@hublo/sentinel 1.5.0-alpha.22 → 1.5.0-alpha.23

package/README.md

@@ -171,6 +171,7 @@ throwaway run wants. Once a module has adopted, nothing is fetched any more: the
 - [`docs/build-adoption.md`](docs/build-adoption.md) — moving a React app's Vite toolchain into sentinel: adoption changes the config's IMPORTS and nothing else, what sentinel owns versus what stays the app's, and why reading nothing is what makes losing nothing a guarantee.
 - [`docs/typescript-adoption.md`](docs/typescript-adoption.md) — the adoption cheat sheet: the two adoption steps, the command model (verb x type x location), options, reading a report, and troubleshooting.
 - [`docs/test-adoption.md`](docs/test-adoption.md) — migrating a module from jest to Vitest: the two steps, what the migration rewrites and what it refuses BY NAME, how the baseline gate proves nothing was lost, and the failures worth recognising.
+- [`docs/static-analysis-adoption.md`](docs/static-analysis-adoption.md) — running the static analysis role on a module: the two steps, the three output shapes, how to read each row and where its threshold comes from, declaring an entry point, and the two limits worth knowing before trusting a number.
 - [`docs/typescript-traces.md`](docs/typescript-traces.md) — a **generated, versioned** reference of live command + output traces (every verb, option, config result and edge case) against the mock monorepo. Regenerate after CLI changes with `pnpm docs:traces`.
 
 ## Architecture: `target → runner → preset`

package/dist/bin/sentinel.js

@@ -15,17 +15,17 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-BN6SCBFW.js";
+} from "../chunk-TL2P2X45.js";
 import {
   resolveContext
-} from "../chunk-KLEXJFJ6.js";
+} from "../chunk-IFK6KGUW.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
   inspectWorkspacePrep,
   readOwnVersion,
   readProjectPackageJson
-} from "../chunk-YQRDKWSH.js";
+} from "../chunk-JEYGPPSL.js";
 import "../chunk-AYEOGJQR.js";
 import "../chunk-O7REVMOC.js";
 import "../chunk-QXFCZON7.js";
@@ -148,7 +148,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-AWWMBSH5.js");
+  const { validateModuleTests } = await import("../validate-7VBODB4M.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/{chunk-KLEXJFJ6.js → chunk-IFK6KGUW.js}

@@ -6,7 +6,7 @@ import {
   readNxProjectName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-YQRDKWSH.js";
+} from "./chunk-JEYGPPSL.js";
 import {
   matchesTsconfigPattern
 } from "./chunk-O7REVMOC.js";

package/dist/{chunk-YQRDKWSH.js → chunk-JEYGPPSL.js}

@@ -24,6 +24,15 @@ function readOwnPackage() {
 function readOwnVersion() {
   return readOwnPackage().version;
 }
+function ownPackageDir() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    if (existsSync(join(dir, "package.json"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return dir;
+    dir = parent;
+  }
+}
 function readProjectPackageJson(dir) {
   const path = join(dir, "package.json");
   if (!existsSync(path)) return {};
@@ -279,6 +288,7 @@ function inspectWorkspacePrep(root) {
 export {
   readOwnPackage,
   readOwnVersion,
+  ownPackageDir,
   readProjectPackageJson,
   readNxProjectName,
   moduleName,
@@ -288,4 +298,4 @@ export {
   ensureWorkspacePrep,
   inspectWorkspacePrep
 };
-//# sourceMappingURL=chunk-YQRDKWSH.js.map
+//# sourceMappingURL=chunk-JEYGPPSL.js.map

package/dist/chunk-JEYGPPSL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared/package-json.ts","../src/core/settings.ts","../src/core/workspace-prep.ts"],"sourcesContent":["/**\n * package.json helpers, shared by the CLI and the engine.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\n/**\n * sentinel's OWN version, for `--version`. We must NOT use\n * `process.env.npm_package_version`, that is the version of whatever script\n * invoked us (an app's package.json, or nothing). Instead walk up from this\n * module to the nearest package.json, which is always sentinel's own, whether\n * running from source or the bundled dist.\n */\n/**\n * sentinel's OWN name + version, read by walking up from this module to the nearest\n * package.json. Used both for `--version` and to pin the exact dependency `--init`\n * writes into an adopted module, so a module always references the version that adopted it.\n */\nexport function readOwnPackage(): { name: string; version: string; bin?: string } {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    const pkgPath = join(dir, 'package.json')\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {\n          name?: string\n          version?: string\n          bin?: string | Record<string, string>\n        }\n        if (typeof pkg.version === 'string') {\n          // The bin PATH, not the command name: a package that adopts itself has to invoke\n          // its own build output, because the `.bin` shim does not exist yet (see below).\n          const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin ?? {})[0]\n          return { name: pkg.name ?? '@hublo/sentinel', version: pkg.version, bin }\n        }\n      } catch {\n        // Malformed package.json; keep walking up.\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) return { name: '@hublo/sentinel', version: '0.0.0' } // filesystem root\n    dir = parent\n  }\n}\n\nexport function readOwnVersion(): string {\n  return readOwnPackage().version\n}\n\n/**\n * The directory sentinel's own `package.json` sits in, for the files it SHIPS beside its code.\n *\n * ⛔ Walked up to, never computed from a count of `..`. The emitted layout is not ours to predict:\n * `tsup` bundles the source into chunks whose depth has nothing to do with the source tree's, and\n * it moves code between them from one build to the next. A relative path from `import.meta.url` is\n * therefore right in `src/` and wrong in `dist/`, which is exactly the failure\n * `roles/test/shared-test-config.ts` records at length after it cost a module 83 passing tests.\n *\n * Measured here: `plugins/sonar-cognitive.js` resolved through a four-segment relative path existed\n * when run from source and did not after the build, and the only symptom was the whole size pass\n * reporting \"oxlint could not be run\".\n */\nexport function ownPackageDir(): string {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    if (existsSync(join(dir, 'package.json'))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return dir\n    dir = parent\n  }\n}\n\n/**\n * Read a module's package.json for framework detection; tolerant of a missing or\n * malformed file (returns `{}`, so detection falls through to the `node` default).\n */\nexport function readProjectPackageJson(dir: string): {\n  /** The package name, which is also what nx calls the project when there is no `project.json`. */\n  name?: string\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  /**\n   * How the module's `.js`/`.ts` files are loaded. It decides whether a Vite config can import\n   * an ESM-only package at all, which is why the build role reads it before rewriting one.\n   */\n  type?: string\n  /**\n   * What nx alone needs per target, which every role writes here and none could read back.\n   *\n   * Typed loosely on purpose: this reader is shared by every role and each one knows the shape of\n   * its own target. Declared at all because a role that WRITES a block and then has to cast to\n   * read it is one refactor away from reading a key it never wrote.\n   */\n  nx?: { targets?: Record<string, Record<string, unknown>> }\n} {\n  const path = join(dir, 'package.json')\n  if (!existsSync(path)) return {}\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as Record<string, never>\n  } catch {\n    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.\\n`)\n    return {}\n  }\n}\n\n/**\n * The nx project name for a module, read from its `project.json`, or undefined if\n * there is none/unreadable. Used when `--init` has to scaffold a `package.json`\n * for a module that only has a `project.json` (common for nx apps/services): the\n * scaffolded file borrows this name so it is a valid, uniquely-named workspace\n * package. Reusable by any tool that scaffolds, not just TypeScript.\n */\nexport function readNxProjectName(dir: string): string | undefined {\n  const path = join(dir, 'project.json')\n  if (!existsSync(path)) return undefined\n  try {\n    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { name?: unknown }\n    return typeof parsed.name === 'string' ? parsed.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * What nx calls this module, resolved the way nx itself resolves it.\n *\n * The precedence is `project.json`, then `package.json`, then the directory, and only the\n * first and last of those were being consulted. A module with no `project.json` therefore\n * answered with its DIRECTORY while nx answered with its package name, and the two disagree\n * in the real repo: `apps/front/hr-management` is `front-hr-management` to nx, as is\n * `apps/front/storybook-app`.\n *\n * That gap is not cosmetic, because this name is what `--module` is matched against. The\n * `serve` script `--init` writes carries `--module <name>`, so a module in that shape was\n * adopted with a script naming a project the workspace does not contain, and `pnpm run serve`\n * failed the day it was adopted with nothing having reported it.\n *\n * One function so the two ends cannot drift again: whoever WRITES the name and whoever\n * RESOLVES it now read the same source.\n */\nexport function moduleName(dir: string): string {\n  const declared = readProjectPackageJson(dir).name\n  return readNxProjectName(dir) ?? (declared === undefined ? basename(dir) : declared)\n}\n","/**\n * Tunable settings: the knobs you would actually change. The fixed vocabulary and\n * its types live in `domain.ts`.\n *\n * Note: the preset is DETECTED from a module's dependencies (see\n * `detect-framework.ts`), deterministically, `node` when no framework dep is present.\n * `--preset` overrides the detection (recommended for `--init`, since hoisted deps\n * can make detection return `node`). The detection table lives in `detect-framework.ts`.\n */\n\n/** A file that marks a workspace root; sentinel refuses to operate there. */\nexport const WORKSPACE_ROOT_MARKER = 'nx.json'\n\n/**\n * How many structured diagnostics a report embeds per module, when the caller does not say.\n *\n * A cap, not a limit on what is counted: the totals stay exact and `diagnosticsTruncated`\n * says when rows were dropped, so a bounded envelope never reads as a clean module. Shared\n * by every role, because a consumer reading `--json` across roles should not have to learn\n * a different cap for each one. `--max-diagnostics 0` means no cap.\n */\nexport const DEFAULT_MAX_DIAGNOSTICS = 100\n","/**\n * Workspace-level preparation that `--init` applies once, at the workspace root, so an\n * adopted module actually installs and resolves cleanly. `--init` writes a module's own\n * files; this is the small, deliberate exception where it also touches the root, because\n * \"set this module up\" is not honest if the workspace it lives in cannot then install or\n * resolve it.\n *\n * Kept intentionally narrow (YAGNI): it applies the specific fixes a workspace's OWN\n * config shows it needs, and is a no-op everywhere else. It is NOT a speculative dedupe\n * engine, when a second, different case appears we generalize from real cases instead of\n * predicting them. The two fixes today:\n *\n *  - i18next singleton override. If the root declares a second TypeScript via the\n *    `@typescript/native` alias (a repo mid-migration running two TypeScripts), adopting a\n *    module re-resolves pnpm and i18next, which carries an optional type-only `typescript`\n *    peer, forks into two peer-keyed variants. That forks react-i18next into two React\n *    contexts and breaks translation-singleton tests. Pinning i18next's `typescript` peer\n *    to the declared TS collapses it to one. Read from the root's own declaration, so it\n *    tracks the version and disappears (no-op) once the migration removes the second TS.\n *    Written to `pnpm-workspace.yaml`, the only place current pnpm reads overrides from.\n *\n *  - release-age allow-list. If the root uses pnpm's `minimumReleaseAgeExclude` gate, a\n *    freshly published sentinel is younger than the gate and will not install; allow-list\n *    it. Only touched when the gate is actually configured.\n *\n *  - root formatter exclusion. A module that has adopted the FORMAT role is formatted by\n *    oxfmt, from its own config. The root Prettier does not know that and still owns every\n *    file in the repo, so `nx format:write` or `prettier --write .` from the root reformats\n *    the module back to the ROOT's style, and the next `pnpm run format` in the module\n *    reverses it. Two formatters fighting over the same files, with whichever ran last\n *    winning, is the exact state adoption removes INSIDE a module, and it has to be removed\n *    at the root too. So the module is excluded in the root `.prettierignore` as it adopts,\n *    and the root's own config is otherwise untouched: it still serves every module that has\n *    not migrated.\n *\n * All three edits are idempotent and defensive: absent the trigger (no second TypeScript, no\n * release-age gate, no root Prettier) each is skipped, so the step is safe on any workspace.\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, relative } from 'node:path'\n\nimport { readOwnPackage } from '../shared/package-json.js'\n\nimport { WORKSPACE_ROOT_MARKER } from './settings.js'\n\nconst OVERRIDE_KEY = 'i18next>typescript'\nconst NATIVE_TS_ALIAS = '@typescript/native' // `npm:typescript@^7.x`: a workspace's second, real TS\nconst WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst RELEASE_AGE_KEY = 'minimumReleaseAgeExclude'\nconst LIST_ITEM = /^(\\s*)-\\s+(.*?)\\s*$/\nconst MAP_ENTRY = /^(\\s+)(.*?):\\s+(.*?)\\s*$/\n\ninterface RootPackageJson {\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  pnpm?: { overrides?: Record<string, string> }\n}\n\n/** Walk up from a module directory to the workspace root (the dir holding the marker). */\nexport function findWorkspaceRoot(startDir: string): string | undefined {\n  let dir = startDir\n  for (;;) {\n    if (existsSync(join(dir, WORKSPACE_ROOT_MARKER))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return undefined\n    dir = parent\n  }\n}\n\n/**\n * The TypeScript version to pin i18next's peer to, read from the root's own\n * `@typescript/native` alias (`npm:typescript@^7.0.2` -> `7.0.2`). Returns undefined when\n * the alias is absent (no second TypeScript, so no fork to fix).\n */\nfunction declaredNativeTs(pkg: RootPackageJson): string | undefined {\n  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS]\n  if (!spec) return undefined\n  const version = spec.slice(spec.lastIndexOf('@') + 1).replace(/^[\\^~>=<\\s]+/, '')\n  return version || undefined\n}\n\n/**\n * Ensure the i18next singleton override matches the declared second TypeScript. No-op when\n * the workspace runs a single TypeScript (no `@typescript/native`). Returns a message when\n * it changed (or would change, under dryRun), else undefined.\n *\n * The override is written to `pnpm-workspace.yaml`, never to `package.json#pnpm`: pnpm 11\n * stopped reading the `pnpm` field and does so SILENTLY, with no warning and no deprecation\n * (pnpm/pnpm#11536), so an override left in `package.json` is simply not applied. The yaml is\n * read by pnpm 10 and 11 alike (https://pnpm.io/settings), which is why there is one target\n * here rather than a version-dependent fallback.\n */\nfunction ensureI18nextSingleton(root: string, dryRun: boolean): string | undefined {\n  const pkgPath = join(root, 'package.json')\n  if (!existsSync(pkgPath)) return undefined\n  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n  const want = declaredNativeTs(pkg)\n  if (!want) return undefined // single TypeScript: nothing forks\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined // no workspace file: nowhere pnpm would read it\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const entry = findOverrideEntry(lines)\n  if (entry.valueIdx !== undefined && entry.value === want) return undefined // already pinned\n  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n\n  applyOverride(lines, entry, want)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n}\n\n/** Where the override sits in the yaml, if at all, plus where a new one would be inserted. */\ninterface OverrideEntry {\n  /** Index of the `OVERRIDE_KEY` line, when the key is already declared. */\n  valueIdx?: number\n  /** Its current value, unquoted. */\n  value?: string\n  /** Index of the `overrides:` key line, when the block exists. */\n  blockIdx?: number\n  /** Index of the block's last entry, so an insertion keeps the block contiguous. */\n  lastEntryIdx?: number\n  /** Indentation the block's entries use. */\n  indent: string\n}\n\n/**\n * Locate the `overrides:` block and the i18next key inside it. A targeted text read rather\n * than a yaml parse, for the same reason `ensureReleaseAgeAllowList` does it: this file is\n * hand-maintained and round-tripping it through a parser would drop its comments and ordering.\n */\nfunction findOverrideEntry(lines: string[]): OverrideEntry {\n  const blockIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === 'overrides:')\n  if (blockIdx === -1) return { indent: '  ' }\n\n  let lastEntryIdx = blockIdx\n  let indent = '  '\n  for (let i = blockIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(MAP_ENTRY)\n    if (!match) break // dedent or blank line: the block ended\n    indent = match[1] ?? indent\n    lastEntryIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === OVERRIDE_KEY) {\n      return {\n        valueIdx: i,\n        value: (match[3] ?? '').replace(/^['\"]|['\"]$/g, ''),\n        blockIdx,\n        lastEntryIdx,\n        indent,\n      }\n    }\n  }\n  return { blockIdx, lastEntryIdx, indent }\n}\n\n/** Update the key in place, append it to an existing block, or open a block at the end. */\nfunction applyOverride(lines: string[], entry: OverrideEntry, want: string): void {\n  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`\n  if (entry.valueIdx !== undefined) {\n    lines[entry.valueIdx] = line\n    return\n  }\n  if (entry.lastEntryIdx !== undefined) {\n    lines.splice(entry.lastEntryIdx + 1, 0, line)\n    return\n  }\n  // No `overrides:` block at all: open one, keeping a single trailing newline.\n  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()\n  lines.push('overrides:', line, '')\n}\n\n/**\n * Ensure sentinel is allow-listed under `minimumReleaseAgeExclude` so a fresh publish\n * installs. No-op when the workspace has no such gate. Targeted text edit so comments and\n * formatting are preserved. Returns a message when it changed (or would), else undefined.\n */\nfunction ensureReleaseAgeAllowList(root: string, dryRun: boolean): string | undefined {\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined\n  const own = readOwnPackage().name\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const keyIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === `${RELEASE_AGE_KEY}:`)\n  if (keyIdx === -1) return undefined // no release-age gate in use\n\n  let lastItemIdx = keyIdx\n  let indent = '  '\n  for (let i = keyIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(LIST_ITEM)\n    if (!match) break\n    indent = match[1] ?? indent\n    lastItemIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === own) return undefined // already listed\n  }\n  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`\n\n  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`\n}\n\n/** The root ignore file Prettier reads, and the section sentinel owns inside it. */\nconst GIT_IGNORE = '.gitignore'\nconst REPORT_DIR_NAME = 'static-analysis-report'\nconst REPORT_PATTERN = `${REPORT_DIR_NAME}/`\nconst REPORT_HEADER = '# @hublo/sentinel: static analysis reports, written inside each module'\nconst PRETTIER_IGNORE = '.prettierignore'\nconst EXCLUSION_HEADER = '# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier'\n\n/** Root Prettier configs. Their presence is what makes an exclusion meaningful. */\nconst ROOT_PRETTIER_CONFIGS = [\n  '.prettierrc',\n  '.prettierrc.json',\n  '.prettierrc.json5',\n  '.prettierrc.yml',\n  '.prettierrc.yaml',\n  '.prettierrc.js',\n  '.prettierrc.cjs',\n  '.prettierrc.mjs',\n  'prettier.config.js',\n  'prettier.config.cjs',\n  'prettier.config.mjs',\n]\n\n/**\n * Exclude a module that now formats itself from the ROOT Prettier.\n *\n * Written as a directory pattern anchored at the root (`/apps/front/x/`), which is what\n * gitignore syntax means by \"this exact directory\", so a module cannot accidentally exclude a\n * same-named directory somewhere else.\n *\n * Skipped entirely when the root has no Prettier at all: there is then nothing to conflict\n * with, and creating an ignore file for a tool the workspace does not use would be noise.\n */\nfunction ensureFormatterExclusion(\n  root: string,\n  moduleDir: string,\n  dryRun: boolean,\n): string | undefined {\n  const rel = relative(root, moduleDir).replaceAll('\\\\', '/')\n  if (rel === '' || rel.startsWith('..')) return undefined // the root itself, or outside it\n\n  const ignorePath = join(root, PRETTIER_IGNORE)\n  const hasPrettier =\n    existsSync(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync(join(root, name)))\n  if (!hasPrettier) return undefined\n\n  const pattern = `/${rel}/`\n  const existing = existsSync(ignorePath) ? readFileSync(ignorePath, 'utf8') : ''\n  const lines = existing.split('\\n')\n  // Already excluded, in whichever spelling a human may have used.\n  if (lines.some((line) => line.trim().replace(/\\/$/, '') === pattern.replace(/\\/$/, ''))) {\n    return undefined\n  }\n  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`\n\n  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER)\n  if (headerIdx === -1) {\n    const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}\\n${pattern}\\n`)\n  } else {\n    // Keep the managed section together and sorted, so the list stays readable as it grows\n    // to 150 entries and a diff shows one added line rather than a reshuffle.\n    let end = headerIdx + 1\n    while (end < lines.length && lines[end]?.trim().startsWith('/')) end += 1\n    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort()\n    writeFileSync(\n      ignorePath,\n      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join('\\n'),\n    )\n  }\n  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`\n}\n\n/**\n * Apply every workspace-level fix the given root needs. Returns the human-readable\n * messages for what changed (empty when nothing did). Under dryRun nothing is written and\n * the messages describe what would change.\n *\n * `formattedModule` is the module that just adopted the FORMAT role, when one did. Absent\n * for a lint-only or TypeScript-only `--init`, because a module that has not adopted the\n * formatter must keep being formatted by the root.\n */\n/**\n * Ignore the static analysis report directory, once, at the ROOT.\n *\n * ## Why the root and not each module\n *\n * The role writes its json and html into `<module>/static-analysis-report/`, so the obvious place\n * for the rule is the module. It was there first, and it was wrong twice over: it CREATES a\n * `.gitignore` in a module that had none, which is a structural change to someone else's module for\n * one line, and it repeats that line once per adopting module. The root already ignores output this\n * way, with `/dist` and `/coverage`.\n *\n * ⚠️ The pattern is deliberately NOT anchored. `/dist` matches only the root's `dist`; the report\n * directory lives inside a module, so `static-analysis-report/` has to match at any depth. Getting\n * that backwards would leave every adopting module with an untracked directory, which is the exact\n * defect this guards against.\n *\n * ## Why this root write is not the dangerous kind\n *\n * The comment on `inspectWorkspacePrep` is right that root writes are what nobody sees afterwards,\n * and the i18next override earned that warning: it re-resolved a module from a pull request that\n * touched none of its files. An ignore line changes no resolution, no build and no install. If it\n * ever goes stale the cost is one unused line, which is why it is reported rather than feared.\n */\nfunction ensureReportIgnored(root: string, dryRun: boolean): string | undefined {\n  const path = join(root, GIT_IGNORE)\n  const existing = existsSync(path) ? readFileSync(path, 'utf8') : ''\n  // Whatever spelling a human may have used: with or without a leading or trailing slash.\n  const already = existing\n    .split('\\n')\n    .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n  if (already) return undefined\n  if (dryRun) return `would ignore ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n\n  const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n  writeFileSync(path, `${prefix}${REPORT_HEADER}\\n${REPORT_PATTERN}\\n`)\n  return `ignored ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n}\n\nexport function ensureWorkspacePrep(opts: {\n  root: string\n  dryRun?: boolean\n  formattedModule?: string\n  /** True when the STATIC ANALYSIS role adopted: it is what earns the ignore line. */\n  analysedModule?: boolean\n}): string[] {\n  const dryRun = Boolean(opts.dryRun)\n  return [\n    ensureI18nextSingleton(opts.root, dryRun),\n    ensureReleaseAgeAllowList(opts.root, dryRun),\n    opts.formattedModule === undefined\n      ? undefined\n      : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),\n    opts.analysedModule === true ? ensureReportIgnored(opts.root, dryRun) : undefined,\n  ].filter((message): message is string => message !== undefined)\n}\n\n/**\n * One standing change sentinel has made to the workspace ROOT, and whether it is still earned.\n *\n * This exists because the three root writes are the only thing sentinel does that nobody can\n * see afterwards. `--init` announces each one on the run that makes it, and then it is a line\n * in someone else's file forever. Two consequences already bit us.\n *\n * The `i18next>typescript` override re-resolved `apps/front/console` from a PR that touched no\n * file under it, so CODEOWNERS pulled nobody and its owners learned about it afterwards.\n *\n * And every one of them is TEMPORARY with its removal condition written in prose. That failed\n * three times in one week: `SENTINEL_TAG=alpha` in the migration-page workflow kept building\n * with a pre-release long after 1.1.0 went stable and reported `Format 0/439` for 15 adopted\n * modules; ADR 0042 and its RFC both sat mid-flight past their deadline; and this release-age\n * exclusion is still waiting on \"once sentinel's release cadence settles\". Nothing failed when\n * any of them expired, because a comment cannot fail.\n *\n * So each entry carries the condition that JUSTIFIES it, evaluated now rather than described.\n * A trigger that has gone away makes the entry dead config, and dead config is something a\n * command can say out loud instead of something a reader has to notice.\n *\n * Read-only, and offline: it inspects the same files `--init` writes and nothing else. What it\n * deliberately does NOT claim is anything needing the npm registry — whether a published\n * version is old enough to clear the release-age gate is not knowable from the repo, so it is\n * stated as the standing exemption it is rather than guessed at.\n */\nexport interface WorkspacePrepEntry {\n  /** `rule` to match the shape the shared renderer already prints as a labelled block. */\n  rule: string\n  /** What it does, whether its trigger still holds, and what would retire it. */\n  reason: string\n}\n\n/** The root-level changes sentinel maintains here, each with its justification checked now. */\nexport function inspectWorkspacePrep(root: string): WorkspacePrepEntry[] {\n  const entries: WorkspacePrepEntry[] = []\n  // Tolerant, unlike the write path above, and the difference is deliberate. `--init` should\n  // fail loudly on a root it cannot parse, because it is about to edit it. `--inspect` is a\n  // read verb that sweeps 441 modules, and one malformed root file must not take the whole\n  // sweep down: the modules still have honest answers to give. Caught by its own test.\n  let pkg: RootPackageJson = {}\n  const pkgPath = join(root, 'package.json')\n  if (existsSync(pkgPath)) {\n    try {\n      pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n    } catch {\n      pkg = {}\n    }\n  }\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  const yaml = existsSync(yamlPath) ? readFileSync(yamlPath, 'utf8') : undefined\n\n  const pinned = yaml === undefined ? undefined : findOverrideEntry(yaml.split('\\n')).value\n  if (pinned !== undefined) {\n    const stillForks = declaredNativeTs(pkg)\n    entries.push({\n      rule: `${WORKSPACE_YAML} → overrides.${OVERRIDE_KEY}`,\n      reason:\n        stillForks === undefined\n          ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing ` +\n            `forks any more. This override is now dead config and can be removed.`\n          : `pinned to ${pinned}, matching the second TypeScript the root declares ` +\n            `(${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, ` +\n            `not only adopted ones. It retires with the second TypeScript.`,\n    })\n  }\n\n  // A copy left in `package.json#pnpm` by an older sentinel, or by hand. Reported because it\n  // is INERT rather than redundant: pnpm 11 dropped the `pnpm` field with no warning\n  // (pnpm/pnpm#11536), so it reads as protection that is not applied.\n  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY]\n  if (legacy !== undefined) {\n    entries.push({\n      rule: `package.json → pnpm.overrides.${OVERRIDE_KEY}`,\n      reason:\n        `pinned to ${legacy}, but pnpm 11 no longer reads the \\`pnpm\\` field of package.json ` +\n        `and says nothing about it, so this override is not applied. Move it to ` +\n        `${WORKSPACE_YAML} under \\`overrides:\\`, which pnpm 10 and 11 both read.`,\n    })\n  }\n\n  const ignorePath = join(root, GIT_IGNORE)\n  if (existsSync(ignorePath)) {\n    const ignored = readFileSync(ignorePath, 'utf8')\n      .split('\\n')\n      .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n    if (ignored) {\n      entries.push({\n        rule: `${GIT_IGNORE} → ${REPORT_PATTERN}`,\n        reason:\n          `the static analysis role writes its json and html into ` +\n          `\\`<module>/${REPORT_PATTERN}\\`, and one unanchored line at the root covers every module ` +\n          `instead of creating a \\`${GIT_IGNORE}\\` in each one. Unlike the override above it changes ` +\n          `no resolution and no build, so a stale one costs a single unused line. It retires when no ` +\n          `module declares a \\`static-analysis\\` script any more, which the adoption report counts ` +\n          `and this read deliberately does not: it would have to sweep every module.`,\n      })\n    }\n  }\n\n  const own = readOwnPackage().name\n  if (yaml !== undefined) {\n    const listed = new RegExp(`^\\\\s*-\\\\s*['\"]?${own.replace('/', '\\\\/')}['\"]?\\\\s*$`, 'm').test(yaml)\n    if (listed) {\n      const gated = new RegExp(`^\\\\s*minimumReleaseAge\\\\s*:`, 'm').test(yaml)\n      entries.push({\n        rule: `${WORKSPACE_YAML} → ${RELEASE_AGE_KEY}: ${own}`,\n        reason: gated\n          ? `${own} is exempt from this workspace's release-age gate, so a freshly published ` +\n            `version installs instead of being held. That is a standing exemption from a ` +\n            `supply-chain control: the exposure is one bump wide, since the version is pinned ` +\n            `and the lockfile carries its integrity, so a re-publish of the same version does ` +\n            `not pass. Retire it once a bump can simply wait out the window.`\n          : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so ` +\n            `there is no gate to be exempt from. This entry is now dead config and can be removed.`,\n      })\n    }\n  }\n\n  return entries\n}\n"],"mappings":";AAGA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,qBAAqB;AAcvB,SAAS,iBAAkE;AAChF,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,YAAI,OAAO,IAAI,YAAY,UAAU;AAGnC,gBAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;AAClF,iBAAO,EAAE,MAAM,IAAI,QAAQ,mBAAmB,SAAS,IAAI,SAAS,IAAI;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AACvE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,iBAAyB;AACvC,SAAO,eAAe,EAAE;AAC1B;AAeO,SAAS,gBAAwB;AACtC,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,QAAI,WAAW,KAAK,KAAK,cAAc,CAAC,EAAG,QAAO;AAClD,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAMO,SAAS,uBAAuB,KAkBrC;AACA,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,YAAQ,OAAO,MAAM,6BAA6B,IAAI;AAAA,CAA6B;AACnF,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,kBAAkB,KAAiC;AACjE,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,WAAW,KAAqB;AAC9C,QAAM,WAAW,uBAAuB,GAAG,EAAE;AAC7C,SAAO,kBAAkB,GAAG,MAAM,aAAa,SAAY,SAAS,GAAG,IAAI;AAC7E;;;ACrIO,IAAM,wBAAwB;AAU9B,IAAM,0BAA0B;;;ACiBvC,SAAS,cAAAA,aAAY,gBAAAC,eAAc,qBAAqB;AACxD,SAAS,WAAAC,UAAS,QAAAC,OAAM,gBAAgB;AAMxC,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAClB,IAAM,YAAY;AASX,SAAS,kBAAkB,UAAsC;AACtE,MAAI,MAAM;AACV,aAAS;AACP,QAAIC,YAAWC,MAAK,KAAK,qBAAqB,CAAC,EAAG,QAAO;AACzD,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOA,SAAS,iBAAiB,KAA0C;AAClE,QAAM,OAAO,IAAI,eAAe,eAAe,KAAK,IAAI,kBAAkB,eAAe;AACzF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAChF,SAAO,WAAW;AACpB;AAaA,SAAS,uBAAuB,MAAc,QAAqC;AACjF,QAAM,UAAUD,MAAK,MAAM,cAAc;AACzC,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO;AACjC,QAAM,MAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AACpD,QAAM,OAAO,iBAAiB,GAAG;AACjC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,QAAQ,kBAAkB,KAAK;AACrC,MAAI,MAAM,aAAa,UAAa,MAAM,UAAU,KAAM,QAAO;AACjE,MAAI,OAAQ,QAAO,aAAa,YAAY,OAAO,IAAI,OAAO,cAAc;AAE5E,gBAAc,OAAO,OAAO,IAAI;AAChC,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,UAAU,YAAY,OAAO,IAAI,OAAO,cAAc;AAC/D;AAqBA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,WAAW,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,YAAY;AACpF,MAAI,aAAa,GAAI,QAAO,EAAE,QAAQ,KAAK;AAE3C,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,WAAS,IAAI,WAAW,GAAG,IAAI,MAAM,QAAQ,KAAK;AAChD,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,mBAAe;AACf,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,cAAc;AACjE,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,cAAc,OAAO;AAC1C;AAGA,SAAS,cAAc,OAAiB,OAAsB,MAAoB;AAChF,QAAM,OAAO,GAAG,MAAM,MAAM,IAAI,YAAY,MAAM,IAAI;AACtD,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,MAAM,QAAQ,IAAI;AACxB;AAAA,EACF;AACA,MAAI,MAAM,iBAAiB,QAAW;AACpC,UAAM,OAAO,MAAM,eAAe,GAAG,GAAG,IAAI;AAC5C;AAAA,EACF;AAEA,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,GAAI,OAAM,IAAI;AACrE,QAAM,KAAK,cAAc,MAAM,EAAE;AACnC;AAOA,SAAS,0BAA0B,MAAc,QAAqC;AACpF,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,MAAM,eAAe,EAAE;AAC7B,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,SAAS,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG;AAC3F,MAAI,WAAW,GAAI,QAAO;AAE1B,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,WAAS,IAAI,SAAS,GAAG,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,kBAAc;AACd,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,IAAK,QAAO;AAAA,EACnE;AACA,MAAI,OAAQ,QAAO,oBAAoB,GAAG,UAAU,eAAe;AAEnE,QAAM,OAAO,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,GAAG;AACtD,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,gBAAgB,GAAG,UAAU,eAAe,OAAO,cAAc;AAC1E;AAGA,IAAM,aAAa;AACnB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB,GAAG,eAAe;AACzC,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGzB,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYA,SAAS,yBACP,MACA,WACA,QACoB;AACpB,QAAM,MAAM,SAAS,MAAM,SAAS,EAAE,WAAW,MAAM,GAAG;AAC1D,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,EAAG,QAAO;AAE/C,QAAM,aAAaF,MAAK,MAAM,eAAe;AAC7C,QAAM,cACJD,YAAW,UAAU,KAAK,sBAAsB,KAAK,CAAC,SAASA,YAAWC,MAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,IAAI,GAAG;AACvB,QAAM,WAAWD,YAAW,UAAU,IAAIG,cAAa,YAAY,MAAM,IAAI;AAC7E,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,MAAI,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI,OAAQ,QAAO,iBAAiB,GAAG,4BAA4B,eAAe;AAElF,QAAM,YAAY,MAAM,UAAU,CAAC,SAAS,KAAK,KAAK,MAAM,gBAAgB;AAC5E,MAAI,cAAc,IAAI;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,kBAAc,YAAY,GAAG,MAAM,GAAG,gBAAgB;AAAA,EAAK,OAAO;AAAA,CAAI;AAAA,EACxE,OAAO;AAGL,QAAI,MAAM,YAAY;AACtB,WAAO,MAAM,MAAM,UAAU,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AACxE,UAAM,UAAU,CAAC,GAAG,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,OAAO,EAAE,KAAK;AACnE;AAAA,MACE;AAAA,MACA,CAAC,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,YAAY,GAAG,4BAA4B,eAAe;AACnE;AAkCA,SAAS,oBAAoB,MAAc,QAAqC;AAC9E,QAAM,OAAOF,MAAK,MAAM,UAAU;AAClC,QAAM,WAAWD,YAAW,IAAI,IAAIG,cAAa,MAAM,MAAM,IAAI;AAEjE,QAAM,UAAU,SACb,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,MAAI,QAAS,QAAO;AACpB,MAAI,OAAQ,QAAO,gBAAgB,cAAc,gBAAgB,UAAU;AAE3E,QAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,gBAAc,MAAM,GAAG,MAAM,GAAG,aAAa;AAAA,EAAK,cAAc;AAAA,CAAI;AACpE,SAAO,WAAW,cAAc,gBAAgB,UAAU;AAC5D;AAEO,SAAS,oBAAoB,MAMvB;AACX,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,SAAO;AAAA,IACL,uBAAuB,KAAK,MAAM,MAAM;AAAA,IACxC,0BAA0B,KAAK,MAAM,MAAM;AAAA,IAC3C,KAAK,oBAAoB,SACrB,SACA,yBAAyB,KAAK,MAAM,KAAK,iBAAiB,MAAM;AAAA,IACpE,KAAK,mBAAmB,OAAO,oBAAoB,KAAK,MAAM,MAAM,IAAI;AAAA,EAC1E,EAAE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAChE;AAoCO,SAAS,qBAAqB,MAAoC;AACvE,QAAM,UAAgC,CAAC;AAKvC,MAAI,MAAuB,CAAC;AAC5B,QAAM,UAAUF,MAAK,MAAM,cAAc;AACzC,MAAID,YAAW,OAAO,GAAG;AACvB,QAAI;AACF,YAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,YAAM,CAAC;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,QAAM,OAAOD,YAAW,QAAQ,IAAIG,cAAa,UAAU,MAAM,IAAI;AAErE,QAAM,SAAS,SAAS,SAAY,SAAY,kBAAkB,KAAK,MAAM,IAAI,CAAC,EAAE;AACpF,MAAI,WAAW,QAAW;AACxB,UAAM,aAAa,iBAAiB,GAAG;AACvC,YAAQ,KAAK;AAAA,MACX,MAAM,GAAG,cAAc,qBAAgB,YAAY;AAAA,MACnD,QACE,eAAe,SACX,aAAa,MAAM,qCAAqC,eAAe,sFAEvE,aAAa,MAAM,uDACf,eAAe;AAAA,IAE3B,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,IAAI,MAAM,YAAY,YAAY;AACjD,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK;AAAA,MACX,MAAM,sCAAiC,YAAY;AAAA,MACnD,QACE,aAAa,MAAM,2IAEhB,cAAc;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,QAAM,aAAaF,MAAK,MAAM,UAAU;AACxC,MAAID,YAAW,UAAU,GAAG;AAC1B,UAAM,UAAUG,cAAa,YAAY,MAAM,EAC5C,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,QAAI,SAAS;AACX,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,UAAU,WAAM,cAAc;AAAA,QACvC,QACE,qEACc,cAAc,uFACD,UAAU;AAAA,MAIzC,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,eAAe,EAAE;AAC7B,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,IAAI,OAAO,kBAAkB,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,KAAK,IAAI;AAC/F,QAAI,QAAQ;AACV,YAAM,QAAQ,IAAI,OAAO,+BAA+B,GAAG,EAAE,KAAK,IAAI;AACtE,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,cAAc,WAAM,eAAe,KAAK,GAAG;AAAA,QACpD,QAAQ,QACJ,GAAG,GAAG,4XAKN,GAAG,GAAG;AAAA,MAEZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["existsSync","readFileSync","dirname","join","existsSync","join","dirname","readFileSync"]}

package/dist/{chunk-AMCGMLPS.js → chunk-SPES5MQT.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-ELZHIN6E.js";
 import {
   findWorkspaceRoot
-} from "./chunk-YQRDKWSH.js";
+} from "./chunk-JEYGPPSL.js";
 
 // src/roles/test/setup/workspace.ts
 function isMissingModule(error) {
@@ -60,4 +60,4 @@ export {
   installWorkspaceSetup,
   pinWorkspaceTimezone
 };
-//# sourceMappingURL=chunk-AMCGMLPS.js.map
+//# sourceMappingURL=chunk-SPES5MQT.js.map

package/dist/{chunk-BN6SCBFW.js → chunk-TL2P2X45.js}

@@ -53,15 +53,16 @@ import {
   selfCommand,
   splitToolArgs,
   walk
-} from "./chunk-KLEXJFJ6.js";
+} from "./chunk-IFK6KGUW.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   WORKSPACE_ROOT_MARKER,
   findWorkspaceRoot,
   moduleName,
+  ownPackageDir,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-YQRDKWSH.js";
+} from "./chunk-JEYGPPSL.js";
 import {
   REPORT_DIR,
   SCRIPTS,
@@ -5104,7 +5105,7 @@ var SIZE = { width: 1600, height: 1200, margin: 30 };
 function hueOf(community) {
   return `hsl(${community * 137 % 360} 65% 52%)`;
 }
-function writeGraphPicture(graph, communities, path2) {
+function layOut(graph, communities) {
   const drawn = graph.copy();
   circular.assign(drawn);
   forceAtlas2.assign(drawn, { iterations: ITERATIONS, settings: forceAtlas2.inferSettings(drawn) });
@@ -5116,11 +5117,144 @@ function writeGraphPicture(graph, communities, path2) {
     drawn.setNodeAttribute(node, "color", hueOf(communities[node] ?? 0));
     drawn.setNodeAttribute(node, "label", named.has(node) ? node.split("/").pop() ?? node : BLANK);
   });
+  return drawn;
+}
+function writeGraphPicture(drawn, path2) {
   return new Promise((resolve5) => {
     renderSvg(drawn, path2, SIZE, () => resolve5());
   });
 }
 
+// src/roles/static-analysis/graph/explorer.ts
+function place(graph) {
+  const nodes = graph.nodes();
+  let minX = Infinity;
+  let maxX = -Infinity;
+  let minY = Infinity;
+  let maxY = -Infinity;
+  for (const node of nodes) {
+    const x = graph.getNodeAttribute(node, "x");
+    const y = graph.getNodeAttribute(node, "y");
+    if (x < minX) minX = x;
+    if (x > maxX) maxX = x;
+    if (y < minY) minY = y;
+    if (y > maxY) maxY = y;
+  }
+  const usableWidth = SIZE.width - 2 * SIZE.margin;
+  const usableHeight = SIZE.height - 2 * SIZE.margin;
+  const spanX = maxX - minX || 1;
+  const spanY = maxY - minY || 1;
+  const scale = Math.min(usableWidth / spanX, usableHeight / spanY);
+  const offsetX = SIZE.margin + (usableWidth - spanX * scale) / 2;
+  const offsetY = SIZE.margin + (usableHeight - spanY * scale) / 2;
+  const placed = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const x = graph.getNodeAttribute(node, "x");
+    const y = graph.getNodeAttribute(node, "y");
+    placed.set(node, {
+      x: offsetX + (x - minX) * scale,
+      y: offsetY + (y - minY) * scale,
+      // `size` is already the sqrt-damped degree `picture.ts` computed, in the same units as the
+      // standalone image, so the two drawings show a file at the same weight.
+      r: graph.getNodeAttribute(node, "size")
+    });
+  }
+  return placed;
+}
+function round(value) {
+  return (Math.round(value * 100) / 100).toString();
+}
+function hueOf2(community) {
+  return `hsl(${community * 137 % 360} 65% 52%)`;
+}
+function jsonInScript(value) {
+  return value.replace(/</g, "\\u003c");
+}
+function buildExplorer(drawn, communities) {
+  const placed = place(drawn);
+  const nodes = [...placed.keys()];
+  const index = new Map(nodes.map((node, position) => [node, position]));
+  const edges = [];
+  const segments = [];
+  drawn.forEachEdge((_edge, _attributes, source, target) => {
+    const from = placed.get(source);
+    const to = placed.get(target);
+    const sourceIndex = index.get(source);
+    const targetIndex = index.get(target);
+    if (!from || !to || sourceIndex === void 0 || targetIndex === void 0) return;
+    segments.push(`M${round(from.x)} ${round(from.y)}L${round(to.x)} ${round(to.y)}`);
+    edges.push(sourceIndex, targetIndex);
+  });
+  const used = [...new Set(nodes.map((node) => communities[node] ?? 0))].sort((a, b) => a - b);
+  const palette2 = used.map((community) => `.g svg .k${community}{fill:${hueOf2(community)}}`).join("");
+  const circles = nodes.map((node) => {
+    const spot = placed.get(node);
+    if (!spot) return "";
+    const community = communities[node] ?? 0;
+    return `<circle cx="${round(spot.x)}" cy="${round(spot.y)}" r="${round(spot.r)}" class="k${community}"/>`;
+  }).join("");
+  const payload = JSON.stringify({ f: nodes, e: edges });
+  const markup = `<section class="g">
+  <p class="read">One dot per file, sized by how many imports touch it, coloured by the community it landed in. The shape is the answer to how many lobes there are and whether they are joined. <b>Point at a dot for its path, click it to keep only that file and its neighbours, click the background to come back.</b></p>
+  <div class="gbar"><output id="gname">&nbsp;</output><button type="button" id="greset" hidden>show everything</button></div>
+  <svg viewBox="0 0 ${SIZE.width} ${SIZE.height}" role="img" aria-label="The module's import graph, one dot per file">
+    <path class="ge" d="${segments.join("")}"/>
+    <path class="gh" d=""/>
+    <g class="gn">${circles}</g>
+  </svg>
+  <style>${palette2}</style>
+  <script type="application/json" id="gdata">${jsonInScript(payload)}</script>
+  <script>${SCRIPT}</script>
+</section>`;
+  return { markup, bytes: Buffer.byteLength(markup, "utf8") };
+}
+var SCRIPT = `(function(){
+  var root=document.currentScript.closest('.g');
+  var data=JSON.parse(root.querySelector('#gdata').textContent);
+  var dots=root.querySelectorAll('.gn circle');
+  var name=root.querySelector('#gname');
+  var reset=root.querySelector('#greset');
+  var highlight=root.querySelector('.gh');
+  var out=[],inn=[];
+  for(var i=0;i<data.f.length;i++){out.push([]);inn.push([]);}
+  for(var k=0;k<data.e.length;k+=2){out[data.e[k]].push(data.e[k+1]);inn[data.e[k+1]].push(data.e[k]);}
+  function show(i){
+    name.textContent=data.f[i]+'  ('+out[i].length+' imported, '+inn[i].length+' importing)';
+  }
+  function clear(){
+    root.classList.remove('gsel');
+    highlight.setAttribute('d','');
+    for(var i=0;i<dots.length;i++)dots[i].classList.remove('gon','gpick');
+    name.innerHTML='&nbsp;';
+    reset.hidden=true;
+  }
+  function pick(i){
+    root.classList.add('gsel');
+    var near={};near[i]=1;
+    var d='';
+    function seg(a,b){
+      d+='M'+dots[a].getAttribute('cx')+' '+dots[a].getAttribute('cy')+'L'+dots[b].getAttribute('cx')+' '+dots[b].getAttribute('cy');
+    }
+    for(var a=0;a<out[i].length;a++){near[out[i][a]]=1;seg(i,out[i][a]);}
+    for(var b=0;b<inn[i].length;b++){near[inn[i][b]]=1;seg(inn[i][b],i);}
+    highlight.setAttribute('d',d);
+    for(var j=0;j<dots.length;j++){
+      dots[j].classList.toggle('gon',!!near[j]);
+      dots[j].classList.toggle('gpick',j===i);
+    }
+    show(i);
+    reset.hidden=false;
+  }
+  for(var n=0;n<dots.length;n++){
+    (function(i){
+      dots[i].addEventListener('mouseenter',function(){show(i);});
+      dots[i].addEventListener('click',function(event){event.stopPropagation();pick(i);});
+    })(n);
+  }
+  root.querySelector('svg').addEventListener('click',clear);
+  reset.addEventListener('click',clear);
+})();`;
+
 // src/roles/static-analysis/graph/scan.ts
 import Graph from "graphology";
 import louvain from "graphology-communities-louvain";
@@ -5302,8 +5436,16 @@ var GAUGE_THRESHOLDS = {
   // Same nesting family as `max-depth`, no citation of its own. Our p90 agrees at 3.
   "max-nested-callbacks": 3,
   // 1 is the rule's floor, there is no stricter value to pick.
-  "max-classes-per-file": 1
+  "max-classes-per-file": 1,
+  // Cognitive complexity, Campbell 2018, measured by Sonar's own rule, loaded
+  // through `plugins/sonar-cognitive.js`.
+  // Sonar publishes 15 for S3776, and that is a vendor default rather than a research value: one of
+  // their own engineers has said publicly that no formula supports it. Our p90 is 7, so 7 wins, and
+  // it reports 342 of 8 083 files, 4.2%, which sits inside the band the eight above occupy.
+  "cognitive-complexity": 7
 };
+var COGNITIVE = "cognitive-complexity";
+var cognitivePlugin = () => join20(ownPackageDir(), "plugins", "sonar-cognitive.js");
 var CATEGORIES = [
   "correctness",
   "suspicious",
@@ -5317,13 +5459,20 @@ function sizeRulesConfig() {
   return {
     plugins: [],
     categories: Object.fromEntries(CATEGORIES.map((category) => [category, "off"])),
+    // Sonar's cognitive complexity, in the SAME run as the eight above rather than a second
+    // invocation: the parse is the expensive part and it is already paid here. Measured over the
+    // whole bench, 8 083 files, the rule adds 2.4 s to a pass that was going to read them anyway.
+    jsPlugins: [cognitivePlugin()],
     // ⛔ `warn` and not `error`, for the reason `tool-config.ts` gives about jscpd's `threshold`:
     // at `error` oxlint exits 1 as soon as one file breaches, which is indistinguishable from the
     // binary failing to run. Measured on `libs/nest/auth`, same config otherwise: `error` exits 1,
     // `warn` exits 0, and both report the same 18 diagnostics. So the tool measures, this role
     // judges, and a non-zero exit means the tool failed.
     rules: Object.fromEntries(
-      Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => [rule, ["warn", threshold]])
+      Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => [
+        rule === COGNITIVE ? `sonar/${rule}` : rule,
+        ["warn", threshold]
+      ])
     )
   };
 }
@@ -5352,7 +5501,9 @@ function ruleOf(code) {
   return /\(([^)]+)\)\s*$/.exec(code)?.[1];
 }
 function valueOf(message) {
-  const match = /\((\d+)\)/.exec(message) ?? /complexity of (\d+)/.exec(message);
+  const match = /\((\d+)\)/.exec(message) ?? /complexity of (\d+)/.exec(message) ?? // Sonar's own wording, a third shape again: "reduce its Cognitive Complexity from 7 to the 0
+  // allowed". It parenthesises nothing, and the `0` after it is the threshold, not the value.
+  /Complexity from (\d+) to/.exec(message);
   return Number(match?.[1] ?? 0);
 }
 function breachesOf(raw) {
@@ -5590,6 +5741,13 @@ var metricsHelp = {
     caveat: "It says nothing about the size of the classes, and a file with one 800-line class never appears here.",
     source: "oxlint max-classes-per-file, above 1. The threshold is the rule's floor, there is no stricter value to pick. The rule for every one of the eight is `min(research, our p90, the rule's default)`, and a vendor default alone is not a reference: at 50, max-lines-per-function flagged 21.3% of our files and carried 77% of the union of all eight. The exclusions are the same list the duplication product pass is given, passed as `--ignore-pattern`: the `ignorePatterns` key in oxlint's config is accepted and silently ignored, which had this gauge measuring the test suite until the file counts were compared, 137 against 111 on `libs/nest/auth`."
   },
+  "cognitive-complexity": {
+    label: "Files hard to follow",
+    what: "Files holding at least one function whose cognitive complexity passes 7.",
+    read: "The other complexity figure, and it answers a different question from McCabe's: not how many paths a test suite must cover, but how much a reader has to hold in their head. The two disagree on purpose. A flat `switch` with twelve cases is cyclomatically 13 and cognitively 1, because nothing is nested and nothing surprises; three `if`s inside each other are cyclomatically 4 and cognitively 6, because each level is charged for the levels above it. When a file is high here and low there, the code is tangled rather than merely branchy, and that is the one this role would act on first.",
+    caveat: "\u26A0\uFE0F In JavaScript and TypeScript, sequences of `||` and `??` do NOT increment, deliberately: in this language they are overwhelmingly default-value shorthand rather than control flow, and SonarSource made that exclusion universal in SonarQube 10.8. So a long chain of fallbacks scores zero here while `&&` chains are charged. \u26D4 And it is a GAUGE, not the line your lint refuses at: no preset in this repository enforces cognitive complexity at all today.",
+    source: "Sonar's own `cognitive-complexity` rule from `eslint-plugin-sonarjs`, loaded into oxlint through `plugins/sonar-cognitive.js` and run in the same invocation as the size rules. It is USED and never copied: that package ships under the Sonar Source-Available License and sentinel is MIT. The algorithm is Campbell 2018 and its author works at SonarSource, so their implementation is the specification's own house rather than one reading of it; verified against Campbell's published example, which scores 7 in both. The threshold is 7, from `min(research, our p90, the rule's default)`: Sonar publishes 15 for S3776 and that is a vendor default rather than a research value, since one of their own engineers has said publicly that no formula supports it, while our p90 over the files the rule touches is 7. It reports 342 of 8 083 files on the bench, 4.2%."
+  },
   usedOnlyByTests: {
     label: "Used only by tests",
     what: "Files of this module that no production code imports, but another module's test files do.",
@@ -5902,8 +6060,35 @@ ${rest > 0 ? `    <p class="sub">The ${HTML_GROUP_LIMIT} longest are listed; ${r
     white-space: nowrap;
   }
   /* The graph. The svg carries a viewBox, so dropping its fixed width lets it fill the column. */
-  .picture svg { width: 100%; height: auto; display: block; }
-  .picture p.read { margin: 0 0 0.8rem; padding: 0 0.6rem; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+  .g svg { width: 100%; height: auto; display: block; }
+  .g p.read { margin: 0 0 0.8rem; padding: 0 0.6rem; color: var(--ink-soft); font-size: 0.88rem; max-width: 52rem; }
+  /* Every edge in one path, faint: it carries the shape, not a readable dependency. */
+  .g .ge { stroke: var(--rule); stroke-width: 0.6; fill: none; }
+  /* The selected file's own edges, drawn on top only once something is picked. */
+  .g .gh { stroke: var(--brand); stroke-width: 1.4; fill: none; }
+  .g .gn circle { cursor: pointer; }
+  /* Dim the module once a file is picked, so its neighbourhood is what is left to read. The
+     opacity sits on the GROUP and the exceptions raise themselves back: one rule instead of one
+     class per dot, which matters at 4 380 of them. */
+  .g.gsel .gn circle { opacity: 0.12; }
+  .g.gsel .gn circle.gon { opacity: 1; }
+  .g.gsel .gn circle.gpick { opacity: 1; stroke: var(--ink); stroke-width: 2; }
+  .g.gsel .ge { opacity: 0.25; }
+  /* The caption. A min-height and not a conditional row: the drawing must not jump by a line
+     when a name appears, which is exactly what pointing at a dot would cause. */
+  .gbar {
+    display: flex; gap: 0.6rem; align-items: center; justify-content: space-between;
+    min-height: 1.9rem; padding: 0 0.6rem; margin-bottom: 0.3rem;
+  }
+  .gbar output {
+    font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.82rem;
+    color: var(--ink); overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .gbar button {
+    font: inherit; font-size: 0.8rem; cursor: pointer; white-space: nowrap;
+    padding: 0.2rem 0.6rem; border: 1px solid var(--rule); border-radius: 0.3rem;
+    background: var(--surface); color: var(--ink-soft);
+  }
 
   /* The collapsed reserves. Closed by default: the figures are what the page opens on. */
   details { border-bottom: 1px solid var(--rule); }
@@ -5984,10 +6169,7 @@ ${report.notes.map((note) => `      <tr><td class="read">${escape(note)}</td></t
 ` : ""}
 ${report.picture ? `
   <h2>Shape</h2>
-  <section class="picture">
-    <p class="read">One dot per file, sized by how many imports touch it, coloured by the community it landed in. It shows the SHAPE: how many lobes, whether they are joined, where everything converges. The names are in the tables below.</p>
 ${report.picture}
-  </section>
 ` : ""}
   <h2>What these numbers do not say</h2>
   <section>
@@ -6882,11 +7064,12 @@ async function emit(report, shape, cwd, graph, coverage) {
   mkdirSync2(join22(cwd, REPORT_DIR), { recursive: true });
   const written = [];
   if (shape === "html" && graph.files > 1 && !hasUnreadableCode(coverage)) {
+    const drawn = layOut(graph.graph, graph.communityOf);
     const picture = `${TARGET}-graph.svg`;
     const path2 = join22(cwd, REPORT_DIR, picture);
-    await writeGraphPicture(graph.graph, graph.communityOf, path2);
+    await writeGraphPicture(drawn, path2);
     written.push(`${REPORT_DIR}/${picture}`);
-    report.picture = inlineable(readFileSync17(path2, "utf8"));
+    report.picture = buildExplorer(drawn, graph.communityOf).markup;
   }
   const name = shape === "json" ? "static-analysis.json" : "static-analysis.html";
   const body = shape === "json" ? renderJson(report) : renderHtml(report);
@@ -6896,9 +7079,6 @@ async function emit(report, shape, cwd, graph, coverage) {
   written: ${written.join(", ")}
 `);
 }
-function inlineable(svg) {
-  return svg.replace(/^<\?xml[^>]*\?>\s*/, "").replace(/^(<svg)\s+width="[^"]*"\s+height="[^"]*"/, "$1");
-}
 function metricsOf(report) {
   return {
     passes: report.passes,

package/dist/index.js

@@ -6,11 +6,11 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-BN6SCBFW.js";
+} from "./chunk-TL2P2X45.js";
 import {
   BaseAdapter
-} from "./chunk-KLEXJFJ6.js";
-import "./chunk-YQRDKWSH.js";
+} from "./chunk-IFK6KGUW.js";
+import "./chunk-JEYGPPSL.js";
 import "./chunk-AYEOGJQR.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";

package/dist/roles/test/setup/jest-parity.js

@@ -3,13 +3,13 @@ import {
 } from "../../../chunk-NUOQXAYR.js";
 import {
   installWorkspaceSetup
-} from "../../../chunk-AMCGMLPS.js";
+} from "../../../chunk-SPES5MQT.js";
 import "../../../chunk-ELZHIN6E.js";
 import {
   clearDeepMocks,
   resetDeepMocks
 } from "../../../chunk-2XLX6PFR.js";
-import "../../../chunk-YQRDKWSH.js";
+import "../../../chunk-JEYGPPSL.js";
 
 // src/roles/test/setup/jest-parity.ts
 import { expect, vi } from "vitest";

package/dist/roles/test/setup/workspace-entry.js

@@ -1,8 +1,8 @@
 import {
   pinWorkspaceTimezone
-} from "../../../chunk-AMCGMLPS.js";
+} from "../../../chunk-SPES5MQT.js";
 import "../../../chunk-ELZHIN6E.js";
-import "../../../chunk-YQRDKWSH.js";
+import "../../../chunk-JEYGPPSL.js";
 
 // src/roles/test/setup/workspace-entry.ts
 await pinWorkspaceTimezone();

package/dist/{validate-AWWMBSH5.js → validate-7VBODB4M.js}

@@ -7,8 +7,8 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-KLEXJFJ6.js";
-import "./chunk-YQRDKWSH.js";
+} from "./chunk-IFK6KGUW.js";
+import "./chunk-JEYGPPSL.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";
 

package/docs/static-analysis-adoption.md

@@ -0,0 +1,195 @@
+# Static analysis adoption cheat sheet
+
+A quick reference for adopting the sentinel static analysis role on a module, and for reading what it prints. The reasoning behind every number, and the measurements that fixed the thresholds, are in [`static-analysis-study.md`](static-analysis-study.md); this page is what you need to run it.
+
+**It measures, it never refuses.** Nothing here fails a build or blocks a merge. A figure answers "is this module drifting", which is a question about a trend, and a check that blocks a merge on a trend blocks the wrong thing. Refusing a single unit is the linter's job and oxlint already does it.
+
+## Adopt a module in two steps
+
+Run from the **module's own directory**. You do not need to install sentinel first: use `npx --yes` for a one-off.
+
+```bash
+# 1. write the module's config + the pinned devDependency
+cd apps/.../<module>
+npx --yes @hublo/sentinel@<version> --init --static-analysis
+
+# 2. fetch what step 1 declared
+pnpm install
+```
+
+`--init` writes `static-analysis.config.mjs`, adds the three scripts below to the module's `package.json`, and pins `@hublo/sentinel` into its own `devDependencies`. It prints what it did:
+
+```
+  wrote static-analysis.config.mjs
+  wrote package.json
+  added the three `static-analysis` scripts and static-analysis.config.mjs; declare
+  this module's entry points and journeys there, everything else comes from the role
+```
+
+**Nothing else is required.** The config stub is written with empty `entry` and `journeys` on purpose: for most modules the figures are already right without declaring anything, and the stub exists so you can correct the one case where they are not (see [Declaring entry points](#declaring-entry-points)).
+
+## Verbs at a glance
+
+| Verb        | Who / when         | Runs the tools?   | What you get                                                           |
+| ----------- | ------------------ | ----------------- | ---------------------------------------------------------------------- |
+| `--run`     | dev, everyday      | **yes**           | the figures, in one of three shapes. Never exits non-zero on a finding |
+| `--inspect` | dev, everyday      | no (reads config) | the resolved settings, and whether this module has adopted             |
+| `--init`    | dev, once to adopt | writes files      | the config stub, the three scripts, the pinned dep                     |
+| `--migrate` | planned            | not available yet | reserved for changing an already-initialized setup                     |
+
+**Location** (any verb): from a module dir → that module; from the root → `--module <name>`, `--ci` (affected), or every module. `--init` writes, so it targets one module only.
+
+## Everyday use
+
+```bash
+pnpm run static-analysis         # the summary, in your terminal. Writes nothing
+pnpm run static-analysis:json    # static-analysis-report/static-analysis.json, for a machine
+pnpm run static-analysis:html    # static-analysis-report/static-analysis.html, for a reader
+```
+
+Or without the scripts:
+
+```bash
+sentinel --run --static-analysis                   # same as the first script
+sentinel --run --static-analysis --output html     # same as the third
+sentinel --inspect --static-analysis               # the settings, without running anything
+```
+
+**Which shape to use.** `console` is the one you run in a loop: it writes nothing and skips the expensive drawing. `json` is for CI and for a script. `html` is the one you open and send: it carries the findings, the places to look, and an explorable import graph.
+
+⚠️ The `html` shape pays for a graph layout that the other two skip, 5 seconds on the largest module measured against 14 ms for the rest of the graph pass. That is fine for a page somebody opens and wrong for a commit hook.
+
+## Reading the report
+
+The console summary of a nest microservice, in full:
+
+```
+sentinel static-analysis: contract
+    Duplicated lines                                       3.95 %
+    Clones                                             61 entries
+    Duplicated lines (tests)                              10.93 %
+    Clones (tests)                                    196 entries
+    Entry points                                  46 of 656 files
+    Unreachable lines                                      1.07 %
+    Unreachable files                                     5 files
+    Unused exports                                      1 exports
+    Unused symbols                                      1 symbols
+    Unused imports                                      0 imports
+    Complexity, worst function                27 max per function
+    Complexity 11-20, moderate risk          18 of 1386 functions
+    Complexity 21-50, high risk               1 of 1386 functions
+    Imports between files                  1135 between 495 files
+    Density                          0.0046 of the possible edges
+    Import cycles                               3 groups, 8 files
+    Communities                                   12 of 495 files
+    Modularity (Q)                                          0.753
+    Files the gauge read                 495 files the gauge read
+    Files with a complex function        18 files over 10, of 495
+    Files with deep nesting                4 files over 3, of 495
+    Long files                          43 files over 150, of 495
+    Files with a long function           5 files over 109, of 495
+    Files with a long function body      47 files over 10, of 495
+    Files with a wide signature           33 files over 3, of 495
+    Files with several classes            16 files over 1, of 495
+    Files hard to follow                  23 files over 7, of 495
+```
+
+Four groups, and they answer different questions:
+
+|                    | what it answers                                                                                                                                                               |
+| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| duplication        | how much of this module repeats itself, product and tests counted apart                                                                                                       |
+| dead code          | what nothing reaches: files, exports, symbols, imports                                                                                                                        |
+| complexity         | two measures, on purpose: how hard the hardest functions are to TEST (McCabe) and how hard they are to FOLLOW (cognitive). They disagree on 60% of the files either one flags |
+| structure and size | how the files depend on each other, and which ones are outliers                                                                                                               |
+
+**Every row carries its denominator**, because none of them compares between modules without one: three breaches over 50 files and three over 3 000 are not the same module.
+
+**A row that is absent was not measured.** It is never a silent zero. When a pass cannot produce a figure, the report says so in its own line under the figures rather than printing `0.00%`, because "no dead code" and "the walk had no entry point" are different facts.
+
+### Three rows people misread
+
+**`Unreachable files` is not a delete list.** It means nothing in this module imports them. A file another module's spec imports is alive, and it has its own row, `Used only by tests`. For a library the question cannot even be answered inside the module, so the role leaves it (see below).
+
+**`Import cycles` reports GROUPS, not paths.** A group of six files can hold a dozen distinct circles, and breaking one does not necessarily break the group. The group is the unit precisely for that reason.
+
+**`Density` must not be compared between modules of different sizes.** Its denominator grows with the square of the file count, so a module gets a lower density by growing rather than by improving. Measured: `libs/nest/auth` 0.0216 at 101 files, `apps/front/host-admin` 0.0005 at 4 380. It is good for one module watched over time.
+
+### Where the size thresholds come from
+
+The nine size rows are measured with oxlint at thresholds this role fixes once for every module, so the same question gets the same answer everywhere. Each one is the **strictest of three candidates**: published research, our own p90, and the rule's own default.
+
+| row                               |     threshold | what decided it                                                                           |
+| --------------------------------- | ------------: | ----------------------------------------------------------------------------------------- |
+| `Files with a complex function`   |            10 | McCabe 1976 says 10, our p90 says 11                                                      |
+| `Files with a long function`      |           109 | our p90. IfSQ SP-1 says 150 and loses for being more permissive than our code             |
+| `Long files`                      |           150 | our p90 of 157, rounded down. No research sets a file's length                            |
+| `Files with deep nesting`         |             3 | IfSQ SP-2, and our p90 agrees                                                             |
+| `Files with nested callbacks`     |             3 | same nesting family                                                                       |
+| `Files with a long function body` | 10 statements | the rule's default, already the strictest candidate                                       |
+| `Files with a wide signature`     |  3 parameters | beyond three the fix is an object or currying, so this is a design boundary               |
+| `Files with several classes`      |             1 | the rule's floor                                                                          |
+| `Files hard to follow`            |             7 | Sonar publishes 15 for cognitive complexity and says no formula supports it; our p90 is 7 |
+
+⚠️ **These will disagree with your green lint, out loud.** The `nest` lint preset refuses `complexity` at 30 while this reports above 10, so a nest developer reads breaches beside a passing build. That is correct: the lint is the line your build refuses at, this is a gauge that answers the same question the same way in every module, including the ones that have not adopted lint at all. The report prints its thresholds under `measured with` so the two are never confused.
+
+## The `html` report
+
+Written to `static-analysis-report/`, two files:
+
+- `static-analysis.html`, self-contained: no CDN, no library, no font, nothing fetched. Open it from disk, attach it to a ticket, serve it from a CI artifact.
+- `static-analysis-graph.svg`, the import graph as a plain image, for when you want to paste a picture.
+
+The page carries what the console summary leaves out: every finding with its path, the code of each clone, and an **explorable import graph**. Point at a dot for its path and its two degrees, click it to keep only that file and its neighbours, click the background to come back. The drawing renders with scripting off; the script only adds the naming and the filtering.
+
+⚠️ `static-analysis-report/` is generated. The rule lives in the **root** `.gitignore`, unanchored so it matches at any depth, rather than one line added to every adopting module's own file. You have nothing to do and nothing to commit.
+
+## Declaring entry points
+
+`entry` names the files that **run although nothing imports them**. They are where reachability starts, and they are added to the patterns the role already ships rather than replacing them.
+
+Most modules need nothing. Declare an entry point when the framework loads a file by convention the role has not met, or when code is loaded by name at run time:
+
+```js
+import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+
+export default defineStaticAnalysis({
+  root: import.meta.dirname,
+  entry: ['src/emails/**'],
+  journeys: {},
+})
+```
+
+**The symptom that tells you one is missing**: a large, tightly-grouped block of unreachable files under one directory. Measured on `libs/cloud/hermes`, 228 of its 231 findings sit under `src/emails`, which holds templates loaded by name rather than imported. That is one line of config, not 228 deletions.
+
+## Two limits worth knowing before you read a number
+
+**A single-file component format cannot be parsed.** `.svelte`, `.vue` and `.astro` files are not read, so on a module holding them the role reports the duplication, complexity and size figures and **omits the graph and the dead-code figures entirely**, with the share printed in their place:
+
+```
+    (252 product file(s) in .svelte cannot be parsed, 53% of this module: no graph
+     and no dead-code figure is reported, because a file the role cannot open still
+     imports the files it imports)
+```
+
+Absent with its reason, rather than a figure that is wrong by half.
+
+**A library's dead code is decided outside the module.** An application has an entry point; a library has none, so a module-local walk would report "the module does not import itself", which is true of every library. The role builds a workspace-wide index of who imports what, once, and caches it under `node_modules/.cache/sentinel/`. Measured on `libs/nest/auth`: **15** unreachable files with the index against **87** without it.
+
+## Troubleshooting
+
+|                                                             |                                                                                                                                  |
+| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| a wall of unreachable files under one directory             | an undeclared entry point, see above                                                                                             |
+| the graph and dead-code rows are missing                    | the module holds `.svelte`, `.vue` or `.astro`; the note above the figures says the share                                        |
+| `Entry points 0 of N`                                       | nothing matched, so the walk had no start. Declare `entry`                                                                       |
+| the numbers differ from another module's                    | check `measured with`: a setting this module moved is marked `(module)`, and two modules measured differently cannot be compared |
+| the run is slow                                             | you are on `--output html`, which pays the graph layout. Use the plain script in a loop                                          |
+| `oxlint could not be run, so no size indicator is reported` | the binary did not resolve; the size rows are absent rather than zero                                                            |
+
+## What the role will not do
+
+- **It will not fail your build.** No threshold here refuses anything, by design, for as long as adoption is incomplete. The only non-zero exits are an unknown `--output` value and a tool that could not be run at all, never a finding.
+- **It will not read your module's `.oxlintrc.json`.** The size gauge writes its own config to a temporary directory, so its scale is the same in every module. A gauge whose scale moves per module compares nothing.
+- **It will not look outside the module**, except for the one measurement that cannot be answered inside it: a library's reachability.
+- **It will not measure your tests.** Specs, fixtures, mocks, stories and generated files are out of every product figure. Duplication reports the test suite separately, on its own two rows, because that one is worth seeing and must not be blended into the product number.

package/docs/static-analysis-study.md

@@ -856,7 +856,14 @@ function is reported: sentinel 752 functions and 41 above 15, network 1 701 and
 1 050 and 6, console 510 and 0. Zero fatal errors on 4 572 files, where escomplex fails on 37.9%
 of `network` and 39.0% of `recruitment`. The worst module is this package.
 
-It is absent from oxlint 1.77, so it is written once here and used twice. See 9.5.
+⛔ **Corrected on 2026-10-13: it is not written here, it is LOADED.** oxlint 1.77 accepts an ESLint
+rule as a JS plugin, so Sonar's own rule runs inside our own pass with none of their code in this
+repository. The reasoning, the measurements and the licence that decides it are in **11.8**.
+
+⚠️ **The four figures above were produced with a version this document does not name**, and the
+plugin's behaviour moved between majors: sequences of `||` and `??` stopped incrementing. So treat
+them as an order of magnitude, not as a baseline. The figures measured on the current version, and
+what the metric actually adds beside McCabe, are in 11.8.
 
 ### 9.3 The maintainability figure
 
@@ -977,13 +984,13 @@ touch no production file at all and the median touches **4**.
 
 ### 9.7 What is still a decision
 
-| open                                   | what it needs                                                                                                                         |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| the `/10` in the `MI`                  | the distribution over the 198 modules. It changes the spread, never the order                                                         |
-| the criticality order of the **eight** | one argument per indicator. **Rarity no longer rules any out:** see 11.6, where the split is removed. Ranking the eight is still open |
-| the overhead line of the SQL study     | the harness rebuilt. #90 corrects the attribution and withdraws the 71%, which was never a ratio                                      |
-| the workspace index for libraries      | built and measured in 10.4 and 10.5. Nothing open here any more                                                                       |
-| a feedback channel on findings         | unchanged from section 8, and it is what would let any of this be proven wrong                                                        |
+| open                                  | what it needs                                                                                                                    |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| the `/10` in the `MI`                 | the distribution over the 198 modules. It changes the spread, never the order                                                    |
+| the criticality order of the **nine** | one argument per indicator. **Rarity no longer rules any out:** see 11.6, where the split is removed. Ranking them is still open |
+| the overhead line of the SQL study    | the harness rebuilt. #90 corrects the attribution and withdraws the 71%, which was never a ratio                                 |
+| the workspace index for libraries     | built and measured in 10.4 and 10.5. Nothing open here any more                                                                  |
+| a feedback channel on findings        | unchanged from section 8, and it is what would let any of this be proven wrong                                                   |
 
 The one measurement that unblocks the first two is the same: **the eight indicators over all 198
 modules, once.** That measurement now exists, in 10.7 over 177 modules and in 11 over a five-module
@@ -1344,15 +1351,15 @@ already sit in the 1-10 band the SEI calls low risk, so 10 is a ratchet rather t
 | 21-50, high risk    |       128 |      1.2 % |
 | over 50, untestable |         8 |      0.1 % |
 
-### 11.6 What the eight say together, and the end of the descriptor split
+### 11.6 What the eight size rules say together, and the end of the descriptor split
 
 A threshold is only half a decision: what matters is what the **set** reports.
 
-|                        |          at the vendor defaults | at the thresholds above |
-| ---------------------- | ------------------------------: | ----------------------: |
-| union of the eight     |             2 236 files, 27.7 % | **1 708 files, 21.1 %** |
-| largest single rule    | `max-lines-per-function`, 1 724 |   `max-statements`, 891 |
-| its share of the union |                        **77 %** |                **52 %** |
+|                               |          at the vendor defaults | at the thresholds above |
+| ----------------------------- | ------------------------------: | ----------------------: |
+| union of the eight size rules |             2 236 files, 27.7 % | **1 708 files, 21.1 %** |
+| largest single rule           | `max-lines-per-function`, 1 724 |   `max-statements`, 891 |
+| its share of the union        |                        **77 %** |                **52 %** |
 
 ⛔ **At the defaults one rule was the report.** `max-lines-per-function` at 50 flagged 21.3% of all
 product files and carried 77% of the union, so the other seven indicators were inaudible: the
@@ -1417,6 +1424,118 @@ always fire first and the statement count would never say anything again.
 
 ---
 
+### 11.8 The ninth indicator: cognitive complexity, loaded rather than written
+
+Section 9.2 chose this metric and said it would be "written once here". It is not written. oxlint
+1.77 accepts an ESLint rule as a JS plugin, so Sonar's own `cognitive-complexity` runs inside the
+same invocation as the eight rules above, through a bridge that re-exposes it and contains none of
+their code.
+
+**Why loaded and not reimplemented**, in order of weight:
+
+⛔ **The licence decides it.** `eslint-plugin-sonarjs` ships under the Sonar Source-Available
+License, whose grant is limited to a "Non-competitive Purpose", and sentinel is published under MIT.
+Depending on a package is not preparing a derivative work of it; transcribing its code into this
+repository would be, in any language, and would mean granting rights we never received. ⚠️ Its
+`package.json` declares `LGPL-3.0-only` while the LICENSE file and every source header say SSAL.
+That contradiction is Sonar's; it is recorded here, not resolved.
+
+**The metric's author works there.** Campbell 2018 is theirs, so their implementation is the
+specification's own house rather than one reading of it among several.
+
+**It costs almost nothing.** Measured: 0 advisories at every level, 94 packages, and `eslint` is
+**not** pulled, because pnpm leaves the peer unmet and oxlint provides the context itself. It does
+pull `typescript`, which nothing of ours imports. The rule adds 2.4 s over 8 083 files to a pass
+that was already reading them.
+
+#### The behaviour is not the paper's, deliberately
+
+Measured on the same file with the same parser, before any of it was believed:
+
+|                             | sonarjs 0.25.1 | sonarjs 4.2.2 |
+| --------------------------- | -------------: | ------------: |
+| `if (a \|\| b \|\| c)`      |              2 |         **1** |
+| `if (a && b && c)`          |              2 |             2 |
+| `const x = a \|\| b \|\| c` |              1 |         **0** |
+
+⛔ **This is not a regression, which is what it was first called here.** Sequences of `||` and `??`
+are excluded on purpose: SonarSource state it themselves, "we tried to adjust the cognitive
+complexity rule to accommodate common idioms", and made the exclusion universal in SonarQube 10.8
+after it had been inconsistent between contexts. In JavaScript those two operators are
+overwhelmingly default-value shorthand rather than control flow. The lesson is the general one: an
+implementation that diverges from a published algorithm is a question to ask, not a defect to
+assume.
+
+#### The host is validated, not assumed
+
+Running somebody else's rule inside another linter removes the question "is our counting right" and
+replaces it with a narrower one: **does oxlint's tree feed the rule the same thing ESLint's does.**
+A fixture cannot answer that, because the constructs at risk are the ones real code has and
+fixtures do not: decorators, enums, `satisfies`, generics, and the JSX short-circuit the rule
+treats specially.
+
+So the same rule was run through both hosts over two real modules and compared **function by
+function**, matched on file and line:
+
+|                          | functions | identical | disagreements | seen by one host only |
+| ------------------------ | --------: | --------: | ------------: | --------------------: |
+| `contract`, nest         |       539 |   **539** |             0 |                     0 |
+| `console`, react and tsx |       581 |   **581** |             0 |                     0 |
+
+⚠️ This was missing when the figure first shipped, and the gap was not obvious: the earlier check
+compared the two hosts on about twenty fixture functions, which proves the plumbing and not the
+parse. It is the same bar `complexity` was held to against oxlint, 839 functions and 839 identical
+values, and it is the bar any rule borrowed from another ecosystem has to clear.
+
+#### The threshold
+
+`min(research, our p90, the rule's default)`, the same rule as the eight above. Sonar publishes
+**15** for S3776, and that is a vendor default rather than a research value: one of their own
+engineers has said publicly that no formula supports it. Our p90 over the files the rule touches is
+**7**, so 7 wins. It reports **342 of 8 083 files, 4.2%**, inside the band the other eight occupy.
+
+#### What it adds, and the honest version of that
+
+⚠️ **Almost nothing to the union.** Of its 342 files, **330 were already flagged** by one of the
+eight: the union goes from 1 708 files to 1 720, 21.1% to 21.3%. Anyone judging the indicator by
+coverage should stop here and conclude it is redundant.
+
+That reading is wrong, and the measurement that shows why is the comparison with McCabe, which is
+the thing it was brought in to complement:
+
+| on 8 083 product files                            |         |
+| ------------------------------------------------- | ------: |
+| flagged by both complexities                      |     242 |
+| **cyclomatic only**, branchy but readable         | **257** |
+| **cognitive only**, tangled without being branchy | **100** |
+| agreement between the two                         | **40%** |
+| Spearman over the 3 823 files carrying both       |   0.764 |
+
+The two disagree on **60% of the files either one flags**, which is the whole point. A flat `switch`
+with twelve cases is cyclomatically 13 and cognitively 1, because nothing is nested and nothing
+surprises; three `if`s inside each other are cyclomatically 4 and cognitively 6, because each level
+is charged for the levels above it. The 257 are the first shape and the 100 are the second. A figure
+that agreed with McCabe would have been the redundant one.
+
+#### Three defects on the way, all with one symptom
+
+Each produced exactly `oxlint could not be run, so no size indicator is reported`, which names
+neither the plugin nor the path, and each silently removed **all nine** figures rather than one:
+
+- the bridge written straight into `plugins/`, which is git-ignored and wiped by every build. It
+  survived until the next `pnpm build`.
+- its path computed by counting `..` from `import.meta.url`. `tsup` bundles into chunks whose depth
+  is not the source tree's, so it resolved from `src/` and not from `dist/`. ⚠️
+  `roles/test/shared-test-config.ts` already records this lesson at length, after it cost a module
+  83 passing tests; it was repeated anyway. The path is now walked up to.
+- the rule is namespaced by its plugin in the config, `sonar/cognitive-complexity`, and bare in the
+  diagnostic. One name in both places gives a config oxlint accepts and a breach map that never
+  matches.
+
+All three are now tests.
+
+---
+
 ## 12. Sources
 
 - IfSQ. _Level 1, Level 2 and Level 3 Standards for Code Quality._ <https://www.ifsq.org/level-1.html>,

package/docs/using-sentinel.md

@@ -4,8 +4,9 @@ The commands, what an adopted module ends up looking like, and how versions move
 migrating a module see [`lint-adoption.md`](lint-adoption.md),
 [`format-adoption.md`](format-adoption.md),
 [`typescript-adoption.md`](typescript-adoption.md),
-[`build-adoption.md`](build-adoption.md) and
-[`test-adoption.md`](test-adoption.md), which also carries the reference gate `--test` runs a
+[`build-adoption.md`](build-adoption.md),
+[`test-adoption.md`](test-adoption.md) and
+[`static-analysis-adoption.md`](static-analysis-adoption.md), which also carries the reference gate `--test` runs a
 migration against.
 
 ## The grid

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.22",
+  "version": "1.5.0-alpha.23",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -118,6 +118,7 @@
     "eslint-plugin-jest-dom": "5.5.0",
     "eslint-plugin-no-barrel-files": "1.2.1",
     "eslint-plugin-react-refresh": "0.4.19",
+    "eslint-plugin-sonarjs": "4.2.2",
     "eslint-plugin-storybook": "10.3.5",
     "eslint-plugin-styled-components-a11y": "2.2.0",
     "graphology": "0.26.0",

package/plugins/sonar-cognitive.js

@@ -0,0 +1,71 @@
+/**
+ * Cognitive complexity, measured by Sonar's own rule, loaded into oxlint.
+ *
+ * ⚠️ Source file. It is COPIED to `plugins/` at build time by `scripts/build-presets.ts`, which
+ * wipes that directory first: `plugins/` is git-ignored, so a file written straight into it lasts
+ * until the next build. Edit this one.
+ *
+ * ## Why a bridge and not an implementation
+ *
+ * Cognitive complexity is Campbell 2018, and its author works at SonarSource, so their
+ * implementation is not one reading of the specification among several: it is the specification's
+ * own house, with the language-specific decisions that come with it. The clearest of those is that
+ * `||` and `??` sequences do NOT increment in JavaScript and TypeScript, which looks like a defect
+ * against the generic paper and is deliberate: in this language those two operators are
+ * overwhelmingly default-value shorthand rather than control flow. SonarSource say so themselves,
+ * "we tried to adjust the cognitive complexity rule to accommodate common idioms", and made the
+ * exclusion universal in SonarQube 10.8 after it had been inconsistent between contexts.
+ *
+ * Measured here before it was believed, same file and same parser on both:
+ *
+ *   |                            | sonarjs 0.25.1 | sonarjs 4.2.2 |
+ *   | `if (a \|\| b \|\| c)`     |              2 |             1 |
+ *   | `if (a && b && c)`         |              2 |             2 |
+ *   | `const x = a \|\| b \|\| c`|              1 |             0 |
+ *
+ * ⛔ **The rule is USED, never copied.** `eslint-plugin-sonarjs` ships under the Sonar
+ * Source-Available License, whose grant is limited to a "Non-competitive Purpose", and sentinel is
+ * published under MIT. Depending on a package is not preparing a derivative work of it; copying its
+ * code into this repository would be, and would also mean granting rights we never received. So
+ * this file re-exposes their rule and contains none of their code.
+ *
+ * ## Why it works at all, which is not obvious
+ *
+ * This is an ESLint rule running inside oxlint. Measured before it was adopted:
+ *
+ *   |                                              | |
+ *   | the same values as ESLint, on `.js` and `.ts`| identical on every fixture, including the 7 of Campbell's own published example |
+ *   | on a real module, `contract`, 516 files      | 765 ms, exit 0, no error |
+ *   | `eslint` itself                              | NOT installed: pnpm leaves the peer unmet and oxlint provides the context |
+ *   | advisories the dependency adds               | 0 at every level, 94 packages |
+ *
+ * ⚠️ It does pull `typescript` as a hard dependency of the plugin, which nothing of ours imports.
+ */
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+
+/**
+ * ⛔ The deep path, and not the package name.
+ *
+ * `eslint-plugin-sonarjs` declares `main: ./cjs/plugin.js` and no `exports` map, so a bare ESM
+ * `import` of the package name fails to resolve under Node's ESM rules. Measured: it throws
+ * `ERR_MODULE_NOT_FOUND` before oxlint has read a single file, and oxlint reports it as
+ * "Failed to parse oxlint configuration file", which points at the wrong thing entirely.
+ */
+const sonarjs = require('eslint-plugin-sonarjs/cjs/plugin.js')
+
+/** CJS interop: the plugin is reached either directly or behind `default`, depending on the build. */
+const rules = sonarjs.rules ?? sonarjs.default?.rules
+
+if (!rules?.['cognitive-complexity']) {
+  throw new Error(
+    'sentinel: eslint-plugin-sonarjs no longer exposes `cognitive-complexity` from cjs/plugin.js. ' +
+      'The cognitive complexity figure cannot be produced; see this file.',
+  )
+}
+
+export default {
+  meta: { name: 'sonar' },
+  rules: { 'cognitive-complexity': rules['cognitive-complexity'] },
+}

package/dist/chunk-YQRDKWSH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shared/package-json.ts","../src/core/settings.ts","../src/core/workspace-prep.ts"],"sourcesContent":["/**\n * package.json helpers, shared by the CLI and the engine.\n */\nimport { existsSync, readFileSync } from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\n/**\n * sentinel's OWN version, for `--version`. We must NOT use\n * `process.env.npm_package_version`, that is the version of whatever script\n * invoked us (an app's package.json, or nothing). Instead walk up from this\n * module to the nearest package.json, which is always sentinel's own, whether\n * running from source or the bundled dist.\n */\n/**\n * sentinel's OWN name + version, read by walking up from this module to the nearest\n * package.json. Used both for `--version` and to pin the exact dependency `--init`\n * writes into an adopted module, so a module always references the version that adopted it.\n */\nexport function readOwnPackage(): { name: string; version: string; bin?: string } {\n  let dir = dirname(fileURLToPath(import.meta.url))\n  for (;;) {\n    const pkgPath = join(dir, 'package.json')\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {\n          name?: string\n          version?: string\n          bin?: string | Record<string, string>\n        }\n        if (typeof pkg.version === 'string') {\n          // The bin PATH, not the command name: a package that adopts itself has to invoke\n          // its own build output, because the `.bin` shim does not exist yet (see below).\n          const bin = typeof pkg.bin === 'string' ? pkg.bin : Object.values(pkg.bin ?? {})[0]\n          return { name: pkg.name ?? '@hublo/sentinel', version: pkg.version, bin }\n        }\n      } catch {\n        // Malformed package.json; keep walking up.\n      }\n    }\n    const parent = dirname(dir)\n    if (parent === dir) return { name: '@hublo/sentinel', version: '0.0.0' } // filesystem root\n    dir = parent\n  }\n}\n\nexport function readOwnVersion(): string {\n  return readOwnPackage().version\n}\n\n/**\n * Read a module's package.json for framework detection; tolerant of a missing or\n * malformed file (returns `{}`, so detection falls through to the `node` default).\n */\nexport function readProjectPackageJson(dir: string): {\n  /** The package name, which is also what nx calls the project when there is no `project.json`. */\n  name?: string\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  /**\n   * How the module's `.js`/`.ts` files are loaded. It decides whether a Vite config can import\n   * an ESM-only package at all, which is why the build role reads it before rewriting one.\n   */\n  type?: string\n  /**\n   * What nx alone needs per target, which every role writes here and none could read back.\n   *\n   * Typed loosely on purpose: this reader is shared by every role and each one knows the shape of\n   * its own target. Declared at all because a role that WRITES a block and then has to cast to\n   * read it is one refactor away from reading a key it never wrote.\n   */\n  nx?: { targets?: Record<string, Record<string, unknown>> }\n} {\n  const path = join(dir, 'package.json')\n  if (!existsSync(path)) return {}\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as Record<string, never>\n  } catch {\n    process.stderr.write(`sentinel: could not parse ${path}; ignoring for detection.\\n`)\n    return {}\n  }\n}\n\n/**\n * The nx project name for a module, read from its `project.json`, or undefined if\n * there is none/unreadable. Used when `--init` has to scaffold a `package.json`\n * for a module that only has a `project.json` (common for nx apps/services): the\n * scaffolded file borrows this name so it is a valid, uniquely-named workspace\n * package. Reusable by any tool that scaffolds, not just TypeScript.\n */\nexport function readNxProjectName(dir: string): string | undefined {\n  const path = join(dir, 'project.json')\n  if (!existsSync(path)) return undefined\n  try {\n    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { name?: unknown }\n    return typeof parsed.name === 'string' ? parsed.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * What nx calls this module, resolved the way nx itself resolves it.\n *\n * The precedence is `project.json`, then `package.json`, then the directory, and only the\n * first and last of those were being consulted. A module with no `project.json` therefore\n * answered with its DIRECTORY while nx answered with its package name, and the two disagree\n * in the real repo: `apps/front/hr-management` is `front-hr-management` to nx, as is\n * `apps/front/storybook-app`.\n *\n * That gap is not cosmetic, because this name is what `--module` is matched against. The\n * `serve` script `--init` writes carries `--module <name>`, so a module in that shape was\n * adopted with a script naming a project the workspace does not contain, and `pnpm run serve`\n * failed the day it was adopted with nothing having reported it.\n *\n * One function so the two ends cannot drift again: whoever WRITES the name and whoever\n * RESOLVES it now read the same source.\n */\nexport function moduleName(dir: string): string {\n  const declared = readProjectPackageJson(dir).name\n  return readNxProjectName(dir) ?? (declared === undefined ? basename(dir) : declared)\n}\n","/**\n * Tunable settings: the knobs you would actually change. The fixed vocabulary and\n * its types live in `domain.ts`.\n *\n * Note: the preset is DETECTED from a module's dependencies (see\n * `detect-framework.ts`), deterministically, `node` when no framework dep is present.\n * `--preset` overrides the detection (recommended for `--init`, since hoisted deps\n * can make detection return `node`). The detection table lives in `detect-framework.ts`.\n */\n\n/** A file that marks a workspace root; sentinel refuses to operate there. */\nexport const WORKSPACE_ROOT_MARKER = 'nx.json'\n\n/**\n * How many structured diagnostics a report embeds per module, when the caller does not say.\n *\n * A cap, not a limit on what is counted: the totals stay exact and `diagnosticsTruncated`\n * says when rows were dropped, so a bounded envelope never reads as a clean module. Shared\n * by every role, because a consumer reading `--json` across roles should not have to learn\n * a different cap for each one. `--max-diagnostics 0` means no cap.\n */\nexport const DEFAULT_MAX_DIAGNOSTICS = 100\n","/**\n * Workspace-level preparation that `--init` applies once, at the workspace root, so an\n * adopted module actually installs and resolves cleanly. `--init` writes a module's own\n * files; this is the small, deliberate exception where it also touches the root, because\n * \"set this module up\" is not honest if the workspace it lives in cannot then install or\n * resolve it.\n *\n * Kept intentionally narrow (YAGNI): it applies the specific fixes a workspace's OWN\n * config shows it needs, and is a no-op everywhere else. It is NOT a speculative dedupe\n * engine, when a second, different case appears we generalize from real cases instead of\n * predicting them. The two fixes today:\n *\n *  - i18next singleton override. If the root declares a second TypeScript via the\n *    `@typescript/native` alias (a repo mid-migration running two TypeScripts), adopting a\n *    module re-resolves pnpm and i18next, which carries an optional type-only `typescript`\n *    peer, forks into two peer-keyed variants. That forks react-i18next into two React\n *    contexts and breaks translation-singleton tests. Pinning i18next's `typescript` peer\n *    to the declared TS collapses it to one. Read from the root's own declaration, so it\n *    tracks the version and disappears (no-op) once the migration removes the second TS.\n *    Written to `pnpm-workspace.yaml`, the only place current pnpm reads overrides from.\n *\n *  - release-age allow-list. If the root uses pnpm's `minimumReleaseAgeExclude` gate, a\n *    freshly published sentinel is younger than the gate and will not install; allow-list\n *    it. Only touched when the gate is actually configured.\n *\n *  - root formatter exclusion. A module that has adopted the FORMAT role is formatted by\n *    oxfmt, from its own config. The root Prettier does not know that and still owns every\n *    file in the repo, so `nx format:write` or `prettier --write .` from the root reformats\n *    the module back to the ROOT's style, and the next `pnpm run format` in the module\n *    reverses it. Two formatters fighting over the same files, with whichever ran last\n *    winning, is the exact state adoption removes INSIDE a module, and it has to be removed\n *    at the root too. So the module is excluded in the root `.prettierignore` as it adopts,\n *    and the root's own config is otherwise untouched: it still serves every module that has\n *    not migrated.\n *\n * All three edits are idempotent and defensive: absent the trigger (no second TypeScript, no\n * release-age gate, no root Prettier) each is skipped, so the step is safe on any workspace.\n */\nimport { existsSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, relative } from 'node:path'\n\nimport { readOwnPackage } from '../shared/package-json.js'\n\nimport { WORKSPACE_ROOT_MARKER } from './settings.js'\n\nconst OVERRIDE_KEY = 'i18next>typescript'\nconst NATIVE_TS_ALIAS = '@typescript/native' // `npm:typescript@^7.x`: a workspace's second, real TS\nconst WORKSPACE_YAML = 'pnpm-workspace.yaml'\nconst RELEASE_AGE_KEY = 'minimumReleaseAgeExclude'\nconst LIST_ITEM = /^(\\s*)-\\s+(.*?)\\s*$/\nconst MAP_ENTRY = /^(\\s+)(.*?):\\s+(.*?)\\s*$/\n\ninterface RootPackageJson {\n  dependencies?: Record<string, string>\n  devDependencies?: Record<string, string>\n  pnpm?: { overrides?: Record<string, string> }\n}\n\n/** Walk up from a module directory to the workspace root (the dir holding the marker). */\nexport function findWorkspaceRoot(startDir: string): string | undefined {\n  let dir = startDir\n  for (;;) {\n    if (existsSync(join(dir, WORKSPACE_ROOT_MARKER))) return dir\n    const parent = dirname(dir)\n    if (parent === dir) return undefined\n    dir = parent\n  }\n}\n\n/**\n * The TypeScript version to pin i18next's peer to, read from the root's own\n * `@typescript/native` alias (`npm:typescript@^7.0.2` -> `7.0.2`). Returns undefined when\n * the alias is absent (no second TypeScript, so no fork to fix).\n */\nfunction declaredNativeTs(pkg: RootPackageJson): string | undefined {\n  const spec = pkg.dependencies?.[NATIVE_TS_ALIAS] ?? pkg.devDependencies?.[NATIVE_TS_ALIAS]\n  if (!spec) return undefined\n  const version = spec.slice(spec.lastIndexOf('@') + 1).replace(/^[\\^~>=<\\s]+/, '')\n  return version || undefined\n}\n\n/**\n * Ensure the i18next singleton override matches the declared second TypeScript. No-op when\n * the workspace runs a single TypeScript (no `@typescript/native`). Returns a message when\n * it changed (or would change, under dryRun), else undefined.\n *\n * The override is written to `pnpm-workspace.yaml`, never to `package.json#pnpm`: pnpm 11\n * stopped reading the `pnpm` field and does so SILENTLY, with no warning and no deprecation\n * (pnpm/pnpm#11536), so an override left in `package.json` is simply not applied. The yaml is\n * read by pnpm 10 and 11 alike (https://pnpm.io/settings), which is why there is one target\n * here rather than a version-dependent fallback.\n */\nfunction ensureI18nextSingleton(root: string, dryRun: boolean): string | undefined {\n  const pkgPath = join(root, 'package.json')\n  if (!existsSync(pkgPath)) return undefined\n  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n  const want = declaredNativeTs(pkg)\n  if (!want) return undefined // single TypeScript: nothing forks\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined // no workspace file: nowhere pnpm would read it\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const entry = findOverrideEntry(lines)\n  if (entry.valueIdx !== undefined && entry.value === want) return undefined // already pinned\n  if (dryRun) return `would pin ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n\n  applyOverride(lines, entry, want)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `pinned ${OVERRIDE_KEY} to ${want} in ${WORKSPACE_YAML} (i18next singleton)`\n}\n\n/** Where the override sits in the yaml, if at all, plus where a new one would be inserted. */\ninterface OverrideEntry {\n  /** Index of the `OVERRIDE_KEY` line, when the key is already declared. */\n  valueIdx?: number\n  /** Its current value, unquoted. */\n  value?: string\n  /** Index of the `overrides:` key line, when the block exists. */\n  blockIdx?: number\n  /** Index of the block's last entry, so an insertion keeps the block contiguous. */\n  lastEntryIdx?: number\n  /** Indentation the block's entries use. */\n  indent: string\n}\n\n/**\n * Locate the `overrides:` block and the i18next key inside it. A targeted text read rather\n * than a yaml parse, for the same reason `ensureReleaseAgeAllowList` does it: this file is\n * hand-maintained and round-tripping it through a parser would drop its comments and ordering.\n */\nfunction findOverrideEntry(lines: string[]): OverrideEntry {\n  const blockIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === 'overrides:')\n  if (blockIdx === -1) return { indent: '  ' }\n\n  let lastEntryIdx = blockIdx\n  let indent = '  '\n  for (let i = blockIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(MAP_ENTRY)\n    if (!match) break // dedent or blank line: the block ended\n    indent = match[1] ?? indent\n    lastEntryIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === OVERRIDE_KEY) {\n      return {\n        valueIdx: i,\n        value: (match[3] ?? '').replace(/^['\"]|['\"]$/g, ''),\n        blockIdx,\n        lastEntryIdx,\n        indent,\n      }\n    }\n  }\n  return { blockIdx, lastEntryIdx, indent }\n}\n\n/** Update the key in place, append it to an existing block, or open a block at the end. */\nfunction applyOverride(lines: string[], entry: OverrideEntry, want: string): void {\n  const line = `${entry.indent}'${OVERRIDE_KEY}': ${want}`\n  if (entry.valueIdx !== undefined) {\n    lines[entry.valueIdx] = line\n    return\n  }\n  if (entry.lastEntryIdx !== undefined) {\n    lines.splice(entry.lastEntryIdx + 1, 0, line)\n    return\n  }\n  // No `overrides:` block at all: open one, keeping a single trailing newline.\n  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()\n  lines.push('overrides:', line, '')\n}\n\n/**\n * Ensure sentinel is allow-listed under `minimumReleaseAgeExclude` so a fresh publish\n * installs. No-op when the workspace has no such gate. Targeted text edit so comments and\n * formatting are preserved. Returns a message when it changed (or would), else undefined.\n */\nfunction ensureReleaseAgeAllowList(root: string, dryRun: boolean): string | undefined {\n  const yamlPath = join(root, WORKSPACE_YAML)\n  if (!existsSync(yamlPath)) return undefined\n  const own = readOwnPackage().name\n  const lines = readFileSync(yamlPath, 'utf8').split('\\n')\n  const keyIdx = lines.findIndex((line) => line.replace(/\\s+$/, '') === `${RELEASE_AGE_KEY}:`)\n  if (keyIdx === -1) return undefined // no release-age gate in use\n\n  let lastItemIdx = keyIdx\n  let indent = '  '\n  for (let i = keyIdx + 1; i < lines.length; i++) {\n    const match = lines[i]?.match(LIST_ITEM)\n    if (!match) break\n    indent = match[1] ?? indent\n    lastItemIdx = i\n    if ((match[2] ?? '').replace(/^['\"]|['\"]$/g, '') === own) return undefined // already listed\n  }\n  if (dryRun) return `would allow-list ${own} under ${RELEASE_AGE_KEY}`\n\n  lines.splice(lastItemIdx + 1, 0, `${indent}- '${own}'`)\n  writeFileSync(yamlPath, lines.join('\\n'))\n  return `allow-listed ${own} under ${RELEASE_AGE_KEY} in ${WORKSPACE_YAML}`\n}\n\n/** The root ignore file Prettier reads, and the section sentinel owns inside it. */\nconst GIT_IGNORE = '.gitignore'\nconst REPORT_DIR_NAME = 'static-analysis-report'\nconst REPORT_PATTERN = `${REPORT_DIR_NAME}/`\nconst REPORT_HEADER = '# @hublo/sentinel: static analysis reports, written inside each module'\nconst PRETTIER_IGNORE = '.prettierignore'\nconst EXCLUSION_HEADER = '# @hublo/sentinel: modules formatted by oxfmt, not by the root Prettier'\n\n/** Root Prettier configs. Their presence is what makes an exclusion meaningful. */\nconst ROOT_PRETTIER_CONFIGS = [\n  '.prettierrc',\n  '.prettierrc.json',\n  '.prettierrc.json5',\n  '.prettierrc.yml',\n  '.prettierrc.yaml',\n  '.prettierrc.js',\n  '.prettierrc.cjs',\n  '.prettierrc.mjs',\n  'prettier.config.js',\n  'prettier.config.cjs',\n  'prettier.config.mjs',\n]\n\n/**\n * Exclude a module that now formats itself from the ROOT Prettier.\n *\n * Written as a directory pattern anchored at the root (`/apps/front/x/`), which is what\n * gitignore syntax means by \"this exact directory\", so a module cannot accidentally exclude a\n * same-named directory somewhere else.\n *\n * Skipped entirely when the root has no Prettier at all: there is then nothing to conflict\n * with, and creating an ignore file for a tool the workspace does not use would be noise.\n */\nfunction ensureFormatterExclusion(\n  root: string,\n  moduleDir: string,\n  dryRun: boolean,\n): string | undefined {\n  const rel = relative(root, moduleDir).replaceAll('\\\\', '/')\n  if (rel === '' || rel.startsWith('..')) return undefined // the root itself, or outside it\n\n  const ignorePath = join(root, PRETTIER_IGNORE)\n  const hasPrettier =\n    existsSync(ignorePath) || ROOT_PRETTIER_CONFIGS.some((name) => existsSync(join(root, name)))\n  if (!hasPrettier) return undefined\n\n  const pattern = `/${rel}/`\n  const existing = existsSync(ignorePath) ? readFileSync(ignorePath, 'utf8') : ''\n  const lines = existing.split('\\n')\n  // Already excluded, in whichever spelling a human may have used.\n  if (lines.some((line) => line.trim().replace(/\\/$/, '') === pattern.replace(/\\/$/, ''))) {\n    return undefined\n  }\n  if (dryRun) return `would exclude ${rel} from the root Prettier (${PRETTIER_IGNORE})`\n\n  const headerIdx = lines.findIndex((line) => line.trim() === EXCLUSION_HEADER)\n  if (headerIdx === -1) {\n    const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n    writeFileSync(ignorePath, `${prefix}${EXCLUSION_HEADER}\\n${pattern}\\n`)\n  } else {\n    // Keep the managed section together and sorted, so the list stays readable as it grows\n    // to 150 entries and a diff shows one added line rather than a reshuffle.\n    let end = headerIdx + 1\n    while (end < lines.length && lines[end]?.trim().startsWith('/')) end += 1\n    const managed = [...lines.slice(headerIdx + 1, end), pattern].sort()\n    writeFileSync(\n      ignorePath,\n      [...lines.slice(0, headerIdx + 1), ...managed, ...lines.slice(end)].join('\\n'),\n    )\n  }\n  return `excluded ${rel} from the root Prettier (${PRETTIER_IGNORE}): it formats itself now`\n}\n\n/**\n * Apply every workspace-level fix the given root needs. Returns the human-readable\n * messages for what changed (empty when nothing did). Under dryRun nothing is written and\n * the messages describe what would change.\n *\n * `formattedModule` is the module that just adopted the FORMAT role, when one did. Absent\n * for a lint-only or TypeScript-only `--init`, because a module that has not adopted the\n * formatter must keep being formatted by the root.\n */\n/**\n * Ignore the static analysis report directory, once, at the ROOT.\n *\n * ## Why the root and not each module\n *\n * The role writes its json and html into `<module>/static-analysis-report/`, so the obvious place\n * for the rule is the module. It was there first, and it was wrong twice over: it CREATES a\n * `.gitignore` in a module that had none, which is a structural change to someone else's module for\n * one line, and it repeats that line once per adopting module. The root already ignores output this\n * way, with `/dist` and `/coverage`.\n *\n * ⚠️ The pattern is deliberately NOT anchored. `/dist` matches only the root's `dist`; the report\n * directory lives inside a module, so `static-analysis-report/` has to match at any depth. Getting\n * that backwards would leave every adopting module with an untracked directory, which is the exact\n * defect this guards against.\n *\n * ## Why this root write is not the dangerous kind\n *\n * The comment on `inspectWorkspacePrep` is right that root writes are what nobody sees afterwards,\n * and the i18next override earned that warning: it re-resolved a module from a pull request that\n * touched none of its files. An ignore line changes no resolution, no build and no install. If it\n * ever goes stale the cost is one unused line, which is why it is reported rather than feared.\n */\nfunction ensureReportIgnored(root: string, dryRun: boolean): string | undefined {\n  const path = join(root, GIT_IGNORE)\n  const existing = existsSync(path) ? readFileSync(path, 'utf8') : ''\n  // Whatever spelling a human may have used: with or without a leading or trailing slash.\n  const already = existing\n    .split('\\n')\n    .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n  if (already) return undefined\n  if (dryRun) return `would ignore ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n\n  const prefix = existing.trim() === '' ? '' : `${existing.replace(/\\n*$/, '')}\\n\\n`\n  writeFileSync(path, `${prefix}${REPORT_HEADER}\\n${REPORT_PATTERN}\\n`)\n  return `ignored ${REPORT_PATTERN} in the root ${GIT_IGNORE}`\n}\n\nexport function ensureWorkspacePrep(opts: {\n  root: string\n  dryRun?: boolean\n  formattedModule?: string\n  /** True when the STATIC ANALYSIS role adopted: it is what earns the ignore line. */\n  analysedModule?: boolean\n}): string[] {\n  const dryRun = Boolean(opts.dryRun)\n  return [\n    ensureI18nextSingleton(opts.root, dryRun),\n    ensureReleaseAgeAllowList(opts.root, dryRun),\n    opts.formattedModule === undefined\n      ? undefined\n      : ensureFormatterExclusion(opts.root, opts.formattedModule, dryRun),\n    opts.analysedModule === true ? ensureReportIgnored(opts.root, dryRun) : undefined,\n  ].filter((message): message is string => message !== undefined)\n}\n\n/**\n * One standing change sentinel has made to the workspace ROOT, and whether it is still earned.\n *\n * This exists because the three root writes are the only thing sentinel does that nobody can\n * see afterwards. `--init` announces each one on the run that makes it, and then it is a line\n * in someone else's file forever. Two consequences already bit us.\n *\n * The `i18next>typescript` override re-resolved `apps/front/console` from a PR that touched no\n * file under it, so CODEOWNERS pulled nobody and its owners learned about it afterwards.\n *\n * And every one of them is TEMPORARY with its removal condition written in prose. That failed\n * three times in one week: `SENTINEL_TAG=alpha` in the migration-page workflow kept building\n * with a pre-release long after 1.1.0 went stable and reported `Format 0/439` for 15 adopted\n * modules; ADR 0042 and its RFC both sat mid-flight past their deadline; and this release-age\n * exclusion is still waiting on \"once sentinel's release cadence settles\". Nothing failed when\n * any of them expired, because a comment cannot fail.\n *\n * So each entry carries the condition that JUSTIFIES it, evaluated now rather than described.\n * A trigger that has gone away makes the entry dead config, and dead config is something a\n * command can say out loud instead of something a reader has to notice.\n *\n * Read-only, and offline: it inspects the same files `--init` writes and nothing else. What it\n * deliberately does NOT claim is anything needing the npm registry — whether a published\n * version is old enough to clear the release-age gate is not knowable from the repo, so it is\n * stated as the standing exemption it is rather than guessed at.\n */\nexport interface WorkspacePrepEntry {\n  /** `rule` to match the shape the shared renderer already prints as a labelled block. */\n  rule: string\n  /** What it does, whether its trigger still holds, and what would retire it. */\n  reason: string\n}\n\n/** The root-level changes sentinel maintains here, each with its justification checked now. */\nexport function inspectWorkspacePrep(root: string): WorkspacePrepEntry[] {\n  const entries: WorkspacePrepEntry[] = []\n  // Tolerant, unlike the write path above, and the difference is deliberate. `--init` should\n  // fail loudly on a root it cannot parse, because it is about to edit it. `--inspect` is a\n  // read verb that sweeps 441 modules, and one malformed root file must not take the whole\n  // sweep down: the modules still have honest answers to give. Caught by its own test.\n  let pkg: RootPackageJson = {}\n  const pkgPath = join(root, 'package.json')\n  if (existsSync(pkgPath)) {\n    try {\n      pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as RootPackageJson\n    } catch {\n      pkg = {}\n    }\n  }\n\n  const yamlPath = join(root, WORKSPACE_YAML)\n  const yaml = existsSync(yamlPath) ? readFileSync(yamlPath, 'utf8') : undefined\n\n  const pinned = yaml === undefined ? undefined : findOverrideEntry(yaml.split('\\n')).value\n  if (pinned !== undefined) {\n    const stillForks = declaredNativeTs(pkg)\n    entries.push({\n      rule: `${WORKSPACE_YAML} → overrides.${OVERRIDE_KEY}`,\n      reason:\n        stillForks === undefined\n          ? `pinned to ${pinned}, but the root no longer declares ${NATIVE_TS_ALIAS}, so nothing ` +\n            `forks any more. This override is now dead config and can be removed.`\n          : `pinned to ${pinned}, matching the second TypeScript the root declares ` +\n            `(${NATIVE_TS_ALIAS}). It re-resolves i18next for EVERY module that depends on it, ` +\n            `not only adopted ones. It retires with the second TypeScript.`,\n    })\n  }\n\n  // A copy left in `package.json#pnpm` by an older sentinel, or by hand. Reported because it\n  // is INERT rather than redundant: pnpm 11 dropped the `pnpm` field with no warning\n  // (pnpm/pnpm#11536), so it reads as protection that is not applied.\n  const legacy = pkg.pnpm?.overrides?.[OVERRIDE_KEY]\n  if (legacy !== undefined) {\n    entries.push({\n      rule: `package.json → pnpm.overrides.${OVERRIDE_KEY}`,\n      reason:\n        `pinned to ${legacy}, but pnpm 11 no longer reads the \\`pnpm\\` field of package.json ` +\n        `and says nothing about it, so this override is not applied. Move it to ` +\n        `${WORKSPACE_YAML} under \\`overrides:\\`, which pnpm 10 and 11 both read.`,\n    })\n  }\n\n  const ignorePath = join(root, GIT_IGNORE)\n  if (existsSync(ignorePath)) {\n    const ignored = readFileSync(ignorePath, 'utf8')\n      .split('\\n')\n      .some((line) => line.trim().replace(/^\\//, '').replace(/\\/$/, '') === REPORT_DIR_NAME)\n    if (ignored) {\n      entries.push({\n        rule: `${GIT_IGNORE} → ${REPORT_PATTERN}`,\n        reason:\n          `the static analysis role writes its json and html into ` +\n          `\\`<module>/${REPORT_PATTERN}\\`, and one unanchored line at the root covers every module ` +\n          `instead of creating a \\`${GIT_IGNORE}\\` in each one. Unlike the override above it changes ` +\n          `no resolution and no build, so a stale one costs a single unused line. It retires when no ` +\n          `module declares a \\`static-analysis\\` script any more, which the adoption report counts ` +\n          `and this read deliberately does not: it would have to sweep every module.`,\n      })\n    }\n  }\n\n  const own = readOwnPackage().name\n  if (yaml !== undefined) {\n    const listed = new RegExp(`^\\\\s*-\\\\s*['\"]?${own.replace('/', '\\\\/')}['\"]?\\\\s*$`, 'm').test(yaml)\n    if (listed) {\n      const gated = new RegExp(`^\\\\s*minimumReleaseAge\\\\s*:`, 'm').test(yaml)\n      entries.push({\n        rule: `${WORKSPACE_YAML} → ${RELEASE_AGE_KEY}: ${own}`,\n        reason: gated\n          ? `${own} is exempt from this workspace's release-age gate, so a freshly published ` +\n            `version installs instead of being held. That is a standing exemption from a ` +\n            `supply-chain control: the exposure is one bump wide, since the version is pinned ` +\n            `and the lockfile carries its integrity, so a re-publish of the same version does ` +\n            `not pass. Retire it once a bump can simply wait out the window.`\n          : `${own} is allow-listed, but this workspace no longer sets minimumReleaseAge, so ` +\n            `there is no gate to be exempt from. This entry is now dead config and can be removed.`,\n      })\n    }\n  }\n\n  return entries\n}\n"],"mappings":";AAGA,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,qBAAqB;AAcvB,SAAS,iBAAkE;AAChF,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,aAAS;AACP,UAAM,UAAU,KAAK,KAAK,cAAc;AACxC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,YAAI,OAAO,IAAI,YAAY,UAAU;AAGnC,gBAAM,MAAM,OAAO,IAAI,QAAQ,WAAW,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;AAClF,iBAAO,EAAE,MAAM,IAAI,QAAQ,mBAAmB,SAAS,IAAI,SAAS,IAAI;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AACvE,UAAM;AAAA,EACR;AACF;AAEO,SAAS,iBAAyB;AACvC,SAAO,eAAe,EAAE;AAC1B;AAMO,SAAS,uBAAuB,KAkBrC;AACA,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,YAAQ,OAAO,MAAM,6BAA6B,IAAI;AAAA,CAA6B;AACnF,WAAO,CAAC;AAAA,EACV;AACF;AASO,SAAS,kBAAkB,KAAiC;AACjE,QAAM,OAAO,KAAK,KAAK,cAAc;AACrC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,WAAW,KAAqB;AAC9C,QAAM,WAAW,uBAAuB,GAAG,EAAE;AAC7C,SAAO,kBAAkB,GAAG,MAAM,aAAa,SAAY,SAAS,GAAG,IAAI;AAC7E;;;AC9GO,IAAM,wBAAwB;AAU9B,IAAM,0BAA0B;;;ACiBvC,SAAS,cAAAA,aAAY,gBAAAC,eAAc,qBAAqB;AACxD,SAAS,WAAAC,UAAS,QAAAC,OAAM,gBAAgB;AAMxC,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,YAAY;AAClB,IAAM,YAAY;AASX,SAAS,kBAAkB,UAAsC;AACtE,MAAI,MAAM;AACV,aAAS;AACP,QAAIC,YAAWC,MAAK,KAAK,qBAAqB,CAAC,EAAG,QAAO;AACzD,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAOA,SAAS,iBAAiB,KAA0C;AAClE,QAAM,OAAO,IAAI,eAAe,eAAe,KAAK,IAAI,kBAAkB,eAAe;AACzF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAChF,SAAO,WAAW;AACpB;AAaA,SAAS,uBAAuB,MAAc,QAAqC;AACjF,QAAM,UAAUD,MAAK,MAAM,cAAc;AACzC,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO;AACjC,QAAM,MAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AACpD,QAAM,OAAO,iBAAiB,GAAG;AACjC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,QAAQ,kBAAkB,KAAK;AACrC,MAAI,MAAM,aAAa,UAAa,MAAM,UAAU,KAAM,QAAO;AACjE,MAAI,OAAQ,QAAO,aAAa,YAAY,OAAO,IAAI,OAAO,cAAc;AAE5E,gBAAc,OAAO,OAAO,IAAI;AAChC,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,UAAU,YAAY,OAAO,IAAI,OAAO,cAAc;AAC/D;AAqBA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,WAAW,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,YAAY;AACpF,MAAI,aAAa,GAAI,QAAO,EAAE,QAAQ,KAAK;AAE3C,MAAI,eAAe;AACnB,MAAI,SAAS;AACb,WAAS,IAAI,WAAW,GAAG,IAAI,MAAM,QAAQ,KAAK;AAChD,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,mBAAe;AACf,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,cAAc;AACjE,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE;AAAA,QAClD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,cAAc,OAAO;AAC1C;AAGA,SAAS,cAAc,OAAiB,OAAsB,MAAoB;AAChF,QAAM,OAAO,GAAG,MAAM,MAAM,IAAI,YAAY,MAAM,IAAI;AACtD,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,MAAM,QAAQ,IAAI;AACxB;AAAA,EACF;AACA,MAAI,MAAM,iBAAiB,QAAW;AACpC,UAAM,OAAO,MAAM,eAAe,GAAG,GAAG,IAAI;AAC5C;AAAA,EACF;AAEA,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,GAAI,OAAM,IAAI;AACrE,QAAM,KAAK,cAAc,MAAM,EAAE;AACnC;AAOA,SAAS,0BAA0B,MAAc,QAAqC;AACpF,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,MAAI,CAACD,YAAW,QAAQ,EAAG,QAAO;AAClC,QAAM,MAAM,eAAe,EAAE;AAC7B,QAAM,QAAQG,cAAa,UAAU,MAAM,EAAE,MAAM,IAAI;AACvD,QAAM,SAAS,MAAM,UAAU,CAAC,SAAS,KAAK,QAAQ,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG;AAC3F,MAAI,WAAW,GAAI,QAAO;AAE1B,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,WAAS,IAAI,SAAS,GAAG,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,QAAQ,MAAM,CAAC,GAAG,MAAM,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,aAAS,MAAM,CAAC,KAAK;AACrB,kBAAc;AACd,SAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,gBAAgB,EAAE,MAAM,IAAK,QAAO;AAAA,EACnE;AACA,MAAI,OAAQ,QAAO,oBAAoB,GAAG,UAAU,eAAe;AAEnE,QAAM,OAAO,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,GAAG;AACtD,gBAAc,UAAU,MAAM,KAAK,IAAI,CAAC;AACxC,SAAO,gBAAgB,GAAG,UAAU,eAAe,OAAO,cAAc;AAC1E;AAGA,IAAM,aAAa;AACnB,IAAM,kBAAkB;AACxB,IAAM,iBAAiB,GAAG,eAAe;AACzC,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGzB,IAAM,wBAAwB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAYA,SAAS,yBACP,MACA,WACA,QACoB;AACpB,QAAM,MAAM,SAAS,MAAM,SAAS,EAAE,WAAW,MAAM,GAAG;AAC1D,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,EAAG,QAAO;AAE/C,QAAM,aAAaF,MAAK,MAAM,eAAe;AAC7C,QAAM,cACJD,YAAW,UAAU,KAAK,sBAAsB,KAAK,CAAC,SAASA,YAAWC,MAAK,MAAM,IAAI,CAAC,CAAC;AAC7F,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,IAAI,GAAG;AACvB,QAAM,WAAWD,YAAW,UAAU,IAAIG,cAAa,YAAY,MAAM,IAAI;AAC7E,QAAM,QAAQ,SAAS,MAAM,IAAI;AAEjC,MAAI,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,CAAC,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI,OAAQ,QAAO,iBAAiB,GAAG,4BAA4B,eAAe;AAElF,QAAM,YAAY,MAAM,UAAU,CAAC,SAAS,KAAK,KAAK,MAAM,gBAAgB;AAC5E,MAAI,cAAc,IAAI;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,kBAAc,YAAY,GAAG,MAAM,GAAG,gBAAgB;AAAA,EAAK,OAAO;AAAA,CAAI;AAAA,EACxE,OAAO;AAGL,QAAI,MAAM,YAAY;AACtB,WAAO,MAAM,MAAM,UAAU,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,GAAG,EAAG,QAAO;AACxE,UAAM,UAAU,CAAC,GAAG,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,OAAO,EAAE,KAAK;AACnE;AAAA,MACE;AAAA,MACA,CAAC,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,YAAY,GAAG,4BAA4B,eAAe;AACnE;AAkCA,SAAS,oBAAoB,MAAc,QAAqC;AAC9E,QAAM,OAAOF,MAAK,MAAM,UAAU;AAClC,QAAM,WAAWD,YAAW,IAAI,IAAIG,cAAa,MAAM,MAAM,IAAI;AAEjE,QAAM,UAAU,SACb,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,MAAI,QAAS,QAAO;AACpB,MAAI,OAAQ,QAAO,gBAAgB,cAAc,gBAAgB,UAAU;AAE3E,QAAM,SAAS,SAAS,KAAK,MAAM,KAAK,KAAK,GAAG,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAC5E,gBAAc,MAAM,GAAG,MAAM,GAAG,aAAa;AAAA,EAAK,cAAc;AAAA,CAAI;AACpE,SAAO,WAAW,cAAc,gBAAgB,UAAU;AAC5D;AAEO,SAAS,oBAAoB,MAMvB;AACX,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,SAAO;AAAA,IACL,uBAAuB,KAAK,MAAM,MAAM;AAAA,IACxC,0BAA0B,KAAK,MAAM,MAAM;AAAA,IAC3C,KAAK,oBAAoB,SACrB,SACA,yBAAyB,KAAK,MAAM,KAAK,iBAAiB,MAAM;AAAA,IACpE,KAAK,mBAAmB,OAAO,oBAAoB,KAAK,MAAM,MAAM,IAAI;AAAA,EAC1E,EAAE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAChE;AAoCO,SAAS,qBAAqB,MAAoC;AACvE,QAAM,UAAgC,CAAC;AAKvC,MAAI,MAAuB,CAAC;AAC5B,QAAM,UAAUF,MAAK,MAAM,cAAc;AACzC,MAAID,YAAW,OAAO,GAAG;AACvB,QAAI;AACF,YAAM,KAAK,MAAMG,cAAa,SAAS,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,YAAM,CAAC;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAWF,MAAK,MAAM,cAAc;AAC1C,QAAM,OAAOD,YAAW,QAAQ,IAAIG,cAAa,UAAU,MAAM,IAAI;AAErE,QAAM,SAAS,SAAS,SAAY,SAAY,kBAAkB,KAAK,MAAM,IAAI,CAAC,EAAE;AACpF,MAAI,WAAW,QAAW;AACxB,UAAM,aAAa,iBAAiB,GAAG;AACvC,YAAQ,KAAK;AAAA,MACX,MAAM,GAAG,cAAc,qBAAgB,YAAY;AAAA,MACnD,QACE,eAAe,SACX,aAAa,MAAM,qCAAqC,eAAe,sFAEvE,aAAa,MAAM,uDACf,eAAe;AAAA,IAE3B,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,IAAI,MAAM,YAAY,YAAY;AACjD,MAAI,WAAW,QAAW;AACxB,YAAQ,KAAK;AAAA,MACX,MAAM,sCAAiC,YAAY;AAAA,MACnD,QACE,aAAa,MAAM,2IAEhB,cAAc;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,QAAM,aAAaF,MAAK,MAAM,UAAU;AACxC,MAAID,YAAW,UAAU,GAAG;AAC1B,UAAM,UAAUG,cAAa,YAAY,MAAM,EAC5C,MAAM,IAAI,EACV,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,MAAM,eAAe;AACvF,QAAI,SAAS;AACX,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,UAAU,WAAM,cAAc;AAAA,QACvC,QACE,qEACc,cAAc,uFACD,UAAU;AAAA,MAIzC,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,MAAM,eAAe,EAAE;AAC7B,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,IAAI,OAAO,kBAAkB,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,KAAK,IAAI;AAC/F,QAAI,QAAQ;AACV,YAAM,QAAQ,IAAI,OAAO,+BAA+B,GAAG,EAAE,KAAK,IAAI;AACtE,cAAQ,KAAK;AAAA,QACX,MAAM,GAAG,cAAc,WAAM,eAAe,KAAK,GAAG;AAAA,QACpD,QAAQ,QACJ,GAAG,GAAG,4XAKN,GAAG,GAAG;AAAA,MAEZ,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["existsSync","readFileSync","dirname","join","existsSync","join","dirname","readFileSync"]}