@hublo/sentinel 1.5.0-alpha.2 → 1.5.0-alpha.4

package/dist/bin/sentinel.js

@@ -15,18 +15,18 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-AHA7LGGA.js";
+} from "../chunk-JNXDJ2QD.js";
 import {
   resolveContext
-} from "../chunk-E3MYVYEZ.js";
+} from "../chunk-KLEXJFJ6.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
   inspectWorkspacePrep,
   readOwnVersion,
   readProjectPackageJson
-} from "../chunk-KMKQDGI6.js";
-import "../chunk-GJGZRXM3.js";
+} from "../chunk-YQRDKWSH.js";
+import "../chunk-DVKTH3RY.js";
 import "../chunk-O7REVMOC.js";
 import "../chunk-QXFCZON7.js";
 
@@ -146,7 +146,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-STUK2AGG.js");
+  const { validateModuleTests } = await import("../validate-AWWMBSH5.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/{chunk-Z7L4FGKP.js → chunk-AMCGMLPS.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-ELZHIN6E.js";
 import {
   findWorkspaceRoot
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-YQRDKWSH.js";
 
 // src/roles/test/setup/workspace.ts
 function isMissingModule(error) {
@@ -60,4 +60,4 @@ export {
   installWorkspaceSetup,
   pinWorkspaceTimezone
 };
-//# sourceMappingURL=chunk-Z7L4FGKP.js.map
+//# sourceMappingURL=chunk-AMCGMLPS.js.map

package/dist/{chunk-GJGZRXM3.js → chunk-DVKTH3RY.js}

@@ -30,13 +30,18 @@ var shared_default = {
   ],
   languages: ["javascript", "typescript", "jsx", "tsx", "css", "scss"],
   journeys: {},
-  duplication: { minTokens: 50, minLines: 5, kinds: ["exact"] },
+  duplication: {
+    minTokens: 50,
+    minLines: 5,
+    kinds: ["exact"]
+  },
   deadCode: {
     minConfidence: 60,
     categories: ["unused-file", "unused-export", "unused-symbol", "unused-import"]
   },
-  thresholds: { duplicatedLinesPercent: 5, deadCodePercent: 5 },
-  tools: { jscpd: {} }
+  tools: {
+    jscpd: {}
+  }
 };
 
 // src/roles/static-analysis/preset-data.ts
@@ -89,4 +94,4 @@ export {
   REPORT_DIR,
   defineStaticAnalysis
 };
-//# sourceMappingURL=chunk-GJGZRXM3.js.map
+//# sourceMappingURL=chunk-DVKTH3RY.js.map

package/dist/{chunk-GJGZRXM3.js.map → chunk-DVKTH3RY.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/deep-merge.ts","../src/roles/static-analysis/presets/shared.json","../src/roles/static-analysis/preset-data.ts","../src/roles/static-analysis/configs/define.ts"],"sourcesContent":["/**\n * Is this a plain JSON object?\n *\n * The file is named for a `deepMerge` that no longer exists. It was written when the engine\n * merged JSON in memory and wrote the result; that approach was replaced by editing the\n * document IN PLACE with jsonc-parser, so a project's comments, key order and formatting\n * survive a `merge-json` op. Nothing has called `deepMerge` since, except its own recursion,\n * so it went.\n *\n * What remains is the predicate the in-place merge still needs, to decide whether a value is\n * a branch to walk into or a leaf to set.\n */\n\n/** True for a mergeable plain object (not null, not an array). */\nexport function isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n","{\n  \"entry\": [\"**/*.integration-spec.ts\", \"**/*.steps.ts\"],\n  \"ignore\": [\n    \"**/node_modules/**\",\n    \"**/dist/**\",\n    \"**/build/**\",\n    \"**/coverage/**\",\n    \"**/.next/**\",\n    \"**/static-analysis-report/**\",\n    \"**/__mocks__/**\",\n    \"**/mocks/**\",\n    \"**/_mock_/**\",\n    \"**/**Mock**/**\",\n    \"**/__fixtures__/**\",\n    \"**/fixtures/**\",\n    \"**/public/**\",\n    \"**/.husky/**\",\n    \"**/.vscode/**\",\n    \"**/.idea/**\",\n    \"**/.github/**\",\n    \"**/*.d.ts\",\n    \"**/*.gen.ts\",\n    \"**/*.generated.ts\"\n  ],\n  \"languages\": [\"javascript\", \"typescript\", \"jsx\", \"tsx\", \"css\", \"scss\"],\n  \"journeys\": {},\n  \"duplication\": { \"minTokens\": 50, \"minLines\": 5, \"kinds\": [\"exact\"] },\n  \"deadCode\": {\n    \"minConfidence\": 60,\n    \"categories\": [\"unused-file\", \"unused-export\", \"unused-symbol\", \"unused-import\"]\n  },\n  \"thresholds\": { \"duplicatedLinesPercent\": 5, \"deadCodePercent\": 5 },\n  \"tools\": { \"jscpd\": {} }\n}\n","/**\n * The static analysis preset: the role's settings, as data.\n *\n * One shared layer and no per-stack preset yet, because nothing measured so far varies by stack:\n * duplication, dead code and complexity are the same questions in Nest and in React. The split\n * that is already foreseen is `LCOM4`, which is meaningless on a functional front end and real on\n * nest's 16 568 classes; when it arrives it becomes `nest.json` beside this layer, which is why\n * the values live here as JSON rather than inline in the code.\n *\n * ## Why these values are the role's and not the module's\n *\n * A team declares FACTS about its own domain (which journeys exist, which files are entry points);\n * it does not declare the values a number is judged by. Two files with the same measurement\n * getting different verdicts in two modules would make every figure incomparable, and the first\n * thing this role has to be able to say is that a number means the same thing everywhere.\n *\n * That is a default, not a wall: a module CAN move any of them (see `configs/define.ts`), and when\n * it does the report prints `(module)` next to the value. The seam exists from the first commit\n * because retrofitting one later means rewriting every module's file.\n *\n * Both thresholds are a STARTING POINT and will be calibrated from the distribution the first full\n * run produces, the same commitment a preset rule carries in `CONTRIBUTING.md`. For scale,\n * sentinel's own package measures 1.4% duplicated lines and 1.3% dead code.\n *\n * ## Where each value comes from, so nobody has to guess later\n *\n *  - `entry` is the single most consequential line in the file. Measured on\n *    `apps/nest/microservices/network` with jscpd 5.4.0: with nothing declared the dead-code pass\n *    reports **33.4%** of lines dead (79 657 lines, 232 files, 13 entry points); with these two\n *    patterns declared it reports **1.0%** (2 462 lines, 207 entry points). The cause is a naming\n *    convention and not a bug: our integration tests are `foo.integration-spec.ts` with a HYPHEN,\n *    so they do not end in `.spec.ts` and the tool's own test-file detection never sees them, and\n *    the 115 `.steps.ts` BDD definitions are tests by no convention it knows. A module ADDS to\n *    this list rather than replacing it, precisely so no team can lose these two by declaring a\n *    third.\n *\n *  - `languages` is this role's name for what the tool calls `format`, a word that already names\n *    another sentinel role and means something else there. Stating it has a measured cost either\n *    way: on `apps/front/console`, naming `typescript` alone scans 300 of 523 files because `.tsx`\n *    is a SEPARATE language to the tool, naming all four scans 522 (the one left out being\n *    `styles.css`), and naming nothing scans every one of its 224 languages, json and markdown\n *    included. Stylesheets are in deliberately: measured on `libs/front` they duplicate at 9.64%\n *    against 3.50% for the code, a signal that only survives because the report is broken down per\n *    language.\n *\n *  - `duplication.minTokens` and `minLines` are the detection window, and the window decides what\n *    is INVISIBLE: a fragment shorter than it is not reported at all, so a reader comparing two\n *    runs has to know both values. They are the tool's own defaults, written out rather than\n *    inherited for that reason.\n *\n *  - `duplication.kinds` is `exact` alone, and that is a correctness constraint rather than\n *    caution. Measured: with a second kind enabled, `duplicatedLines` adds up overlapping clones.\n *    Two 9-line files reported 13 duplicated lines out of 18, 72%, because an `exact` clone of\n *    lines 1-4 and a `similar` clone of lines 1-9 containing it were both counted; the real extent\n *    is 9 of 18, 50%. The tool's own answer is to cap the display at 100%, which does not make a\n *    threshold meaningful. Opening another kind therefore requires computing the share ourselves\n *    from the UNION of the line ranges.\n *\n *  - `deadCode.minConfidence` is the tool's own default of 60. It scores every finding and names\n *    what lowered it (a file calling `eval`, an unrecognised decorator, a name appearing in a\n *    string literal, a file in the scan that did not parse). Measured on sentinel: 60 yields 20\n *    files, 10 exports and 22 symbols; 90 yields 18 files; 100 yields nothing.\n *\n *  - `deadCode.categories` leaves out `unused-member` deliberately: without type information\n *    `x.render()` could reach any `render` in the project, which the tool itself calls its least\n *    certain rule.\n *\n *  - `ignore` excludes generated, vendored and fixture code, which duplicates by nature and buries\n *    the clones a developer can act on. It is load-bearing rather than tidy: measured on this\n *    package, scanning the module root with no ignore list reports 18 186 files and 32 153 clones,\n *    **31 969** of them touching `node_modules`; with the list, 408 files and zero.\n *\n *  - `tools.jscpd` is passed to the tool verbatim, and it is **sentinel's own** escape hatch, not a\n *    module's: `defineStaticAnalysis` excludes it from what a module can override. Everything above\n *    uses OUR key names, translated on the way out, so that replacing the tool one day does not\n *    oblige a single module to edit its config file, and a module only ever knows the ROLE. This\n *    block is where that guarantee stops, which is why it stays on this side and why it is empty:\n *    the first thing to put in it would be an option a single preset needs, not a workaround.\n */\nimport sharedData from './presets/shared.json'\n\n/**\n * Where the json and html reports are written, relative to the module.\n *\n * Named for the role rather than left on the tool's default `report/`, and added to `.gitignore`\n * by `--init`. Both halves matter: the format role once shipped a `lint/` directory that nothing\n * ignored, and every adopting module grew an untracked directory nobody could explain.\n */\nexport const REPORT_DIR = 'static-analysis-report'\n\nexport type StaticDefaults = {\n  entry: string[]\n  ignore: string[]\n  languages: string[]\n  journeys: Record<string, string[]>\n  duplication: { minTokens: number; minLines: number; kinds: string[] }\n  deadCode: { minConfidence: number; categories: string[] }\n  thresholds: { duplicatedLinesPercent: number; deadCodePercent: number }\n  tools: { jscpd: Record<string, unknown> }\n}\n\n/** The role's settings. Read-only here; `defineStaticAnalysis` resolves a module against them. */\nexport const defaults: StaticDefaults = sharedData as StaticDefaults\n","/**\n * `defineStaticAnalysis`: what a module imports to declare its own static analysis settings.\n *\n * ```js\n * // static-analysis.config.mjs\n * import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'\n *\n * export default defineStaticAnalysis({\n *   root: import.meta.dirname,\n *   entry: ['**\\/*.steps.ts'],\n *   journeys: { planning: ['src/planning/**'] },\n * })\n * ```\n *\n * ## Why a function and not `{ ...baseConfig, ... }`\n *\n * A spread is SHALLOW, so a module writing `deadCode: { minConfidence: 80 }` would replace the\n * whole block and silently lose `categories`. And the flattening happens in the module's file,\n * before this package ever sees the object, so nothing here could tell \"set one key, keep the\n * rest\" from \"set one key, drop the rest\". A function receives the module's INTENT, the keys it\n * actually passed, and merges them here. Second reason: the defaults are never copied into a\n * module, so changing one reaches every module at the next release instead of leaving 108 stale\n * copies behind.\n *\n * Same shape as `reactTestConfig` in the test role, for the same reasons.\n *\n * ## Two semantics, one obvious and one deliberate\n *\n * `entry` and `journeys` are FACTS a team declares, and they ADD to what this role ships: no\n * module can lose `**\\/*.integration-spec.ts` by declaring a third pattern, which matters\n * because that one pattern is the difference between 33.4% and 1.0% of dead code on a real\n * service (see `defaults.ts`).\n *\n * `overrides` REPLACES, including those lists. It is the seam for the day a team has a real\n * reason, it is not documented anywhere a developer would meet it, and every path it sets is\n * recorded in `moved` so the report can print `(module)` next to the value. Without that trace\n * two modules stop being comparable and nobody knows. It reaches every setting EXCEPT the vendor\n * passthrough, for the reason stated on the field itself.\n */\nimport { isPlainObject } from '../../../shared/deep-merge.js'\nimport { defaults, type StaticDefaults } from '../preset-data.js'\n\ntype DeepPartial<T> = { [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K] }\n\n/** What a module's config file passes. Everything is optional, including the file itself. */\nexport interface StaticAnalysisInput {\n  /** The module's own directory, normally `import.meta.dirname`. */\n  root?: string\n  /** Files that run although nothing imports them. ADDED to the shipped patterns. */\n  entry?: string[]\n  /** Named journeys, as `{ name: [globs] }`. MERGED by name with any shipped ones. */\n  journeys?: Record<string, string[]>\n  /**\n   * The seam. Replaces whatever it names, and every path it sets lands in `moved`.\n   *\n   * ⛔ `tools` is excluded, and the reason is the whole point of translating the vocabulary: a\n   * module knows the ROLE, not the tool underneath it. A key named after the vendor would mean\n   * nothing to the person reading their own config file, and showing it would invite them to learn\n   * a name we are working to keep out of their world. The passthrough still exists, on sentinel's\n   * side, for a preset that needs a vendor option; a module that genuinely needs one gets a key in\n   * OUR vocabulary, which is the right friction because it goes through a review instead of\n   * spreading silently.\n   */\n  overrides?: DeepPartial<Omit<StaticDefaults, 'tools'>>\n}\n\nexport interface ResolvedStaticConfig extends StaticDefaults {\n  /** The module's directory, or null when its config file did not say. */\n  root: string | null\n  /**\n   * Dotted paths the module set through `overrides`, so the report can mark them. Sorted, so\n   * two runs on the same config produce the same report.\n   */\n  moved: string[]\n}\n\n/**\n * Merge `patch` into `base`, recursively, patch winning.\n *\n * Not the `deepMerge` this repo once had: that one existed for WRITING a module's json and was\n * replaced by an in-place jsonc edit, which is why only `isPlainObject` survived. This is the\n * read side, which has no file to preserve and only has to resolve two objects into one.\n *\n * Arrays are replaced, never concatenated. Additive behaviour is a decision about a specific\n * key, which `defineStaticAnalysis` makes explicitly for `entry`, rather than a property of the\n * merge: a merge that silently concatenates cannot express \"replace this list\", and a team\n * reaching for `overrides` is asking for exactly that.\n */\nfunction mergeInto<T>(base: T, patch: unknown): T {\n  if (!isPlainObject(patch)) return base\n  if (!isPlainObject(base)) return patch as T\n  const out: Record<string, unknown> = { ...base }\n  for (const [key, value] of Object.entries(patch)) {\n    out[key] = isPlainObject(value) ? mergeInto(out[key], value) : value\n  }\n  return out as T\n}\n\n/** Every leaf path in `patch`, dotted, so a reader can be told what the module decided. */\nfunction leafPaths(patch: unknown, prefix = ''): string[] {\n  if (!isPlainObject(patch)) return prefix ? [prefix] : []\n  return Object.entries(patch).flatMap(([key, value]) =>\n    leafPaths(value, prefix ? `${prefix}.${key}` : key),\n  )\n}\n\n/** The same list with duplicates dropped, keeping the first occurrence's order. */\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)]\n}\n\n/**\n * Drop the vendor passthrough from what a module sent.\n *\n * ⚠️ Enforced here and not by the type, because the type cannot: a module's config file is `.mjs`,\n * so nothing type-checks it, and `Omit` on the input would be documentation that compiles away. A\n * `tools` key written there is dropped and NAMED on stderr rather than ignored, so a developer who\n * found the key somewhere learns why it did nothing instead of concluding the role is broken.\n */\nfunction withoutVendorKeys(overrides: unknown): unknown {\n  if (!isPlainObject(overrides) || !('tools' in overrides)) return overrides\n  const { tools: _vendor, ...rest } = overrides\n  process.stderr.write(\n    'sentinel static-analysis: ignoring `overrides.tools` from this module. The tool underneath ' +\n      \"the role is not part of a module's surface; if a setting is missing, it needs a key of \" +\n      'its own.\\n',\n  )\n  return rest\n}\n\n/** Resolve a module's declaration against this role's defaults. */\nexport function defineStaticAnalysis(input: StaticAnalysisInput = {}): ResolvedStaticConfig {\n  const declared: StaticDefaults = {\n    ...defaults,\n    entry: unique([...defaults.entry, ...(input.entry ?? [])]),\n    journeys: { ...defaults.journeys, ...(input.journeys ?? {}) },\n  }\n  const overrides = withoutVendorKeys(input.overrides)\n\n  return {\n    ...mergeInto(declared, overrides),\n    root: input.root ?? null,\n    moved: leafPaths(overrides).sort(),\n  }\n}\n"],"mappings":";AAcO,SAAS,cAAc,OAAkD;AAC9E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AChBA;AAAA,EACE,OAAS,CAAC,4BAA4B,eAAe;AAAA,EACrD,QAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAa,CAAC,cAAc,cAAc,OAAO,OAAO,OAAO,MAAM;AAAA,EACrE,UAAY,CAAC;AAAA,EACb,aAAe,EAAE,WAAa,IAAI,UAAY,GAAG,OAAS,CAAC,OAAO,EAAE;AAAA,EACpE,UAAY;AAAA,IACV,eAAiB;AAAA,IACjB,YAAc,CAAC,eAAe,iBAAiB,iBAAiB,eAAe;AAAA,EACjF;AAAA,EACA,YAAc,EAAE,wBAA0B,GAAG,iBAAmB,EAAE;AAAA,EAClE,OAAS,EAAE,OAAS,CAAC,EAAE;AACzB;;;ACuDO,IAAM,aAAa;AAcnB,IAAM,WAA2B;;;ACdxC,SAAS,UAAa,MAAS,OAAmB;AAChD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,IAAI,EAAG,QAAO;AACjC,QAAM,MAA+B,EAAE,GAAG,KAAK;AAC/C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI,cAAc,KAAK,IAAI,UAAU,IAAI,GAAG,GAAG,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAgB,SAAS,IAAc;AACxD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AACvD,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAQ,CAAC,CAAC,KAAK,KAAK,MAC/C,UAAU,OAAO,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK,GAAG;AAAA,EACpD;AACF;AAGA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAUA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,CAAC,cAAc,SAAS,KAAK,EAAE,WAAW,WAAY,QAAO;AACjE,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AACpC,UAAQ,OAAO;AAAA,IACb;AAAA,EAGF;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,QAA6B,CAAC,GAAyB;AAC1F,QAAM,WAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,GAAI,MAAM,SAAS,CAAC,CAAE,CAAC;AAAA,IACzD,UAAU,EAAE,GAAG,SAAS,UAAU,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC9D;AACA,QAAM,YAAY,kBAAkB,MAAM,SAAS;AAEnD,SAAO;AAAA,IACL,GAAG,UAAU,UAAU,SAAS;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,UAAU,SAAS,EAAE,KAAK;AAAA,EACnC;AACF;","names":[]}
+{"version":3,"sources":["../src/shared/deep-merge.ts","../src/roles/static-analysis/presets/shared.json","../src/roles/static-analysis/preset-data.ts","../src/roles/static-analysis/configs/define.ts"],"sourcesContent":["/**\n * Is this a plain JSON object?\n *\n * The file is named for a `deepMerge` that no longer exists. It was written when the engine\n * merged JSON in memory and wrote the result; that approach was replaced by editing the\n * document IN PLACE with jsonc-parser, so a project's comments, key order and formatting\n * survive a `merge-json` op. Nothing has called `deepMerge` since, except its own recursion,\n * so it went.\n *\n * What remains is the predicate the in-place merge still needs, to decide whether a value is\n * a branch to walk into or a leaf to set.\n */\n\n/** True for a mergeable plain object (not null, not an array). */\nexport function isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n","{\n  \"entry\": [\"**/*.integration-spec.ts\", \"**/*.steps.ts\"],\n  \"ignore\": [\n    \"**/node_modules/**\",\n    \"**/dist/**\",\n    \"**/build/**\",\n    \"**/coverage/**\",\n    \"**/.next/**\",\n    \"**/static-analysis-report/**\",\n    \"**/__mocks__/**\",\n    \"**/mocks/**\",\n    \"**/_mock_/**\",\n    \"**/**Mock**/**\",\n    \"**/__fixtures__/**\",\n    \"**/fixtures/**\",\n    \"**/public/**\",\n    \"**/.husky/**\",\n    \"**/.vscode/**\",\n    \"**/.idea/**\",\n    \"**/.github/**\",\n    \"**/*.d.ts\",\n    \"**/*.gen.ts\",\n    \"**/*.generated.ts\"\n  ],\n  \"languages\": [\"javascript\", \"typescript\", \"jsx\", \"tsx\", \"css\", \"scss\"],\n  \"journeys\": {},\n  \"duplication\": {\n    \"minTokens\": 50,\n    \"minLines\": 5,\n    \"kinds\": [\"exact\"]\n  },\n  \"deadCode\": {\n    \"minConfidence\": 60,\n    \"categories\": [\"unused-file\", \"unused-export\", \"unused-symbol\", \"unused-import\"]\n  },\n  \"tools\": {\n    \"jscpd\": {}\n  }\n}\n","/**\n * The static analysis preset: the role's settings, as data.\n *\n * One shared layer and no per-stack preset yet, because nothing measured so far varies by stack:\n * duplication, dead code and complexity are the same questions in Nest and in React. The split\n * that is already foreseen is `LCOM4`, which is meaningless on a functional front end and real on\n * nest's 16 568 classes; when it arrives it becomes `nest.json` beside this layer, which is why\n * the values live here as JSON rather than inline in the code.\n *\n * ## Why these values are the role's and not the module's\n *\n * A team declares FACTS about its own domain (which journeys exist, which files are entry points);\n * it does not declare the values a number is judged by. Two files with the same measurement\n * getting different verdicts in two modules would make every figure incomparable, and the first\n * thing this role has to be able to say is that a number means the same thing everywhere.\n *\n * That is a default, not a wall: a module CAN move any of them (see `configs/define.ts`), and when\n * it does the report prints `(module)` next to the value. The seam exists from the first commit\n * because retrofitting one later means rewriting every module's file.\n *\n * ⛔ There are no thresholds here, and their absence is a decision rather than an omission.\n *\n * A threshold was written first, at 5% of duplicated lines, and then removed. Measured over all 228\n * nx projects: 5% flags 65 of the 201 measurable modules, a third of the repository, and moving the\n * figure until the count felt manageable is not calibration, it is fitting the instrument to the\n * answer. Calibration is legitimate when a bench is polluted and the noise is removed, or when the\n * reference frame changes; neither applies to a share of duplicated lines.\n *\n * And there is nothing to calibrate AGAINST: of the sources in `docs/static-analysis-study.md`\n * section 5, NDepend, Lattix, ArchUnit, CodeScene and Arcan, none publishes a threshold for\n * duplicated lines. One invented here would travel as if it were published.\n *\n * So the role reports the measurement. What makes a single figure readable is the distribution it\n * sits in, which only a workspace-wide run can know, so that belongs to the sweep and to the\n * migration page, not to a module's own report. The first defensible warning will not be an absolute\n * number either: a module that got WORSE than its own previous measurement is a signal that needs no\n * invented bar, which is what a baseline gives, and that was already deferred for its own reasons.\n *\n * ## Where each value comes from, so nobody has to guess later\n *\n *  - `entry` is the single most consequential line in the file. Measured on\n *    `apps/nest/microservices/network` with jscpd 5.4.0: with nothing declared the dead-code pass\n *    reports **33.4%** of lines dead (79 657 lines, 232 files, 13 entry points); with these two\n *    patterns declared it reports **1.0%** (2 462 lines, 207 entry points). The cause is a naming\n *    convention and not a bug: our integration tests are `foo.integration-spec.ts` with a HYPHEN,\n *    so they do not end in `.spec.ts` and the tool's own test-file detection never sees them, and\n *    the 115 `.steps.ts` BDD definitions are tests by no convention it knows. A module ADDS to\n *    this list rather than replacing it, precisely so no team can lose these two by declaring a\n *    third.\n *\n *  - `languages` is this role's name for what the tool calls `format`, a word that already names\n *    another sentinel role and means something else there. Stating it has a measured cost either\n *    way: on `apps/front/console`, naming `typescript` alone scans 300 of 523 files because `.tsx`\n *    is a SEPARATE language to the tool, naming all four scans 522 (the one left out being\n *    `styles.css`), and naming nothing scans every one of its 224 languages, json and markdown\n *    included. Stylesheets are in deliberately: measured on `libs/front` they duplicate at 9.64%\n *    against 3.50% for the code, a signal that only survives because the report is broken down per\n *    language.\n *\n *  - `duplication.minTokens` and `minLines` are the detection window, and the window decides what\n *    is INVISIBLE: a fragment shorter than it is not reported at all, so a reader comparing two\n *    runs has to know both values. They are the tool's own defaults, written out rather than\n *    inherited for that reason.\n *\n *  - `duplication.kinds` is `exact` alone, and that is a correctness constraint rather than\n *    caution. Measured: with a second kind enabled, `duplicatedLines` adds up overlapping clones.\n *    Two 9-line files reported 13 duplicated lines out of 18, 72%, because an `exact` clone of\n *    lines 1-4 and a `similar` clone of lines 1-9 containing it were both counted; the real extent\n *    is 9 of 18, 50%. The tool's own answer is to cap the display at 100%, which does not make a\n *    threshold meaningful. Opening another kind therefore requires computing the share ourselves\n *    from the UNION of the line ranges.\n *\n *  - `deadCode.minConfidence` is the tool's own default of 60. It scores every finding and names\n *    what lowered it (a file calling `eval`, an unrecognised decorator, a name appearing in a\n *    string literal, a file in the scan that did not parse). Measured on sentinel: 60 yields 20\n *    files, 10 exports and 22 symbols; 90 yields 18 files; 100 yields nothing.\n *\n *  - `deadCode.categories` leaves out `unused-member` deliberately: without type information\n *    `x.render()` could reach any `render` in the project, which the tool itself calls its least\n *    certain rule.\n *\n *  - `ignore` excludes generated, vendored and fixture code, which duplicates by nature and buries\n *    the clones a developer can act on. It is load-bearing rather than tidy: measured on this\n *    package, scanning the module root with no ignore list reports 18 186 files and 32 153 clones,\n *    **31 969** of them touching `node_modules`; with the list, 408 files and zero.\n *\n *  - `tools.jscpd` is passed to the tool verbatim, and it is **sentinel's own** escape hatch, not a\n *    module's: `defineStaticAnalysis` excludes it from what a module can override. Everything above\n *    uses OUR key names, translated on the way out, so that replacing the tool one day does not\n *    oblige a single module to edit its config file, and a module only ever knows the ROLE. This\n *    block is where that guarantee stops, which is why it stays on this side and why it is empty:\n *    the first thing to put in it would be an option a single preset needs, not a workaround.\n */\nimport sharedData from './presets/shared.json'\n\n/**\n * Where the json and html reports are written, relative to the module.\n *\n * Named for the role rather than left on the tool's default `report/`, and added to `.gitignore`\n * by `--init`. Both halves matter: the format role once shipped a `lint/` directory that nothing\n * ignored, and every adopting module grew an untracked directory nobody could explain.\n */\nexport const REPORT_DIR = 'static-analysis-report'\n\nexport type StaticDefaults = {\n  entry: string[]\n  ignore: string[]\n  languages: string[]\n  journeys: Record<string, string[]>\n  duplication: { minTokens: number; minLines: number; kinds: string[] }\n  deadCode: { minConfidence: number; categories: string[] }\n  tools: { jscpd: Record<string, unknown> }\n}\n\n/** The role's settings. Read-only here; `defineStaticAnalysis` resolves a module against them. */\nexport const defaults: StaticDefaults = sharedData as StaticDefaults\n","/**\n * `defineStaticAnalysis`: what a module imports to declare its own static analysis settings.\n *\n * ```js\n * // static-analysis.config.mjs\n * import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'\n *\n * export default defineStaticAnalysis({\n *   root: import.meta.dirname,\n *   entry: ['**\\/*.steps.ts'],\n *   journeys: { planning: ['src/planning/**'] },\n * })\n * ```\n *\n * ## Why a function and not `{ ...baseConfig, ... }`\n *\n * A spread is SHALLOW, so a module writing `deadCode: { minConfidence: 80 }` would replace the\n * whole block and silently lose `categories`. And the flattening happens in the module's file,\n * before this package ever sees the object, so nothing here could tell \"set one key, keep the\n * rest\" from \"set one key, drop the rest\". A function receives the module's INTENT, the keys it\n * actually passed, and merges them here. Second reason: the defaults are never copied into a\n * module, so changing one reaches every module at the next release instead of leaving 108 stale\n * copies behind.\n *\n * Same shape as `reactTestConfig` in the test role, for the same reasons.\n *\n * ## Two semantics, one obvious and one deliberate\n *\n * `entry` and `journeys` are FACTS a team declares, and they ADD to what this role ships: no\n * module can lose `**\\/*.integration-spec.ts` by declaring a third pattern, which matters\n * because that one pattern is the difference between 33.4% and 1.0% of dead code on a real\n * service (see `defaults.ts`).\n *\n * `overrides` REPLACES, including those lists. It is the seam for the day a team has a real\n * reason, it is not documented anywhere a developer would meet it, and every path it sets is\n * recorded in `moved` so the report can print `(module)` next to the value. Without that trace\n * two modules stop being comparable and nobody knows. It reaches every setting EXCEPT the vendor\n * passthrough, for the reason stated on the field itself.\n */\nimport { isPlainObject } from '../../../shared/deep-merge.js'\nimport { defaults, type StaticDefaults } from '../preset-data.js'\n\ntype DeepPartial<T> = { [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K] }\n\n/** What a module's config file passes. Everything is optional, including the file itself. */\nexport interface StaticAnalysisInput {\n  /** The module's own directory, normally `import.meta.dirname`. */\n  root?: string\n  /** Files that run although nothing imports them. ADDED to the shipped patterns. */\n  entry?: string[]\n  /** Named journeys, as `{ name: [globs] }`. MERGED by name with any shipped ones. */\n  journeys?: Record<string, string[]>\n  /**\n   * The seam. Replaces whatever it names, and every path it sets lands in `moved`.\n   *\n   * ⛔ `tools` is excluded, and the reason is the whole point of translating the vocabulary: a\n   * module knows the ROLE, not the tool underneath it. A key named after the vendor would mean\n   * nothing to the person reading their own config file, and showing it would invite them to learn\n   * a name we are working to keep out of their world. The passthrough still exists, on sentinel's\n   * side, for a preset that needs a vendor option; a module that genuinely needs one gets a key in\n   * OUR vocabulary, which is the right friction because it goes through a review instead of\n   * spreading silently.\n   */\n  overrides?: DeepPartial<Omit<StaticDefaults, 'tools'>>\n}\n\nexport interface ResolvedStaticConfig extends StaticDefaults {\n  /** The module's directory, or null when its config file did not say. */\n  root: string | null\n  /**\n   * Dotted paths the module set through `overrides`, so the report can mark them. Sorted, so\n   * two runs on the same config produce the same report.\n   */\n  moved: string[]\n}\n\n/**\n * Merge `patch` into `base`, recursively, patch winning.\n *\n * Not the `deepMerge` this repo once had: that one existed for WRITING a module's json and was\n * replaced by an in-place jsonc edit, which is why only `isPlainObject` survived. This is the\n * read side, which has no file to preserve and only has to resolve two objects into one.\n *\n * Arrays are replaced, never concatenated. Additive behaviour is a decision about a specific\n * key, which `defineStaticAnalysis` makes explicitly for `entry`, rather than a property of the\n * merge: a merge that silently concatenates cannot express \"replace this list\", and a team\n * reaching for `overrides` is asking for exactly that.\n */\nfunction mergeInto<T>(base: T, patch: unknown): T {\n  if (!isPlainObject(patch)) return base\n  if (!isPlainObject(base)) return patch as T\n  const out: Record<string, unknown> = { ...base }\n  for (const [key, value] of Object.entries(patch)) {\n    out[key] = isPlainObject(value) ? mergeInto(out[key], value) : value\n  }\n  return out as T\n}\n\n/** Every leaf path in `patch`, dotted, so a reader can be told what the module decided. */\nfunction leafPaths(patch: unknown, prefix = ''): string[] {\n  if (!isPlainObject(patch)) return prefix ? [prefix] : []\n  return Object.entries(patch).flatMap(([key, value]) =>\n    leafPaths(value, prefix ? `${prefix}.${key}` : key),\n  )\n}\n\n/** The same list with duplicates dropped, keeping the first occurrence's order. */\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)]\n}\n\n/**\n * Drop the vendor passthrough from what a module sent.\n *\n * ⚠️ Enforced here and not by the type, because the type cannot: a module's config file is `.mjs`,\n * so nothing type-checks it, and `Omit` on the input would be documentation that compiles away. A\n * `tools` key written there is dropped and NAMED on stderr rather than ignored, so a developer who\n * found the key somewhere learns why it did nothing instead of concluding the role is broken.\n */\nfunction withoutVendorKeys(overrides: unknown): unknown {\n  if (!isPlainObject(overrides) || !('tools' in overrides)) return overrides\n  const { tools: _vendor, ...rest } = overrides\n  process.stderr.write(\n    'sentinel static-analysis: ignoring `overrides.tools` from this module. The tool underneath ' +\n      \"the role is not part of a module's surface; if a setting is missing, it needs a key of \" +\n      'its own.\\n',\n  )\n  return rest\n}\n\n/** Resolve a module's declaration against this role's defaults. */\nexport function defineStaticAnalysis(input: StaticAnalysisInput = {}): ResolvedStaticConfig {\n  const declared: StaticDefaults = {\n    ...defaults,\n    entry: unique([...defaults.entry, ...(input.entry ?? [])]),\n    journeys: { ...defaults.journeys, ...(input.journeys ?? {}) },\n  }\n  const overrides = withoutVendorKeys(input.overrides)\n\n  return {\n    ...mergeInto(declared, overrides),\n    root: input.root ?? null,\n    moved: leafPaths(overrides).sort(),\n  }\n}\n"],"mappings":";AAcO,SAAS,cAAc,OAAkD;AAC9E,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AChBA;AAAA,EACE,OAAS,CAAC,4BAA4B,eAAe;AAAA,EACrD,QAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAa,CAAC,cAAc,cAAc,OAAO,OAAO,OAAO,MAAM;AAAA,EACrE,UAAY,CAAC;AAAA,EACb,aAAe;AAAA,IACb,WAAa;AAAA,IACb,UAAY;AAAA,IACZ,OAAS,CAAC,OAAO;AAAA,EACnB;AAAA,EACA,UAAY;AAAA,IACV,eAAiB;AAAA,IACjB,YAAc,CAAC,eAAe,iBAAiB,iBAAiB,eAAe;AAAA,EACjF;AAAA,EACA,OAAS;AAAA,IACP,OAAS,CAAC;AAAA,EACZ;AACF;;;ACgEO,IAAM,aAAa;AAanB,IAAM,WAA2B;;;AC3BxC,SAAS,UAAa,MAAS,OAAmB;AAChD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,CAAC,cAAc,IAAI,EAAG,QAAO;AACjC,QAAM,MAA+B,EAAE,GAAG,KAAK;AAC/C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI,cAAc,KAAK,IAAI,UAAU,IAAI,GAAG,GAAG,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAgB,SAAS,IAAc;AACxD,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AACvD,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAQ,CAAC,CAAC,KAAK,KAAK,MAC/C,UAAU,OAAO,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK,GAAG;AAAA,EACpD;AACF;AAGA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAUA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,CAAC,cAAc,SAAS,KAAK,EAAE,WAAW,WAAY,QAAO;AACjE,QAAM,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI;AACpC,UAAQ,OAAO;AAAA,IACb;AAAA,EAGF;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,QAA6B,CAAC,GAAyB;AAC1F,QAAM,WAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,GAAI,MAAM,SAAS,CAAC,CAAE,CAAC;AAAA,IACzD,UAAU,EAAE,GAAG,SAAS,UAAU,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC9D;AACA,QAAM,YAAY,kBAAkB,MAAM,SAAS;AAEnD,SAAO;AAAA,IACL,GAAG,UAAU,UAAU,SAAS;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,OAAO,UAAU,SAAS,EAAE,KAAK;AAAA,EACnC;AACF;","names":[]}

package/dist/{chunk-AHA7LGGA.js → chunk-JNXDJ2QD.js}

@@ -53,19 +53,19 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-E3MYVYEZ.js";
+} from "./chunk-KLEXJFJ6.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   findWorkspaceRoot,
   moduleName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-YQRDKWSH.js";
 import {
   REPORT_DIR,
   defineStaticAnalysis,
   isPlainObject
-} from "./chunk-GJGZRXM3.js";
+} from "./chunk-DVKTH3RY.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -4932,7 +4932,7 @@ function fileSettings(config) {
     ...config.tools.jscpd
   };
 }
-function duplicationRun(config, reportDir, paths) {
+function duplicationRun(config, paths) {
   const dir = mkdtempSync(join18(tmpdir(), "sentinel-static-"));
   const configPath = join18(dir, "jscpd.json");
   writeFileSync3(configPath, `${JSON.stringify(fileSettings(config), null, 2)}
@@ -4948,11 +4948,11 @@ function duplicationRun(config, reportDir, paths) {
     "--reporters",
     "json",
     "--output",
-    reportDir,
+    dir,
     "--no-tips",
     ...paths
   ];
-  return { args, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
+  return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
 }
 
 // src/roles/static-analysis/adapters/jscpd/resolve.ts
@@ -4970,9 +4970,7 @@ var scripts = () => ({
   [`${SCRIPT}:html`]: `sentinel --run --${SCRIPT} --output html`
 });
 var targets = () => ({
-  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] },
-  [`${SCRIPT}:json`]: { cache: false },
-  [`${SCRIPT}:html`]: { cache: false }
+  [SCRIPT]: { cache: true, inputs: ["default", `{projectRoot}/${STATIC_CONFIG_FILE}`] }
 });
 var CONFIG_STUB = `import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
 
@@ -5008,17 +5006,25 @@ var JscpdAdapter = class extends BaseAdapter {
         // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
         ...existsSync14(join19(context.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: CONFIG_STUB }],
         manifestOperation(context.cwd, scripts()),
-        ...nxTargetOperations({ cwd: context.cwd, targets: targets() }),
-        // The reports are build output. Without this every adopting module grows an untracked
-        // directory nobody can explain, which is exactly what the format role's `lint/` did.
-        { kind: "ensure-lines", path: ".gitignore", lines: [`/${REPORT_DIR}/`] }
+        ...nxTargetOperations({ cwd: context.cwd, targets: targets() })
+        // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
+        // and not here: a per-module rule creates a `.gitignore` in modules that had none and
+        // repeats the same line in every adopting module.
       ],
       notes: [
         `added the three \`${SCRIPT}\` scripts and ${STATIC_CONFIG_FILE}; declare this module's entry points and journeys there, everything else comes from the role`
       ]
     };
   }
-  async run(ctx) {
+  /**
+   * Measure, and emit only when asked to.
+   *
+   * `--run` prints and may write a file; `--report` answers a machine and must do neither, which is
+   * the only difference between the two verbs here. Shared rather than duplicated because the
+   * measurement is where every reserve lives: two copies would drift, and the one that drifted
+   * would be the one nobody reads.
+   */
+  async measure(ctx, emitting) {
     const shape = ctx.output ?? "console";
     if (!SHAPES.includes(shape)) {
       process.stderr.write(
@@ -5057,9 +5063,7 @@ var JscpdAdapter = class extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     const { paths } = splitToolArgs(ctx.cwd, ctx.toolArgs, { valueFlags: ["-c", "--config"] });
-    const reportDir = join19(ctx.cwd, REPORT_DIR);
-    mkdirSync(reportDir, { recursive: true });
-    const { args, dispose } = duplicationRun(config, reportDir, paths.length > 0 ? paths : ["."]);
+    const { args, rawReportDir, dispose } = duplicationRun(config, paths.length > 0 ? paths : ["."]);
     try {
       const result = spawnSync5(jscpd, args, { cwd: ctx.cwd, encoding: "utf8" });
       if (result.error) {
@@ -5070,26 +5074,44 @@ var JscpdAdapter = class extends BaseAdapter {
         return { ok: false, code: 1 };
       }
       if (result.status !== 0) {
+        if (analysedNothing(result.stderr)) {
+          process.stderr.write(
+            `sentinel static-analysis(jscpd): nothing left to measure in this module once the exclusions applied, so no figure is reported (a figure of 0% would be a different claim).
+`
+          );
+          return { ok: true, code: 0 };
+        }
         process.stderr.write(
           `sentinel static-analysis(jscpd): jscpd exited ${result.status}
 ${result.stderr ?? ""}`
         );
         return { ok: false, code: result.status ?? 1 };
       }
-      const report = buildReport(ctx, reportDir, config);
+      const report = buildReport(ctx, rawReportDir);
       if (!report) {
-        process.stderr.write(
-          `sentinel static-analysis(jscpd): jscpd wrote no report in ${REPORT_DIR}
-`
-        );
+        process.stderr.write(`sentinel static-analysis(jscpd): jscpd wrote no report
+`);
         return { ok: false, code: 1 };
       }
-      emit(report, shape, reportDir);
+      if (emitting) emit(report, shape, ctx.cwd);
       return { ok: true, code: 0, metrics: metricsOf(report) };
     } finally {
       dispose();
     }
   }
+  /** `--run`: measure and show it. */
+  async run(ctx) {
+    return this.measure(ctx, true);
+  }
+  /**
+   * `--report`: the same figures, for a machine.
+   *
+   * It writes nothing and prints nothing: the caller is the `--json` envelope or the CI comment,
+   * and a role that also printed its table would make the same numbers arrive twice in two shapes.
+   */
+  async report(ctx) {
+    return this.measure(ctx, false);
+  }
   /**
    * Adoption, from the COMMITTED manifest only, so a workspace-wide sweep stays cheap and needs no
    * install. The script is the marker, which is also how the migration page follows this role.
@@ -5110,7 +5132,10 @@ ${result.stderr ?? ""}`
     };
   }
 };
-function buildReport(ctx, reportDir, config) {
+function analysedNothing(stderr) {
+  return typeof stderr === "string" && stderr.includes("--fail-on-empty");
+}
+function buildReport(ctx, reportDir) {
   const path = join19(reportDir, "jscpd-report.json");
   if (!existsSync14(path)) return void 0;
   let parsed;
@@ -5121,17 +5146,18 @@ function buildReport(ctx, reportDir, config) {
   }
   const total = parsed.statistics?.total;
   if (!total) return void 0;
-  const limit = config.thresholds.duplicatedLinesPercent;
-  const moved = config.moved.includes("thresholds.duplicatedLinesPercent");
   const percent = Number((total.percentage ?? 0).toFixed(2));
   const rows = [
     {
       metric: "duplicatedLinesPercent",
       value: percent,
       unit: "%",
-      threshold: limit,
-      over: percent > limit,
-      moved
+      // No threshold, and none is coming from here: see `preset-data.ts`. The figure is reported as
+      // measured, and what makes it readable is the distribution it sits in, which one module
+      // cannot know.
+      threshold: null,
+      over: false,
+      moved: false
     },
     {
       metric: "clones",
@@ -5155,15 +5181,15 @@ function buildReport(ctx, reportDir, config) {
   );
   return { module: ctx.module, passes: ["duplication"], rows, byLanguage };
 }
-function emit(report, shape, reportDir) {
+function emit(report, shape, cwd) {
   if (shape === "console") {
     process.stdout.write(renderConsole(report));
     return;
   }
   const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
   const body = shape === "json" ? renderJson(report) : renderHtml(report);
-  const path = join19(reportDir, name);
-  writeFileSync4(path, body, "utf8");
+  mkdirSync(join19(cwd, REPORT_DIR), { recursive: true });
+  writeFileSync4(join19(cwd, REPORT_DIR, name), body, "utf8");
   process.stdout.write(`${renderConsole(report)}
   written: ${REPORT_DIR}/${name}
 `);

package/dist/{chunk-E3MYVYEZ.js → chunk-KLEXJFJ6.js}

@@ -6,7 +6,7 @@ import {
   readNxProjectName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-KMKQDGI6.js";
+} from "./chunk-YQRDKWSH.js";
 import {
   matchesTsconfigPattern
 } from "./chunk-O7REVMOC.js";

package/dist/{chunk-KMKQDGI6.js → chunk-YQRDKWSH.js}

@@ -150,6 +150,10 @@ function ensureReleaseAgeAllowList(root, dryRun) {
   writeFileSync(yamlPath, lines.join("\n"));
   return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`;
 }
+var GIT_IGNORE = ".gitignore";
+var REPORT_DIR_NAME = "static-analysis-report";
+var REPORT_PATTERN = `${REPORT_DIR_NAME}/`;
+var REPORT_HEADER = "# @hublo/sentinel: static analysis reports, written inside each module";
 var PRETTIER_IGNORE = ".prettierignore";
 var EXCLUSION_HEADER = "# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier";
 var ROOT_PRETTIER_CONFIGS = [
@@ -197,12 +201,27 @@ ${pattern}
   }
   return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`;
 }
+function ensureReportIgnored(root, dryRun) {
+  const path = join2(root, GIT_IGNORE);
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const already = existing.split("\n").some((line) => line.trim().replace(/^\//, "").replace(/\/$/, "") === REPORT_DIR_NAME);
+  if (already) return void 0;
+  if (dryRun) return `would ignore ${REPORT_PATTERN} in the root ${GIT_IGNORE}`;
+  const prefix = existing.trim() === "" ? "" : `${existing.replace(/\n*$/, "")}
+
+`;
+  writeFileSync(path, `${prefix}${REPORT_HEADER}
+${REPORT_PATTERN}
+`);
+  return `ignored ${REPORT_PATTERN} in the root ${GIT_IGNORE}`;
+}
 function ensureWorkspacePrep(opts) {
   const dryRun = Boolean(opts.dryRun);
   return [
     ensureI18nextSingleton(opts.root, dryRun),
     ensureReleaseAgeAllowList(opts.root, dryRun),
-    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun)
+    opts.formattedModule === void 0 ? void 0 : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),
+    opts.analysedModule === true ? ensureReportIgnored(opts.root, dryRun) : void 0
   ].filter((message) => message !== void 0);
 }
 function inspectWorkspacePrep(root) {
@@ -233,6 +252,16 @@ function inspectWorkspacePrep(root) {
       reason: `pinned to ${legacy}, but pnpm 11 no longer reads the \`pnpm\` field of package.json and says nothing about it, so this override is not applied. Move it to ${WORKSPACE_YAML} under \`overrides:\`, which pnpm 10 and 11 both read.`
     });
   }
+  const ignorePath = join2(root, GIT_IGNORE);
+  if (existsSync2(ignorePath)) {
+    const ignored = readFileSync2(ignorePath, "utf8").split("\n").some((line) => line.trim().replace(/^\//, "").replace(/\/$/, "") === REPORT_DIR_NAME);
+    if (ignored) {
+      entries.push({
+        rule: `${GIT_IGNORE} \u2192 ${REPORT_PATTERN}`,
+        reason: `the static analysis role writes its json and html into \`<module>/${REPORT_PATTERN}\`, and one unanchored line at the root covers every module instead of creating a \`${GIT_IGNORE}\` in each one. Unlike the override above it changes no resolution and no build, so a stale one costs a single unused line. It retires when no module declares a \`static-analysis\` script any more, which the adoption report counts and this read deliberately does not: it would have to sweep every module.`
+      });
+    }
+  }
   const own = readOwnPackage().name;
   if (yaml !== void 0) {
     const listed = new RegExp(`^\\s*-\\s*['"]?${own.replace("/", "\\/")}['"]?\\s*$`, "m").test(yaml);
@@ -259,4 +288,4 @@ export {
   ensureWorkspacePrep,
   inspectWorkspacePrep
 };
-//# sourceMappingURL=chunk-KMKQDGI6.js.map
+//# sourceMappingURL=chunk-YQRDKWSH.js.map

package/dist/chunk-YQRDKWSH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/package-json.ts","../src/core/settings.ts","../src/core/workspace-prep.ts"],"sourcesContent":["/**\n * package.json helpers, shared by the CLI and the engine.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\n/**\n * sentinel's OWN version, for `--version`. We must NOT use\n * `process.env.npm_package_version`, that is the version of whatever script\n * invoked us (an app's package.json, or nothing). Instead walk up from this\n * module to the nearest package.json, which is always sentinel's own, whether\n * running from source or the bundled dist.\n */\n/**\n * sentinel's OWN name + version, read by walking up from this module to the nearest\n * package.json. Used both for `--version` and to pin the exact dependency `--init`\n * writes into an adopted module, so a module always references the version that adopted it.\n */\nexport function readOwnPackage(): { name: string; version: string; bin?: string } {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    const pkgPath = join(dir, 'package.json')\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {\n          name?: string\n          version?: string\n          bin?: string | Record<string, string>\n        }\n        if (typeof pkg.version === 'string') {\n          // The bin PATH, not the command name: a package that adopts itself has to invoke\n          // its own build output, because the `.bin` shim does not exist yet (see below).\n          const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin ?? {})[0]\n          return { name: pkg.name ?? '@hublo/sentinel', version: pkg.version, bin }\n        }\n      } catch {\n        // Malformed package.json; keep walking up.\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) return { name: '@hublo/sentinel', version: '0.0.0' } // filesystem root\n    dir = parent\n  }\n}\n\nexport function readOwnVersion(): string {\n  return readOwnPackage().version\n}\n\n/**\n * Read a module's package.json for framework detection; tolerant of a missing or\n * malformed file (returns `{}`, so detection falls through to the `node` default).\n */\nexport function readProjectPackageJson(dir: string): {\n  /** The package name, which is also what nx calls the project when there is no `project.json`. */\n  name?: string\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  /**\n   * How the module's `.js`/`.ts` files are loaded. It decides whether a Vite config can import\n   * an ESM-only package at all, which is why the build role reads it before rewriting one.\n   */\n  type?: string\n  /**\n   * What nx alone needs per target, which every role writes here and none could read back.\n   *\n   * Typed loosely on purpose: this reader is shared by every role and each one knows the shape of\n   * its own target. Declared at all because a role that WRITES a block and then has to cast to\n   * read it is one refactor away from reading a key it never wrote.\n   */\n  nx?: { targets?: Record<string, Record<string, unknown>> }\n} {\n  const path = join(dir, 'package.json')\n  if (!existsSync(path)) return {}\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as Record<string, never>\n  } catch {\n    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.\\n`)\n    return {}\n  }\n}\n\n/**\n * The nx project name for a module, read from its `project.json`, or undefined if\n * there is none/unreadable. Used when `--init` has to scaffold a `package.json`\n * for a module that only has a `project.json` (common for nx apps/services): the\n * scaffolded file borrows this name so it is a valid, uniquely-named workspace\n * package. Reusable by any tool that scaffolds, not just TypeScript.\n */\nexport function readNxProjectName(dir: string): string | undefined {\n  const path = join(dir, 'project.json')\n  if (!existsSync(path)) return undefined\n  try {\n    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { name?: unknown }\n    return typeof parsed.name === 'string' ? parsed.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * What nx calls this module, resolved the way nx itself resolves it.\n *\n * The precedence is `project.json`, then `package.json`, then the directory, and only the\n * first and last of those were being consulted. A module with no `project.json` therefore\n * answered with its DIRECTORY while nx answered with its package name, and the two disagree\n * in the real repo: `apps/front/hr-management` is `front-hr-management` to nx, as is\n * `apps/front/storybook-app`.\n *\n * That gap is not cosmetic, because this name is what `--module` is matched against. The\n * `serve` script `--init` writes carries `--module <name>`, so a module in that shape was\n * adopted with a script naming a project the workspace does not contain, and `pnpm run serve`\n * failed the day it was adopted with nothing having reported it.\n *\n * One function so the two ends cannot drift again: whoever WRITES the name and whoever\n * RESOLVES it now read the same source.\n */\nexport function moduleName(dir: string): string {\n  const declared = readProjectPackageJson(dir).name\n  return readNxProjectName(dir) ?? (declared === undefined ? basename(dir) : declared)\n}\n","/**\n * Tunable settings: the knobs you would actually change. The fixed vocabulary and\n * its types live in `domain.ts`.\n *\n * Note: the preset is DETECTED from a module's dependencies (see\n * `detect-framework.ts`), deterministically, `node` when no framework dep is present.\n * `--preset` overrides the detection (recommended for `--init`, since hoisted deps\n * can make detection return `node`). The detection table lives in `detect-framework.ts`.\n */\n\n/** A file that marks a workspace root; sentinel refuses to operate there. */\nexport const WORKSPACE_ROOT_MARKER = 'nx.json'\n\n/**\n * How many structured diagnostics a report embeds per module, when the caller does not say.\n *\n * A cap, not a limit on what is counted: the totals stay exact and `diagnosticsTruncated`\n * says when rows were dropped, so a bounded envelope never reads as a clean module. Shared\n * by every role, because a consumer reading `--json` across roles should not have to learn\n * a different cap for each one. `--max-diagnostics 0` means no cap.\n */\nexport const DEFAULT_MAX_DIAGNOSTICS = 100\n","/**\n * Workspace-level preparation that `--init` applies once, at the workspace root, so an\n * adopted module actually installs and resolves cleanly. `--init` writes a module's own\n * files; this is the small, deliberate exception where it also touches the root, because\n * \"set this module up\" is not honest if the workspace it lives in cannot then install or\n * resolve it.\n *\n * Kept intentionally narrow (YAGNI): it applies the specific fixes a workspace's OWN\n * config shows it needs, and is a no-op everywhere else. It is NOT a speculative dedupe\n * engine, when a second, different case appears we generalize from real cases instead of\n * predicting them. The two fixes today:\n *\n *  - i18next singleton override. If the root declares a second TypeScript via the\n *    `@typescript/native` alias (a repo mid-migration running two TypeScripts), adopting a\n *    module re-resolves pnpm and i18next, which carries an optional type-only `typescript`\n *    peer, forks into two peer-keyed variants. That forks react-i18next into two React\n *    contexts and breaks translation-singleton tests. Pinning i18next's `typescript` peer\n *    to the declared TS collapses it to one. Read from the root's own declaration, so it\n *    tracks the version and disappears (no-op) once the migration removes the second TS.\n *    Written to `pnpm-workspace.yaml`, the only place current pnpm reads overrides from.\n *\n *  - release-age allow-list. If the root uses pnpm's `minimumReleaseAgeExclude` gate, a\n *    freshly published sentinel is younger than the gate and will not install; allow-list\n *    it. Only touched when the gate is actually configured.\n *\n *  - root formatter exclusion. A module that has adopted the FORMAT role is formatted by\n *    oxfmt, from its own config. The root Prettier does not know that and still owns every\n *    file in the repo, so `nx format:write` or `prettier --write .` from the root reformats\n *    the module back to the ROOT's style, and the next `pnpm run format` in the module\n *    reverses it. Two formatters fighting over the same files, with whichever ran last\n *    winning, is the exact state adoption removes INSIDE a module, and it has to be removed\n *    at the root too. So the module is excluded in the root `.prettierignore` as it adopts,\n *    and the root's own config is otherwise untouched: it still serves every module that has\n *    not migrated.\n *\n * All three edits are idempotent and defensive: absent the trigger (no second TypeScript, no\n * release-age gate, no root Prettier) each is skipped, so the step is safe on any workspace.\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, relative } from 'node:path'\n\nimport { readOwnPackage } from '../shared/package-json.js'\n\nimport { WORKSPACE_ROOT_MARKER } from './settings.js'\n\nconst OVERRIDE_KEY = 'i18next>typescript'\nconst NATIVE_TS_ALIAS = '@typescript/native' // `npm:typescript@^7.x`: a workspace's second, real TS\nconst WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst RELEASE_AGE_KEY = 'minimumReleaseAgeExclude'\nconst LIST_ITEM = /^(\\s*)-\\s+(.*?)\\s*$/\nconst MAP_ENTRY = /^(\\s+)(.*?):\\s+(.*?)\\s*$/\n\ninterface RootPackageJson {\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  pnpm?: { overrides?: Record<string, string> }\n}\n\n/** Walk up from a module directory to the workspace root (the dir holding the marker). */\nexport function findWorkspaceRoot(startDir: string): string | undefined {\n  let dir = startDir\n  for (;;) {\n    if (existsSync(join(dir, WORKSPACE_ROOT_MARKER))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return undefined\n    dir = parent\n  }\n}\n\n/**\n * The TypeScript version to pin i18next's peer to, read from the root's own\n * `@typescript/native` alias (`npm:typescript@^7.0.2` -> `7.0.2`). Returns undefined when\n * the alias is absent (no second TypeScript, so no fork to fix).\n */\nfunction declaredNativeTs(pkg: RootPackageJson): string | undefined {\n  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS]\n  if (!spec) return undefined\n  const version = spec.slice(spec.lastIndexOf('@') + 1).replace(/^[\\^~>=<\\s]+/, '')\n  return version || undefined\n}\n\n/**\n * Ensure the i18next singleton override matches the declared second TypeScript. No-op when\n * the workspace runs a single TypeScript (no `@typescript/native`). Returns a message when\n * it changed (or would change, under dryRun), else undefined.\n *\n * The override is written to `pnpm-workspace.yaml`, never to `package.json#pnpm`: pnpm 11\n * stopped reading the `pnpm` field and does so SILENTLY, with no warning and no deprecation\n * (pnpm/pnpm#11536), so an override left in `package.json` is simply not applied. The yaml is\n * read by pnpm 10 and 11 alike (https://pnpm.io/settings), which is why there is one target\n * here rather than a version-dependent fallback.\n */\nfunction ensureI18nextSingleton(root: string, dryRun: boolean): string | undefined {\n  const pkgPath = join(root, 'package.json')\n  if (!existsSync(pkgPath)) return undefined\n  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n  const want = declaredNativeTs(pkg)\n  if (!want) return undefined // single TypeScript: nothing forks\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined // no workspace file: nowhere pnpm would read it\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const entry = findOverrideEntry(lines)\n  if (entry.valueIdx !== undefined && entry.value === want) return undefined // already pinned\n  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n\n  applyOverride(lines, entry, want)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n}\n\n/** Where the override sits in the yaml, if at all, plus where a new one would be inserted. */\ninterface OverrideEntry {\n  /** Index of the `OVERRIDE_KEY` line, when the key is already declared. */\n  valueIdx?: number\n  /** Its current value, unquoted. */\n  value?: string\n  /** Index of the `overrides:` key line, when the block exists. */\n  blockIdx?: number\n  /** Index of the block's last entry, so an insertion keeps the block contiguous. */\n  lastEntryIdx?: number\n  /** Indentation the block's entries use. */\n  indent: string\n}\n\n/**\n * Locate the `overrides:` block and the i18next key inside it. A targeted text read rather\n * than a yaml parse, for the same reason `ensureReleaseAgeAllowList` does it: this file is\n * hand-maintained and round-tripping it through a parser would drop its comments and ordering.\n */\nfunction findOverrideEntry(lines: string[]): OverrideEntry {\n  const blockIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === 'overrides:')\n  if (blockIdx === -1) return { indent: '  ' }\n\n  let lastEntryIdx = blockIdx\n  let indent = '  '\n  for (let i = blockIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(MAP_ENTRY)\n    if (!match) break // dedent or blank line: the block ended\n    indent = match[1] ?? indent\n    lastEntryIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === OVERRIDE_KEY) {\n      return {\n        valueIdx: i,\n        value: (match[3] ?? '').replace(/^['\"]|['\"]$/g, ''),\n        blockIdx,\n        lastEntryIdx,\n        indent,\n      }\n    }\n  }\n  return { blockIdx, lastEntryIdx, indent }\n}\n\n/** Update the key in place, append it to an existing block, or open a block at the end. */\nfunction applyOverride(lines: string[], entry: OverrideEntry, want: string): void {\n  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`\n  if (entry.valueIdx !== undefined) {\n    lines[entry.valueIdx] = line\n    return\n  }\n  if (entry.lastEntryIdx !== undefined) {\n    lines.splice(entry.lastEntryIdx + 1, 0, line)\n    return\n  }\n  // No `overrides:` block at all: open one, keeping a single trailing newline.\n  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()\n  lines.push('overrides:', line, '')\n}\n\n/**\n * Ensure sentinel is allow-listed under `minimumReleaseAgeExclude` so a fresh publish\n * installs. No-op when the workspace has no such gate. Targeted text edit so comments and\n * formatting are preserved. Returns a message when it changed (or would), else undefined.\n */\nfunction ensureReleaseAgeAllowList(root: string, dryRun: boolean): string | undefined {\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined\n  const own = readOwnPackage().name\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const keyIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === `${RELEASE_AGE_KEY}:`)\n  if (keyIdx === -1) return undefined // no release-age gate in use\n\n  let lastItemIdx = keyIdx\n  let indent = '  '\n  for (let i = keyIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(LIST_ITEM)\n    if (!match) break\n    indent = match[1] ?? indent\n    lastItemIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === own) return undefined // already listed\n  }\n  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`\n\n  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`\n}\n\n/** The root ignore file Prettier reads, and the section sentinel owns inside it. */\nconst GIT_IGNORE = '.gitignore'\nconst REPORT_DIR_NAME = 'static-analysis-report'\nconst REPORT_PATTERN = `${REPORT_DIR_NAME}/`\nconst REPORT_HEADER = '# @hublo/sentinel: static analysis reports, written inside each module'\nconst PRETTIER_IGNORE = '.prettierignore'\nconst EXCLUSION_HEADER = '# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier'\n\n/** Root Prettier configs. Their presence is what makes an exclusion meaningful. */\nconst ROOT_PRETTIER_CONFIGS = [\n  '.prettierrc',\n  '.prettierrc.json',\n  '.prettierrc.json5',\n  '.prettierrc.yml',\n  '.prettierrc.yaml',\n  '.prettierrc.js',\n  '.prettierrc.cjs',\n  '.prettierrc.mjs',\n  'prettier.config.js',\n  'prettier.config.cjs',\n  'prettier.config.mjs',\n]\n\n/**\n * Exclude a module that now formats itself from the ROOT Prettier.\n *\n * Written as a directory pattern anchored at the root (`/apps/front/x/`), which is what\n * gitignore syntax means by \"this exact directory\", so a module cannot accidentally exclude a\n * same-named directory somewhere else.\n *\n * Skipped entirely when the root has no Prettier at all: there is then nothing to conflict\n * with, and creating an ignore file for a tool the workspace does not use would be noise.\n */\nfunction ensureFormatterExclusion(\n  root: string,\n  moduleDir: string,\n  dryRun: boolean,\n): string | undefined {\n  const rel = relative(root, moduleDir).replaceAll('\\\\', '/')\n  if (rel === '' || rel.startsWith('..')) return undefined // the root itself, or outside it\n\n  const ignorePath = join(root, PRETTIER_IGNORE)\n  const hasPrettier =\n    existsSync(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync(join(root, name)))\n  if (!hasPrettier) return undefined\n\n  const pattern = `/${rel}/`\n  const existing = existsSync(ignorePath) ? readFileSync(ignorePath, 'utf8') : ''\n  const lines = existing.split('\\n')\n  // Already excluded, in whichever spelling a human may have used.\n  if (lines.some((line) => line.trim().replace(/\\/$/, '') === pattern.replace(/\\/$/, ''))) {\n    return undefined\n  }\n  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`\n\n  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER)\n  if (headerIdx === -1) {\n    const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}\\n${pattern}\\n`)\n  } else {\n    // Keep the managed section together and sorted, so the list stays readable as it grows\n    // to 150 entries and a diff shows one added line rather than a reshuffle.\n    let end = headerIdx + 1\n    while (end < lines.length && lines[end]?.trim().startsWith('/')) end += 1\n    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort()\n    writeFileSync(\n      ignorePath,\n      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join('\\n'),\n    )\n  }\n  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`\n}\n\n/**\n * Apply every workspace-level fix the given root needs. Returns the human-readable\n * messages for what changed (empty when nothing did). Under dryRun nothing is written and\n * the messages describe what would change.\n *\n * `formattedModule` is the module that just adopted the FORMAT role, when one did. Absent\n * for a lint-only or TypeScript-only `--init`, because a module that has not adopted the\n * formatter must keep being formatted by the root.\n */\n/**\n * Ignore the static analysis report directory, once, at the ROOT.\n *\n * ## Why the root and not each module\n *\n * The role writes its json and html into `<module>/static-analysis-report/`, so the obvious place\n * for the rule is the module. It was there first, and it was wrong twice over: it CREATES a\n * `.gitignore` in a module that had none, which is a structural change to someone else's module for\n * one line, and it repeats that line once per adopting module. The root already ignores output this\n * way, with `/dist` and `/coverage`.\n *\n * ⚠️ The pattern is deliberately NOT anchored. `/dist` matches only the root's `dist`; the report\n * directory lives inside a module, so `static-analysis-report/` has to match at any depth. Getting\n * that backwards would leave every adopting module with an untracked directory, which is the exact\n * defect this guards against.\n *\n * ## Why this root write is not the dangerous kind\n *\n * The comment on `inspectWorkspacePrep` is right that root writes are what nobody sees afterwards,\n * and the i18next override earned that warning: it re-resolved a module from a pull request that\n * touched none of its files. An ignore line changes no resolution, no build and no install. If it\n * ever goes stale the cost is one unused line, which is why it is reported rather than feared.\n */\nfunction ensureReportIgnored(root: string, dryRun: boolean): string | undefined {\n  const path = join(root, GIT_IGNORE)\n  const existing = existsSync(path) ? readFileSync(path, 'utf8') : ''\n  // Whatever spelling a human may have used: with or without a leading or trailing slash.\n  const already = existing\n    .split('\\n')\n    .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n  if (already) return undefined\n  if (dryRun) return `would ignore ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n\n  const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n  writeFileSync(path, `${prefix}${REPORT_HEADER}\\n${REPORT_PATTERN}\\n`)\n  return `ignored ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n}\n\nexport function ensureWorkspacePrep(opts: {\n  root: string\n  dryRun?: boolean\n  formattedModule?: string\n  /** True when the STATIC ANALYSIS role adopted: it is what earns the ignore line. */\n  analysedModule?: boolean\n}): string[] {\n  const dryRun = Boolean(opts.dryRun)\n  return [\n    ensureI18nextSingleton(opts.root, dryRun),\n    ensureReleaseAgeAllowList(opts.root, dryRun),\n    opts.formattedModule === undefined\n      ? undefined\n      : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),\n    opts.analysedModule === true ? ensureReportIgnored(opts.root, dryRun) : undefined,\n  ].filter((message): message is string => message !== undefined)\n}\n\n/**\n * One standing change sentinel has made to the workspace ROOT, and whether it is still earned.\n *\n * This exists because the three root writes are the only thing sentinel does that nobody can\n * see afterwards. `--init` announces each one on the run that makes it, and then it is a line\n * in someone else's file forever. Two consequences already bit us.\n *\n * The `i18next>typescript` override re-resolved `apps/front/console` from a PR that touched no\n * file under it, so CODEOWNERS pulled nobody and its owners learned about it afterwards.\n *\n * And every one of them is TEMPORARY with its removal condition written in prose. That failed\n * three times in one week: `SENTINEL_TAG=alpha` in the migration-page workflow kept building\n * with a pre-release long after 1.1.0 went stable and reported `Format 0/439` for 15 adopted\n * modules; ADR 0042 and its RFC both sat mid-flight past their deadline; and this release-age\n * exclusion is still waiting on \"once sentinel's release cadence settles\". Nothing failed when\n * any of them expired, because a comment cannot fail.\n *\n * So each entry carries the condition that JUSTIFIES it, evaluated now rather than described.\n * A trigger that has gone away makes the entry dead config, and dead config is something a\n * command can say out loud instead of something a reader has to notice.\n *\n * Read-only, and offline: it inspects the same files `--init` writes and nothing else. What it\n * deliberately does NOT claim is anything needing the npm registry — whether a published\n * version is old enough to clear the release-age gate is not knowable from the repo, so it is\n * stated as the standing exemption it is rather than guessed at.\n */\nexport interface WorkspacePrepEntry {\n  /** `rule` to match the shape the shared renderer already prints as a labelled block. */\n  rule: string\n  /** What it does, whether its trigger still holds, and what would retire it. */\n  reason: string\n}\n\n/** The root-level changes sentinel maintains here, each with its justification checked now. */\nexport function inspectWorkspacePrep(root: string): WorkspacePrepEntry[] {\n  const entries: WorkspacePrepEntry[] = []\n  // Tolerant, unlike the write path above, and the difference is deliberate. `--init` should\n  // fail loudly on a root it cannot parse, because it is about to edit it. `--inspect` is a\n  // read verb that sweeps 441 modules, and one malformed root file must not take the whole\n  // sweep down: the modules still have honest answers to give. Caught by its own test.\n  let pkg: RootPackageJson = {}\n  const pkgPath = join(root, 'package.json')\n  if (existsSync(pkgPath)) {\n    try {\n      pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n    } catch {\n      pkg = {}\n    }\n  }\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  const yaml = existsSync(yamlPath) ? readFileSync(yamlPath, 'utf8') : undefined\n\n  const pinned = yaml === undefined ? undefined : findOverrideEntry(yaml.split('\\n')).value\n  if (pinned !== undefined) {\n    const stillForks = declaredNativeTs(pkg)\n    entries.push({\n      rule: `${WORKSPACE_YAML} → overrides.${OVERRIDE_KEY}`,\n      reason:\n        stillForks === undefined\n          ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing ` +\n            `forks any more. This override is now dead config and can be removed.`\n          : `pinned to ${pinned}, matching the second TypeScript the root declares ` +\n            `(${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, ` +\n            `not only adopted ones. It retires with the second TypeScript.`,\n    })\n  }\n\n  // A copy left in `package.json#pnpm` by an older sentinel, or by hand. Reported because it\n  // is INERT rather than redundant: pnpm 11 dropped the `pnpm` field with no warning\n  // (pnpm/pnpm#11536), so it reads as protection that is not applied.\n  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY]\n  if (legacy !== undefined) {\n    entries.push({\n      rule: `package.json → pnpm.overrides.${OVERRIDE_KEY}`,\n      reason:\n        `pinned to ${legacy}, but pnpm 11 no longer reads the \\`pnpm\\` field of package.json ` +\n        `and says nothing about it, so this override is not applied. Move it to ` +\n        `${WORKSPACE_YAML} under \\`overrides:\\`, which pnpm 10 and 11 both read.`,\n    })\n  }\n\n  const ignorePath = join(root, GIT_IGNORE)\n  if (existsSync(ignorePath)) {\n    const ignored = readFileSync(ignorePath, 'utf8')\n      .split('\\n')\n      .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n    if (ignored) {\n      entries.push({\n        rule: `${GIT_IGNORE} → ${REPORT_PATTERN}`,\n        reason:\n          `the static analysis role writes its json and html into ` +\n          `\\`<module>/${REPORT_PATTERN}\\`, and one unanchored line at the root covers every module ` +\n          `instead of creating a \\`${GIT_IGNORE}\\` in each one. Unlike the override above it changes ` +\n          `no resolution and no build, so a stale one costs a single unused line. It retires when no ` +\n          `module declares a \\`static-analysis\\` script any more, which the adoption report counts ` +\n          `and this read deliberately does not: it would have to sweep every module.`,\n      })\n    }\n  }\n\n  const own = readOwnPackage().name\n  if (yaml !== undefined) {\n    const listed = new RegExp(`^\\\\s*-\\\\s*['\"]?${own.replace('/', '\\\\/')}['\"]?\\\\s*$`, 'm').test(yaml)\n    if (listed) {\n      const gated = new RegExp(`^\\\\s*minimumReleaseAge\\\\s*:`, 'm').test(yaml)\n      entries.push({\n        rule: `${WORKSPACE_YAML} → ${RELEASE_AGE_KEY}: ${own}`,\n        reason: gated\n          ? `${own} is exempt from this workspace's release-age gate, so a freshly published ` +\n            `version installs instead of being held. That is a standing exemption from a ` +\n            `supply-chain control: the exposure is one bump wide, since the version is pinned ` +\n            `and the lockfile carries its integrity, so a re-publish of the same version does ` +\n            `not pass. Retire it once a bump can simply wait out the window.`\n          : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so ` +\n            `there is no gate to be exempt from. This entry is now dead config and can be removed.`,\n      })\n    }\n  }\n\n  return entries\n}\n"],"mappings":";AAGA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,qBAAqB;AAcvB,SAAS,iBAAkE;AAChF,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,YAAI,OAAO,IAAI,YAAY,UAAU;AAGnC,gBAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;AAClF,iBAAO,EAAE,MAAM,IAAI,QAAQ,mBAAmB,SAAS,IAAI,SAAS,IAAI;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AACvE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,iBAAyB;AACvC,SAAO,eAAe,EAAE;AAC1B;AAMO,SAAS,uBAAuB,KAkBrC;AACA,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,YAAQ,OAAO,MAAM,6BAA6B,IAAI;AAAA,CAA6B;AACnF,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,kBAAkB,KAAiC;AACjE,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,WAAW,KAAqB;AAC9C,QAAM,WAAW,uBAAuB,GAAG,EAAE;AAC7C,SAAO,kBAAkB,GAAG,MAAM,aAAa,SAAY,SAAS,GAAG,IAAI;AAC7E;;;AC9GO,IAAM,wBAAwB;AAU9B,IAAM,0BAA0B;;;ACiBvC,SAAS,cAAAA,aAAY,gBAAAC,eAAc,qBAAqB;AACxD,SAAS,WAAAC,UAAS,QAAAC,OAAM,gBAAgB;AAMxC,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAClB,IAAM,YAAY;AASX,SAAS,kBAAkB,UAAsC;AACtE,MAAI,MAAM;AACV,aAAS;AACP,QAAIC,YAAWC,MAAK,KAAK,qBAAqB,CAAC,EAAG,QAAO;AACzD,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOA,SAAS,iBAAiB,KAA0C;AAClE,QAAM,OAAO,IAAI,eAAe,eAAe,KAAK,IAAI,kBAAkB,eAAe;AACzF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAChF,SAAO,WAAW;AACpB;AAaA,SAAS,uBAAuB,MAAc,QAAqC;AACjF,QAAM,UAAUD,MAAK,MAAM,cAAc;AACzC,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO;AACjC,QAAM,MAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AACpD,QAAM,OAAO,iBAAiB,GAAG;AACjC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,QAAQ,kBAAkB,KAAK;AACrC,MAAI,MAAM,aAAa,UAAa,MAAM,UAAU,KAAM,QAAO;AACjE,MAAI,OAAQ,QAAO,aAAa,YAAY,OAAO,IAAI,OAAO,cAAc;AAE5E,gBAAc,OAAO,OAAO,IAAI;AAChC,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,UAAU,YAAY,OAAO,IAAI,OAAO,cAAc;AAC/D;AAqBA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,WAAW,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,YAAY;AACpF,MAAI,aAAa,GAAI,QAAO,EAAE,QAAQ,KAAK;AAE3C,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,WAAS,IAAI,WAAW,GAAG,IAAI,MAAM,QAAQ,KAAK;AAChD,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,mBAAe;AACf,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,cAAc;AACjE,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,cAAc,OAAO;AAC1C;AAGA,SAAS,cAAc,OAAiB,OAAsB,MAAoB;AAChF,QAAM,OAAO,GAAG,MAAM,MAAM,IAAI,YAAY,MAAM,IAAI;AACtD,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,MAAM,QAAQ,IAAI;AACxB;AAAA,EACF;AACA,MAAI,MAAM,iBAAiB,QAAW;AACpC,UAAM,OAAO,MAAM,eAAe,GAAG,GAAG,IAAI;AAC5C;AAAA,EACF;AAEA,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,GAAI,OAAM,IAAI;AACrE,QAAM,KAAK,cAAc,MAAM,EAAE;AACnC;AAOA,SAAS,0BAA0B,MAAc,QAAqC;AACpF,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,MAAM,eAAe,EAAE;AAC7B,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,SAAS,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG;AAC3F,MAAI,WAAW,GAAI,QAAO;AAE1B,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,WAAS,IAAI,SAAS,GAAG,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,kBAAc;AACd,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,IAAK,QAAO;AAAA,EACnE;AACA,MAAI,OAAQ,QAAO,oBAAoB,GAAG,UAAU,eAAe;AAEnE,QAAM,OAAO,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,GAAG;AACtD,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,gBAAgB,GAAG,UAAU,eAAe,OAAO,cAAc;AAC1E;AAGA,IAAM,aAAa;AACnB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB,GAAG,eAAe;AACzC,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGzB,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYA,SAAS,yBACP,MACA,WACA,QACoB;AACpB,QAAM,MAAM,SAAS,MAAM,SAAS,EAAE,WAAW,MAAM,GAAG;AAC1D,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,EAAG,QAAO;AAE/C,QAAM,aAAaF,MAAK,MAAM,eAAe;AAC7C,QAAM,cACJD,YAAW,UAAU,KAAK,sBAAsB,KAAK,CAAC,SAASA,YAAWC,MAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,IAAI,GAAG;AACvB,QAAM,WAAWD,YAAW,UAAU,IAAIG,cAAa,YAAY,MAAM,IAAI;AAC7E,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,MAAI,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI,OAAQ,QAAO,iBAAiB,GAAG,4BAA4B,eAAe;AAElF,QAAM,YAAY,MAAM,UAAU,CAAC,SAAS,KAAK,KAAK,MAAM,gBAAgB;AAC5E,MAAI,cAAc,IAAI;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,kBAAc,YAAY,GAAG,MAAM,GAAG,gBAAgB;AAAA,EAAK,OAAO;AAAA,CAAI;AAAA,EACxE,OAAO;AAGL,QAAI,MAAM,YAAY;AACtB,WAAO,MAAM,MAAM,UAAU,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AACxE,UAAM,UAAU,CAAC,GAAG,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,OAAO,EAAE,KAAK;AACnE;AAAA,MACE;AAAA,MACA,CAAC,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,YAAY,GAAG,4BAA4B,eAAe;AACnE;AAkCA,SAAS,oBAAoB,MAAc,QAAqC;AAC9E,QAAM,OAAOF,MAAK,MAAM,UAAU;AAClC,QAAM,WAAWD,YAAW,IAAI,IAAIG,cAAa,MAAM,MAAM,IAAI;AAEjE,QAAM,UAAU,SACb,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,MAAI,QAAS,QAAO;AACpB,MAAI,OAAQ,QAAO,gBAAgB,cAAc,gBAAgB,UAAU;AAE3E,QAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,gBAAc,MAAM,GAAG,MAAM,GAAG,aAAa;AAAA,EAAK,cAAc;AAAA,CAAI;AACpE,SAAO,WAAW,cAAc,gBAAgB,UAAU;AAC5D;AAEO,SAAS,oBAAoB,MAMvB;AACX,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,SAAO;AAAA,IACL,uBAAuB,KAAK,MAAM,MAAM;AAAA,IACxC,0BAA0B,KAAK,MAAM,MAAM;AAAA,IAC3C,KAAK,oBAAoB,SACrB,SACA,yBAAyB,KAAK,MAAM,KAAK,iBAAiB,MAAM;AAAA,IACpE,KAAK,mBAAmB,OAAO,oBAAoB,KAAK,MAAM,MAAM,IAAI;AAAA,EAC1E,EAAE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAChE;AAoCO,SAAS,qBAAqB,MAAoC;AACvE,QAAM,UAAgC,CAAC;AAKvC,MAAI,MAAuB,CAAC;AAC5B,QAAM,UAAUF,MAAK,MAAM,cAAc;AACzC,MAAID,YAAW,OAAO,GAAG;AACvB,QAAI;AACF,YAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,YAAM,CAAC;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,QAAM,OAAOD,YAAW,QAAQ,IAAIG,cAAa,UAAU,MAAM,IAAI;AAErE,QAAM,SAAS,SAAS,SAAY,SAAY,kBAAkB,KAAK,MAAM,IAAI,CAAC,EAAE;AACpF,MAAI,WAAW,QAAW;AACxB,UAAM,aAAa,iBAAiB,GAAG;AACvC,YAAQ,KAAK;AAAA,MACX,MAAM,GAAG,cAAc,qBAAgB,YAAY;AAAA,MACnD,QACE,eAAe,SACX,aAAa,MAAM,qCAAqC,eAAe,sFAEvE,aAAa,MAAM,uDACf,eAAe;AAAA,IAE3B,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,IAAI,MAAM,YAAY,YAAY;AACjD,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK;AAAA,MACX,MAAM,sCAAiC,YAAY;AAAA,MACnD,QACE,aAAa,MAAM,2IAEhB,cAAc;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,QAAM,aAAaF,MAAK,MAAM,UAAU;AACxC,MAAID,YAAW,UAAU,GAAG;AAC1B,UAAM,UAAUG,cAAa,YAAY,MAAM,EAC5C,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,QAAI,SAAS;AACX,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,UAAU,WAAM,cAAc;AAAA,QACvC,QACE,qEACc,cAAc,uFACD,UAAU;AAAA,MAIzC,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,eAAe,EAAE;AAC7B,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,IAAI,OAAO,kBAAkB,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,KAAK,IAAI;AAC/F,QAAI,QAAQ;AACV,YAAM,QAAQ,IAAI,OAAO,+BAA+B,GAAG,EAAE,KAAK,IAAI;AACtE,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,cAAc,WAAM,eAAe,KAAK,GAAG;AAAA,QACpD,QAAQ,QACJ,GAAG,GAAG,4XAKN,GAAG,GAAG;AAAA,MAEZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["existsSync","readFileSync","dirname","join","existsSync","join","dirname","readFileSync"]}

package/dist/index.js

@@ -6,12 +6,12 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-AHA7LGGA.js";
+} from "./chunk-JNXDJ2QD.js";
 import {
   BaseAdapter
-} from "./chunk-E3MYVYEZ.js";
-import "./chunk-KMKQDGI6.js";
-import "./chunk-GJGZRXM3.js";
+} from "./chunk-KLEXJFJ6.js";
+import "./chunk-YQRDKWSH.js";
+import "./chunk-DVKTH3RY.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 export {

package/dist/roles/static-analysis/config.d.ts

@@ -12,10 +12,6 @@ type StaticDefaults = {
         minConfidence: number;
         categories: string[];
     };
-    thresholds: {
-        duplicatedLinesPercent: number;
-        deadCodePercent: number;
-    };
     tools: {
         jscpd: Record<string, unknown>;
     };

package/dist/roles/static-analysis/config.js

@@ -1,6 +1,6 @@
 import {
   defineStaticAnalysis
-} from "../../chunk-GJGZRXM3.js";
+} from "../../chunk-DVKTH3RY.js";
 export {
   defineStaticAnalysis
 };

package/dist/roles/test/setup/jest-parity.js

@@ -3,13 +3,13 @@ import {
 } from "../../../chunk-NUOQXAYR.js";
 import {
   installWorkspaceSetup
-} from "../../../chunk-Z7L4FGKP.js";
+} from "../../../chunk-AMCGMLPS.js";
 import "../../../chunk-ELZHIN6E.js";
 import {
   clearDeepMocks,
   resetDeepMocks
 } from "../../../chunk-2XLX6PFR.js";
-import "../../../chunk-KMKQDGI6.js";
+import "../../../chunk-YQRDKWSH.js";
 
 // src/roles/test/setup/jest-parity.ts
 import { expect, vi } from "vitest";

package/dist/roles/test/setup/workspace-entry.js

@@ -1,8 +1,8 @@
 import {
   pinWorkspaceTimezone
-} from "../../../chunk-Z7L4FGKP.js";
+} from "../../../chunk-AMCGMLPS.js";
 import "../../../chunk-ELZHIN6E.js";
-import "../../../chunk-KMKQDGI6.js";
+import "../../../chunk-YQRDKWSH.js";
 
 // src/roles/test/setup/workspace-entry.ts
 await pinWorkspaceTimezone();

package/dist/{validate-STUK2AGG.js → validate-AWWMBSH5.js}

@@ -7,8 +7,8 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-E3MYVYEZ.js";
-import "./chunk-KMKQDGI6.js";
+} from "./chunk-KLEXJFJ6.js";
+import "./chunk-YQRDKWSH.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 

package/docs/static-analysis-study.md

@@ -157,6 +157,29 @@ to centrality, ranking all 12 372 files twice:
 **Rank correlation DC against LOC: 0.388.** Far from 1, so the two rankings designate different
 files and centrality carries information size does not. The criticism does not bite here.
 
+### What centrality is evidence FOR, and where that evidence stops
+
+Two measurements above say what centrality is NOT: not file size in disguise, not a proxy for change
+frequency. Neither says what it is good for, and the literature does.
+
+| source                                                                                           | what it establishes                                                                                                                                                                                                                                                     |
+| ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Zimmermann and Nagappan, ICSE 2008, on Windows Server 2003                                       | models built from network measures reach a recall **10 percentage points** higher than models built from complexity metrics, and network measures identified **60%** of the binaries the developers themselves called critical, **twice** what complexity metrics found |
+| Tosun, Turhan and Bener, PROMISE 2009, five systems (three small embedded, two Eclipse versions) | network measures are important indicators of defective modules for large and complex systems, **and have no significant effect on small-scale projects**                                                                                                                |
+
+⛔ The second one is a boundary on everything this role can claim, so it is written here rather than
+left implicit. Centrality's predictive value is demonstrated on LARGE systems. A module of forty
+files gets a `DC` figure that means exactly what it says about its graph and nothing at all about
+where its defects are. `host-admin` at 5 880 files sits on one side of that line; most of
+`libs/nest` sits on the other. It becomes the `caveat` of the centrality help entry, unchanged.
+
+And it settles what the number is FOR, which is a question the role has to answer before it prints
+anything. Test impact analysis selects: given this diff, which tests can catch a defect in it.
+Centrality is a property of the code and knows nothing about a diff, so it cannot select. What it can
+do is ORDER: which tests to run first, and where strengthening tests pays. The two compose, and the
+composition has a sharp consequence worth stating: a highly central file is precisely the one where
+impact-based selection saves nothing, because changing it reaches almost everything.
+
 ### Centrality is not a proxy for change frequency
 
 The hypothesis was that a central file, being heavily used, is frequently changed, which would
@@ -771,6 +794,13 @@ The two are complementary as long as every figure carries its unit.
 - Ben Khalfallah, H. _Code Health Meter: A Quantitative and Graph-Theoretic Foundation for
   Automated Code Quality and Architecture Assessment._ ACM TOSEM 35(4), article 114, March 2026.
   <https://doi.org/10.1145/3737670>
+- Zimmermann, T. and Nagappan, N. _Predicting Defects using Network Analysis on Dependency Graphs._
+  ICSE 2008.
+  <https://www.microsoft.com/en-us/research/publication/predicting-defects-using-network-analysis-on-dependency-graphs/>
+- Tosun, A., Turhan, B. and Bener, A. _Validation of network measures as indicators of defective
+  modules in software systems._ PROMISE 2009. <https://doi.org/10.1145/1540438.1540446>
+- Hammant, P. _The Rise of Test Impact Analysis._ martinfowler.com, August 2017.
+  <https://martinfowler.com/articles/rise-test-impact-analysis.html>
 - Hassan, A. E. _Predicting Faults Using the Complexity of Code Changes._ ICSE 2009.
   <https://sailresearch.github.io/sail-website/data/pdfs/ICSE2009_PredictingFaultsUsingTheComplexityOfCodeChanges.pdf>
 - Sadowski, C. et al. _Tricorder: Building a Program Analysis Ecosystem._ Google.

package/docs/typescript-traces.md

@@ -235,10 +235,10 @@ $ sentinel --report --json 2>/dev/null
     "format",
     "typescript",
     "build",
-    "test"
+    "test",
+    "static-analysis"
   ],
   "skipped": [
-    "static-analysis",
     "runtime-analysis",
     "arch"
   ],
@@ -309,6 +309,16 @@ $ sentinel --report --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "svelte-app",
+      "target": "static-analysis",
+      "flavour": "svelte",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "bff-admin",
       "target": "lint",
@@ -375,6 +385,16 @@ $ sentinel --report --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "bff-admin",
+      "target": "static-analysis",
+      "flavour": "nest",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "react-app",
       "target": "lint",
@@ -441,6 +461,16 @@ $ sentinel --report --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "react-app",
+      "target": "static-analysis",
+      "flavour": "react",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "utils",
       "target": "lint",
@@ -494,6 +524,16 @@ $ sentinel --report --json 2>/dev/null
       "adopted": false,
       "preset": null,
       "conformant": false
+    },
+    {
+      "project": "utils",
+      "target": "static-analysis",
+      "flavour": "node",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
     }
   ]
 }
@@ -525,10 +565,10 @@ $ sentinel --report --all --json 2>/dev/null
     "format",
     "typescript",
     "build",
-    "test"
+    "test",
+    "static-analysis"
   ],
   "skipped": [
-    "static-analysis",
     "runtime-analysis",
     "arch"
   ],
@@ -599,6 +639,16 @@ $ sentinel --report --all --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "svelte-app",
+      "target": "static-analysis",
+      "flavour": "svelte",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "bff-admin",
       "target": "lint",
@@ -665,6 +715,16 @@ $ sentinel --report --all --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "bff-admin",
+      "target": "static-analysis",
+      "flavour": "nest",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "react-app",
       "target": "lint",
@@ -731,6 +791,16 @@ $ sentinel --report --all --json 2>/dev/null
       "preset": null,
       "conformant": false
     },
+    {
+      "project": "react-app",
+      "target": "static-analysis",
+      "flavour": "react",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
+    },
     {
       "project": "utils",
       "target": "lint",
@@ -784,6 +854,16 @@ $ sentinel --report --all --json 2>/dev/null
       "adopted": false,
       "preset": null,
       "conformant": false
+    },
+    {
+      "project": "utils",
+      "target": "static-analysis",
+      "flavour": "node",
+      "ok": true,
+      "status": "ok",
+      "adopted": false,
+      "preset": null,
+      "conformant": false
     }
   ]
 }
@@ -1076,6 +1156,51 @@ $ sentinel --init --dry-run
   build: no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through `@nx/webpack`), the build role does not apply to it.
   test: this module has no test and no jest leftovers, so there is nothing to do here.
   dry run: no files written
+  added the three `static-analysis` scripts and static-analysis.config.mjs; declare this module's entry points and journeys there, everything else comes from the role
+
+  create static-analysis.config.mjs
+    + import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+    + 
+    + export default defineStaticAnalysis({
+    +   root: import.meta.dirname,
+    + 
+    +   // Files that RUN although nothing imports them: they are where reachability starts. Added to
+    +   // the patterns sentinel ships, never replacing them.
+    +   entry: [],
+    + 
+    +   // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
+    +   // relative to this module, because one run measures one module.
+    +   journeys: {},
+    + })
+
+  update package.json
+    - { "name": "bff-admin", "dependencies": { "@nestjs/core": "^10" } }
+    + {
+    +   "name": "bff-admin",
+    +   "dependencies": {
+    +     "@nestjs/core": "^10"
+    +   },
+    +   "scripts": {
+    +     "static-analysis": "sentinel --run --static-analysis",
+    +     "static-analysis:json": "sentinel --run --static-analysis --output json",
+    +     "static-analysis:html": "sentinel --run --static-analysis --output html"
+    +   },
+    +   "devDependencies": {
+    +     "@hublo/sentinel": "<version>"
+    +   },
+    +   "nx": {
+    +     "targets": {
+    +       "static-analysis": {
+    +         "cache": true,
+    +         "inputs": [
+    +           "default",
+    +           "{projectRoot}/static-analysis.config.mjs"
+    +         ]
+    +       }
+    +     }
+    +   }
+    + }
+  dry run: no files written
   materialized the nest format preset into .oxfmtrc.json (@hublo/sentinel@<version>). oxfmt has no `extends`, so the values live here; `sentinel --status --format` reports modules left behind by a preset change
 
   create .oxfmtrc.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.2",
+  "version": "1.5.0-alpha.4",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",

package/dist/chunk-KMKQDGI6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/package-json.ts","../src/core/settings.ts","../src/core/workspace-prep.ts"],"sourcesContent":["/**\n * package.json helpers, shared by the CLI and the engine.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\n/**\n * sentinel's OWN version, for `--version`. We must NOT use\n * `process.env.npm_package_version`, that is the version of whatever script\n * invoked us (an app's package.json, or nothing). Instead walk up from this\n * module to the nearest package.json, which is always sentinel's own, whether\n * running from source or the bundled dist.\n */\n/**\n * sentinel's OWN name + version, read by walking up from this module to the nearest\n * package.json. Used both for `--version` and to pin the exact dependency `--init`\n * writes into an adopted module, so a module always references the version that adopted it.\n */\nexport function readOwnPackage(): { name: string; version: string; bin?: string } {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    const pkgPath = join(dir, 'package.json')\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {\n          name?: string\n          version?: string\n          bin?: string | Record<string, string>\n        }\n        if (typeof pkg.version === 'string') {\n          // The bin PATH, not the command name: a package that adopts itself has to invoke\n          // its own build output, because the `.bin` shim does not exist yet (see below).\n          const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin ?? {})[0]\n          return { name: pkg.name ?? '@hublo/sentinel', version: pkg.version, bin }\n        }\n      } catch {\n        // Malformed package.json; keep walking up.\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) return { name: '@hublo/sentinel', version: '0.0.0' } // filesystem root\n    dir = parent\n  }\n}\n\nexport function readOwnVersion(): string {\n  return readOwnPackage().version\n}\n\n/**\n * Read a module's package.json for framework detection; tolerant of a missing or\n * malformed file (returns `{}`, so detection falls through to the `node` default).\n */\nexport function readProjectPackageJson(dir: string): {\n  /** The package name, which is also what nx calls the project when there is no `project.json`. */\n  name?: string\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  /**\n   * How the module's `.js`/`.ts` files are loaded. It decides whether a Vite config can import\n   * an ESM-only package at all, which is why the build role reads it before rewriting one.\n   */\n  type?: string\n  /**\n   * What nx alone needs per target, which every role writes here and none could read back.\n   *\n   * Typed loosely on purpose: this reader is shared by every role and each one knows the shape of\n   * its own target. Declared at all because a role that WRITES a block and then has to cast to\n   * read it is one refactor away from reading a key it never wrote.\n   */\n  nx?: { targets?: Record<string, Record<string, unknown>> }\n} {\n  const path = join(dir, 'package.json')\n  if (!existsSync(path)) return {}\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as Record<string, never>\n  } catch {\n    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.\\n`)\n    return {}\n  }\n}\n\n/**\n * The nx project name for a module, read from its `project.json`, or undefined if\n * there is none/unreadable. Used when `--init` has to scaffold a `package.json`\n * for a module that only has a `project.json` (common for nx apps/services): the\n * scaffolded file borrows this name so it is a valid, uniquely-named workspace\n * package. Reusable by any tool that scaffolds, not just TypeScript.\n */\nexport function readNxProjectName(dir: string): string | undefined {\n  const path = join(dir, 'project.json')\n  if (!existsSync(path)) return undefined\n  try {\n    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { name?: unknown }\n    return typeof parsed.name === 'string' ? parsed.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * What nx calls this module, resolved the way nx itself resolves it.\n *\n * The precedence is `project.json`, then `package.json`, then the directory, and only the\n * first and last of those were being consulted. A module with no `project.json` therefore\n * answered with its DIRECTORY while nx answered with its package name, and the two disagree\n * in the real repo: `apps/front/hr-management` is `front-hr-management` to nx, as is\n * `apps/front/storybook-app`.\n *\n * That gap is not cosmetic, because this name is what `--module` is matched against. The\n * `serve` script `--init` writes carries `--module <name>`, so a module in that shape was\n * adopted with a script naming a project the workspace does not contain, and `pnpm run serve`\n * failed the day it was adopted with nothing having reported it.\n *\n * One function so the two ends cannot drift again: whoever WRITES the name and whoever\n * RESOLVES it now read the same source.\n */\nexport function moduleName(dir: string): string {\n  const declared = readProjectPackageJson(dir).name\n  return readNxProjectName(dir) ?? (declared === undefined ? basename(dir) : declared)\n}\n","/**\n * Tunable settings: the knobs you would actually change. The fixed vocabulary and\n * its types live in `domain.ts`.\n *\n * Note: the preset is DETECTED from a module's dependencies (see\n * `detect-framework.ts`), deterministically, `node` when no framework dep is present.\n * `--preset` overrides the detection (recommended for `--init`, since hoisted deps\n * can make detection return `node`). The detection table lives in `detect-framework.ts`.\n */\n\n/** A file that marks a workspace root; sentinel refuses to operate there. */\nexport const WORKSPACE_ROOT_MARKER = 'nx.json'\n\n/**\n * How many structured diagnostics a report embeds per module, when the caller does not say.\n *\n * A cap, not a limit on what is counted: the totals stay exact and `diagnosticsTruncated`\n * says when rows were dropped, so a bounded envelope never reads as a clean module. Shared\n * by every role, because a consumer reading `--json` across roles should not have to learn\n * a different cap for each one. `--max-diagnostics 0` means no cap.\n */\nexport const DEFAULT_MAX_DIAGNOSTICS = 100\n","/**\n * Workspace-level preparation that `--init` applies once, at the workspace root, so an\n * adopted module actually installs and resolves cleanly. `--init` writes a module's own\n * files; this is the small, deliberate exception where it also touches the root, because\n * \"set this module up\" is not honest if the workspace it lives in cannot then install or\n * resolve it.\n *\n * Kept intentionally narrow (YAGNI): it applies the specific fixes a workspace's OWN\n * config shows it needs, and is a no-op everywhere else. It is NOT a speculative dedupe\n * engine, when a second, different case appears we generalize from real cases instead of\n * predicting them. The two fixes today:\n *\n *  - i18next singleton override. If the root declares a second TypeScript via the\n *    `@typescript/native` alias (a repo mid-migration running two TypeScripts), adopting a\n *    module re-resolves pnpm and i18next, which carries an optional type-only `typescript`\n *    peer, forks into two peer-keyed variants. That forks react-i18next into two React\n *    contexts and breaks translation-singleton tests. Pinning i18next's `typescript` peer\n *    to the declared TS collapses it to one. Read from the root's own declaration, so it\n *    tracks the version and disappears (no-op) once the migration removes the second TS.\n *    Written to `pnpm-workspace.yaml`, the only place current pnpm reads overrides from.\n *\n *  - release-age allow-list. If the root uses pnpm's `minimumReleaseAgeExclude` gate, a\n *    freshly published sentinel is younger than the gate and will not install; allow-list\n *    it. Only touched when the gate is actually configured.\n *\n *  - root formatter exclusion. A module that has adopted the FORMAT role is formatted by\n *    oxfmt, from its own config. The root Prettier does not know that and still owns every\n *    file in the repo, so `nx format:write` or `prettier --write .` from the root reformats\n *    the module back to the ROOT's style, and the next `pnpm run format` in the module\n *    reverses it. Two formatters fighting over the same files, with whichever ran last\n *    winning, is the exact state adoption removes INSIDE a module, and it has to be removed\n *    at the root too. So the module is excluded in the root `.prettierignore` as it adopts,\n *    and the root's own config is otherwise untouched: it still serves every module that has\n *    not migrated.\n *\n * All three edits are idempotent and defensive: absent the trigger (no second TypeScript, no\n * release-age gate, no root Prettier) each is skipped, so the step is safe on any workspace.\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, relative } from 'node:path'\n\nimport { readOwnPackage } from '../shared/package-json.js'\n\nimport { WORKSPACE_ROOT_MARKER } from './settings.js'\n\nconst OVERRIDE_KEY = 'i18next>typescript'\nconst NATIVE_TS_ALIAS = '@typescript/native' // `npm:typescript@^7.x`: a workspace's second, real TS\nconst WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst RELEASE_AGE_KEY = 'minimumReleaseAgeExclude'\nconst LIST_ITEM = /^(\\s*)-\\s+(.*?)\\s*$/\nconst MAP_ENTRY = /^(\\s+)(.*?):\\s+(.*?)\\s*$/\n\ninterface RootPackageJson {\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  pnpm?: { overrides?: Record<string, string> }\n}\n\n/** Walk up from a module directory to the workspace root (the dir holding the marker). */\nexport function findWorkspaceRoot(startDir: string): string | undefined {\n  let dir = startDir\n  for (;;) {\n    if (existsSync(join(dir, WORKSPACE_ROOT_MARKER))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return undefined\n    dir = parent\n  }\n}\n\n/**\n * The TypeScript version to pin i18next's peer to, read from the root's own\n * `@typescript/native` alias (`npm:typescript@^7.0.2` -> `7.0.2`). Returns undefined when\n * the alias is absent (no second TypeScript, so no fork to fix).\n */\nfunction declaredNativeTs(pkg: RootPackageJson): string | undefined {\n  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS]\n  if (!spec) return undefined\n  const version = spec.slice(spec.lastIndexOf('@') + 1).replace(/^[\\^~>=<\\s]+/, '')\n  return version || undefined\n}\n\n/**\n * Ensure the i18next singleton override matches the declared second TypeScript. No-op when\n * the workspace runs a single TypeScript (no `@typescript/native`). Returns a message when\n * it changed (or would change, under dryRun), else undefined.\n *\n * The override is written to `pnpm-workspace.yaml`, never to `package.json#pnpm`: pnpm 11\n * stopped reading the `pnpm` field and does so SILENTLY, with no warning and no deprecation\n * (pnpm/pnpm#11536), so an override left in `package.json` is simply not applied. The yaml is\n * read by pnpm 10 and 11 alike (https://pnpm.io/settings), which is why there is one target\n * here rather than a version-dependent fallback.\n */\nfunction ensureI18nextSingleton(root: string, dryRun: boolean): string | undefined {\n  const pkgPath = join(root, 'package.json')\n  if (!existsSync(pkgPath)) return undefined\n  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n  const want = declaredNativeTs(pkg)\n  if (!want) return undefined // single TypeScript: nothing forks\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined // no workspace file: nowhere pnpm would read it\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const entry = findOverrideEntry(lines)\n  if (entry.valueIdx !== undefined && entry.value === want) return undefined // already pinned\n  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n\n  applyOverride(lines, entry, want)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n}\n\n/** Where the override sits in the yaml, if at all, plus where a new one would be inserted. */\ninterface OverrideEntry {\n  /** Index of the `OVERRIDE_KEY` line, when the key is already declared. */\n  valueIdx?: number\n  /** Its current value, unquoted. */\n  value?: string\n  /** Index of the `overrides:` key line, when the block exists. */\n  blockIdx?: number\n  /** Index of the block's last entry, so an insertion keeps the block contiguous. */\n  lastEntryIdx?: number\n  /** Indentation the block's entries use. */\n  indent: string\n}\n\n/**\n * Locate the `overrides:` block and the i18next key inside it. A targeted text read rather\n * than a yaml parse, for the same reason `ensureReleaseAgeAllowList` does it: this file is\n * hand-maintained and round-tripping it through a parser would drop its comments and ordering.\n */\nfunction findOverrideEntry(lines: string[]): OverrideEntry {\n  const blockIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === 'overrides:')\n  if (blockIdx === -1) return { indent: '  ' }\n\n  let lastEntryIdx = blockIdx\n  let indent = '  '\n  for (let i = blockIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(MAP_ENTRY)\n    if (!match) break // dedent or blank line: the block ended\n    indent = match[1] ?? indent\n    lastEntryIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === OVERRIDE_KEY) {\n      return {\n        valueIdx: i,\n        value: (match[3] ?? '').replace(/^['\"]|['\"]$/g, ''),\n        blockIdx,\n        lastEntryIdx,\n        indent,\n      }\n    }\n  }\n  return { blockIdx, lastEntryIdx, indent }\n}\n\n/** Update the key in place, append it to an existing block, or open a block at the end. */\nfunction applyOverride(lines: string[], entry: OverrideEntry, want: string): void {\n  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`\n  if (entry.valueIdx !== undefined) {\n    lines[entry.valueIdx] = line\n    return\n  }\n  if (entry.lastEntryIdx !== undefined) {\n    lines.splice(entry.lastEntryIdx + 1, 0, line)\n    return\n  }\n  // No `overrides:` block at all: open one, keeping a single trailing newline.\n  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()\n  lines.push('overrides:', line, '')\n}\n\n/**\n * Ensure sentinel is allow-listed under `minimumReleaseAgeExclude` so a fresh publish\n * installs. No-op when the workspace has no such gate. Targeted text edit so comments and\n * formatting are preserved. Returns a message when it changed (or would), else undefined.\n */\nfunction ensureReleaseAgeAllowList(root: string, dryRun: boolean): string | undefined {\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined\n  const own = readOwnPackage().name\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const keyIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === `${RELEASE_AGE_KEY}:`)\n  if (keyIdx === -1) return undefined // no release-age gate in use\n\n  let lastItemIdx = keyIdx\n  let indent = '  '\n  for (let i = keyIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(LIST_ITEM)\n    if (!match) break\n    indent = match[1] ?? indent\n    lastItemIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === own) return undefined // already listed\n  }\n  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`\n\n  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`\n}\n\n/** The root ignore file Prettier reads, and the section sentinel owns inside it. */\nconst PRETTIER_IGNORE = '.prettierignore'\nconst EXCLUSION_HEADER = '# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier'\n\n/** Root Prettier configs. Their presence is what makes an exclusion meaningful. */\nconst ROOT_PRETTIER_CONFIGS = [\n  '.prettierrc',\n  '.prettierrc.json',\n  '.prettierrc.json5',\n  '.prettierrc.yml',\n  '.prettierrc.yaml',\n  '.prettierrc.js',\n  '.prettierrc.cjs',\n  '.prettierrc.mjs',\n  'prettier.config.js',\n  'prettier.config.cjs',\n  'prettier.config.mjs',\n]\n\n/**\n * Exclude a module that now formats itself from the ROOT Prettier.\n *\n * Written as a directory pattern anchored at the root (`/apps/front/x/`), which is what\n * gitignore syntax means by \"this exact directory\", so a module cannot accidentally exclude a\n * same-named directory somewhere else.\n *\n * Skipped entirely when the root has no Prettier at all: there is then nothing to conflict\n * with, and creating an ignore file for a tool the workspace does not use would be noise.\n */\nfunction ensureFormatterExclusion(\n  root: string,\n  moduleDir: string,\n  dryRun: boolean,\n): string | undefined {\n  const rel = relative(root, moduleDir).replaceAll('\\\\', '/')\n  if (rel === '' || rel.startsWith('..')) return undefined // the root itself, or outside it\n\n  const ignorePath = join(root, PRETTIER_IGNORE)\n  const hasPrettier =\n    existsSync(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync(join(root, name)))\n  if (!hasPrettier) return undefined\n\n  const pattern = `/${rel}/`\n  const existing = existsSync(ignorePath) ? readFileSync(ignorePath, 'utf8') : ''\n  const lines = existing.split('\\n')\n  // Already excluded, in whichever spelling a human may have used.\n  if (lines.some((line) => line.trim().replace(/\\/$/, '') === pattern.replace(/\\/$/, ''))) {\n    return undefined\n  }\n  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`\n\n  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER)\n  if (headerIdx === -1) {\n    const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}\\n${pattern}\\n`)\n  } else {\n    // Keep the managed section together and sorted, so the list stays readable as it grows\n    // to 150 entries and a diff shows one added line rather than a reshuffle.\n    let end = headerIdx + 1\n    while (end < lines.length && lines[end]?.trim().startsWith('/')) end += 1\n    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort()\n    writeFileSync(\n      ignorePath,\n      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join('\\n'),\n    )\n  }\n  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`\n}\n\n/**\n * Apply every workspace-level fix the given root needs. Returns the human-readable\n * messages for what changed (empty when nothing did). Under dryRun nothing is written and\n * the messages describe what would change.\n *\n * `formattedModule` is the module that just adopted the FORMAT role, when one did. Absent\n * for a lint-only or TypeScript-only `--init`, because a module that has not adopted the\n * formatter must keep being formatted by the root.\n */\nexport function ensureWorkspacePrep(opts: {\n  root: string\n  dryRun?: boolean\n  formattedModule?: string\n}): string[] {\n  const dryRun = Boolean(opts.dryRun)\n  return [\n    ensureI18nextSingleton(opts.root, dryRun),\n    ensureReleaseAgeAllowList(opts.root, dryRun),\n    opts.formattedModule === undefined\n      ? undefined\n      : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),\n  ].filter((message): message is string => message !== undefined)\n}\n\n/**\n * One standing change sentinel has made to the workspace ROOT, and whether it is still earned.\n *\n * This exists because the three root writes are the only thing sentinel does that nobody can\n * see afterwards. `--init` announces each one on the run that makes it, and then it is a line\n * in someone else's file forever. Two consequences already bit us.\n *\n * The `i18next>typescript` override re-resolved `apps/front/console` from a PR that touched no\n * file under it, so CODEOWNERS pulled nobody and its owners learned about it afterwards.\n *\n * And every one of them is TEMPORARY with its removal condition written in prose. That failed\n * three times in one week: `SENTINEL_TAG=alpha` in the migration-page workflow kept building\n * with a pre-release long after 1.1.0 went stable and reported `Format 0/439` for 15 adopted\n * modules; ADR 0042 and its RFC both sat mid-flight past their deadline; and this release-age\n * exclusion is still waiting on \"once sentinel's release cadence settles\". Nothing failed when\n * any of them expired, because a comment cannot fail.\n *\n * So each entry carries the condition that JUSTIFIES it, evaluated now rather than described.\n * A trigger that has gone away makes the entry dead config, and dead config is something a\n * command can say out loud instead of something a reader has to notice.\n *\n * Read-only, and offline: it inspects the same files `--init` writes and nothing else. What it\n * deliberately does NOT claim is anything needing the npm registry — whether a published\n * version is old enough to clear the release-age gate is not knowable from the repo, so it is\n * stated as the standing exemption it is rather than guessed at.\n */\nexport interface WorkspacePrepEntry {\n  /** `rule` to match the shape the shared renderer already prints as a labelled block. */\n  rule: string\n  /** What it does, whether its trigger still holds, and what would retire it. */\n  reason: string\n}\n\n/** The root-level changes sentinel maintains here, each with its justification checked now. */\nexport function inspectWorkspacePrep(root: string): WorkspacePrepEntry[] {\n  const entries: WorkspacePrepEntry[] = []\n  // Tolerant, unlike the write path above, and the difference is deliberate. `--init` should\n  // fail loudly on a root it cannot parse, because it is about to edit it. `--inspect` is a\n  // read verb that sweeps 441 modules, and one malformed root file must not take the whole\n  // sweep down: the modules still have honest answers to give. Caught by its own test.\n  let pkg: RootPackageJson = {}\n  const pkgPath = join(root, 'package.json')\n  if (existsSync(pkgPath)) {\n    try {\n      pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n    } catch {\n      pkg = {}\n    }\n  }\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  const yaml = existsSync(yamlPath) ? readFileSync(yamlPath, 'utf8') : undefined\n\n  const pinned = yaml === undefined ? undefined : findOverrideEntry(yaml.split('\\n')).value\n  if (pinned !== undefined) {\n    const stillForks = declaredNativeTs(pkg)\n    entries.push({\n      rule: `${WORKSPACE_YAML} → overrides.${OVERRIDE_KEY}`,\n      reason:\n        stillForks === undefined\n          ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing ` +\n            `forks any more. This override is now dead config and can be removed.`\n          : `pinned to ${pinned}, matching the second TypeScript the root declares ` +\n            `(${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, ` +\n            `not only adopted ones. It retires with the second TypeScript.`,\n    })\n  }\n\n  // A copy left in `package.json#pnpm` by an older sentinel, or by hand. Reported because it\n  // is INERT rather than redundant: pnpm 11 dropped the `pnpm` field with no warning\n  // (pnpm/pnpm#11536), so it reads as protection that is not applied.\n  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY]\n  if (legacy !== undefined) {\n    entries.push({\n      rule: `package.json → pnpm.overrides.${OVERRIDE_KEY}`,\n      reason:\n        `pinned to ${legacy}, but pnpm 11 no longer reads the \\`pnpm\\` field of package.json ` +\n        `and says nothing about it, so this override is not applied. Move it to ` +\n        `${WORKSPACE_YAML} under \\`overrides:\\`, which pnpm 10 and 11 both read.`,\n    })\n  }\n\n  const own = readOwnPackage().name\n  if (yaml !== undefined) {\n    const listed = new RegExp(`^\\\\s*-\\\\s*['\"]?${own.replace('/', '\\\\/')}['\"]?\\\\s*$`, 'm').test(yaml)\n    if (listed) {\n      const gated = new RegExp(`^\\\\s*minimumReleaseAge\\\\s*:`, 'm').test(yaml)\n      entries.push({\n        rule: `${WORKSPACE_YAML} → ${RELEASE_AGE_KEY}: ${own}`,\n        reason: gated\n          ? `${own} is exempt from this workspace's release-age gate, so a freshly published ` +\n            `version installs instead of being held. That is a standing exemption from a ` +\n            `supply-chain control: the exposure is one bump wide, since the version is pinned ` +\n            `and the lockfile carries its integrity, so a re-publish of the same version does ` +\n            `not pass. Retire it once a bump can simply wait out the window.`\n          : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so ` +\n            `there is no gate to be exempt from. This entry is now dead config and can be removed.`,\n      })\n    }\n  }\n\n  return entries\n}\n"],"mappings":";AAGA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,qBAAqB;AAcvB,SAAS,iBAAkE;AAChF,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,YAAI,OAAO,IAAI,YAAY,UAAU;AAGnC,gBAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;AAClF,iBAAO,EAAE,MAAM,IAAI,QAAQ,mBAAmB,SAAS,IAAI,SAAS,IAAI;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AACvE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,iBAAyB;AACvC,SAAO,eAAe,EAAE;AAC1B;AAMO,SAAS,uBAAuB,KAkBrC;AACA,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,YAAQ,OAAO,MAAM,6BAA6B,IAAI;AAAA,CAA6B;AACnF,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,kBAAkB,KAAiC;AACjE,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,WAAW,KAAqB;AAC9C,QAAM,WAAW,uBAAuB,GAAG,EAAE;AAC7C,SAAO,kBAAkB,GAAG,MAAM,aAAa,SAAY,SAAS,GAAG,IAAI;AAC7E;;;AC9GO,IAAM,wBAAwB;AAU9B,IAAM,0BAA0B;;;ACiBvC,SAAS,cAAAA,aAAY,gBAAAC,eAAc,qBAAqB;AACxD,SAAS,WAAAC,UAAS,QAAAC,OAAM,gBAAgB;AAMxC,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAClB,IAAM,YAAY;AASX,SAAS,kBAAkB,UAAsC;AACtE,MAAI,MAAM;AACV,aAAS;AACP,QAAIC,YAAWC,MAAK,KAAK,qBAAqB,CAAC,EAAG,QAAO;AACzD,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOA,SAAS,iBAAiB,KAA0C;AAClE,QAAM,OAAO,IAAI,eAAe,eAAe,KAAK,IAAI,kBAAkB,eAAe;AACzF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAChF,SAAO,WAAW;AACpB;AAaA,SAAS,uBAAuB,MAAc,QAAqC;AACjF,QAAM,UAAUD,MAAK,MAAM,cAAc;AACzC,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO;AACjC,QAAM,MAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AACpD,QAAM,OAAO,iBAAiB,GAAG;AACjC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,QAAQ,kBAAkB,KAAK;AACrC,MAAI,MAAM,aAAa,UAAa,MAAM,UAAU,KAAM,QAAO;AACjE,MAAI,OAAQ,QAAO,aAAa,YAAY,OAAO,IAAI,OAAO,cAAc;AAE5E,gBAAc,OAAO,OAAO,IAAI;AAChC,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,UAAU,YAAY,OAAO,IAAI,OAAO,cAAc;AAC/D;AAqBA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,WAAW,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,YAAY;AACpF,MAAI,aAAa,GAAI,QAAO,EAAE,QAAQ,KAAK;AAE3C,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,WAAS,IAAI,WAAW,GAAG,IAAI,MAAM,QAAQ,KAAK;AAChD,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,mBAAe;AACf,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,cAAc;AACjE,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,cAAc,OAAO;AAC1C;AAGA,SAAS,cAAc,OAAiB,OAAsB,MAAoB;AAChF,QAAM,OAAO,GAAG,MAAM,MAAM,IAAI,YAAY,MAAM,IAAI;AACtD,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,MAAM,QAAQ,IAAI;AACxB;AAAA,EACF;AACA,MAAI,MAAM,iBAAiB,QAAW;AACpC,UAAM,OAAO,MAAM,eAAe,GAAG,GAAG,IAAI;AAC5C;AAAA,EACF;AAEA,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,GAAI,OAAM,IAAI;AACrE,QAAM,KAAK,cAAc,MAAM,EAAE;AACnC;AAOA,SAAS,0BAA0B,MAAc,QAAqC;AACpF,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,MAAM,eAAe,EAAE;AAC7B,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,SAAS,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG;AAC3F,MAAI,WAAW,GAAI,QAAO;AAE1B,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,WAAS,IAAI,SAAS,GAAG,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,kBAAc;AACd,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,IAAK,QAAO;AAAA,EACnE;AACA,MAAI,OAAQ,QAAO,oBAAoB,GAAG,UAAU,eAAe;AAEnE,QAAM,OAAO,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,GAAG;AACtD,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,gBAAgB,GAAG,UAAU,eAAe,OAAO,cAAc;AAC1E;AAGA,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGzB,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYA,SAAS,yBACP,MACA,WACA,QACoB;AACpB,QAAM,MAAM,SAAS,MAAM,SAAS,EAAE,WAAW,MAAM,GAAG;AAC1D,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,EAAG,QAAO;AAE/C,QAAM,aAAaF,MAAK,MAAM,eAAe;AAC7C,QAAM,cACJD,YAAW,UAAU,KAAK,sBAAsB,KAAK,CAAC,SAASA,YAAWC,MAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,IAAI,GAAG;AACvB,QAAM,WAAWD,YAAW,UAAU,IAAIG,cAAa,YAAY,MAAM,IAAI;AAC7E,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,MAAI,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI,OAAQ,QAAO,iBAAiB,GAAG,4BAA4B,eAAe;AAElF,QAAM,YAAY,MAAM,UAAU,CAAC,SAAS,KAAK,KAAK,MAAM,gBAAgB;AAC5E,MAAI,cAAc,IAAI;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,kBAAc,YAAY,GAAG,MAAM,GAAG,gBAAgB;AAAA,EAAK,OAAO;AAAA,CAAI;AAAA,EACxE,OAAO;AAGL,QAAI,MAAM,YAAY;AACtB,WAAO,MAAM,MAAM,UAAU,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AACxE,UAAM,UAAU,CAAC,GAAG,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,OAAO,EAAE,KAAK;AACnE;AAAA,MACE;AAAA,MACA,CAAC,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,YAAY,GAAG,4BAA4B,eAAe;AACnE;AAWO,SAAS,oBAAoB,MAIvB;AACX,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,SAAO;AAAA,IACL,uBAAuB,KAAK,MAAM,MAAM;AAAA,IACxC,0BAA0B,KAAK,MAAM,MAAM;AAAA,IAC3C,KAAK,oBAAoB,SACrB,SACA,yBAAyB,KAAK,MAAM,KAAK,iBAAiB,MAAM;AAAA,EACtE,EAAE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAChE;AAoCO,SAAS,qBAAqB,MAAoC;AACvE,QAAM,UAAgC,CAAC;AAKvC,MAAI,MAAuB,CAAC;AAC5B,QAAM,UAAUF,MAAK,MAAM,cAAc;AACzC,MAAID,YAAW,OAAO,GAAG;AACvB,QAAI;AACF,YAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,YAAM,CAAC;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,QAAM,OAAOD,YAAW,QAAQ,IAAIG,cAAa,UAAU,MAAM,IAAI;AAErE,QAAM,SAAS,SAAS,SAAY,SAAY,kBAAkB,KAAK,MAAM,IAAI,CAAC,EAAE;AACpF,MAAI,WAAW,QAAW;AACxB,UAAM,aAAa,iBAAiB,GAAG;AACvC,YAAQ,KAAK;AAAA,MACX,MAAM,GAAG,cAAc,qBAAgB,YAAY;AAAA,MACnD,QACE,eAAe,SACX,aAAa,MAAM,qCAAqC,eAAe,sFAEvE,aAAa,MAAM,uDACf,eAAe;AAAA,IAE3B,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,IAAI,MAAM,YAAY,YAAY;AACjD,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK;AAAA,MACX,MAAM,sCAAiC,YAAY;AAAA,MACnD,QACE,aAAa,MAAM,2IAEhB,cAAc;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,eAAe,EAAE;AAC7B,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,IAAI,OAAO,kBAAkB,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,KAAK,IAAI;AAC/F,QAAI,QAAQ;AACV,YAAM,QAAQ,IAAI,OAAO,+BAA+B,GAAG,EAAE,KAAK,IAAI;AACtE,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,cAAc,WAAM,eAAe,KAAK,GAAG;AAAA,QACpD,QAAQ,QACJ,GAAG,GAAG,4XAKN,GAAG,GAAG;AAAA,MAEZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["existsSync","readFileSync","dirname","join","existsSync","join","dirname","readFileSync"]}