was caught: these globs contain commas, so they\n *    survive the config FILE and are destroyed by the `-i` command-line flag, which splits on\n *    commas and cuts `{test,spec}` in half. The adapter writes a file, which is one more reason it\n *    does.\n *\n *  - `deadCode.minConfidence` is the tool's own default of 60. It scores every finding and names\n *    what lowered it (a file calling `eval`, an unrecognised decorator, a name appearing in a\n *    string literal, a file in the scan that did not parse). Measured on sentinel: 60 yields 20\n *    files, 10 exports and 22 symbols; 90 yields 18 files; 100 yields nothing.\n *\n *  - `deadCode.categories` leaves out `unused-member` deliberately: without type information\n *    `x.render()` could reach any `render` in the project, which the tool itself calls its least\n *    certain rule.\n *\n *  - `ignore` excludes generated, vendored and fixture code, which duplicates by nature and buries\n *    the clones a developer can act on. It is load-bearing rather than tidy: measured on this\n *    package, scanning the module root with no ignore list reports 18 186 files and 32 153 clones,\n *    **31 969** of them touching `node_modules`; with the list, 408 files and zero.\n *\n *  - `tools.jscpd` is passed to the tool verbatim, and it is **sentinel's own** escape hatch, not a\n *    module's: `defineStaticAnalysis` excludes it from what a module can override. Everything above\n *    uses OUR key names, translated on the way out, so that replacing the tool one day does not\n *    oblige a single module to edit its config file, and a module only ever knows the ROLE. This\n *    block is where that guarantee stops, which is why it stays on this side and why it is empty:\n *    the first thing to put in it would be an option a single preset needs, not a workaround.\n */\nimport sharedData from './presets/shared.json'\n\n/**\n * Where the json and html reports are written, relative to the module.\n *\n * Named for the role rather than left on the tool's default `report/`, and added to `.gitignore`\n * by `--init`. Both halves matter: the format role once shipped a `lint/` directory that nothing\n * ignored, and every adopting module grew an untracked directory nobody could explain.\n */\nexport const REPORT_DIR = 'static-analysis-report'\n\nexport type StaticDefaults = {\n  entry: string[]\n  ignore: string[]\n  languages: string[]\n  journeys: Record<string, string[]>\n  duplication: { minTokens: number; minLines: number; kinds: string[]; tests: string[] }\n  deadCode: { minConfidence: number; categories: string[] }\n  tools: { jscpd: Record<string, unknown> }\n}\n\n/** The role's settings. Read-only here; `defineStaticAnalysis` resolves a module against them. */\nexport const defaults: StaticDefaults = sharedData as StaticDefaults\n\n/**\n * Keys a module declares DIRECTLY rather than through `overrides`, and how each one combines.\n *\n * They are apart because the verb differs: these two are added to and merged, so a team cannot\n * lose what the role ships by declaring its own. Everything else replaces.\n */\nconst DECLARED: Record<string, string> = {\n  entry: 'added to the patterns the role ships, never replacing them',\n  journeys: \"merged by name with the role's\",\n}\n\n/**\n * ⛔ Not a module's to set, and the catalogue says so rather than leaving it absent: a key that is\n * simply missing from a list reads as an oversight, and someone will try it. Passing it is dropped\n * with a message, see `configs/define.ts`.\n */\nconst NOT_YOURS: Record<string, string> = {\n  tools: \"sentinel's own passthrough to the tool underneath; a module never names the vendor\",\n}\n\n/** A value as a reader compares it: short lists in full, long ones as a count. */\nfunction render(value: unknown): string {\n  if (Array.isArray(value)) {\n    const joined = value.join(', ')\n    return value.length <= 6 && joined.length <= 72 ? joined : `${value.length} patterns`\n  }\n  if (value && typeof value === 'object') return `${Object.keys(value).length} entries`\n  return String(value)\n}\n\n/** One documented key: its path, the role's value, and the note a reader needs. */\nexport interface OverridableSetting {\n  /** The dotted path a module writes, e.g. `duplication.minTokens`. */\n  key: string\n  /** The role's current value, rendered. */\n  value: string\n  /** How it combines, or why it is not available. */\n  note: string\n  /** Where it goes: directly in the config, inside `overrides`, or nowhere. */\n  where: 'declared' | 'overrides' | 'refused'\n}\n\n/**\n * Every setting a module can touch, DERIVED from the values rather than written beside them.\n *\n * Héla's ask, and the reason it is generated: a hand-written list is a second copy of the preset,\n * and the first setting somebody adds makes it a lie that nobody notices, because a stale comment\n * fails no test. Here a new key appears in the next module's config file on its own, with its real\n * value, and `tests/role-layout.test.ts` refuses a key that reaches none of the three groups.\n *\n * It is a snapshot: `--init` leaves an EXISTING config alone, by design, so a module that adopted\n * earlier keeps the catalogue of that day. The report is the live answer, since it prints the value\n * every figure was produced with.\n */\nexport function overridableSettings(from: StaticDefaults = defaults): OverridableSetting[] {\n  const rows: OverridableSetting[] = []\n\n  for (const [key, value] of Object.entries(from)) {\n    if (key in NOT_YOURS) {\n      rows.push({ key, value: render(value), note: NOT_YOURS[key] ?? '', where: 'refused' })\n      continue\n    }\n    if (key in DECLARED) {\n      rows.push({ key, value: render(value), note: DECLARED[key] ?? '', where: 'declared' })\n      continue\n    }\n    // A group is documented by its leaves, because `duplication` whole is not what anyone writes.\n    const leaves =\n      value && typeof value === 'object' && !Array.isArray(value)\n        ? Object.entries(value).map(([leaf, own]) => ({ key: `${key}.${leaf}`, own }))\n        : [{ key, own: value }]\n    for (const leaf of leaves) {\n      rows.push({ key: leaf.key, value: render(leaf.own), note: 'replaced', where: 'overrides' })\n    }\n  }\n\n  return rows\n}\n","/**\n * `defineStaticAnalysis`: what a module imports to declare its own static analysis settings.\n *\n * ```js\n * // static-analysis.config.mjs\n * import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'\n *\n * export default defineStaticAnalysis({\n *   root: import.meta.dirname,\n *   entry: ['**\\/*.steps.ts'],\n *   journeys: { planning: ['src/planning/**'] },\n * })\n * ```\n *\n * ## Why a function and not `{ ...baseConfig, ... }`\n *\n * A spread is SHALLOW, so a module writing `deadCode: { minConfidence: 80 }` would replace the\n * whole block and silently lose `categories`. And the flattening happens in the module's file,\n * before this package ever sees the object, so nothing here could tell \"set one key, keep the\n * rest\" from \"set one key, drop the rest\". A function receives the module's INTENT, the keys it\n * actually passed, and merges them here. Second reason: the defaults are never copied into a\n * module, so changing one reaches every module at the next release instead of leaving 108 stale\n * copies behind.\n *\n * Same shape as `reactTestConfig` in the test role, for the same reasons.\n *\n * ## Two semantics, one obvious and one deliberate\n *\n * `entry` and `journeys` are FACTS a team declares, and they ADD to what this role ships: no\n * module can lose `**\\/*.integration-spec.ts` by declaring a third pattern, which matters\n * because that one pattern is the difference between 33.4% and 1.0% of dead code on a real\n * service (see `defaults.ts`).\n *\n * `overrides` REPLACES, including those lists. It is the seam for the day a team has a real\n * reason, it is not documented anywhere a developer would meet it, and every path it sets is\n * recorded in `moved` so the report can print `(module)` next to the value. Without that trace\n * two modules stop being comparable and nobody knows. It reaches every setting EXCEPT the vendor\n * passthrough, for the reason stated on the field itself.\n */\nimport { isPlainObject } from '../../../shared/deep-merge.js'\nimport { defaults, type StaticDefaults } from '../preset-data.js'\n\ntype DeepPartial<T> = { [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K] }\n\n/** What a module's config file passes. Everything is optional, including the file itself. */\nexport interface StaticAnalysisInput {\n  /** The module's own directory, normally `import.meta.dirname`. */\n  root?: string\n  /** Files that run although nothing imports them. ADDED to the shipped patterns. */\n  entry?: string[]\n  /** Named journeys, as `{ name: [globs] }`. MERGED by name with any shipped ones. */\n  journeys?: Record<string, string[]>\n  /**\n   * The seam. Replaces whatever it names, and every path it sets lands in `moved`.\n   *\n   * ⛔ `tools` is excluded, and the reason is the whole point of translating the vocabulary: a\n   * module knows the ROLE, not the tool underneath it. A key named after the vendor would mean\n   * nothing to the person reading their own config file, and showing it would invite them to learn\n   * a name we are working to keep out of their world. The passthrough still exists, on sentinel's\n   * side, for a preset that needs a vendor option; a module that genuinely needs one gets a key in\n   * OUR vocabulary, which is the right friction because it goes through a review instead of\n   * spreading silently.\n   */\n  overrides?: DeepPartial<Omit<StaticDefaults, 'tools'>>\n}\n\nexport interface ResolvedStaticConfig extends StaticDefaults {\n  /** The module's directory, or null when its config file did not say. */\n  root: string | null\n  /**\n   * Dotted paths the module set through `overrides`, so the report can mark them. Sorted, so\n   * two runs on the same config produce the same report.\n   */\n  moved: string[]\n}\n\n/**\n * Merge `patch` into `base`, recursively, patch winning.\n *\n * Not the `deepMerge` this repo once had: that one existed for WRITING a module's json and was\n * replaced by an in-place jsonc edit, which is why only `isPlainObject` survived. This is the\n * read side, which has no file to preserve and only has to resolve two objects into one.\n *\n * Arrays are replaced, never concatenated. Additive behaviour is a decision about a specific\n * key, which `defineStaticAnalysis` makes explicitly for `entry`, rather than a property of the\n * merge: a merge that silently concatenates cannot express \"replace this list\", and a team\n * reaching for `overrides` is asking for exactly that.\n */\nfunction mergeInto<T>(base: T, patch: unknown): T {\n  if (!isPlainObject(patch)) return base\n  if (!isPlainObject(base)) return patch as T\n  const out: Record<string, unknown> = { ...base }\n  for (const [key, value] of Object.entries(patch)) {\n    out[key] = isPlainObject(value) ? mergeInto(out[key], value) : value\n  }\n  return out as T\n}\n\n/** Every leaf path in `patch`, dotted, so a reader can be told what the module decided. */\nfunction leafPaths(patch: unknown, prefix = ''): string[] {\n  if (!isPlainObject(patch)) return prefix ? [prefix] : []\n  return Object.entries(patch).flatMap(([key, value]) =>\n    leafPaths(value, prefix ? `${prefix}.${key}` : key),\n  )\n}\n\n/** The same list with duplicates dropped, keeping the first occurrence's order. */\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)]\n}\n\n/**\n * Drop the vendor passthrough from what a module sent.\n *\n * ⚠️ Enforced here and not by the type, because the type cannot: a module's config file is `.mjs`,\n * so nothing type-checks it, and `Omit` on the input would be documentation that compiles away. A\n * `tools` key written there is dropped and NAMED on stderr rather than ignored, so a developer who\n * found the key somewhere learns why it did nothing instead of concluding the role is broken.\n */\nfunction withoutVendorKeys(overrides: unknown): unknown {\n  if (!isPlainObject(overrides) || !('tools' in overrides)) return overrides\n  const { tools: _vendor, ...rest } = overrides\n  process.stderr.write(\n    'sentinel static-analysis: ignoring `overrides.tools` from this module. The tool underneath ' +\n      \"the role is not part of a module's surface; if a setting is missing, it needs a key of \" +\n      'its own.\\n',\n  )\n  return rest\n}\n\n/** Resolve a module's declaration against this role's defaults. */\nexport function defineStaticAnalysis(input: StaticAnalysisInput = {}): ResolvedStaticConfig {\n  const declared: StaticDefaults = {\n    ...defaults,\n    entry: unique([...defaults.entry, ...(input.entry ?? [])]),\n    journeys: { ...defaults.journeys, ...(input.journeys ?? {}) },\n  }\n  const overrides = withoutVendorKeys(input.overrides)\n\n  return {\n    ...mergeInto(declared, overrides),\n    root: input.root ?? null,\n    moved: leafPaths(overrides).sort(),\n  }\n}\n"],"mappings":";AAcO,SAAS,cAAc,OAAkD;AAC9E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AChBA;AAAA,EACE,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAa,CAAC,cAAc,cAAc,OAAO,OAAO,OAAO,MAAM;AAAA,EACrE,UAAY,CAAC;AAAA,EACb,aAAe;AAAA,IACb,WAAa;AAAA,IACb,UAAY;AAAA,IACZ,OAAS,CAAC,OAAO;AAAA,IACjB,OAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAY;AAAA,IACV,eAAiB;AAAA,IACjB,YAAc,CAAC,eAAe,iBAAiB,iBAAiB,eAAe;AAAA,EACjF;AAAA,EACA,OAAS;AAAA,IACP,OAAS,CAAC;AAAA,EACZ;AACF;;;ACmGO,IAAM,aAAa;AAanB,IAAM,WAA2B;AAQxC,IAAM,WAAmC;AAAA,EACvC,OAAO;AAAA,EACP,UAAU;AACZ;AAOA,IAAM,YAAoC;AAAA,EACxC,OAAO;AACT;AAGA,SAAS,OAAO,OAAwB;AACtC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,WAAO,MAAM,UAAU,KAAK,OAAO,UAAU,KAAK,SAAS,GAAG,MAAM,MAAM;AAAA,EAC5E;AACA,MAAI,SAAS,OAAO,UAAU,SAAU,QAAO,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM;AAC3E,SAAO,OAAO,KAAK;AACrB;AA0BO,SAAS,oBAAoB,OAAuB,UAAgC;AACzF,QAAM,OAA6B,CAAC;AAEpC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,OAAO,WAAW;AACpB,WAAK,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,UAAU,CAAC;AACrF;AAAA,IACF;AACA,QAAI,OAAO,UAAU;AACnB,WAAK,KAAK,EAAE,KAAK,OAAO,OAAO,KAAK,GAAG,MAAM,SAAS,GAAG,KAAK,IAAI,OAAO,WAAW,CAAC;AACrF;AAAA,IACF;AAEA,UAAM,SACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACtD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,IAC3E,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC;AAC1B,eAAW,QAAQ,QAAQ;AACzB,WAAK,KAAK,EAAE,KAAK,KAAK,KAAK,OAAO,OAAO,KAAK,GAAG,GAAG,MAAM,YAAY,OAAO,YAAY,CAAC;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO;AACT;;;ACvJA,SAAS,UAAa,MAAS,OAAmB;AAChD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,IAAI,EAAG,QAAO;AACjC,QAAM,MAA+B,EAAE,GAAG,KAAK;AAC/C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI,cAAc,KAAK,IAAI,UAAU,IAAI,GAAG,GAAG,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAgB,SAAS,IAAc;AACxD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AACvD,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAQ,CAAC,CAAC,KAAK,KAAK,MAC/C,UAAU,OAAO,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK,GAAG;AAAA,EACpD;AACF;AAGA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAUA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,CAAC,cAAc,SAAS,KAAK,EAAE,WAAW,WAAY,QAAO;AACjE,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AACpC,UAAQ,OAAO;AAAA,IACb;AAAA,EAGF;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,QAA6B,CAAC,GAAyB;AAC1F,QAAM,WAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,GAAI,MAAM,SAAS,CAAC,CAAE,CAAC;AAAA,IACzD,UAAU,EAAE,GAAG,SAAS,UAAU,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC9D;AACA,QAAM,YAAY,kBAAkB,MAAM,SAAS;AAEnD,SAAO;AAAA,IACL,GAAG,UAAU,UAAU,SAAS;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,UAAU,SAAS,EAAE,KAAK;AAAA,EACnC;AACF;","names":[]}